CN104954390A - Cloud storage integrity detection method for recovering lost secret keys and system applying cloud storage integrity detection method - Google Patents

Abstract

The invention provides a cloud storage integrity detection method capable of recovering lost keys and a system applied to the method. The system includes a parameter generation center module, a cloud module, a key distribution center module, a group member module, and an audit center module . With this system, when the key of a member in the group is lost, it is possible to avoid regenerating a new key and re-signing some data; the key is verifiable, that is, each member of the group can verify that the key distribution center has given Whether the key he sent is correct, the user who lost the key can also verify whether the shares sent to him by other t+1 members in the group are correct. This can prevent the key distribution center or the user who distributes the share to the lost user from being dishonest; when the key is restored, the user's key is blinded, so that each member does not know each other's key. This improves the security of key recovery and prevents malicious users from framing the cloud.

Description

Cloud storage integrity detection method and system capable of recovering lost keys

technical field

The invention relates to the technical field of cloud storage security, in particular to a cloud storage integrity detection method and system capable of recovering lost keys.

Background technique

In recent years, with the rapid development of Internet technology and the increasing number of cloud service providers, cloud computing services have entered people's lives more and more deeply, and data storage in the cloud has also become a hot spot of concern. Today, with the development of the network and the advancement of technology, a large number of interactive applications and massive data will be generated in life, and these data require a large amount of software and hardware for storage and calculation, and the maintenance cost of the data is very high. As an important application form of cloud computing, cloud storage can provide low-cost and convenient large-scale storage services to store and manage data for users. Users can use services on demand and outsource data storage to the cloud, thus changing the way of resource deployment and service provision, and avoiding users' large investment in local software, hardware and maintenance.

However, there are also many threats to cloud storage. For example, there are loopholes in the system software, hackers’ intrusion, hardware failure, resulting in data loss, and cloud service providers deliberately delete infrequently used data in order to save storage space. reputation, while deliberately concealing the fact that data was lost. When the user's data and application systems are moved to the cloud, the user loses the authority to directly control them. Moreover, any errors in the cloud may result in modification or loss of user data. Therefore, users have reason to doubt whether the data stored in the cloud is complete and usable. Data owners need a safe and reliable service mechanism to ensure that the data is truly and completely stored in the cloud server.

Cloud storage data integrity auditing is a good solution to ensure the integrity and availability of data stored in the cloud. However, the traditional method of verifying data integrity needs to download all the data to complete the verification task, which is impractical in the case of data outsourcing. Because the amount of data stored in the cloud is very large, it will cost a lot of communication and computing overhead, and it will also bring a great burden to the I/O device. The private audit is more efficient, but only the user can complete the verification by himself. But public auditing allows anyone to challenge and verify the integrity of the data. Due to the large amount of data stored in the cloud, the audit task is very heavy. Due to the limited computing power and time of user equipment, in public audit, users can entrust audit tasks to trusted third-party audit centers, and can verify the integrity of data without downloading complete data. The audit center sends a query to the cloud, and the cloud sends an audit certificate to the audit center based on the query. The audit center can verify the integrity of the data stored in the cloud through the verification certificate.

In the practical application of cloud storage, group shared data storage is a very important application. In this cloud storage form of shared data, any member belonging to a certain group can access, modify, and other operations on the data in the cloud. Therefore, cloud storage data integrity audit methods for shared data have received some attention. In the shared data group, the key of the group member may be lost and cannot be recovered due to hardware failure, loss of mobile device, etc. If the traditional method is used, a new key needs to be redistributed to the member whose key is lost, and then It is necessary to download all the data of this user from the cloud and re-sign the data with a new key, otherwise there will be security problems. However, this would cost intolerable computational and communication overheads and cannot be applied to cloud storage environments. Therefore, there needs to be an effective method that can recover his key when the member key is lost, without regenerating a new key and recalculating the signature.

The patent of the present invention proposes an efficient cloud storage integrity detection method that can recover lost keys. When the key of a member in the group is lost, his key can be recovered through the keys of other t+1 members (t+1 is the threshold value) in the group, and each user does not know other members in the group user's key. The cloud storage method proposed in this scheme can not only ensure the integrity of the data, but also recover the key for the member whose key is lost.

Contents of the invention

The technical problem to be solved by the invention is to prevent the security problem caused by the loss of the key of the group member in the shared data. Based on this, this patent proposes a cloud storage integrity detection method that can recover lost keys. In this method, when the key of a member in the group is lost, his key can be recovered through the keys of other t+1 members in the group (where t+1 represents the threshold value), and each user can The keys of other members of the group are not known. The patented electronic medical system of the present invention, massive data storage and many other fields have broad application.

In order to solve the above technical problems, the present invention provides a cloud storage integrity detection system capable of recovering lost keys, which includes a parameter generation center module, a cloud module, a key distribution center module, a group member module, and an audit center module (referred to as TPA);

The parameter generation center module generates various system parameters, generates public and private keys for users, calculates audit parameters, etc.;

The cloud module provides data storage and data sharing services for group members, and the data file F is divided into n data blocks {m ₁ ,..., m _n } and stored in the cloud;

The key distribution center module generates a key and a public key for each member in the group member module, and distributes the key to each member, and discloses the public key of each member;

The group member module includes the data owner and other users (assuming that the group has n members U={U ₁ , U ₂ ,..., U _n }), the data owner uploads the data file to the cloud and shares it with the group Other users in the database, while other users can access the data, there is no distinction between the two;

The audit center module is entrusted by the user to verify the integrity of the data stored in the cloud module.

The present invention also provides a cloud storage integrity detection method for recoverable lost keys using the cloud storage integrity detection system for recoverable lost keys, which includes:

The first step, system parameter generation, adopts the parameter generation center module of the system to generate various system parameters;

The second step, key distribution, uses the key distribution center module to randomly select a polynomial, calculates n shares {s _i } _1≤i≤n and distributes the shares to each member U _i of the group (i=1, 2,...,n) as the key, and calculate and publish the public key of each member

The third step is data uploading and auditing. For data uploading, the group members use their own keys to sign the data to be uploaded to the cloud module. The group members upload the data and the data block signature to the cloud together. The module randomly selects the sampling data that needs to be questioned, and sends the challenge chal to the cloud. The cloud module generates an audit proof proof according to the challenge chal sent by the audit center module and sends it to the audit center module. The audit center module receives the proof proof sent by the cloud. After that, verify whether the challenged data block is correct by verifying the equation.

The fourth step is key recovery. When the key of user U _x in the group is lost, he can reconstruct his own key s _x through the keys of other t+1 members in the group.

The system parameter generating step is further specifically generating two multiplicative cyclic groups G ₁ and G ₂ (their order is a large prime number p) for the parameter generating central module, and a bilinear pairing: Among them, g, u are two independent generators in _G1 . Then choose a cryptographic hash function in Finally choose a prime q such that q|p-1, (q is the order of Z _p ^* ). Then all public parameters are

The key distribution step further specifically includes:

In step a, the key distribution center module randomly selects a polynomial (a _i ∈ Z _p ), calculate each member’s key s _i =f(i), i=1, 2...., n and public key

In step b, the key distribution center module broadcasts the commitment value g ^s , Send s _i (i=1, 2, K, n) to each member U _i (i=1, 2, ..., n) in the group, and disclose the public key of each member

Step c, after each user U _i (i=1, 2, ..., n) in the group receives the key _si sent by the key distribution center module, verify whether the following equation is true:

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; the\; s</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; i</span>}}^{\mathrm{<span\; class="notranslate">\; j</span>}}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; p</span>}$

If the equation is established, it means that the user U _i believes that the key _si given to him by the key distribution center module is correct. And each user stores a commitment value g ^s ,

The data uploading and auditing steps further include:

In step a, the data file is uploaded. The group member U _i divides the data file F to be uploaded to the cloud module into n data blocks, that is, F=(m _i , . . . , m _n ). Then use his key _si to calculate the signature of data block m _i (i=1, 2, ..., n) Finally, send the data block (m ₁ ,..., m _n ) and the signature Φ={σ _i } _1≤i≤n corresponding to the data block to the cloud module, and delete the data block and its corresponding signature locally;

Step b, data file audit,

(b1) Generate a challenge: the audit center module randomly selects a set I with c elements, and I∈[1,n], then generates a random element v _i ∈ Z _p , i∈I, and generates a challenge chal={( i, v _i )} _i∈I and sent to the cloud;

(b2) Proof generation: After receiving the challenge, the cloud module divides the set I into n parts, that is, I={I ₁ ,...I _n }, where I _i represents the data block signed by the user U _i in the set I The set of , I _i has c _i elements. F, I=I ₁ ∪K∪I _n and I _i ∩I _j =φ. Then, for each set I _j , the cloud module calculates the linear combination of data blocks and compute the aggregate of the signature Finally, (σ, μ) is sent to the audit center module as proof, where σ={σ ₁ ,…,σ _n }, μ={μ ₁ , K, μ _n };

(b3) Proof verification: When the audit center module receives the proof proof, it verifies whether the following equations are true,

$\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; I</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}\mathrm{<span\; class="notranslate">\; h</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; u</span>}}^{{\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; pk</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; .</span>$

When the equation is established, it means that the data stored in the cloud module is correct; otherwise, it is considered that at least one data block is incorrect.

The key recovery step further includes:

When the user U _x key of the group is lost, he can obtain t+1 keys from t+1 members in the group, perform reconstruction operation, and then recover his own key s _x . Without loss of generality, it is assumed that these t+1 members are U _i (i=1, 2, ..., t+1);

Group member U _i (i=1, 2, ..., t+1) randomly selects a polynomial To calculate u _ij =f _i (j) and u _ix =f _i (x), where j=1, 2, . . . , t+1. The committed value is then broadcast over a secure channel u _ix , (l=0,1,...t), u _ij , (j=1, 2, ..., t+1);

After the user U _x whose key is lost receives the message u _ix broadcast by the user U _i (i=1, 2, ..., t+1), verify whether the following equation holds true,

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; x</span>}}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; o</span>}}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 0</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; x</span>}}^{\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; p</span>}<span\; class="notranslate">\; )</span>$

If the equation holds, the user U _x calculates

Member U _j (j=1, 2, ..., t+1) receives the message u _ij broadcast by other t users, and then verifies whether the following equation holds true,

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; o</span>}}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; p</span>}<span\; class="notranslate">\; )</span>$

If the equality is established, the member U _j (j=1, 2, ..., t+1) calculates That is, the key s _j is blinded, and then s _j ′ is broadcast through a secure channel;

After the user U _x receives the message s _j ′ broadcast by the user U _j (j=1, 2, ..., t+1), it verifies whether the following equation holds true,

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{{\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; the\; s</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 0</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; \&Center\; Dot;</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; \&epsiv;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; j</span>}}$

If the equality holds, user U _x computes his key in, $C_{Bj}x={\mathrm{\&Pi;}}_{i=\{1,2,...,t+1\}\backslash \left\{j\right\}}\frac{x-i}{j-i}.$

Beneficial effects of the present invention:

1. When the key of a member in the group is lost, his key can be recovered through the keys of other t+1 members in the group, avoiding regenerating a new key and re-signing some data;

2. The key is verifiable, that is, each member of the group can verify whether the key sent to him by the key distribution center is correct, and the user who lost the key can also verify the key sent to him by other t+1 members in the group Is the share correct. This prevents the key distribution center or the user who distributes shares to the lost user of the key from being dishonest;

3. When the key is restored, the user's key is blinded, so that each member does not know each other's key. This improves the security of key recovery and prevents malicious users from framing the cloud.

Description of drawings

Figure 1 is a system structure diagram of a cloud storage integrity detection method that can recover lost keys. The key distribution center generates keys for all members in the group. When a member key in the group is lost, his key can be recovered from the keys of other t+1 members of the group.

Fig. 2 is a schematic diagram of the system parameter generation stage of the cloud storage integrity detection method capable of recovering lost keys. This is done by the parameter generation center. The parameter generation center generates various system parameters used in the scheme.

Fig. 3 is a schematic diagram of the key distribution stage of the cloud storage integrity detection method capable of recovering lost keys. The key distribution center randomly selects a polynomial, calculates n shares and distributes the shares to each member of the group as a key, and calculates and publishes the public key of each member.

Fig. 4 is a schematic diagram of the data upload and audit stages of the cloud storage integrity detection method that can restore lost keys. Group members store data and block signatures in the cloud. The audit center issues queries to the cloud in order to verify the integrity of the data stored in the cloud.

Fig. 5 is a schematic diagram of the key recovery stage of the cloud storage integrity detection method capable of recovering lost keys. When the user U _x key of the group is lost, he can get no less than t+1 keys from the members of the group, perform reconstruction operation, and then recover his own key.

Detailed ways

The following examples are used to describe the implementation of the present invention in detail, so as to fully understand and implement the process of how to apply technical means to solve technical problems and achieve technical effects in the present invention.

One, the relevant theory applied in the present invention

(1) Bilinear pairing

Let G ₁ and G ₂ be two multiplicative groups whose order is a prime number q, if the mapping satisfy the following properties:

1) Bilinear: For $\begin{array}{cc}\&ForAll;P,Q\&Element;G_1,& a,b\&Element;Z_q^{*},\end{array}$ satisfy $\hat{e}(P^a,Q^b)=\hat{e}{(P,Q)}^{ab};$

2) Non-degenerate: there exists P, Q∈G, such that

3) Computability: There is an effective algorithm for can be calculated

then the mapping for a bilinear pairing.

(2) Lagrange interpolation formula

Given t points (x ₁ , y ₁ ), K, (x _t , y _t ), the following interpolation formula can be used to determine and uniquely determine a polynomial whose degree is less than t and the given t points are all on it :

$\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{\mathrm{<span\; class="notranslate">\; the\; y</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&NotEqual;</span>\mathrm{<span\; class="notranslate">\; i</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}\frac{\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; x</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; .</span>$

FIG. 1 is a system structure diagram of a cloud storage integrity detection method for recovering lost keys provided by an embodiment of the present invention.

Among them, the system parameter generation stage is executed by the parameter generation center to generate the public parameters required by the system

The key distribution center randomly selects a polynomial, and calculates the key s _i (i=1, 2, ..., n) and public key of each member U _i (i = 1, 2, ..., n) in the group Then distribute the key s _i (i=1, 2, ..., n) to each member U _i (i = 1, 2, ..., n) in the group, and disclose the public key of each member After each user U _i (i=1, 2, ..., n) in the group receives the key _si sent by the key distribution center, it verifies whether the received _si is correct.

The group member U _i divides the data file F to be uploaded to the cloud into n data blocks, that is, F=(m ₁ , . . . , m _n ). Then use his key _si to calculate the signature of data block m _i (i=1, 2, ..., n) Finally, send the data block (m ₁ , . . . , m _n ) and the signature Φ={σ _i } _1≤i≤n corresponding to the data block to the cloud, and delete the data block and its corresponding signature locally.

The audit center TPA randomly selects the sampling data that needs to be challenged, and sends the challenge chal to the cloud. The cloud generates audit proof proof according to the challenge chal sent by TPA and sends it to TPA. After TPA receives the proof from the cloud, TPA verifies the integrity of the cloud data block through the proof.

When the key of user U _x in the group is lost, he can reconstruct his own key s _x through the keys of other t+1 members in the group.

Fig. 2 is a schematic diagram of the system parameter generation stage of the cloud storage integrity detection method for recoverable lost keys provided by an embodiment of the present invention.

The system parameter generation stage is executed by the parameter generation center. The parameter generation center generates two multiplicative cyclic groups G ₁ , G ₂ (their order is a large prime number p), and a bilinear pairing: Among them, g, u are two independent generators in _G1 . Then choose a cryptographic hash function in Finally choose a prime q such that q|p-1, (q is the order of Z _p ^* ). All public parameters are The parameter generation center provides the key distribution center with the parameters to generate the public keys of each group member; provides the audit center with the parameters for generating the challenge and verification; and provides the group users with the parameters for generating the data block signature.

Fig. 3 is a schematic diagram of the key distribution stage of the identity-traceable shared data cloud audit method provided by the embodiment of the present invention.

In the key distribution phase, the key distribution center randomly selects a polynomial Calculate each member's key s _i =f(i), i=1, 2,..., n and public key Then, the broadcast commitment value g ^s , And send the key s _i (i=1, 2, ..., n) to each member U _i (i = 1, 2, ..., n) in the group, and disclose the public key of each member After receiving the key _si sent by the key distribution center, each user U _i (i=1, 2, ..., n) in the group verifies whether the key _si given to him by the key distribution center is correct. And each user stores a commitment value g ^s ,

Fig. 4 is a schematic diagram of the data upload and audit stages of the cloud storage integrity detection method for recoverable lost keys provided by an embodiment of the present invention.

In the data upload stage, the group member U _i divides the data file F to be uploaded to the cloud into n data blocks, that is, F=(m ₁ , . . . , m _n ). Then use his key _si to calculate the signature of data block m _i (i=1, 2, ..., n) Finally, send the data block (m ₁ , . . . , m _n ) and the signature Φ={σ _i } _1≤i≤n corresponding to the data block to the cloud, and delete the data block and its corresponding signature locally. In the audit stage, the audit center TPA selects a challenge chal={(i, v _i )} _i∈I and sends it to the cloud. After receiving the challenge, the cloud calculates the linear combination of the challenge data blocks and the aggregation of the signature, and then obtains proof= (σ, μ), sent to the audit center. After receiving the proof, the audit center verifies the integrity of the data stored in the cloud by verifying whether the verification equation holds.

Fig. 5 is a schematic diagram of a key recovery stage of a cloud storage integrity detection method for recovering a lost key provided by an embodiment of the present invention.

When the user U _x key of the group is lost, he can obtain t+1 blinded keys from t+1 members U _i (i=1, 2,...t+1) in the group, and then verify Are these blinded keys correct. If it is correct, perform reconstruction operation, and then recover its own key s _x .

Two, the concrete realization process of the present invention

1. System parameter generation stage: as shown in Figure 2, it is completed by the parameter generation center. The parameter generating center generates various system parameters.

The parameter generation center generates two multiplicative cyclic groups G ₁ , G ₂ (their order is a large prime number p), and a bilinear pairing: Among them, g, u are two independent generators in _G1 . Then choose a cryptographic hash function in Finally choose a prime q such that q|p-1, (q is the order of Z _p ^* ). Then all public parameters are

2. Key distribution stage: as shown in Figure 3, the key distribution center randomly selects a polynomial, calculates n shares {s _i } _1≤i≤n and distributes the shares to each member U _i (i =1, 2,..., n) as the key, and calculate and publish the public key of each member

(1) The key distribution center randomly selects a polynomial Calculate each member's key s _i =f(i), i=1, 2,..., n and public key

(2) The key distribution center broadcasts the commitment value g ^s , Send s _i (i=1, 2, ..., n) to each member U _i (i = 1, 2, ..., n) in the group, and disclose the public key of each member

(3) After each user U _i (i=1, 2, ..., n) in the group receives the key _si sent by the key distribution center, it verifies whether the following equation holds true:

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; the\; s</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; i</span>}}^{\mathrm{<span\; class="notranslate">\; j</span>}}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; p</span>}$

If the equation is established, it means that the user U _i believes that the key _si given to him by the key distribution center is correct. And each user stores g ^s ,

3. Data upload and audit stage: as shown in Figure 4.

When data is uploaded, the group members use their own keys to sign the data to be uploaded to the cloud, and the group members upload the data and the data block signature to the cloud together.

During data auditing, the audit center TPA randomly selects the sampling data that needs to be challenged, and sends the challenge chal to the cloud. The cloud generates audit proof proof according to the challenge chal sent by TPA and sends it to TPA. After receiving the proof from the cloud, TPA verifies whether the challenged data block is correct through the verification equation.

Data file upload:

(1) The group member U _i divides the data file F to be uploaded to the cloud into n data blocks, that is, F=(m ₁ , . . . , m _n ). Then use his key _si to calculate the signature of data block m _i (i=1, 2, ..., n) Finally, send the data block (m ₁ , . . . , m _n ) and the signature Φ={σ _i } _1≤i≤n corresponding to the data block to the cloud, and delete the data block and its corresponding signature locally.

Data file audit:

(2) Generate a challenge: the audit center TPA randomly selects a set I with c elements, and I∈[1,n], then generates a random element v _i ∈ Z _p , i∈I, and generates a challenge chal={( i, v _i )} _i∈I and send to the cloud.

(3) Proof generation: After receiving the challenge, the cloud divides the set I into n parts, that is, I={I ₁ ,...I _n }, where I _i represents the number of data blocks signed by user U _i in set I Set, I _i has c _i elements. F, I=I ₁ ∪K∪I _n and I _i ∩I _j =φ. Then, for each set I _j , the cloud computes a linear combination of data blocks and compute the aggregate of the signature Finally, (σ, μ) is sent to TPA as a proof, where σ={σ ₁ ,…,σ _n }, μ={μ ₁ , K, μ _n }.

(4) Proof verification: When TPA receives the proof proof, it verifies whether the following equations hold,

$\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; g</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}}\stackrel{<span\; class="notranslate">\; ^</span>}{\mathrm{<span\; class="notranslate">\; e</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; I</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}\mathrm{<span\; class="notranslate">\; h</span>}{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; u</span>}}^{{\mathrm{<span\; class="notranslate">\; \&mu;</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; ,</span>{\mathrm{<span\; class="notranslate">\; pk</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; .</span>$

When the equation is established, it means that the data stored in the cloud is correct; otherwise, it is considered that at least one data block is incorrect.

4. Key recovery stage: as shown in Figure 5, when the user U _x key of the group is lost, he can obtain t+1 keys from t+1 members in the group, perform reconstruction operations, and then restore himself The key s _x . Without loss of generality, assume that these t+1 members are U _i (i=1, 2, . . . , t+1).

(1) Group member U _i (i=1, 2, ..., t+1) randomly selects a polynomial To calculate u _ij =f _i (j) and u _ix =f _i (x), where j=1, 2, . . . , t+1. The committed value is then broadcast over a secure channel u _ix , (l=0,1,...,t), u _ij , (j=1, 2, . . . , t+1).

(2) After the user U _x whose key is lost receives the message u _ix broadcast by the user U _i (i=1, 2, . . . , t+1), then verify whether the following equation holds true.

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; x</span>}}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; o</span>}}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 0</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; x</span>}}^{\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; p</span>}<span\; class="notranslate">\; )</span>$

If the equation holds, the user U _x calculates

(3) After each member U _j (i=1, 2, ..., t+1) receives the message u _ij broadcast by other t users U _i (i = 1, 2, ..., t), then verify the following Whether the equality holds.

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; u</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; o</span>}}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; p</span>}<span\; class="notranslate">\; )</span>$

If the equation is established, the member U _j (i=1, 2,..., t+1) calculates That is, the key s _j is blinded, and then s _j ′ is broadcast through a secure channel.

(4) After the user U _x receives the message s _j ′ broadcast by the user U _j (j=1, 2, . . . , t+1), it verifies whether the following equation holds true.

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{{\mathrm{<span\; class="notranslate">\; the\; s</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; the\; s</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 0</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; j</span>}}^{\mathrm{<span\; class="notranslate">\; l</span>}}}<span\; class="notranslate">\; \&CenterDot;</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}^{\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\mathrm{<span\; class="notranslate">\; \&epsiv;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}\mathrm{<span\; class="notranslate">\; j</span>}}$

If the equality holds, user U _x computes his key in, $C_{Bj}x={\mathrm{\&Pi;}}_{i=\{1,2,...,t+1\}\backslash \left\{j\right\}}\frac{x-i}{j-i}.$

All of the above-mentioned primary implementations of this intellectual property rights are not intended to limit other forms of implementations of this new product and/or new method. Those skilled in the art will, with this important information, modify the above to achieve a similar implementation. However, all modifications or alterations to the new product based on the present invention belong to reserved rights.

The above is only a preferred embodiment of the present invention, and is not intended to limit the present invention to other forms. Any skilled person who is familiar with this profession may use the technical content disclosed above to change or remodel it into an equivalent change. Example. However, any simple modifications, equivalent changes and modifications made to the above embodiments according to the technical essence of the present invention without departing from the content of the technical solution of the present invention still belong to the protection scope of the technical solution of the present invention.

Claims (6)

1. A cloud storage integrity detection system capable of recovering lost keys is characterized in that: the system comprises a parameter generation center module, a cloud end module, a key distribution center module, a group member module and an auditing center module (TPA for short);

the parameter generation center module generates various system parameters, generates public and private keys for users, calculates audit parameters and the like;

the cloud module provides data storage and data sharing service for group members, and the data file F is divided into n data blocks { m₁，...，m_nStoreAt the cloud end;

the key distribution center module generates a key and a public key for each member in the group member module, distributes the key to each member and discloses the public key of each member;

the group member module includes data owners and other users (assuming that a group has n members U ═ U-₁，U₂，...，U_nThe data owner uploads the data file to the cloud end and shares the data file with other users in the group, and the other users can access the data without distinguishing the data;

and the audit center module is entrusted by a user to verify the integrity of the data stored in the cloud end module.

2. The method for detecting the integrity of the cloud storage with the recoverable lost key by using the system for detecting the integrity of the cloud storage with the recoverable lost key according to claim 1, comprises the following steps:

firstly, generating system parameters, namely generating various system parameters by adopting a parameter generation central module of the system;

secondly, key distribution is carried out, a polynomial is randomly selected by adopting a key distribution center module, and n shares { s ] are calculated_i}_1≤i≤nAnd distribute shares to individual members U of the population_i(i ═ 1, 2.. times, n) as a key, and a public key of each member is calculated and disclosed

And thirdly, data uploading and auditing, wherein the data uploading is that the group members sign data to be uploaded to a cloud module by using own keys, the group members upload the data and the data block signatures to the cloud together, the data auditing is that sampling data to be queried are randomly selected by an auditing center module and inquiry chal is sent to the cloud, the cloud module generates an auditing proof according to the inquiry chal sent by the auditing center module and sends the auditing proof to the auditing center module, and after the auditing center module receives the proof sent by the cloud, whether the queried data block is correct is verified through a verification equation.

Fourthly, recovering the key, and users U in the group_xWhen the key is lost, the user can reconstruct the key of other t +1 members in the group to recover the key s of the user_x。

3. The cloud storage integrity detection method of claim 2, wherein: the system parameter generation step is further embodied as that the parameter generation central module generates two multiplication cycle groups G₁，G₂(their order is all large prime p), and a bilinear pairing:wherein G, u are G₁Two independent generators. Then selecting a cryptographic hash functionWhereinFinally, the prime number q is chosen such that q | p-1, (q is Z_p ^*The step (d). Then the overall common parameter is

4. The cloud storage integrity detection method of claim 2 or 2, wherein: the key distribution step further specifically comprises,

step a, the key distribution center module randomly selects a polynomial Calculating the secret key s of each member_iF (i), i 1, 2, n and a public key

Step b, the key distribution center module broadcasts the commitment value g^s，Handle s_i(i 1, 2.., n) to each member U in the group_i(i ═ 1, 2.. times, n), and discloses the public keys of the individual members

Step c, each user U in the group_i(i 1, 2.. n.) receiving the key s sent by the key distribution center module_iThen, it is verified whether the following equation holds:

<math> <mrow> <msup> <mi>g</mi> <msub> <mi>s</mi> <mi>i</mi> </msub> </msup> <mo>=</mo> <msup> <mi>g</mi> <mi>s</mi> </msup> <msubsup> <mo>&Pi;</mo> <mrow> <mi>j</mi> <mo>=</mo> <mn>1</mn> </mrow> <mi>t</mi> </msubsup> <msup> <mrow> <mo>(</mo> <msup> <mi>g</mi> <msub> <mi>a</mi> <mi>j</mi> </msub> </msup> <mo>)</mo> </mrow> <msup> <mi>i</mi> <mi>j</mi> </msup> </msup> <mi>mod</mi> <mi> </mi> <mi>p</mi> </mrow> </math>

if the equation is true, the user U is stated_iBelieving the key s given to him by the key distribution center module_iIs correct. And each user stores a commitment value g^s，

5. The cloud storage integrity detection method of claims 2 to 4, wherein: the data uploading and auditing steps further include,

step a, uploading data files and making group members U_iThe data file F to be uploaded to the cloud module is divided into n data blocks, i.e. F ═ m₁，...，m_n). Then uses his key s_iCalculating a data block m_iA signature of (i ═ 1, 2.., n)Finally, the data block (m)₁，...，m_n) Signature Φ ═ σ corresponding to data block_i}_1≤i≤nSending the data block to a cloud module, and locally deleting the data block and a signature corresponding to the data block;

step b, auditing the data file,

(b1) generating a challenge: the audit center module randomly selects a set I with c elements, and the I belongs to [1, n ]]Then generating a random element v_i∈Z_pI belongs to I, generates challenge chal { (I, v)_i)}_i∈IAnd sending to the cloud;

(b2) proof of generation: after the cloud module receives the inquiry, the set I is divided into n parts, namely I ═ I₁，...I_nIn which I_iRepresented in set I by user U_iSet of signed data blocks, I_iIn is c_iAnd (4) each element. So that the method has the advantages that,I＝I₁∪K∪I_nand I_i∩I_jPhi is given. Then, for each set I_jCloud module computing linear combinations of data blocksAnd compute aggregations of signaturesFinally, (sigma, mu) is sent to the audit center module as proof, wherein sigma is { sigma ═ sigma₁，...，σ_n}，μ＝{μ₁，K，μ_n}；

(b3) And (3) proving and verifying: after the audit center module receives the proof, whether the following equation is established or not is verified,

<math> <mrow> <mover> <mi>e</mi> <mo>^</mo> </mover> <mrow> <mo>(</mo> <msubsup> <mo>&Pi;</mo> <mrow> <mi>j</mi> <mo>=</mo> <mn>1</mn> </mrow> <mi>n</mi> </msubsup> <msub> <mi>&sigma;</mi> <mi>j</mi> </msub> <mo>,</mo> <mi>g</mi> <mo>)</mo> </mrow> <mo>=</mo> <msubsup> <mo>&Pi;</mo> <mrow> <mi>j</mi> <mo>=</mo> <mn>1</mn> </mrow> <mi>n</mi> </msubsup> <mover> <mi>e</mi> <mo>^</mo> </mover> <mrow> <mo>(</mo> <msub> <mo>&Pi;</mo> <mrow> <mi>i</mi> <mo>&Element;</mo> <msub> <mi>I</mi> <mi>j</mi> </msub> </mrow> </msub> <mi>H</mi> <msup> <mrow> <mo>(</mo> <mi>i</mi> <mo>)</mo> </mrow> <msub> <mi>v</mi> <mi>i</mi> </msub> </msup> <mo>&CenterDot;</mo> <msup> <mi>u</mi> <msub> <mi>&mu;</mi> <mi>j</mi> </msub> </msup> <mo>,</mo> <msub> <mi>pk</mi> <mi>j</mi> </msub> <mo>)</mo> </mrow> <mo>.</mo> </mrow> </math>

when the equation is established, the data stored by the cloud module is correct; otherwise, at least one of the data blocks is deemed incorrect.

6. The cloud storage integrity detection method of claims 2 to 5, wherein: the key recovery step further comprises the step of,

user U of current group_xWhen the key is lost, the user can obtain t +1 keys from t +1 members in the group to reconstruct the key s_x. Without loss of generality, assume that the t +1 members are U_i(i＝1，2，...，t+1)；

Group member U_i(i 1, 2.., t +1) randomly selecting a polynomialTo calculate u_ij＝f_i(j) And u_ix＝f_i(x) Wherein j is 1, 2. The commitment value is then broadcast over a secure channel <math> <mrow> <msub> <mi>&epsiv;</mi> <mrow> <mi>i</mi> <mi>x</mi> </mrow> </msub> <mo>=</mo> <msup> <mi>g</mi> <msub> <mi>u</mi> <mrow> <mi>i</mi> <mi>x</mi> </mrow> </msub> </msup> <mo>,</mo> <msub> <mi>u</mi> <mrow> <mi>i</mi> <mi>x</mi> </mrow> </msub> <mo>,</mo> <msup> <mi>g</mi> <msub> <mi>a</mi> <mrow> <mi>i</mi> <mi>l</mi> </mrow> </msub> </msup> <mo>,</mo> <mrow> <mo>(</mo> <mi>l</mi> <mo>=</mo> <mn>0</mn> <mo>,</mo> <mn>1</mn> <mo>,</mo> <mo>...</mo> <mo>,</mo> <mi>t</mi> <mo>)</mo> </mrow> <mo>,</mo> <msub> <mi>&epsiv;</mi> <mrow> <mi>i</mi> <mi>j</mi> </mrow> </msub> <mo>=</mo> <msup> <mi>g</mi> <msub> <mi>u</mi> <mrow> <mi>i</mi> <mi>j</mi> </mrow> </msub> </msup> <mo>,</mo> <msub> <mi>u</mi> <mrow> <mi>i</mi> <mi>j</mi> </mrow> </msub> <mo>,</mo> <mrow> <mo>(</mo> <mi>j</mi> <mo>=</mo> <mn>1</mn> <mo>,</mo> <mn>2</mn> <mo>,</mo> <mo>...</mo> <mo>,</mo> <mi>t</mi> <mo>+</mo> <mn>1</mn> <mo>)</mo> </mrow> <mo>;</mo> </mrow> </math>

User U when key is lost_xReceiving user U_i(i 1, 2.. t +1) broadcast message u_ixAfter that, it is verified whether the following equation is established,

<math> <mrow> <msup> <mi>g</mi> <msub> <mi>u</mi> <mrow> <mi>i</mi> <mi>x</mi> </mrow> </msub> </msup> <mo>=</mo> <msup> <mi>g</mi> <msub> <mi>a</mi> <mrow> <mi>i</mi> <mi>o</mi> </mrow> </msub> </msup> <msubsup> <mo>&Pi;</mo> <mrow> <mi>l</mi> <mo>=</mo> <mn>0</mn> </mrow> <mi>t</mi> </msubsup> <msup> <mrow> <mo>(</mo> <msup> <mi>g</mi> <msub> <mi>a</mi> <mrow> <mi>i</mi> <mi>l</mi> </mrow> </msub> </msup> <mo>)</mo> </mrow> <msup> <mi>x</mi> <mi>l</mi> </msup> </msup> <mrow> <mo>(</mo> <mi>mod</mi> <mi> </mi> <mi>p</mi> <mo>)</mo> </mrow> </mrow> </math>

if the equation is true, the user U_xComputing

Member U_j(j 1, 2.. t +1) receiving message u broadcast by other t users_ijAfter that, the air conditioner is started to work,it is then verified whether the following equation holds,

<math> <mrow> <msup> <mi>g</mi> <msub> <mi>u</mi> <mrow> <mi>i</mi> <mi>j</mi> </mrow> </msub> </msup> <mo>=</mo> <msup> <mi>g</mi> <msub> <mi>a</mi> <mrow> <mi>i</mi> <mi>o</mi> </mrow> </msub> </msup> <msubsup> <mo>&Pi;</mo> <mrow> <mi>l</mi> <mo>=</mo> <mn>1</mn> </mrow> <mi>t</mi> </msubsup> <msup> <mrow> <mo>(</mo> <msup> <mi>g</mi> <msub> <mi>a</mi> <mrow> <mi>i</mi> <mi>l</mi> </mrow> </msub> </msup> <mo>)</mo> </mrow> <msup> <mi>j</mi> <mi>l</mi> </msup> </msup> <mrow> <mo>(</mo> <mi>mod</mi> <mi> </mi> <mi>p</mi> <mo>)</mo> </mrow> </mrow> </math>

if the equation is true, then member U_j(j ═ 1, 2.., t +1) calculationI.e. the pair key s_jBlinded and then broadcast s over a secure channel_j′；

User U_xReceiving user U_j(j ═ 1, 2.. gtt +1) broadcasted message s_jAfter that, it is verified whether the following equation is true,

<math> <mrow> <msup> <mi>g</mi> <msubsup> <mi>s</mi> <mi>j</mi> <mo>&prime;</mo> </msubsup> </msup> <mo>=</mo> <msup> <mi>g</mi> <mi>s</mi> </msup> <msubsup> <mo>&Pi;</mo> <mrow> <mi>l</mi> <mo>=</mo> <mn>1</mn> </mrow> <mi>t</mi> </msubsup> <msup> <mrow> <mo>(</mo> <msup> <mi>g</mi> <msub> <mi>a</mi> <mrow> <mi>i</mi> <mi>l</mi> </mrow> </msub> </msup> <mo>)</mo> </mrow> <msup> <mi>j</mi> <mi>l</mi> </msup> </msup> <mo>&CenterDot;</mo> <msubsup> <mo>&Pi;</mo> <mrow> <mi>i</mi> <mo>=</mo> <mn>1</mn> </mrow> <mrow> <mi>t</mi> <mo>+</mo> <mn>1</mn> </mrow> </msubsup> <msub> <mi>&epsiv;</mi> <mrow> <mi>i</mi> <mi>j</mi> </mrow> </msub> </mrow> </math>

if the equation is true, the user U_xCalculate his keyWherein, <math> <mrow> <msub> <mi>C</mi> <mrow> <mi>B</mi> <mi>j</mi> </mrow> </msub> <mi>x</mi> <mo>=</mo> <msub> <mo>&Pi;</mo> <mrow> <mi>i</mi> <mo>=</mo> <mo>{</mo> <mn>1</mn> <mo>,</mo> <mn>2</mn> <mo>,</mo> <mo>...</mo> <mo>,</mo> <mi>t</mi> <mo>+</mo> <mn>1</mn> <mo>}</mo> <mo>\</mo> <mo>{</mo> <mi>j</mi> <mo>}</mo> </mrow> </msub> <mfrac> <mrow> <mi>x</mi> <mo>-</mo> <mi>i</mi> </mrow> <mrow> <mi>j</mi> <mo>-</mo> <mi>i</mi> </mrow> </mfrac> <mo>.</mo> </mrow> </math>