Data aggregation method and apparatus, and storage medium and electronic device

Abstract

Provided in the present disclosure are a data aggregation method and apparatus, and a storage medium and an electronic device. The method comprises: receiving pieces of mask data that are sent by smart devices and label values that respectively correspond to the pieces of mask data; aggregating the pieces of mask data on the basis of the pieces of mask data, the label values and a pre-constructed aggregation tree, and determining a mask result; then, receiving mask bit shares of the mask result that are sent by the smart devices and message verification codes that correspond to the mask bit shares, and verifying the mask bit shares on the basis of the message verification codes that correspond to the mask bit shares; and when the verification is successful, decrypting the mask result on the basis of the mask bit shares, and determining an aggregation result. In this way, the accuracy of mask bit shares that are sent by smart devices is ensured, and a mask result is decrypted by using mask bit shares that have passed verification, thereby ensuring the accuracy of an aggregation result.

Description

Data aggregation method, device, storage medium and electronic device Technical Field

[0001] The present disclosure relates to the field of computer technology, and in particular to a method, device, storage medium, and electronic device for data aggregation. Background Art

[0002] With the continuous development of science and technology, data aggregation has received widespread attention. Data aggregation is a technology that combines data from different data sources and is commonly used in Internet of Things scenarios.

[0003] Currently, smart devices that provide services to users, such as smartphones, smart meters, and smartwatches, can collect user data generated when users use these devices. However, the user data collected by each smart device is different. To better provide services to users, the user data collected by smart devices can be aggregated, analyzed, and then services provided based on the analysis results. However, user data often contains private information about users. When aggregating the collected user data, each smart device must ensure that this private information is not leaked. Therefore, how to aggregate data while protecting user privacy is a critical issue.

[0004] Based on this, the present disclosure provides a method for data aggregation.

[0005] Summary of the Invention

[0006] The present disclosure provides a data aggregation method, device, storage medium, and electronic device.

[0007] This disclosure adopts the following technical solutions:

[0008] The present disclosure provides a data aggregation method, which is applied to an aggregation center and includes:

[0009] Receiving masked data sent by each smart device and a label value corresponding to each masked data, wherein the masked data is data processed by the smart device based on the masked bit share of the to-be-aggregated data, and the masked bit share is generated by the smart device based on a secure multi-party computation preprocessing function;

[0010] According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result;

[0011] receiving a mask bit share of the mask result and a message authentication code corresponding to the mask bit share sent by each smart device, wherein each mask bit share is used to decrypt the mask result;

[0012] Verifying each mask bit share according to a message authentication code corresponding to each mask bit share;

[0013] When the verification is passed, the mask result is decrypted according to the respective mask bit shares to determine the aggregation result.

[0014] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of XOR operation units;

[0015] According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including:

[0016] According to the mask data and the label values, for each operation node in the pre-constructed aggregation tree, and in turn for each XOR operation unit in the operation node, determine the mask data and label value input to the XOR operation unit;

[0017] Performing an XOR operation on the determined mask data to determine the mask data output by the XOR operation unit; and performing an XOR operation on the determined label value to determine the label value output by the XOR operation unit;

[0018] The mask data output by the XOR operation unit is used as the mask data of the next XOR operation unit input to the XOR operation unit, and the label value output by the XOR operation unit is used as the label value of the next XOR operation unit input to the XOR operation unit, until the mask data and label value output by the last XOR operation unit are determined, and the mask data output by the last XOR operation unit is used as the mask data output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node;

[0019] The mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0020] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of AND operation units;

[0021] Receive the mask data sent by each smart device and the label value corresponding to each mask data, including:

[0022] Send the pre-built aggregation tree to each smart device;

[0023] Receive the unit ciphertext, mask data, and label value corresponding to the mask data of each operation unit in the aggregation tree sent by each smart device;

[0024] According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including:

[0025] Determining, for each operation node in the aggregation tree and, in turn, for each AND operation unit in the operation node, mask data input to the AND operation unit based on the mask data and the label values, and determining, based on the determined mask data, a unit ciphertext corresponding to the AND operation unit;

[0026] Determine a label value input to the AND operation unit, and determine mask data and a label value output by the AND operation unit based on the determined label value and the unit ciphertext;

[0027] The mask data output by the AND operation unit is used as the mask data input to the next AND operation unit of the AND operation unit, and the label value output by the AND operation unit is used as the label value input to the next AND operation unit of the AND operation unit, until the mask data and label value output by the last AND operation unit are determined, and the mask data output by the last AND operation unit is used as the mask data output by the operation node, and the label value output by the last AND operation unit is used as the label value output by the operation node;

[0028] The mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0029] Optionally, the AND operation unit corresponds to a number of unit ciphertexts;

[0030] Determining the mask data and the label value output by the AND operation unit according to the determined label value and the unit ciphertext, specifically including:

[0031] For each unit ciphertext, determine, based on the determined tag value and the unit ciphertext, a message authentication code of the mask data to be verified output by the AND operation unit, the tag value output by the AND operation unit, and the mask data to be verified output by the AND operation unit;

[0032] Determining a key for a message authentication code of the masked data to be verified output by the AND operation unit, which is generated based on the secure multi-party computation preprocessing function, and performing calculations based on the key and the masked data to be verified output by the AND operation unit to determine a first calculation result;

[0033] Determining whether each first calculation result is consistent with a message authentication code corresponding to each mask data to be verified;

[0034] If so, each mask data to be verified is used as the mask data output by the AND operation unit;

[0035] If not, the smart device corresponding to the mask data to be verified that failed the verification is determined, and a verification failure message is sent to the determined smart device.

[0036] Optionally, verifying each mask bit share according to a message authentication code corresponding to each mask bit share specifically includes:

[0037] For each masked bit share, determining a key and a message authentication code corresponding to the masked bit share generated based on the multi-party secure computation preprocessing function, performing a calculation based on the key and the masked bit share to determine a second calculation result;

[0038] Each mask bit share is verified according to the second calculation result corresponding to each mask bit share and the message authentication code corresponding to each mask bit share.

[0039] The present disclosure also provides a data aggregation method, which is applied to a smart device and includes:

[0040] Determine the data to be aggregated;

[0041] Generate mask bit shares using a secure multi-party computation preprocessing function based on the topology of an aggregation tree, wherein the aggregation tree is pre-constructed by the aggregation center;

[0042] Processing the data to be aggregated according to the mask bit share, determining mask data, and generating a label value corresponding to the mask data;

[0043] Sending the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device;

[0044] Determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification is passed, determine the aggregation result according to the mask bit share and the mask result.

[0045] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of AND operation units;

[0046] Sending the mask data and the label value corresponding to the mask data to the aggregation center specifically includes:

[0047] For each operation node in the aggregation tree, and in turn for each AND operation unit in the operation node, determine a share of verifiable mask bits and a label value input to the AND operation unit;

[0048] Using the secure multi-party computation preprocessing function, determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit;

[0049] Determine a unit ciphertext corresponding to the AND operation unit based on the triple, the share of verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit;

[0050] The unit ciphertext corresponding to each operation unit of each operation node in the aggregation tree, the mask data, and the label value corresponding to the mask data are sent to the aggregation center.

[0051] Optionally, the operation node further includes a plurality of XOR operation units;

[0052] Determine the share of verifiable mask bits and the label value input to the AND operation unit, specifically including:

[0053] When the previous operation unit of the AND operation unit is an XOR operation unit, determining a verifiable mask bit share and a label value input to the previous operation unit of the AND operation unit;

[0054] Determine, based on the verifiable mask bit share of the previous operation unit input to the AND operation unit, the verifiable mask bit share output by the previous operation unit of the AND operation unit, and use the verifiable mask bit share as the input to the AND operation unit;

[0055] According to the label value of the previous operation unit input to the AND operation unit, the label value output by the previous operation unit of the AND operation unit is determined and used as the label value input to the AND operation unit.

[0056] Optionally, the computing node is a computing node to which the smart device belongs, the triplet includes a first value, a second value, and a third value, and the verifiable mask bit share input into the AND operation unit includes a first verifiable mask bit share and a second verifiable mask bit share;

[0057] Determining a unit ciphertext corresponding to the AND operation unit according to the triple, the share of verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit, specifically comprising:

[0058] Determine a first value based on the first value in the triplet and the first verifiable mask bit share input to the AND operation unit, and determine a second value based on the second value in the triplet and the second verifiable mask bit share input to the AND operation unit, and send the first value and the second value to other intelligent devices, wherein the other intelligent devices are intelligent devices other than the intelligent device among the intelligent devices that input data to the computing node;

[0059] receiving a third value and a fourth value sent by the other smart device, aggregating the received third value and the first value to determine a first total value, and aggregating the received fourth value and the second value to determine a second total value;

[0060] Determining the mask data to be verified output by the AND operation unit according to the first total value, the second total value, the triplet, the share of verifiable mask bits output by the AND operation unit, and the share of verifiable mask bits input to the AND operation unit;

[0061] The unit ciphertext corresponding to the AND operation unit is determined according to the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit.

[0062] Optionally, sending the mask data and the label value corresponding to the mask data to the aggregation center specifically includes:

[0063] The mask data is sent to other smart devices except the smart device, so that the other smart devices generate label values ​​corresponding to the mask data and send them to the aggregation center, and the mask data and the label values ​​corresponding to the mask data are sent to the aggregation center.

[0064] The present disclosure provides a data aggregation device, which is applied to an aggregation center and includes:

[0065] a first receiving module, configured to receive mask data sent by each smart device and a tag value corresponding to each mask data, wherein the mask data is data processed by the smart device based on a mask bit share of the data to be aggregated, and the mask bit share is generated by the smart device based on a secure multi-party computation preprocessing function;

[0066] an aggregation module, configured to aggregate the masked data based on the masked data and the label values ​​and based on a pre-built aggregation tree to determine a masking result;

[0067] a second receiving module, configured to receive a mask bit share of the mask result and a message verification code corresponding to the mask bit share sent by each smart device, wherein each mask bit share is used to decrypt the mask result;

[0068] a verification module, configured to verify each mask bit share according to a message verification code corresponding to each mask bit share;

[0069] The decryption module is used to decrypt the mask result according to the bit shares of each mask when the verification is passed to determine the aggregation result.

[0070] The present disclosure also provides a data aggregation device, which is applied to a smart device and includes:

[0071] A determination module, used to determine the data to be aggregated;

[0072] A generation module, configured to generate mask bit shares based on a topological structure of an aggregation tree using a secure multi-party computation preprocessing function, wherein the aggregation tree is pre-constructed by the aggregation center;

[0073] an encryption module, configured to process the data to be aggregated according to the mask bit share, determine mask data, and generate a label value corresponding to the mask data;

[0074] a sending module, configured to send the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device;

[0075] The mask module is used to determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification is passed, determines the aggregation result according to each mask bit share and the mask result.

[0076] The present disclosure provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, the method for data aggregation is implemented.

[0077] The present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned data aggregation method when executing the program.

[0078] At least one of the above technical solutions adopted in the present disclosure can achieve the following beneficial effects:

[0079] The data aggregation method provided by the present disclosure first receives masked data sent by each smart device and the label value corresponding to each masked data. Based on the masked data and label values, the masked data are aggregated based on a pre-built aggregation tree to determine the masked result. Then, the masked bit share of the masked result and the message verification code corresponding to the masked bit share are received from each smart device. Each masked bit share is verified based on the message verification code corresponding to each masked bit share. If the verification is successful, the masked result is decrypted based on each masked bit share to determine the aggregation result.

[0080] As can be seen from the above method, when performing data aggregation, the present application receives the mask data sent by each smart device and the label value corresponding to each mask data. According to each mask data and each label value, based on the pre-built aggregation tree, each mask data is aggregated to determine the mask result. Then, the mask bit share of the mask result sent by each smart device and the message verification code corresponding to the mask bit share are received, and each mask bit share is verified according to the message verification code corresponding to each mask bit share. When the verification is passed, the mask result is decrypted according to each mask bit share to determine the aggregation result, which can ensure the accuracy of each mask bit share sent by each smart device, and the mask result is decrypted using each mask bit share that has passed the verification, which can ensure the accuracy of the aggregation result. BRIEF DESCRIPTION OF THE DRAWINGS

[0081] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present disclosure. The exemplary embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation of the present disclosure. In the drawings:

[0082] FIG1 is a flow chart of a data aggregation method provided in the present disclosure;

[0083] FIG2 is a schematic diagram of a polymerization tree provided in the present disclosure;

[0084] FIG3 is a flow chart of another data aggregation method provided in the present disclosure;

[0085] FIG4 is a schematic diagram of a data aggregation device structure provided by the present disclosure;

[0086] FIG5 is a schematic diagram of another data aggregation device structure provided by the present disclosure;

[0087] FIG6 is a schematic structural diagram of an electronic device provided by the present disclosure. DETAILED DESCRIPTION

[0088] To make the objectives, technical solutions, and advantages of the present disclosure more clear, the technical solutions of the present disclosure will be clearly and completely described below in conjunction with the specific embodiments of the present disclosure and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present disclosure.

[0089] The technical solutions provided by various embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0090] The present disclosure provides a method for data aggregation, which is applied to an aggregation center. As shown in FIG1 , FIG1 is a flow chart of a method for data aggregation provided in the present disclosure, which specifically includes the following steps S100 to S108 .

[0091] S100: Receive mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data processed by the smart device based on a mask bit share on the aggregated data, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function.

[0092] In the present disclosure, in order to better provide services to users, the aggregation center can aggregate user data collected by smart devices, analyze the aggregated data, and then provide services to users based on the analysis results. For example, in a vehicle dispatching scenario, each building in the dispatching area has one or more smart devices for collecting user data. The smart devices can be image acquisition devices such as cameras and video cameras in the building. The user data includes information such as the collected images of users, the number of users, the time when users arrived at the building, and the time when users left the building. The vehicle dispatching system (i.e., the aggregation center) can aggregate the user data collected by each smart device and analyze the aggregated data to determine the analysis results. The analysis results can be the user flow in the dispatching area for each time period. Based on the determined analysis results, vehicles are reasonably dispatched to the dispatching area. However, user data may contain private data of users or the buildings where the smart devices are located, such as user personal information, user images, and other information. Therefore, when performing data aggregation, if the smart devices directly send the collected user data to the aggregation center, the aggregation center can obtain the specific data collected by each smart device, which may leak the privacy of users or smart devices.

[0093] Based on this, in data aggregation, the device used for data aggregation, namely the aggregation center, can receive the masked data sent by each smart device and the label value corresponding to each masked data. The aggregation center can be a system, a server, or an electronic device such as a desktop computer or laptop. For ease of description, the data aggregation method provided in this disclosure is described below using the aggregation center as the execution entity. A smart device is any device that can collect data. In different data aggregation scenarios, the smart devices may be the same or different. Similarly, the aggregation centers may be the same or different. In a vehicle dispatch scenario, the aggregation center can be a vehicle dispatch system or a service provider capable of dispatching vehicles. Smart devices can be image acquisition devices such as cameras and video cameras in the dispatched area. In a smart grid scenario, the aggregation center can be a power center, and the smart devices can be electric meters in users' homes. For ease of illustration, the following description uses the aggregation center and smart devices as examples. The masked data is the data processed by the smart device based on the masked bit shares. The masked bit shares are generated by the smart device based on a secure multi-party computation (MPC) preprocessing function. The label value corresponding to the masked data is a bit string randomly generated by the smart device based on the masked data. The secure multi-party computation preprocessing function is a function in the existing secure multi-party computation library. This secure multi-party computation preprocessing function can generate, based on the aggregation tree, the global key of each smart device and the aggregation center, the masked bit shares of the data input to each operation node in the aggregation tree, the masked bit shares of the data output by each operation node in the aggregation tree, the message authentication code for each masked bit share to be verified, and the key corresponding to each authentication code.

[0094] In the present disclosure, due to different scenarios of data aggregation application, the data collected by smart devices may be different, and the data to be aggregated may also be different. In the vehicle dispatch scenario, the user data collected by the smart device includes information such as the collected user image, the number of users, the time when the user arrives at the building, and the time when the user leaves the building. Therefore, the data to be aggregated can be the above-mentioned user data, or it can be partial user data such as the number of the above-mentioned users. This disclosure does not make any specific limitations. In the smart grid scenario, the user data collected by the smart device includes information such as user information, user electricity consumption, user address, and user electricity consumption time period. Therefore, the data to be aggregated can be the above-mentioned user data, or it can be partial user data such as user electricity consumption. This disclosure does not make any specific limitations. In addition, since the data to be aggregated contains the user's privacy data, the smart device can first mask the data to be aggregated, and then send the masked data to be aggregated (i.e., masked data) to the aggregation center to ensure that the user's privacy data contained in the data to be aggregated is not leaked.

[0095] Specifically, each smart device can generate a mask bit share based on a secure multi-party computing preprocessing function, determine the data to be aggregated, and use the mask bit share to process the data to be aggregated, determine the mask data, generate a label value corresponding to the mask data, and send the mask data and the corresponding label value to the aggregation center. The aggregation center receives the mask data sent by each smart device and the label value corresponding to each mask data. The label value can be a bit string randomly generated by the smart device based on the mask data. When the bit value of the mask data is 0, the smart device can randomly generate a K-bit bit string as the label value. When the bit value of the mask data is 1, the smart device can perform an exclusive OR (XOR) operation on the bit string generated when the bit value is 0 and a pre-stored global key, and use the result of the exclusive OR operation as the label value. K is a natural number and can be set in advance. The global key can be generated in advance by the smart device based on a secure multi-party computing preprocessing function.

[0096] S102: According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result.

[0097] The aggregation center aggregates each masked data based on each masked data and each label value based on a pre-built aggregation tree to determine the masked result. The aggregation tree is pre-built by the aggregation center based on the number of smart devices that perform data aggregation. The aggregation tree includes several operation nodes and leaf nodes. The leaf nodes in the aggregation tree represent the data to be aggregated corresponding to each smart device, and each leaf node represents the data to be aggregated of one smart device. All nodes in the aggregation tree except the leaf nodes are operation nodes. The operation nodes are used to perform XOR operations, AND operations, etc. on the data input to the operation node. The result output by the root operation node in the aggregation tree is the result of data aggregation of the data to be aggregated of each smart device. In one embodiment, for the upstream node (i.e., the operation node) of the leaf node in the aggregation tree, there are two smart devices whose data to be aggregated input into the upstream node. For the upstream node of the upstream node, there can be four smart devices inputting data into the upstream node of the upstream node. Therefore, in the aggregation tree, at least two smart devices input data into the operation node.

[0098] For example, as shown in FIG2 , FIG2 is a schematic diagram of an aggregation tree provided in the present disclosure. Assume that there are n smart devices for data aggregation, namely, smart devices D1 to D2. n , the corresponding input of each smart device is V1~V n , V1~V n As the leaf node of the aggregation tree. Since the data aggregation process can be V1+V2+V3+V4+...+V n, can also be expressed as (V1+V2)+(V3+V4)+...+(V n-1 +V n )=[(V1+V2)+(V3+V4)]+...+(V n-1 +V n )], so at the bottom level of the aggregation tree, every two leaf nodes can serve as inputs to their upstream nodes. For example, V1 and V2 of a leaf node serve as inputs to its two upstream nodes, which are computation nodes. From the upstream nodes of the leaf nodes to the top level of the aggregation tree, the outputs of every two computation nodes serve as inputs to their upstream nodes. The nodes with a "+" in the boxes in Figure 2 represent computation nodes in the aggregation tree.

[0099] Specifically, the aggregation center determines the mask data and label value input to each computing node in the pre-constructed aggregation tree based on each mask data and each label value. The aggregation center then determines the mask data output by the computing node based on the mask data input to the computing node, and determines the label value output by the computing node based on the label value input to the computing node. The aggregation center then uses the mask data output by the computing node as the mask data input to the next computing node, and the label value output by the computing node as the label value input to the next computing node, until the mask data and label value output by the last computing node are determined. The mask data output by the last computing node is then used as the masked result of the aggregation tree output. The next computing node to the computing node is the computing node that uses the mask data and label value output by the computing node as input. When determining the mask data and label value input to the computing node, if the computing node is an upstream computing node of a leaf node in the aggregation tree, the mask data and label value input to the computing node are determined from the received mask data and label values. If the operation node is not an upstream operation node of a leaf node in the aggregation tree, the mask data output by the previous operation node of the operation node is determined to be the mask data input to the operation node, and the label value output by the previous operation node of the operation node is determined to be the label value input to the operation node.

[0100] In the present disclosure, an operation node may include an XOR operation unit, and an operation node may include one or more XOR operation units. Therefore, when each operation node includes several XOR operation units, in the above step S102, the aggregation center can determine the mask data and label value input to the XOR operation unit for each operation node in the aggregation tree, and for each XOR operation unit in the operation node in turn, based on each mask data and each label value, perform XOR operation on the determined mask data, determine the mask data output by the XOR operation unit, and perform XOR operation on the determined label value to determine the label value output by the XOR operation unit. Afterwards, the mask data output by the XOR operation unit is used as the mask data input to the next XOR operation unit of the XOR operation unit, and the label value output by the XOR operation unit is used as the label value input to the next XOR operation unit of the XOR operation unit, until the mask data and label value output by the last XOR operation unit are determined, and the mask data output by the last XOR operation unit is used as the mask data output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node. Afterwards, the mask data output by the operation node is used as the mask data input to the next operation node of the operation node, and the label value output by the operation node is used as the label value input to the next operation node of the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0101] If the XOR operation unit is the first operation unit in the operation node, the mask data and label value input to the XOR operation unit are the mask data and label value input to the operation node. If the XOR operation unit is not the first operation unit in the operation node, the mask data and label value input to the XOR operation unit are the mask data and label value output by the previous XOR operation unit of the XOR operation unit.

[0102] In the present disclosure, a computing node may include an AND computing unit, and a computing node may include one or more AND computing units. Therefore, when each computing node includes several AND computing units, in the above step 102, the aggregation center may determine the mask data input to the AND computing unit for each computing node in the aggregation tree, and in turn for each AND computing unit in the computing node, based on the mask data and the label values, and determine the unit ciphertext corresponding to the AND computing unit based on the determined mask data. Thereafter, the aggregation center determines the label value input to the AND computing unit, and determines the mask data and label value output by the AND computing unit based on the determined label value and the unit ciphertext. The mask data output by the AND operation unit is then used as the mask data input to the next AND operation unit after the AND operation unit, and the label value output by the AND operation unit is used as the label value input to the next AND operation unit after the AND operation unit, until the mask data and label value output by the last AND operation unit are determined. At this point, the mask data output by the last AND operation unit is used as the mask data output by the operation node, and the label value output by the last AND operation unit is used as the label value input to the operation node. Afterwards, the mask data output by the operation node is used as the mask data input to the next operation node after the operation node, and the label value output by the operation node is used as the label value input to the next operation node after the operation node, until the mask data and label value input by the last operation node are determined. At this point, the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0103] If the AND operation unit is the first operation unit in the operation node, the mask data and label value input to the AND operation unit are the mask data and label value input to the operation node. If the AND operation unit is not the first operation unit in the operation node, the mask data and label value input to the AND operation unit are the mask data and label value output by the previous AND operation unit.

[0104] The above-mentioned unit ciphertext is determined by each smart device based on the aggregation tree and sent to the aggregation center. Therefore, in the above-mentioned step S100, the aggregation center can send the pre-built aggregation tree to each smart device, and then receive the unit ciphertext, mask data and label value corresponding to the mask data of each operation unit in the aggregation tree sent by each smart device. Among them, when sending the pre-built aggregation tree to each smart device, the aggregation center can send an aggregation request to each smart device, and the aggregation request contains the aggregation tree, and the aggregation request prompts the smart device to send the data to be aggregated to the aggregation center so that the aggregation center can perform data aggregation. Each of the above-mentioned operation units has a corresponding unit ciphertext, and each smart device can generate a corresponding unit ciphertext for each operation unit in the aggregation tree.

[0105] In addition, when the smart device generates the corresponding unit ciphertext for each operation unit in the aggregation tree, it needs to determine the bit value of the mask data input into the operation unit. The bit value can be 0 or 1. Since there are two mask data inputs into the operation unit, there are four combinations of the bit values ​​of the mask data input into the operation unit, namely 00, 01, 10 and 11. Each combination corresponds to a unit ciphertext, so each unit ciphertext corresponding to the operation unit can be generated based on multiple combinations, and the unit ciphertext corresponding to each combination can be generated by each smart device, that is, there are several unit ciphertexts corresponding to the operation unit.

[0106] Based on this, when determining the unit ciphertext corresponding to the operation unit based on the determined mask data, the aggregation center can determine the bit value combination corresponding to the mask data based on the determined mask data. Based on the determined combination, the aggregation center can determine the unit ciphertext corresponding to the operation unit from the unit ciphertexts for the operation unit sent by each smart device, that is, the number of unit ciphertexts corresponding to the operation unit. For example, smart devices D1 and D2 each send four unit ciphertexts for operation unit A to the aggregation center. These four unit ciphertexts are determined based on four combinations (i.e., 00, 01, 10, and 11). Therefore, the aggregation center can receive a total of eight unit ciphertexts for operation unit A. Assuming that the bit values ​​corresponding to the determined mask data are 0 and 1, respectively, the bit value combination is 01. From the eight unit ciphertexts for operation unit A sent by smart devices D1 and D2, the aggregation center can determine the unit ciphertext corresponding to combination 01. Therefore, the aggregation center can determine two unit ciphertexts corresponding to operation unit A.

[0107] When determining the mask data and label value output by the AND operation unit based on the determined label value and the unit ciphertext, the aggregation center can determine, for each unit ciphertext, the first mask data and first label value output by the AND operation unit corresponding to the unit ciphertext based on the determined label value and the unit ciphertext. Thereafter, each first mask data is used as the mask data output by the AND operation unit, and each first label value is used as the label value output by the AND operation unit.

[0108] In the present disclosure, the operation node may also include several AND operation units and several XOR operation units. Therefore, in the above step S102, the aggregation center can determine the type of the operation unit for each operation node in the aggregation tree and for each operation unit in the operation node in turn according to each mask data and each label value. When the operation unit is an XOR operation unit, the mask data and label value output by the XOR operation unit are determined according to the above process, which will not be repeated here, and the determined mask data and label value are used as the mask data and label value of the next operation unit input to the XOR operation unit. When the operation unit is an AND operation unit, the mask data and label value output by the AND operation unit are determined according to the above process, which will not be repeated here, and the determined mask data and label value are used as the mask data and label value of the next operation unit input to the AND operation unit, until the mask data and label value output by the last operation unit are determined, the mask data output by the last operation unit is used as the mask data output by the operation node, and the label value output by the last operation unit is used as the label value output by the operation node. Afterwards, the mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0109] S104: Receive the mask bit share of the mask result and the message verification code corresponding to the mask bit share sent by each smart device, wherein each bit share is used to decrypt the mask result.

[0110] S106: Verify each mask bit share according to the message authentication code corresponding to each mask bit share.

[0111] S108: When the verification is passed, the mask result is decrypted according to the respective mask bit shares to determine an aggregation result.

[0112] The aggregation center can receive the mask bit share of the mask result sent by each smart device and the message verification code corresponding to the mask bit share. Afterwards, each mask bit share is verified according to the message verification code corresponding to each mask bit share. When the verification is passed, the mask result is decrypted according to each mask bit share to determine the aggregation result. Among them, each smart device will send the mask bit share corresponding to the mask result to the aggregation center, and the mask bit share is used to decrypt the mask result finally output by the aggregation tree. The message verification code corresponding to the mask bit share is generated by the smart device based on the secure multi-party computing preprocessing function, and is used to verify whether the mask bit share sent by the smart device is accurate.

[0113] In addition, since the mask result is obtained by the aggregation center by aggregating the mask data of each smart device according to the operation nodes in the aggregation tree, each smart device can send a mask bit share to the aggregation center. Each mask bit share is a key generated by the smart device for the mask result output by the aggregation tree. Therefore, the aggregation center can decrypt the mask result output by the aggregation tree according to each mask bit share.

[0114] When verifying each masked bit share based on the message authentication code corresponding to each masked bit share, the aggregation center can determine, for each masked bit share, the key and message authentication code corresponding to the masked bit share generated based on the multi-party secure computation preprocessing function, and perform calculations based on the key and the masked bit share to determine a second calculation result. Subsequently, each masked bit share can be verified based on the second calculation result corresponding to each masked bit share and the message authentication code corresponding to each masked bit share.

[0115] Among them, when calculating based on the key and the mask bit share to determine the second calculation result, the aggregation center can determine the global key generated based on the secure multi-party computing preprocessing function, and use the global key to encrypt the mask bit share, and then perform an XOR operation on the encrypted result and the key determined in the above process, and use the result after the XOR operation as the second calculation result.

[0116] When verifying each masked bit share based on the second calculation result corresponding to each masked bit share and the message verification code corresponding to each masked bit share, if the second calculation result corresponding to each masked bit share and the message verification code corresponding to each masked bit share are consistent, the masked bit share is determined to have passed verification. If the second calculation result corresponding to a masked bit share and the message verification code corresponding to the masked bit share are inconsistent, the masked bit share is determined to have failed verification, and a verification failure message is sent to the smart device that sent the masked bit share that failed verification.

[0117] When the mask result is decrypted according to each mask bit share and the aggregation result is determined, the following formula (1) can be used for calculation:

[0118] Among them, z w Represents the aggregation result, z′ w Represents the mask result, represents the exclusive OR operation, Indicates smart device D i The share of each mask bit sent, where n represents the number of smart devices.

[0119] As can be seen from the above method, when performing data aggregation, the aggregation center first receives masked data sent by each smart device and the label values ​​corresponding to each masked data. The masked data is the data after the smart device has masked the data to be aggregated, thereby protecting the privacy contained in the data to be aggregated from each smart device. Subsequently, based on the masked data and label values, the masked data are aggregated based on a pre-constructed aggregation tree to determine a masking result. By aggregating the masked data of each smart device through the aggregation tree and determining a masking result, the privacy contained in the data to be aggregated from each smart device is protected. The aggregation center only knows the masking result and not the specific data to be aggregated from each smart device. Furthermore, the data aggregation process is accelerated and time costs are reduced. Next, the aggregation center receives the masked bit shares of the masked result and the message verification code corresponding to each masked bit share from each smart device. This allows the aggregation center to verify each masked bit share based on the message verification code corresponding to each masked bit share, ensuring the accuracy of each masked bit share sent by each smart device. When the verification is passed, the mask result is decrypted according to the share of each mask bit to determine the aggregation result, so that the aggregation center uses the verified share of each mask bit to decrypt the mask result to ensure the accuracy of the aggregation result. The aggregation center can only know the aggregation result of each smart device, but cannot know the specific data to be aggregated of each smart device, which ensures the privacy of the data to be aggregated of each smart device.

[0120] In the present disclosure, in order to ensure the accuracy of the aggregation result, the aggregation center can verify whether the mask data output by the AND operation unit is accurate during the data aggregation process based on the aggregation number. Therefore, in the above step S102, when the mask data and label value output by the AND operation unit are determined according to the determined label value and the unit ciphertext, the aggregation center can determine the mask data to be verified output by the AND operation unit (i.e., the above-mentioned first mask data), the label value output by the AND operation unit, and the message verification code of the mask data to be verified output by the AND operation unit for each unit ciphertext based on the determined label value and the unit ciphertext. Then, the key of the message verification code of the mask data to be verified output by the AND operation unit generated based on the secure multi-party computation preprocessing function is determined, and the first calculation result is determined based on the key and the mask data to be verified output by the AND operation unit. Afterwards, it is determined whether each first calculation result is consistent with the message verification code corresponding to each mask data to be verified. If so, each mask data to be verified is used as the mask data output by the AND operation unit. If not, the smart device corresponding to the masked data to be verified that failed verification is determined, and a verification failure message is sent to the determined smart device. The AND operation unit corresponds to a number of unit ciphertexts. The process of determining the first calculation result is similar to that of determining the second calculation result and will not be repeated here.

[0121] When determining the message authentication code of the mask data to be verified output by the AND operation unit, the tag value output by the AND operation unit, and the mask data to be verified output by the AND operation unit based on the determined tag value and the unit ciphertext, the following formula (2) can be used for calculation:

[0122] in, Indicates smart device D i The unit ciphertext corresponding to the operation unit sent to the aggregation center, t = z' α , z′ α Indicates the mask data input to the AND operation unit, s = z' β , z′ β Indicates the mask data input to the AND operation unit, Indicates the label value input to the AND operation unit. Indicates the label value input to the AND operation unit. Indicates the mask data to be verified output by the AND operation unit, Indicates the mask data to be verified The corresponding message verification code, that is, the message verification code of the mask data to be verified output by the AND operation unit, Indicates the intermediate label value output by the AND operation unit. Indicates smart device D iOther identified smart devices D j The message authentication code of the mask data to be verified is determined by the aggregation center based on the determined label value and the unit ciphertext. Indicates smart device D i Other smart devices stored D j The key of the message authentication code of the masked data to be verified output by the AND operation unit is determined, Indicates other smart devices D j The mask data to be verified output by the determined AND operation unit, Δ i Represents the global key of the smart device Di, Represents the label value output by the AND operation unit. H(x) represents the hash function, γ represents the output of the AND operation unit, and s and t represent the two inputs of the AND operation unit respectively.

[0123] In the present disclosure, after determining the mask data, the smart device can send the mask data to other smart devices other than itself and the aggregation center. The other smart devices can send the label value corresponding to the received mask data to the aggregation center. The label value is a K-bit bit string randomly generated by the other smart devices based on the mask data. Therefore, one mask data corresponds to the label values ​​generated by multiple smart devices. Therefore, in the above step S102, the aggregation center can receive each mask data sent by each smart device, and for each mask data, the aggregation center can receive the label value corresponding to the mask data sent by each smart device.

[0124] Based on this, in step S102, the aggregation center can perform data aggregation on each mask data based on the pre-built aggregation tree according to each mask data and the label values ​​corresponding to each mask data, and determine the mask result output by the aggregation tree. The specific process is similar to the above process in which each mask data corresponds to one label value, except that each mask data corresponds to multiple label values, and the label value output by each XOR operation unit and each AND operation unit is a set containing multiple label values. The specific process will not be repeated here.

[0125] In the present disclosure, in the smart grid scenario, the aggregation center can be a power center, and the smart device can be an electric meter at a user's home. The data to be aggregated can be the electricity consumption of the user's home. The aggregation center can build an aggregation tree based on the number of smart devices, that is, the number of electricity meters of residents in the area to be aggregated (such as a community), and send it to each smart device. Afterwards, each electricity meter masks the collected user's electricity consumption, determines the mask data, and generates a corresponding label value based on the mask data, and sends the mask data and label value to the aggregation center. The aggregation center determines the mask result based on the aggregation tree based on the received mask data and label values. The aggregation center then decrypts the mask result based on the mask bit share corresponding to the mask result sent by each smart device, determines the aggregation result, that is, the overall electricity consumption of the area to be aggregated, and allocates electricity based on the overall electricity consumption of the area to be aggregated.

[0126] The use of an aggregation tree for data aggregation accelerates data aggregation. The data input into the aggregation tree is masked data (i.e., masked data representing the user's electricity usage), preventing the aggregation center from knowing the specific electricity usage of each meter, thus protecting user privacy. The masked data sent by the meter can then be decrypted based on the corresponding mask bit share to determine the aggregated result, representing the overall electricity usage for the area being aggregated.

[0127] Of course, in the vehicle dispatching scenario, the above-mentioned aggregation center can be a vehicle dispatching system, the smart device can be an image acquisition device in the area to be dispatched, and the data to be aggregated can be the number of users. The specific data aggregation process is similar to the above-mentioned data aggregation process in the smart grid scenario, so it will not be repeated here.

[0128] The present disclosure also provides a method for data aggregation, which is applied to smart devices. As shown in FIG3 , FIG3 is a flow chart of another method for data aggregation provided in the present disclosure, which specifically includes the following steps S200 to S208 .

[0129] S200: Determine data to be aggregated.

[0130] S202: Generate mask bit shares using a secure multi-party computing preprocessing function according to the topological structure of the aggregation tree, wherein the aggregation tree is pre-constructed by the aggregation center.

[0131] S204: Process the data to be aggregated according to the mask bit share, determine mask data, and generate a label value corresponding to the mask data.

[0132] To protect the privacy contained in the data to be aggregated, the smart device can determine the data to be aggregated, and based on the topological structure of the aggregation tree, use a secure multi-party computation preprocessing function to generate a mask bit share. The data to be aggregated is then processed based on the mask bit share to determine the masked data and generate a label value corresponding to the masked data. The aggregation tree is constructed by the aggregation center based on the number of smart devices. The leaf nodes in the aggregation tree represent the data to be aggregated corresponding to each smart device. All nodes in the aggregation tree, except the leaf nodes, are computation nodes. The root computation node in the aggregation tree outputs the result of data aggregation of the data to be aggregated from each smart device. The data to be aggregated is data collected by smart devices. Depending on the application scenario of data aggregation, different smart devices and data to be aggregated may vary. The specific data types of smart devices and data to be aggregated in different scenarios are described in step S100 above and will not be further elaborated here. The secure multi-party computation preprocessing function is a function in an existing secure multi-party computation library. The label value corresponding to the masked data can be a label value randomly generated by the smart device based on the masked data.

[0133] Specifically, in response to an aggregation request sent by an aggregation center, the smart device can determine the aggregation tree pre-constructed by the aggregation center and the data to be aggregated. Based on the topology of the aggregation tree, a secure multi-party computation pre-processing function is used to generate a mask bit share. The data to be aggregated is then processed based on the mask bit share to determine the masked data and generate a tag value corresponding to the masked data. For example, in a smart grid scenario, the smart device can be an electric meter at a user's residence in a community, and the data to be aggregated can be the user's residential electricity consumption. The electric meter can determine the user's residential electricity consumption, and based on the topology of the aggregation tree, a secure multi-party computation pre-processing function is used to generate a mask bit share. Based on the mask bit share, the electricity consumption is then processed to determine the masked electricity consumption and generate a tag value corresponding to the masked electricity consumption.

[0134] In the present disclosure, the above-mentioned steps S200 and S202 may be performed in any order or simultaneously.

[0135] S206: Send the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device.

[0136] The smart center can send the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device.

[0137] In the present disclosure, an aggregation tree includes several operation nodes, each of which may include an AND operation unit. A single operation node may include one or more AND operation units. Therefore, when each operation node includes several AND operation units, when sending mask data and the label value corresponding to the mask data to the aggregation center, the smart device, in addition to sending the mask data and the label value corresponding to the mask data to the aggregation center, also needs to send the unit ciphertext corresponding to the AND operation unit in the aggregation tree to the aggregation center. Therefore, the smart device can determine the verifiable mask bit share and label value input to each operation node in the aggregation tree and, in turn, each AND operation unit in the operation node, and use a secure multi-party computation preprocessing function to determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit. Then, based on the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit, determine the unit ciphertext corresponding to the AND operation unit. Then, the unit ciphertext, mask data and label value corresponding to each operation unit in the aggregation tree are sent to the aggregation center.

[0138] The verifiable mask bit share includes the mask bit share, the message authentication code corresponding to the mask bit share, and the key of the message authentication code corresponding to the mask bit share of other smart devices, where the other smart devices are devices other than the smart device itself.

[0139] If the operation node is an upstream operation node of a leaf node in the aggregation tree, the verifiable masked bit share input to the operation node is generated by the intelligent device using a secure multi-party computation preprocessing function, and the label value input to the operation node is a K-bit bit string randomly generated by the intelligent device or the result of an exclusive-or operation of a randomly generated K-bit bit string with a global key. If the operation node is not an upstream operation node of a leaf node in the aggregation tree, the verifiable masked bit share output by the previous operation node of the operation node is determined to be the verifiable masked bit share input to the operation node, and the label value output by the previous operation node of the operation node is determined to be the label value input to the operation node.

[0140] If the AND operation unit is the first operation unit in the operation node, the verifiable mask bit share and label value input to the AND operation unit are the verifiable mask bit share and label value input to the operation node. If the AND operation unit is not the first operation unit in the operation node, the verifiable mask bit share and label value input to the AND operation unit are the verifiable mask bit share and label value output by the previous operation unit of the AND operation unit. In addition, when the previous operation unit of the AND operation unit is the AND operation unit, a secure multi-party computation preprocessing function is used to determine the verifiable mask bit share and label value output by the previous operation unit of the AND operation unit, and the verifiable mask bit share output by the previous operation unit of the AND operation unit is used as the verifiable mask bit share input to the AND operation unit, and the label value output by the previous operation unit of the AND operation unit is used as the label value input to the AND operation unit.

[0141] In addition, the operation node may also include a plurality of XOR operation units, and the previous operation unit of the AND operation unit may also be an XOR operation unit. Therefore, when determining the verifiable mask bit share and label value input to the AND operation unit, when the previous operation unit of the AND operation unit is an XOR operation unit, the verifiable mask bit share and label value input to the previous operation unit (i.e., the XOR operation unit) of the AND operation unit are determined, and based on the verifiable mask bit share input to the previous operation unit of the AND operation unit, the verifiable mask bit share output by the previous operation unit of the AND operation unit is determined as the verifiable mask bit share output by the AND operation unit. Furthermore, based on the label value input to the previous operation unit of the AND operation unit, the label value output by the previous operation unit of the AND operation unit is determined as the label value output by the AND operation unit.

[0142] In particular, when determining the share of verifiable masked bits output by the preceding operation unit of the AND operation unit based on the share of verifiable masked bits input to the preceding operation unit of the AND operation unit, the smart device may perform an exclusive OR operation on the share of verifiable masked bits input to the preceding operation unit of the AND operation unit to determine the share of verifiable masked bits output by the preceding operation unit of the AND operation unit. Similarly, when determining the label value output by the preceding operation unit of the AND operation unit based on the label value input to the preceding operation unit of the AND operation unit, the smart device may perform an exclusive OR operation on the label value input to the preceding operation unit of the AND operation unit to determine the label value output by the preceding operation unit of the AND operation unit.

[0143] The above triples are three parameters generated by a secure multi-party computation preprocessing function. The triples include a first value, a second value, and a third value. The verifiable mask bit share input to the AND operation unit includes the first verifiable mask bit share and the second verifiable mask bit share. In addition, for each smart device, there are operation nodes to which the smart device belongs and operation nodes unrelated to the smart device in the aggregation tree. If the smart device directly inputs data or indirectly inputs data to a certain operation node in the aggregation tree, then the operation node is the operation node to which the smart device belongs, and the operation nodes other than the operation node to which the smart device belongs are operation nodes unrelated to the smart device. Continuing with the above example, assuming that the smart devices D1 and D2 in Figure 2 both input data to a certain operation node in the upstream operation node, then the smart devices D1 and D2 both belong to the operation node, and the operation node that uses the data output by the operation node as input (i.e., indirect input) is also the operation node to which the smart devices D1 and D2 belong.

[0144] Based on this, the above-mentioned operation node may be an operation node to which the smart device belongs. When determining the unit ciphertext corresponding to the AND operation unit according to the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit, the smart device may determine the first value according to the first value in the triple and the first verifiable mask bit share input to the AND operation unit, and determine the second value according to the second value in the triple and the second verifiable mask bit share input to the AND operation unit. Specifically, the following formulas (3) to (4) may be used for calculation:

[0145] in, Indicates smart device D i The first value determined, represents the first verifiable mask bit share of the input to the AND operation unit determined by the intelligent device Di, Indicates smart device D i The first value in the determined triplet. represents the second value determined by the smart device Di, Indicates smart device D i Determine the second verifiable mask bit share of the input to the AND operation unit, Indicates smart device D i The second value in the determined triplet.

[0146] If the AND operation unit is the first operation unit in the operation node, and the operation node is the upstream operation node of the leaf node in the aggregation tree, the first verifiable mask bit share and the second verifiable mask bit share represent the verifiable mask bit shares of different smart devices input into the AND operation unit. For a certain smart device input into the AND operation unit, the smart device can generate a verifiable mask bit share input into the AND operation unit, and the other verifiable mask bit share input into the AND operation unit can be directly set to 0. Therefore, if the above Input the verifiable mask bit share of the AND operation unit to the smart device Di, then The verifiable mask bit share for processing the aggregated data generated by the smart device Di based on the secure multi-party computation pre-processing function, The default value is 0; if the above For smart devices D i Input the verifiable mask bit share of the AND operation unit, then the above It can also default to 0. The smart device Di may generate a verifiable mask bit share for processing the aggregated data based on a secure multi-party computation pre-processing function.

[0147] above or When it is not 0, or When the verifiable mask bit share for processing the aggregated data generated by the smart device Di based on the secure multi-party computation pre-processing function is used, it can be expressed by the following formula (5):

[0148] in, Indicates smart device D i The generated verifiable mask bit share of the input operation node or the AND operation unit, Indicates smart device D i The generated mask bit share, express The corresponding message verification code, Indicates other smart devices D j The key corresponding to the message authentication code corresponding to the mask bit share of the input operation node or the operation unit is generated. or Only smart device D i In addition, in order to protect privacy, smart device D i Unable to or Inform other smart devices, and there is no need for mutual verification between smart devices. Based on this, in order to save the storage cost and communication overhead of each smart device, each smart device does not need to store the data generated by other smart devices. or The corresponding message authentication code corresponds to the key, so the above Can default to 0.

[0149] Then, the first value and the second value are sent to other smart devices. The other smart devices are smart devices that belong to the computing node together with the smart device, that is, the other smart devices are smart devices other than the smart device (that is, the smart device Di, that is, the smart device serving as the execution subject) among the smart devices that input data to the computing node. The third value and the fourth value sent by the other smart devices are received, and the received third value and the first value are aggregated to determine the first total value, and the received fourth value and the second value are aggregated to determine the second total value. Specifically, the following formulas (6) to (7) can be used for calculation:

[0150] Among them, d γ Indicates smart device D i The first total value determined, n represents the number of smart devices, Indicates smart device D i The first value determined, Indicates smart device D n The third value is determined and sent to the smart device D i The first and third values ​​are determined in a similar manner, except that they are determined locally by different smart devices. γ represents the second total value determined by the intelligent device Di, Indicates smart device D i The second value is determined. Indicates smart device D n The fourth value is determined and the third value is sent to the smart device D i The determination process of the second value and the fourth value is similar, but they are determined locally by different smart devices.

[0151] Afterwards, the mask data to be verified output by the AND operation unit is determined based on the first total value, the second total value, the triplet, the share of the verifiable mask bits output by the AND operation unit, and the share of the verifiable mask bits input to the AND operation unit. Specifically, the following formulas (8) to (9) can be used for calculation:

[0152] in, Indicates smart device D i The third value in the determined triplet, Indicates smart device D i The mask data to be verified output by the determined AND operation unit, Indicates smart device D i The determined share of the verifiable mask bits output by the AND operation unit is the share of the verifiable mask bits output by the AND operation unit for the smart device D i Generated by a secure multi-party computing preprocessing function, in order to save storage costs, the key corresponding to the message authentication code of other smart devices stored in the verifiable mask bit share output by the AND operation unit can be only the key corresponding to the message authentication code of the other smart devices determined above, that is, the key corresponding to the message authentication code of other smart devices other than the smart device (i.e., the smart device serving as the execution subject) among the smart devices that input data to the AND operation node is stored in the verifiable mask bit share output by the AND operation unit. The key corresponding to the message authentication code of the smart device that does not input data to the AND operation node does not need to be stored and is directly defaulted to 0. t and s are bit values, and each t, ​​s∈{0,1}.

[0153] Afterwards, the unit ciphertext corresponding to the AND operation unit is determined based on the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit. Specifically, the following formula (10) can be used for calculation:

[0154] in, Indicates smart device D i The unit ciphertext corresponding to the operation unit is determined. Since t can be 0 or 1, and s can be 0 or 1, there are 4 combinations of t and s, namely 00, 01, 10, and 11. Each combination corresponds to a unit ciphertext, so there are 4 unit ciphertexts corresponding to the operation unit. := is the assignment symbol. Indicates smart device D i When the determined bit value is t, the label value of the AND operation unit is input. Indicates smart device D i When the determined bit value is t, the label value of the AND operation unit is input, and γ represents the output of the AND operation unit. The message authentication code of the mask data to be verified output by the AND operation unit, Indicates smart device D i When the determined bit value is 0, the label value output by the AND operation unit, Δ i Represents the global key of the smart device Di, Indicates smart device Di Other smart devices stored D j The determined key corresponds to the message authentication code of the mask data to be verified output by the operation unit.

[0155] If the AND operation unit is the first operation unit in the operation node, and the operation node is the upstream operation node of the leaf node in the aggregation tree, the above and All are smart devices D i A randomly generated K-bit bit string, where the bit values ​​are t and s respectively.

[0156] In addition, the computing node may also be a computing node unrelated to the smart device. Therefore, the verifiable mask bit share input to the computing node is 0, the generated triples of the AND computing unit are also 0, and the verifiable mask bit share output by the AND computing unit is also 0. Furthermore, when determining the unit ciphertext corresponding to the AND computing unit based on the triples, the verifiable mask bit share input to the AND computing unit, the tag value input to the AND computing unit, the verifiable mask bit share output by the AND computing unit, and the tag value output by the AND computing unit, the smart device may determine a first value based on a first value in the triples and the first verifiable mask bit share input to the AND computing unit, and determine a second value based on a second value in the triples and the verifiable mask bit share input to the AND computing unit. Then, based on the first value, the second value, the triples, the verifiable mask bit share output by the AND computing unit, and the verifiable mask bit share input to the AND computing unit, determine the mask data to be verified output by the AND computing unit. The unit ciphertext corresponding to the AND operation unit is determined according to the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit.

[0157] In addition, the smart device can also send the masked data to other smart devices other than the smart device, so that the other smart devices generate a label value corresponding to the masked data and send it to the aggregation center. In addition, the masked data and the label value corresponding to the masked data are sent to the aggregation center. Among them, the other smart devices other than the smart device can determine the label value corresponding to the masked data based on the received masked data and send it to the aggregation center. The label value corresponding to the masked data is a K-bit bit string randomly generated by the other smart device based on the bit value of the masked data. The specific process is similar to the process of generating the label value in step S202 above and will not be repeated here. Based on this, the aggregation center can receive the masked data sent by each smart device and the label values ​​corresponding to each masked data.

[0158] S208: Determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification is passed, determines the aggregation result according to each mask bit share and the mask result.

[0159] The smart device can determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share based on the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification is passed, determines the aggregation result based on each mask bit share and the mask result. Among them, the mask bit share is used to decrypt the mask result. The message verification code corresponding to the mask bit share is generated by the smart device based on the secure multi-party computing preprocessing function, and is used to verify whether the mask bit share sent by the smart device is accurate.

[0160] If the masked result output by the above-mentioned aggregation tree is the masked bit share stored in the verifiable masked bit share output by the last XOR operation unit in the aggregation tree, the smart device can determine the verifiable masked bit share output by the XOR operation unit based on the verifiable masked bit share input to the XOR operation unit, and send the masked bit share stored in the verifiable masked bit share and the message verification code corresponding to the masked bit share to the aggregation center. If the masked result output by the above-mentioned aggregation tree is the masked bit share stored in the verifiable masked bit share output by the last AND operation unit in the aggregation tree, the smart device can use a secure multi-party computation preprocessing function to generate the verifiable masked bit share output by the AND operation unit, and send the masked bit share stored in the verifiable masked bit share and the message verification code corresponding to the masked bit share to the aggregation center.

[0161] The above is the data aggregation method provided by the present disclosure. Based on the same idea, the present disclosure also provides a data aggregation device, which is applied to an aggregation center, as shown in FIG4 .

[0162] FIG4 is a schematic diagram of a data aggregation device provided by the present disclosure, including:

[0163] A first receiving module 300 is configured to receive mask data sent by each smart device and a tag value corresponding to each mask data, wherein the mask data is data processed by the smart device based on mask bit shares of the data to be aggregated, and the mask bit shares are generated by the smart device based on a secure multi-party computation preprocessing function;

[0164] Aggregation module 302, configured to aggregate the masked data and the label values ​​based on a pre-built aggregation tree to determine a masking result;

[0165] A second receiving module 304 is configured to receive the mask bit share of the mask result and the message verification code corresponding to the mask bit share sent by each smart device, wherein each mask bit share is used to decrypt the mask result;

[0166] A verification module 306, configured to verify each mask bit share according to a message verification code corresponding to each mask bit share;

[0167] The decryption module 308 is configured to decrypt the mask result according to the respective mask bit shares to determine an aggregation result when the verification is passed.

[0168] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of XOR operation units;

[0169] The aggregation module 302 is specifically used to, based on the mask data and label values, determine the mask data and label value input to each operation node in the pre-constructed aggregation tree and, in turn, for each XOR operation unit in the operation node; perform XOR operation on the determined mask data to determine the mask data output by the XOR operation unit; and perform XOR operation on the determined label value to determine the label value output by the XOR operation unit; use the mask data output by the XOR operation unit as the mask data input to the next XOR operation unit of the XOR operation unit, and use the label value output by the XOR operation unit as the label value input to the next XOR operation unit of the XOR operation unit, until the mask data and label value output by the last XOR operation unit are determined, use the mask data output by the last XOR operation unit as the mask data output by the operation node, and use the label value output by the last XOR operation unit as the label value output by the operation node; use the mask data output by the operation node as the mask data input to the next operation node of the operation node, And the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0170] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of AND operation units;

[0171] The first receiving module 300 is specifically configured to send the pre-built aggregation tree to each smart device; receive the unit ciphertext, mask data, and label value corresponding to the mask data of each operation unit in the aggregation tree sent by each smart device;

[0172] The aggregation module 302 is specifically configured to, based on the mask data and the label values, determine the mask data input to the AND operation unit for each operation node in the aggregation tree and, in turn, for each AND operation unit in the operation node, and determine the unit ciphertext corresponding to the AND operation unit based on the determined mask data; determine the label value input to the AND operation unit, and, based on the determined label value and the unit ciphertext, determine the mask data and label value output by the AND operation unit; use the mask data output by the AND operation unit as the mask data input to the next AND operation unit of the AND operation unit, and use the label value output by the AND operation unit as the label value input to the next AND operation unit of the AND operation unit. The label value of the operation unit is determined until the mask data and label value output by the last operation unit are determined, and the mask data output by the last operation unit is used as the mask data output by the operation node, and the label value output by the last operation unit is used as the label value output by the operation node; the mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

[0173] Optionally, the AND operation unit corresponds to a number of unit ciphertexts;

[0174] The aggregation module 302 is specifically used to determine, for each unit ciphertext, the mask data to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code of the mask data to be verified output by the AND operation unit according to the determined label value and the unit ciphertext; determine the key of the message verification code of the mask data to be verified output by the AND operation unit generated based on the secure multi-party computing preprocessing function, and perform calculation based on the key and the mask data to be verified output by the AND operation unit to determine a first calculation result; judge whether each first calculation result is consistent with the message verification code corresponding to each mask data to be verified; if so, use each mask data to be verified as the mask data output by the AND operation unit; if not, determine the smart device corresponding to the mask data to be verified that fails the verification, and send a verification failure message to the determined smart device.

[0175] Optionally, the verification module 306 is specifically used to determine, for each mask bit share, a key and a message verification code corresponding to the mask bit share generated based on the multi-party secure computing preprocessing function, perform calculations based on the key and the mask bit share to determine a second calculation result; and verify each mask bit share based on the second calculation result corresponding to each mask bit share and the message verification code corresponding to each mask bit share.

[0176] The present disclosure also provides a data aggregation device, which is applied to a smart device, as shown in FIG5 , which is a schematic structural diagram of another data aggregation device provided by the present disclosure, including:

[0177] A determination module 400 is used to determine data to be aggregated;

[0178] A generating module 402 is configured to generate a mask bit share based on a topological structure of an aggregation tree using a secure multi-party computation pre-processing function, wherein the aggregation tree is pre-constructed by the aggregation center;

[0179] An encryption module 404 is configured to process the data to be aggregated according to the mask bit share, determine mask data, and generate a label value corresponding to the mask data;

[0180] The sending module 406 is configured to send the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device;

[0181] The mask module 408 is used to determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share based on the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification is passed, determines the aggregation result based on each mask bit share and the mask result.

[0182] Optionally, the aggregation tree includes a plurality of operation nodes, and each operation node includes a plurality of AND operation units;

[0183] The sending module 406 is specifically used to determine, for each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, the verifiable mask bit share and label value input to the AND operation unit; use the secure multi-party computation preprocessing function to determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit; determine the unit ciphertext corresponding to the AND operation unit based on the triple, the verifiable mask bit share input to the AND operation unit, the label value input to the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit; and send the unit ciphertext corresponding to each AND operation unit of each operation node in the aggregation tree, the mask data, and the label value corresponding to the mask data to the aggregation center.

[0184] Optionally, the operation node further includes a plurality of XOR operation units;

[0185] The sending module 406 is specifically used to, when the previous operation unit of the AND operation unit is an exclusive OR operation unit, determine the verifiable mask bit share and label value of the previous operation unit input into the AND operation unit; determine the verifiable mask bit share output by the previous operation unit of the AND operation unit according to the verifiable mask bit share input into the previous operation unit of the AND operation unit, and use it as the verifiable mask bit share input into the AND operation unit; determine the label value output by the previous operation unit of the AND operation unit according to the label value input into the previous operation unit of the AND operation unit, and use it as the label value input into the AND operation unit.

[0186] Optionally, the computing node is a computing node to which the smart device belongs, the triplet includes a first value, a second value, and a third value, and the verifiable mask bit share input into the AND operation unit includes a first verifiable mask bit share and a second verifiable mask bit share;

[0187] The sending module 406 is specifically configured to determine a first value based on the first numerical value in the triplet and the first verifiable mask bit share input to the AND operation unit, and determine a second value based on the second numerical value in the triplet and the second verifiable mask bit share input to the AND operation unit, and send the first value and the second value to other intelligent devices, wherein the other intelligent devices are intelligent devices other than the intelligent device among the intelligent devices that input data to the operation node; receive a third value and a fourth value sent by the other intelligent devices, aggregate the received third value and the first value to determine a first total value, and aggregate the received fourth value and the second value to determine a second total value; determine the mask data to be verified output by the AND operation unit based on the first total value, the second total value, the triplet, the verifiable mask bit share output by the AND operation unit, and the verifiable mask bit share input to the AND operation unit; and determine the unit ciphertext corresponding to the AND operation unit based on the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit.

[0188] Optionally, the sending module 406 is specifically used to send the mask data to other smart devices other than the smart device, so that the other smart devices generate label values ​​corresponding to the mask data and send them to the aggregation center, and send the mask data and the label values ​​corresponding to the mask data to the aggregation center.

[0189] The present disclosure also provides a computer-readable storage medium storing a computer program, which implements the above-mentioned data aggregation method when executed by a processor.

[0190] This disclosure also provides an electronic device. As shown in Figure 6, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile storage, and may also include other hardware required for its services. The processor reads the corresponding computer program from the non-volatile storage into the memory and then runs it, thereby implementing the aforementioned data aggregation method.

[0191] Of course, in addition to software implementation, this disclosure does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0192] In the 1990s, technological improvements could be clearly distinguished as either hardware improvements (for example, improvements to circuit structures like diodes, transistors, and switches) or software improvements (improvements to process flows). However, with the advancement of technology, many process flow improvements today can now be considered direct improvements to hardware circuit structures. Designers almost always create the corresponding hardware circuit structure by programming the improved process flow into the hardware circuit. Therefore, it cannot be said that a process flow improvement cannot be implemented using hardware modules. For example, a programmable logic device (PLD), such as a field programmable gate array (FPGA), is an integrated circuit whose logical function is determined by user programming. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to hire a chip manufacturer to design and manufacture a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly done using "logic compiler" software. This is similar to the software compiler used when developing programs. Before compilation, the original code must also be written in a specific programming language, called a hardware description language (HDL). There is not just one HDL, but many, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art will also understand that by simply programming the method flow in one of these hardware description languages ​​and then programming it into an integrated circuit, a hardware circuit that implements the logic method flow can be easily obtained.

[0193] The controller can be implemented in any suitable manner. For example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that in addition to implementing the controller in a purely computer-readable program code format, the controller can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be considered as structures within the hardware component. Or even, the devices for implementing various functions can be considered as both software modules that implement the method and structures within the hardware component.

[0194] The systems, devices, modules, or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0195] For the convenience of description, the above devices are described as being divided into various units according to their functions. Of course, when implementing the present disclosure, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0196] Those skilled in the art will appreciate that the embodiments of the present disclosure may be provided as methods, systems, or computer program products. Therefore, the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0197] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0198] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0199] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0200] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0201] Memory may include non-persistent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0202] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change RAM (PRAM), static random-access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape and disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. According to the definition in this article, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0203] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0204] The present disclosure may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform specific tasks or implement specific abstract data types. The present disclosure may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communications network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0205] The various embodiments of this disclosure are described in a progressive manner. Similar portions between the various embodiments can be referenced to each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so their description is relatively simple. For relevant portions, refer to the description of the method embodiments.

[0206] The foregoing is merely an embodiment of the present disclosure and is not intended to limit the present disclosure. Various modifications and variations are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present disclosure are intended to be included within the scope of the claims of the present disclosure.

Claims

1. A method for data aggregation, characterized in that: The method is applied to a aggregation center, and the method comprises: Receiving mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data processed by the smart device based on the mask bit share on the to-be-aggregated data, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function; According to the mask data and the label values, based on a pre-constructed aggregation tree, the mask data are aggregated to determine a mask result; Receiving a mask bit share of the mask result and a message verification code corresponding to the mask bit share sent by each smart device, wherein each mask bit share is used to decrypt the mask result; Verifying each mask bit share according to a message authentication code corresponding to each mask bit share; When the verification is passed, the mask result is decrypted according to the bit shares of each mask to determine the aggregation result.

2. The method according to claim 1, characterized in that The aggregation tree includes a plurality of operation nodes, each of which includes a plurality of XOR operation units; According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including: According to the mask data and the label values, for each operation node in the pre-constructed aggregation tree, and in turn for each XOR operation unit in the operation node, determine the mask data and the label value input to the XOR operation unit; Performing an XOR operation on the determined mask data to determine the mask data output by the XOR operation unit; and performing an XOR operation on the determined label value to determine the label value output by the XOR operation unit; The mask data output by the XOR operation unit is used as the mask data of the next XOR operation unit input to the XOR operation unit, and the label value output by the XOR operation unit is used as the label value of the next XOR operation unit input to the XOR operation unit, until the mask data and label value output by the last XOR operation unit are determined, and the mask data output by the last XOR operation unit is used as the mask data output by the operation node, and the label value output by the last XOR operation unit is used as the label value output by the operation node; The mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

3. The method according to claim 1, characterized in that The aggregation tree includes a plurality of operation nodes, each of which includes a plurality of AND operation units; Receive the mask data sent by each smart device and the label value corresponding to each mask data, including: Send the pre-built aggregation tree to each smart device; Receiving the unit ciphertext, mask data and label value corresponding to the mask data of each operation unit in the aggregation tree sent by each smart device; According to the mask data and the label values, based on a pre-built aggregation tree, the mask data are aggregated to determine a mask result, specifically including: According to the mask data and the label values, for each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, determine the mask data input to the AND operation unit, and determine the unit ciphertext corresponding to the AND operation unit according to the determined mask data; Determine the label value input to the AND operation unit, and determine the mask data and label value output by the AND operation unit according to the determined label value and the unit ciphertext; The mask data output by the AND operation unit is used as the mask data of the next AND operation unit input to the AND operation unit, and the label value output by the AND operation unit is used as the label value of the next AND operation unit input to the AND operation unit, until the mask data and label value output by the last AND operation unit are determined, the mask data output by the last AND operation unit is used as the mask data output by the operation node, and the mask data output by the last AND operation unit is used as the mask data output by the operation node. The label value output by the operation unit is used as the label value output by the operation node; The mask data output by the operation node is used as the mask data of the next operation node input to the operation node, and the label value output by the operation node is used as the label value of the next operation node input to the operation node, until the mask data and label value output by the last operation node are determined, and the mask data output by the last operation node is used as the mask result output by the aggregation tree.

4. The method according to claim 3, characterized in that The AND operation unit corresponds to a number of unit ciphertexts; Determining the mask data and the label value output by the AND operation unit according to the determined label value and the unit ciphertext, specifically includes: For each unit ciphertext, determine the mask data to be verified output by the AND operation unit, the label value output by the AND operation unit, and the message verification code of the mask data to be verified output by the AND operation unit according to the determined label value and the unit ciphertext; Determine a key of a message authentication code of the mask data to be verified output by the AND operation unit generated based on the secure multi-party computation preprocessing function, and perform calculation according to the key and the mask data to be verified output by the AND operation unit to determine a first calculation result; Determining whether each first calculation result is consistent with a message verification code corresponding to each mask data to be verified; If yes, each mask data to be verified is used as mask data output by the AND operation unit; If not, the smart device corresponding to the mask data to be verified that failed the verification is determined, and a verification failure message is sent to the determined smart device.

5. The method according to claim 1, characterized in that Verifying each mask bit share according to a message verification code corresponding to each mask bit share specifically includes: For each mask bit share, determine a key and a message authentication code corresponding to the mask bit share generated based on the multi-party secure computing preprocessing function, and perform calculations based on the key and the mask bit share to determine a second calculation result; The mask bit shares are verified according to the second calculation results corresponding to the mask bit shares and the message verification codes corresponding to the mask bit shares.

6. A method for data aggregation, characterized in that: The method is applied to a smart device, and the method comprises: Determine the data to be aggregated; Generate mask bit shares using a secure multi-party computing preprocessing function according to a topological structure of an aggregation tree, wherein the aggregation tree is pre-constructed by an aggregation center; Processing the data to be aggregated according to the mask bit share, determining mask data, and generating a label value corresponding to the mask data; Sending the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value received from each smart device; Determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification passes, determines the aggregation result according to each mask bit share and the mask result.

7. The method according to claim 6, characterized in that The aggregation tree includes a plurality of operation nodes, each of which includes a plurality of AND operation units; Sending the mask data and the label value corresponding to the mask data to the aggregation center specifically includes: For each operation node in the aggregation tree, and for each AND operation unit in the operation node in turn, determine the share of verifiable mask bits and the label value input to the AND operation unit; Using the secure multi-party computation preprocessing function, determine the triple of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit; According to the triple, the share of the verifiable mask bits input to the AND operation unit, the The label value of the AND operation unit, the verifiable mask bit share output by the AND operation unit, and the label value output by the AND operation unit are used to determine the unit ciphertext corresponding to the AND operation unit; The unit ciphertext corresponding to the operation unit of each operation node in the aggregation tree, the mask data and the label value corresponding to the mask data are sent to the aggregation center.

8. The method according to claim 7, characterized in that The operation node also includes a number of XOR operation units; Determine the verifiable mask bit share and label value input to the AND operation unit, including: When the previous operation unit of the AND operation unit is an XOR operation unit, determining a verifiable mask bit share and a label value input to the previous operation unit of the AND operation unit; Determine the verifiable mask bit share output by the previous operation unit of the AND operation unit according to the verifiable mask bit share input to the previous operation unit of the AND operation unit, and use it as the verifiable mask bit share input to the AND operation unit; According to the label value of the previous operation unit input to the AND operation unit, the label value output by the previous operation unit of the AND operation unit is determined and used as the label value input to the AND operation unit.

9. The method according to claim 7, characterized in that The computing node is a computing node to which the smart device belongs, the triplet includes a first value, a second value, and a third value, and the verifiable mask bit share input into the AND computing unit includes a first verifiable mask bit share and a second verifiable mask bit share; Determining a unit ciphertext corresponding to the AND operation unit according to the triple, the share of the verifiable mask bits input to the AND operation unit, the label value input to the AND operation unit, the share of the verifiable mask bits output by the AND operation unit, and the label value output by the AND operation unit, specifically includes: Determine a first value according to the first value in the triplet and the first verifiable mask bit share input to the AND operation unit, and determine a second value according to the second value in the triplet and the second verifiable mask bit share input to the AND operation unit, and send the first value and the second value to other intelligent devices, wherein the other intelligent devices are intelligent devices other than the intelligent device among the intelligent devices that input data to the operation node; receiving a third value and a fourth value sent by the other smart device, aggregating the received third value and the first value to determine a first total value, and aggregating the received fourth value and the second value to determine a second total value; Determine the mask data to be verified output by the AND operation unit according to the first total value, the second total value, the triplet, the share of the verifiable mask bits output by the AND operation unit, and the share of the verifiable mask bits input to the AND operation unit; The unit ciphertext corresponding to the AND operation unit is determined according to the mask data to be verified output by the AND operation unit, the label value input to the AND operation unit, and the label value output by the AND operation unit.

10. The method according to claim 6, characterized in that Sending the mask data and the label value corresponding to the mask data to the aggregation center specifically includes: The mask data is sent to other smart devices except the smart device, so that the other smart devices generate label values ​​corresponding to the mask data and send them to the aggregation center, and the mask data and the label values ​​corresponding to the mask data are sent to the aggregation center.

11. A data aggregation device, characterized in that: The device is applied to a polymerization center, and comprises: A first receiving module is used to receive mask data sent by each smart device and a label value corresponding to each mask data, wherein the mask data is data processed by the smart device based on the mask bit share on the data to be aggregated, and the mask bit share is generated by the smart device based on a secure multi-party computing preprocessing function; An aggregation module, configured to aggregate the mask data and the label values ​​based on a pre-built aggregation tree to determine a mask result; A second receiving module is used to receive the mask bit share of the mask result sent by each smart device and the message verification code corresponding to the mask bit share, wherein each mask bit share is used to decrypt the mask result; A verification module, configured to verify each mask bit share according to a message verification code corresponding to each mask bit share; The decryption module is used to decrypt the mask result according to the bit shares of each mask to determine the aggregation result when the verification is passed.

12. A data aggregation device, characterized in that: The device is applied to a smart device, and comprises: A determination module, used to determine the data to be aggregated; A generation module, configured to generate a mask bit share according to a topological structure of an aggregation tree and using a secure multi-party computing preprocessing function, wherein the aggregation tree is pre-constructed by an aggregation center; An encryption module, used to process the data to be aggregated according to the mask bit share, determine the mask data, and generate a label value corresponding to the mask data; A sending module, used for sending the mask data and the label value corresponding to the mask data to the aggregation center, so that the aggregation center determines the mask result according to the mask data and label value sent by each smart device; The mask module is used to determine the mask bit share corresponding to the mask result output by the aggregation tree and the message verification code corresponding to the mask bit share, and send the determined mask bit share and message verification code to the aggregation center, so that the aggregation center verifies each mask bit share according to the received mask bit share and the message verification code corresponding to each mask bit share, and when the verification is passed, determines the aggregation result according to each mask bit share and the mask result.

13. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 10 is implemented.

Images