Local decision making
The present disclosure relates to the use of cryptographic techniques to facilitate local decision making at a gateway device ( 120 ) interfacing between an operator device ( 110 ) and edge devices ( 130 ), for example as can be found in Internet of Things infrastructures. Local decision making is facilitated in the context of end to end encryption of data between the edge device and operator device by enabling a function of the data to be computed at the gateway ( 120 ) without decrypting the data, for example using Functional Encryption (FE). The gateway determines an action based on the computed function, for example whether to transmit the data to the operator device ( 110 ). Examples of edge devices are video surveillance cameras or utility consumption meters but the disclosure is applicable to any edge device that produces data to be transmitted with end to end encryption. The disclosure is also not limited to IoT infrastructures.
1. A method of local decision making in a communications system comprising an operator device in communication with a plurality of gateway devices and a plurality of edge devices, each edge device of the plurality of edge devices in communication with a respective gateway device of the plurality of gateway devices, the method comprising:
receiving encrypted data at a gateway device from an edge device for transmission to the operator device, wherein the encrypted data is encrypted with a public key such that the encrypted data can be decrypted with a corresponding private key and a function of the data can be computed without the private key, wherein the gateway device does not have access to the private key;
applying, at the gateway device, an operator to the encrypted data to compute a value of a function of the encrypted data without decrypting the encrypted data;
determining, at the gateway device, an action to be taken based on the value; and
taking the determined action.
2. The method according to claim 1 , wherein determining the action comprises deciding whether or how to transmit the encrypted input-data to the operator and taking the determined action comprises transmitting or not transmitting the encrypted input data to the operator device based on the determination.
3. The method according to claim 1 , comprising receiving instances of encrypted data from respective edge devices and computing a respective value of the function for each instance of encrypted data, wherein determining the action comprises selecting which instances of the encrypted data to transmit and, or how to transmit them based on the computed values and the action comprises transmitting selected one or more of the received instances of encrypted data based on the computed values.
4. The method according to claim 1 , wherein the action comprises sending a control signal to the edge device and/or sending an alarm signal to the operator device.
5. The method according to claim 1 , comprising receiving instances of encrypted data from respective edge devices and computing a respective value of the function for each instance of encrypted data and determining the action to be taken based on the computed values, wherein the action comprises sending a control signal to the edge device and/or sending an alarm signal to the operator device.
6. The method according to claim 1 , wherein the edge device or devices comprise a video camera, the encrypted data comprises encrypted video data and encrypted motion data indicative of motion in frames of the video data and the function comprises a function of the motion data indicative of an amount of motion in frames of the video data.
7. The method according to claim 6 , wherein the action comprises selecting a quality of video data to be transmitted to the operator based on the value.
8. The method according to claim 1 , wherein the edge device or devices comprise a utility consumption meter and the encrypted data comprises utility consumption data.
9. The method according to claim 1 , wherein the function comprises a sum.
10. The method according to claim 1 , wherein the function returns a value indicating whether a sum of magnitudes of the data exceed a threshold value.
11. A method of local decision making in a communications system comprising an operator device in communication with a plurality of gateway devices and a plurality of edge devices, each edge device of the plurality of edge devices in communication with a respective gateway device of the plurality of gateway devices, the method comprising:
receiving encrypted data at a gateway device from an edge device for transmission to the operator device, wherein the encrypted data is encrypted with a public key such that the encrypted data can be decrypted with a corresponding private key and a function of the data can be computed without the private key, wherein the data is encrypted using functional encryption, and wherein the gateway device does not have access to the private key;
applying, at the gateway device, an operator to the encrypted data to compute a value of a function of the data without decrypting the encrypted data;
determining, at the gateway device, an action to be taken based on the value; and
taking the determined action.
12. A gateway device for use in a communications system comprising an operator device in communication with a plurality of gateway devices and a plurality of edge devices, each edge device of the plurality of edge devices in communication with a respective gateway device of the plurality of gateway devices, wherein each gateway device of the plurality of gateway devices comprises:
a memory storing computer instructions;
a communications interface for receiving encrypted data from an edge device and for transmitting the encrypted data to an operator device, wherein the encrypted data is encrypted with a public key such that the encrypted data can be decrypted with a corresponding private key and a function of the data can be computed without the private key, wherein the gateway device does not have access to the private key; and
a processor configured to execute the computer instructions to:
apply an operator to the encrypted data to compute a value of a function of the data without decrypting the encrypted data;
determine an action to be taken based on the value, wherein determining the action comprises deciding whether or how to transmit the encrypted data to the operator; and
take the determined action.
13. The gateway device according to claim 12 , wherein connections between the gateway device and the plurality of edge devices have higher bandwidth and/or shorter latency than connections between the plurality of edge devices and the operator device.