CN106301789A - Apply the dynamic verification method of the cloud storage data that linear homomorphism based on lattice signs - Google Patents

Abstract

The invention discloses a dynamic verification method for cloud storage data using a lattice-based linear homomorphic signature, including data integrity verification: generating a public key and a private key of a linear homomorphic signature algorithm on a lattice; dividing a file into multiple Each data block is signed, and then the value of the root node is calculated based on the Merkle hash tree, and the value of the root node is signed, and the data block, the signature of the data block and the signature of the root node are sent to the cloud. server; provide the public key and the identifier of the file to the third-party audit, and the third-party audit initiates a challenge to the cloud server to verify whether the data block has changed; the cloud server provides corresponding proof according to the challenge initiated by the third-party audit; The proof provided by the server judges whether the data block is complete, and feedbacks the verification result to the user. The invention can resist quantum attacks initiated by quantum computers in the future, and supports cloud dynamic operation verification while ensuring user private information.

Description

A dynamic verification method for cloud storage data using lattice-based linear homomorphic signatures

technical field

The invention relates to the field of encryption technology, in particular to a dynamic verification method for cloud storage data using a lattice-based linear homomorphic signature.

Background technique

Cloud storage is a basic service of cloud computing. Cloud storage providers provide users with a large amount of storage space, and users can access cloud data anytime and anywhere. While providing convenience for users, it also brings new security risks. After the user uploads the local data to the cloud server, he loses direct control over the data. Malicious cloud service providers may spy on or tamper with the user's data out of curiosity or other unknown purposes. Therefore, the integrity and availability of cloud data become Problems to be solved. Cloud authentication protocols based on traditional cryptographic schemes generally specify the intractability of a difficult problem, for example, authentication protocols based on the RSA signature algorithm, and authentication protocols based on the bilinear mapping of the Diffie-Hellman difficult problem. With the development of science and technology, the advent of quantum computers has become possible. Quantum computers can solve the above difficult problems in polynomial time, so that data verification protocols based on traditional cryptographic schemes will no longer be secure.

According to the current research results, there is no effective cracking algorithm for the lattice-hard problem. The cryptographic scheme based on the lattice-hard problem is an important direction of the current cryptosystem research. According to the definition of lattice in the literature, the lattice-based verification protocol It has the following advantages: the lattice is an additive commutative group in algebra, and most lattice encryption schemes use integer lattices, and the efficiency of linear operations on lattices is greatly improved compared with exponential operations; there are ready-made protocol proofs for difficult problems based on lattices, Guarantee the security of the grid password. As a standard digital signature scheme, the signature scheme designed by Gentry, Peikert and Vaikuntanathan (hereinafter referred to as GPV signature) has become the basic tool of many lattice public key cryptographic algorithms. F.Wang used GPV signatures to build a lattice-based linear homomorphic signature scheme (LHS) on binary domains, and H.Liu proposed a cloud storage public verification scheme based on LHS. However, this solution does not support dynamic data verification. In cloud storage verification, since files or data are often inserted, modified or deleted, dynamic data verification is particularly important.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies of the prior art, to provide a dynamic verification method for cloud storage data using lattice-based linear homomorphic signatures, using lattice-based linear homomorphic signatures, Merkle hash trees and random oracles Based on the safe and anti-collision hash function under the model, a new dynamic verification method for cloud storage data is constructed.

The object of the present invention is achieved through the following technical solutions: the dynamic verification method of cloud storage data based on lattice-based linear homomorphic signatures, including data integrity verification, and the data integrity verification includes:

Key generation: use the trapdoor base generation algorithm on the lattice to generate the public key and private key of the linear homomorphic signature algorithm on the lattice;

Data block signature: Divide the file into multiple data blocks, use the linear homomorphic signature algorithm on the lattice to sign each data block, and then calculate the value of the root node based on the Merkle hash tree, and calculate the value of the root node Signature, and finally send the data block, the signature of the data block and the signature of the root node to the cloud server;

Third-party challenge: provide the public key and file identifier to the third-party audit, and the third-party audit challenges the cloud server to verify whether the data blocks in the cloud server have changed;

Server certification: the cloud server provides corresponding certification according to the challenge initiated by the third-party audit;

Third-party verification: The third-party audit judges whether the data blocks in the cloud server are complete according to the certificate provided by the cloud server, and feeds back the verification result to the user.

The key is generated in the following way:

(pk,sk)←TrapGen(1 ⁿ )

$\mathrm{<span\; class="notranslate">\; p</span>}\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; Z</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; *</span>\mathrm{<span\; class="notranslate">\; m</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; the\; s</span>}\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; T</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; Z</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; *</span>\mathrm{<span\; class="notranslate">\; m</span>}}$

In the formula, TrqpGen(1 ⁿ ) is the trapdoor basis generation algorithm on the lattice, pk is the public key, sk is the private key, It is a group composed of m*m integer matrices in base q.

The data block signature includes:

Divide the file F into l data blocks, F={u ₁ ,u ₂ ,…,u _l }, where is a group composed of m-dimensional column vectors;

Calculation coefficient 1≤j≤n, where id is the identifier of file F, and j represents the jth data block, is the anti-collision security hash function under the random oracle model, and n represents the system security parameter;

Calculate the inner product of the coefficient α _j with each data block Let the inner product vector V _i =(V _i1 ,V _i2 ,...,V _in ) ^T , 1≤i≤l, 1≤j≤n;

Call SamplePre(A,T,σ,V _i ) to generate the signature e _i of the data block, 1≤i≤l, let the signature set Φ={e ₁ ,e ₂ ,…,e _l },

Construct a Merkle hash tree based on the signature set Φ. The leaf nodes of the Merkle hash tree are arranged in a preset order by signature e _i ; the values of non-leaf nodes are determined by their child nodes using a collision-resistant hash function Obtain and calculate the value h _R of the root node; use the SamplePre(A,T,σ,h _R ) algorithm to sign the value h _R of the root node, and obtain the signature Sig(h _R ) of the value of the root node;

The user sends {F,Φ,id,Sig(h _R )} to the cloud server CSP, and deletes the file F, signature set Φ and signature Sig(h _R ) locally.

The data block signature also includes using SamplePre(A, T, σ, id) to sign the identifier id of the file F.

The third-party challenges described include:

The user sends the audit request AuditQuest=(Sig(id)||id) to the third-party audit, where Sig(id) represents the signature on the identifier id;

After the third-party audit receives the audit request AuditQuest=(Sig(id)||id), it verifies the signature Sig(id). If the signature Sig(id) is established, the third-party audit selects a subset arbitrarily As the subscript set of the data to be sampled, where [l]={1,2,…,l}, S ₁ ≤S ₂ ≤…≤S _θ ; definition challenge chal={id,ci , _i } _i∈I , ci _∈ Z _q , where ci is a random coefficient selected arbitrarily by the third-party audit, and the challenge chal={id, _{ci ,i} i∈I is sent} to the cloud server.

Said server certificates include:

After the cloud server receives the challenge chal={id,c _i ,i} _i∈I from the third-party audit, take the matrix B=(α ₁ ,α ₂ ,…,α _n ), α _j =H ₂ (id ||j), 1≤j≤n; define BC ^T ＝0(modq), calculated by the cloud server Cloud server randomly selected Calculate u _i ′=C ^T p _i +u _i , 1≤i≤l;

The cloud server calculates the aggregated data of sampled data blocks according to chal={id,c _i ,i} _i∈I :

Cloud server will prove Send to a third-party audit, where Ω _i is the auxiliary information composed of sibling nodes from the i-th leaf node to the root node.

Said third-party verification includes:

Third-party audit received proof from cloud server after, according to Obtain the value h′ _R of the root node, judge A·Sig(h _R )=h′ _R and Are both established:

If it is not established, it means that the cloud server has incomplete data blocks, and returns 0;

If it holds, then calculate the coefficient calculate Let V _com ＝(V _com,1 ,V _com.2 ,...V _com,n ) ^T ; According to the linear property of BLS signature, aggregate signature Verify that Ae _com = V _com (mod q) and Whether all are true, if true, it means that the sampled data block is complete, and return 1; otherwise, it means that the sampled data block is incomplete, and return 0.

The dynamic verification method also includes modifying data:

The user will modify the data block Use the lattice-based linear homomorphic signature algorithm to find the corresponding signature order update information and will update the information sent to the cloud server;

The cloud server executes the polynomial time algorithm ExeUpdate(F,Φ,Update), and the cloud server modifies the data block according to The subscript i of the to-be-modified data block u _i is replaced by the modified data block The signature e _i is replaced by get file signature collection Calculate the value of the new root node according to the signature set Φ ^* Cloud server will prove sent to the user;

According to (Ω _i , e _i ), the user obtains the value h′ _R corresponding to the root node of the Merkle hash tree MTH, and judges that A·Sig(h _R )=h′ _R and Whether they are all true, if A·Sig(h _R )≠h′ _R , it means that the data block before modifying the data is incomplete; if it is true, the user will and (Ω _i , e _i ) to find the value h _R of the root node, if Then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification. After the data integrity verification is successful, the local modified data block sign P _Update and Sig(h _R ) delete.

The dynamic validation method also includes inserting data:

The user uses the lattice-based linear homomorphic signature algorithm to obtain the signature e ^*' of the inserted data block ^* ', and sends the update information Update={I,i,u ^*' ,e ^*' } to the cloud server;

The cloud server executes the polynomial time algorithm ExeUpdate(F,Φ,Update), stores the inserted data block u ^*' in the cloud server, puts the signature e ^*' after the signature e _i , and obtains the file signature collection Calculate the value of the new root node The cloud server will sent to the user;

The user obtains the value h″ _R of the root node of the Merkle hash tree according to (Ω _i , e _i ), and judges that A·Sig(h _R )=h″ _R and Whether they are all true, if A·Sig(h _R )≠h″ _R , it means that the data block before inserting the data is incomplete; if it is true, the user can find the root node according to the signature e ^*' and (Ω _i ,e _i ) value of h _R , if Then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification. After the data integrity verification is successful, the local block is inserted into the data block u ^*' , signature e ^*' , P _Update , and Sig(h _R ) delete.

The dynamic verification method also includes deleting data:

The user sends update information Update={D,i} to the cloud server, and the cloud server executes the polynomial time algorithm ExeUpdate(F,Φ,Update), deletes the data block u _i and its signature e _i stored on the cloud server, and obtains the file F＝{u ₁ ,u ₂ ,…,u _i-1 ,u _i+1 ,…,u _l }, signature set Φ ^*” ＝{e ₁ ,e ₂ ,…,e _i-1 ,e _{i+ 1} ,…,e _l }, calculate the value of the new root node The cloud server will sent to the user;

The user obtains the value h″′ _R of the root node of the Merkle hash tree according to (Ω _i , e _i ), and judges that A·Sig(h _R )=h″′ _R and Whether they are all true, if A·Sig(h _R )≠h″′ _R , it means that the data block before deleting the data is incomplete; if it is true, the user can find the value h _R of the root node according to Ω _i , if Then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification. After the data integrity verification is successful, the local P _Update and Sig (h _R ) Deleted.

The beneficial effects of the present invention are:

(1) In the present invention, the grid-based linear homomorphic signature ensures that it can resist quantum attacks initiated by future quantum computers, and the anti-collision hash function ensures the unforgeability of user data, and the linear operation on the grid ensures that the calculation efficiency is higher than the traditional exponential The operation has been greatly improved;

(2) The present invention supports cloud dynamic operation verification, such as modification, insertion, and deletion of files or data;

(3) Support public auditing, while using third-party auditing for verification, it can also achieve the purpose of privacy protection.

Description of drawings

Fig. 1 is a framework schematic diagram of the present invention;

Fig. 2 is a schematic flow chart of an embodiment of data integrity verification in the present invention;

Fig. 3 is a schematic diagram of an embodiment of modifying data in the present invention;

Fig. 4 is a schematic diagram of an embodiment of inserting data in the present invention;

Fig. 5 is a schematic diagram of an embodiment of deleting data in the present invention.

detailed description

The technical solution of the present invention will be further described in detail below in conjunction with the accompanying drawings, but the protection scope of the present invention is not limited to the following description.

As shown in Figure 1, the user uploads data to the cloud server. Due to the limitations of the user's software and hardware facilities, time, and computing power, it is impossible to verify the integrity of the data uploaded to the cloud server anytime and anywhere. Three-party audit (Third Party Auditor, TPA) to complete the verification. The user sends a data integrity audit request to the third-party audit, and the third-party audit sends a challenge to the cloud server (CSP) to verify instead of the user according to the user's request, and finally feeds back the verification result to the user.

Embodiment one

As shown in Figure 2, the dynamic verification method of cloud storage data based on lattice-based linear homomorphic signature includes data integrity verification, and the data integrity verification includes:

S01. Key generation: use the trapdoor base generation algorithm on the lattice to generate the public key and private key of the linear homomorphic signature algorithm on the lattice.

The keys are generated in the following way:

(pk,sk)←TrapGen(1 ⁿ )

$\mathrm{<span\; class="notranslate">\; p</span>}\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; A</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; Z</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}^{\mathrm{<span\; class="notranslate">\; no</span>}<span\; class="notranslate">\; *</span>\mathrm{<span\; class="notranslate">\; m</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; the\; s</span>}\mathrm{<span\; class="notranslate">\; k</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; T</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; Z</span>}}_{\mathrm{<span\; class="notranslate">\; q</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; *</span>\mathrm{<span\; class="notranslate">\; m</span>}}$

In the formula, TrqpGen(1 ⁿ ) is the trapdoor basis generation algorithm on the lattice, pk is the public key, sk is the private key, It is a group composed of m*m integer matrices in base q. Matrix A is randomly obtained from this group and obeys uniform distribution. The setting of is not clearly specified, as long as it is m*m dimensional, and each element is an integer modulo q.

S02. Data block signature: Divide the file into multiple data blocks, use the linear homomorphic signature algorithm on the grid to sign each data block, and then calculate the value of the root node based on the Merkle hash tree, and the root node value signature, and finally send the data block, the signature of the data block and the signature of the root node to the cloud server.

The data block signature includes:

S021. Divide the file F into l data blocks, F={u ₁ ,u ₂ ,…,u _l }, where is a group composed of m-dimensional column vectors, and the value of each element is obtained by integer modulo q.

S022. Calculation coefficient 1≤j≤n, where id is the identifier of file F, and j represents the jth data block, is the anti-collision security hash function under the random oracle model, and n represents the system security parameter.

S023. Calculate the inner product of the coefficient α _j and each data block Let the inner product vector V _i =(V _i1 , V _i2 ,...,V _in ) ^T , 1≤i≤l, 1≤j≤n.

S024. Call SamplePre(A,T,σ,V _i ) to generate the signature e _i of the data block, 1≤i≤l, let the signature set Φ={e ₁ ,e ₂ ,...,e _l }, Sample Pre(A,T,σ,V _i ) is a sampling algorithm on the lattice. The lattice-based encryption schemes are all based on the LWE-learning with errors problem, and the error amount of the LWE problem is generally obtained from Gaussian discrete sampling.

S025. Construct a Merkle hash tree (MHT) according to the signature set Φ. The leaf nodes of the Merkle hash tree are arranged in a preset order by signature e _i ; the values of non-leaf nodes are used by their child nodes to use anti-collision hash function Obtain and calculate the value h _R of the root node; use the SamplePre(A,T,σ,h _R ) algorithm to sign the value h _R of the root node, and obtain the signature Sig(h _R ) of the root node value.

S026. The user sends {F,Φ,id,Sig(h _R )} to the cloud server CSP, and deletes the file F, signature set Φ and signature Sig(h _R ) locally.

The data block signature also includes using SamplePre(A, T, σ, id) to sign the identifier id of the file F, and the signature algorithm uses SamplePre(A, T, σ, id) to inform the first party when a third party challenges The three-party audit request comes from which user and the file to be verified.

S03. Third-party challenge: provide the public key and file identifier to the third-party audit, and the third-party audit initiates a challenge to the cloud server to verify whether the data blocks in the cloud server have changed.

Described third-party challenge comprises: user audit request AuditQuest=(Sig(id)||id) (AuditQuest is the audit request that user sends third-party audit, and content comprises the id of the file to be audited and the signature to id; The id is re-signed to tell the third-party audit that the audit request comes from a specific user. The third-party audit has the public key of user X. If the signature verification of id fails, it means that the request does not come from user X, and the request will not be accepted. This is to prevent other users from impersonating user X) to send to the third-party audit, where Sig(id) represents the signature on the identifier id; after the third-party audit receives the audit request AuditQuest=(Sig(id)||id), it will The signature Sig(id) is verified. If the signature Sig(id) is not valid, the third-party audit will not accept the request and requires the user to resend it; if the signature Sig(id) is valid, the third-party audit will select a subset arbitrarily As the subscript set of the data to be sampled, where [l]={1,2,…,l}, S ₁ ≤S ₂ ≤…≤S _θ ; definition challenge chal={id,ci , _i } _i∈I , c _i ∈ Z _q , where c _i is a random coefficient selected arbitrarily by the third-party audit to ensure that the cloud server will not forge the certificate, and send the challenge chal={id,ci , _i } _i∈I to the cloud server, requiring The cloud server gives the corresponding proof.

S04. Server certification: The cloud server provides corresponding certification according to the challenge initiated by the third-party audit.

The server proof includes: after the cloud server receives the challenge chal={id,ci, _i } _i∈I from the third-party audit, take the matrix B=(α ₁ ,α ₂ ,…,α _n ), α _j ＝H ₂ (id||j), 1≤j≤n; define BC ^T ＝0(modq), calculated by the cloud server Cloud server randomly selected Calculate u _i ′=C ^T p _i +u _i , 1≤i≤l, this is done in order not to disclose any information about data block u _i to the third party audit; the purpose of defining BC ^T =0 is to determine through B The matrix C that is orthogonal to it, and then process u _i ′=C ^T p _i +u _i , middle, It is a group composed of n-dimensional column vectors obtained by integer modulo q. p _i is randomly selected from this group, and the purpose is to use it as a coefficient to increase the security of u _i ′. Since p _i is obtained completely randomly, third-party audit It is impossible to get any information about u _i from u _i ′, ensuring that user data will not be stolen by a third-party audit.

The cloud server calculates the aggregated data of sampled data blocks according to chal={id,c _i ,i} _i∈I :

Cloud server will prove Send to a third-party audit, where Ω _i is the auxiliary information composed of sibling nodes from the i-th leaf node to the root node.

S05. Third-party verification: the third-party audit judges whether the data block in the cloud server is complete according to the certificate provided by the cloud server, and feeds back the verification result to the user.

The third-party verification includes: the third-party audit receives the certificate from the cloud server after, according to Obtain the value h′ _R of the root node, judge A·Sig(h _R )=h′ _R and Whether all are established: (here to verify whether the signature of the root node is correct, the purpose is to judge whether the received proof proof information is wrong, if the signature of the root node is correct, A·Sig(h _R )=h′ _R , is established, then the calculation of h′ _R is correct, thus proving that Ω _i and Sig(h _R ) in Proof are correct)

If it is not established, it means that the cloud server has incomplete data blocks, and returns 0;

If it holds, then calculate the coefficient calculate Let V _com ＝(V _com,1 ,V _com.2 ,…V _c o _m,n ) ^T ; According to the linear property of BLS signature, aggregate signature Verify that Ae _com = V _com (mod q) and Whether all are true, if true, it means that the sampled data block is complete, and return 1; otherwise, it means that the sampled data block is incomplete, and return 0. The verification here is to prove the integrity of the aggregated data U _com of the sampled data block.

Among them, e _i is the value of the leaf node of the Merkle hash tree, Ω _i is the auxiliary information from the i-th leaf node to the root node, which is composed of the sibling nodes of the i-th leaf node and the sibling nodes of the parent node (simplified In other words, the information until the root node can be obtained is auxiliary information).

BLS: It is the abbreviation of a signature, full name: Lattice-based Linear Signature, the aggregated data formed by the linear combination of the original data blocks; the signature of this aggregated data is my acquisition method: because the signature is linearly homomorphic, then the aggregated data The signature can then be a linear combination of the signatures of the original data block.

V _com,j ＝h _αj (u _com )＝＜α _j ,u _com ＞ means Inner product with α _j , the subscript com is derived from U _com , indicating that it is obtained from the aggregation of sampled data blocks (actually a linear combination), and the corresponding subscript uses V _com,j .

Embodiment two

On the basis of Embodiment 1, in this embodiment, the dynamic verification method also includes modifying data: M represents the request information for data modification, and the user wants to modify the data block u _i to As an example, the user will modify the data block Use the lattice-based linear homomorphic signature algorithm to find the corresponding signature order update information and will update the information sent to the cloud server;

The cloud server executes the polynomial time algorithm ExeUpdate(F,Φ,Update), and the cloud server modifies the data block according to The subscript i of the to-be-modified data block u _i is replaced by the modified data block The signature e _i is replaced by get file signature collection Calculate the value of the new root node according to the signature set Φ ^* As shown in Figure 3, the cloud server will prove Sent to the user; P _Update is the proof that the data sent by the cloud server to the verifier is updated correctly, that is, the abbreviation of Proof of updating, the purpose is to distinguish it from Proof.

According to (Ω _i , e _i ), the user obtains the value h′ _R corresponding to the root node of the Merkle hash tree MTH, and judges that A·Sig(h _R )=h′ _R and Whether they are all true, if A·Sig(h _R )≠h′ _R , it means that the data block before modifying the data is incomplete; if it is true, the user will and (Ω _i , e _i ) to find the value h _R of the root node, if It means that the cloud server has performed data update operations according to the user's requirements, then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification, and the data After the integrity verification is successful, the local modified data block sign P _Update and Sig(h _R ) delete.

In Figure 3, change the value of the third data block and calculate in turn h _a =H ₁ (h _c ||h _d ), so

Embodiment three

On the basis of Embodiment 1, in this embodiment, the dynamic verification method also includes modifying data: I represents the request information for data insertion, and the user adds data block u ^*' after the i-th data block as an example .

The dynamic verification method also includes inserting data: the user uses a lattice-based linear homomorphic signature algorithm to obtain the signature e ^*' of the inserted data block u ^* ', and updates the update information Update={I, i, u ^*' , e ^{* '} }Sent to the cloud server;

The cloud server executes the polynomial time algorithm ExeUpdate(F,Φ,Update), stores the inserted data block u ^*' in the cloud server, puts the signature e ^*' after the signature e _i , and obtains the file signature collection Calculate the value of the new root node (as shown in Figure 4); the cloud server will sent to the user;

The user obtains the value h″ _R of the root node of the Merkle hash tree according to (Ω _i , e _i ), and judges that A·Sig(h _R )=h″ _R and Whether they are all true, if A·Sig(h _R )≠h″ _R , it means that the data block before inserting the data is incomplete; if it is true, the user can find the root node according to the signature e ^*' and (Ω _i ,e _i ) value of h _R , if It means that the cloud server has performed the data insertion operation according to the user's request, then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification. After the data integrity verification is successful, the local block is inserted into the data block u ^*' , signature e ^*' , P _Update and Sig(h _R ) is deleted.

In Figure 4, a new data block e ^*' is entered and exited at the fourth node, then the node h _g =H ₁ (e ₄ ||e ^*' ), calculated in turn, to obtain

Embodiment four

On the basis of Embodiment 1, in this embodiment, the dynamic verification method further includes modifying data: D represents request information for data deletion.

The dynamic verification method also includes deleting data: the user sends update information Update={D, i} to the cloud server, and the cloud server executes the polynomial time algorithm ExeUpdate(F, Φ, Update), and stores the data block u on the cloud server _i and its signature e _i are deleted, and the file F＝{u ₁ ,u ₂ ,…,u _i-1 ,u _i+1 ,…,u _l } is obtained, and the signature set Φ ^*" ＝{e ₁ ,e ₂ , ...,e _i-1 ,e _i+1 ,...,e _l }, calculate the value of the new root node (As shown in Figure 5), the cloud server will sent to the user.

The user obtains the value h″′ _R of the root node of the Merkle hash tree according to (Ω _i , e _i ), and judges that A·Sig(h _R )=h″′ _R and Whether they are all true, if A·Sig(h _R )≠h″′ _R , it means that the data block before deleting the data is incomplete; if it is true, the user can find the value h _R of the root node according to Ω _i , if It means that the cloud server has performed the data deletion operation according to the user's request, then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification. After the data integrity verification succeeds, the local P _Update and Sig(h _R ) are deleted.

In the figure, to delete the third data block, it only needs to take h _d =e ₄ .

The above descriptions are only preferred embodiments of the present invention, and it should be understood that the present invention is not limited to the forms disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications and environments, and Modifications can be made within the scope of the ideas described herein, by virtue of the above teachings or skill or knowledge in the relevant art. However, changes and changes made by those skilled in the art do not depart from the spirit and scope of the present invention, and should all be within the protection scope of the appended claims of the present invention.

Claims (10)

1. Apply the dynamic verification method of the cloud storage data based on the linear homomorphic signature of lattice, it is characterized in that, comprise data integrity verification, described data integrity verification comprises: Key generation: use the trapdoor base generation algorithm on the lattice to generate the public key and private key of the linear homomorphic signature algorithm on the lattice; Data block signature: Divide the file into multiple data blocks, use the linear homomorphic signature algorithm on the lattice to sign each data block, and then calculate the value of the root node based on the Merkle hash tree, and calculate the value of the root node Signature, and finally send the data block, the signature of the data block and the signature of the root node to the cloud server; Third-party challenge: provide the public key and file identifier to the third-party audit, and the third-party audit challenges the cloud server to verify whether the data blocks in the cloud server have changed; Server certification: the cloud server provides corresponding certification according to the challenge initiated by the third-party audit; Third-party verification: The third-party audit judges whether the data blocks in the cloud server are complete according to the certificate provided by the cloud server, and feeds back the verification result to the user. 2. the application according to claim 1 is based on the dynamic verification method of the cloud storage data of the linear homomorphic signature of lattice, it is characterized in that, the mode of described key generation is as follows: (pk,sk)←TrapGen(1 ⁿ ) In the formula, TrqpGen(1 ⁿ ) is the trapdoor basis generation algorithm on the lattice, pk is the public key, sk is the private key, It is a group composed of m*m integer matrices in base q. 3. the application according to claim 1 is based on the dynamic verification method of the cloud storage data of the linear homomorphic signature of grid, it is characterized in that, described data block signature comprises: Divide the file F into l data blocks, F={u ₁ ,u ₂ ,…,u _l }, where is a group composed of m-dimensional column vectors; Calculation coefficient 1≤j≤n, where id is the identifier of file F, and j represents the jth data block, is the anti-collision security hash function under the random oracle model, and n represents the system security parameter; Calculate the inner product of the coefficient α _j with each data block Let the inner product vector V _i =(V _i1 ,V _i2 ,...,V _in ) ^T , 1≤i≤l, 1≤j≤n; Call SamplePre(A,T,σ,V _i ) to generate the signature e _i of the data block, 1≤i≤l, let the signature set Φ={e ₁ ,e ₂ ,…,e _l }, Construct a Merkle hash tree based on the signature set Φ. The leaf nodes of the Merkle hash tree are arranged in a preset order by signature e _i ; the values of non-leaf nodes are determined by their child nodes using a collision-resistant hash function Obtain and calculate the value h _R of the root node; use the SamplePre(A,T,σ,h _R ) algorithm to sign the value h _R of the root node, and obtain the signature Sig(h _R ) of the value of the root node; The user sends {F,Φ,id,Sig(h _R )} to the cloud server CSP, and deletes the file F, signature set Φ and signature Sig(h _R ) locally. 4. The application according to claim 3 is based on the dynamic verification method of the cloud storage data of the linear homomorphic signature of lattice, it is characterized in that, described data block signature also comprises adopting SamplePre (A, T, σ, id) to file F's identifier id to sign. 5. the application according to claim 4 is based on the dynamic verification method of the cloud storage data of linear homomorphic signature of grid, it is characterized in that, described third-party challenge comprises: The user sends the audit request AuditQuest=(Sig(id)||id) to the third-party audit, where Sig(id) represents the signature on the identifier id; After the third-party audit receives the audit request AuditQuest=(Sig(id)||id), it verifies the signature Sig(id). If the signature Sig(id) is established, the third-party audit selects a subset arbitrarily As the subscript set of the data to be sampled, where [l]={1,2,…,l}, S ₁ ≤S ₂ ≤…≤S _θ ; definition challenge chal={id,ci , _i } _i∈I , ci _{∈Ζ q} , where ci is a random coefficient selected arbitrarily by the third-party audit, and the challenge chal={id, _{ci ,i} i∈I is sent} to the cloud server. 6. the application according to claim 5 is based on the dynamic verification method of the cloud storage data of linear homomorphic signature of grid, it is characterized in that, described server proof comprises: After the cloud server receives the challenge chal={id,c _i ,i} _i∈I from the third-party audit, take the matrix B=(α ₁ ,α ₂ ,…,α _n ), α _j =H ₂ (id ||j), 1≤j≤n; define BC ^T ＝0(modq), calculated by the cloud server Cloud server randomly selected Calculate u′ _i ＝C ^T p _i +u _i , 1≤i≤l; The cloud server calculates the aggregated data of sampled data blocks according to chal={id,c _i ,i} _i∈I : Cloud server will prove Send to a third-party audit, where Ω _i is the auxiliary information composed of sibling nodes from the i-th leaf node to the root node. 7. the application according to claim 6 is based on the dynamic verification method of the cloud storage data of the linear homomorphic signature of lattice, it is characterized in that, described third-party verification comprises: Third-party audit received proof from cloud server after, according to Obtain the value h′ _R of the root node, judge A·Sig(h _R )=h′ _R and Are both established: If it is not established, it means that the cloud server has incomplete data blocks, and returns 0; If it holds, then calculate the coefficient calculate Let V _com ＝(V _com,1 ,V _com.2 ,...V _com,n ) ^T ; According to the linear property of BLS signature, aggregate signature Verify that Ae _com = V _com (modq) and Whether all are true, if true, it means that the sampled data block is complete, and return 1; otherwise, it means that the sampled data block is incomplete, and return 0. 8. the application according to claim 6 is based on the dynamic verification method of the cloud storage data of the linear homomorphic signature of lattice, it is characterized in that, described dynamic verification method also comprises modification data: The user will modify the data block Use the lattice-based linear homomorphic signature algorithm to find the corresponding signature order update information and will update the information sent to the cloud server; The cloud server executes the polynomial time algorithm ExeUpdate(F,Φ,Update), and the cloud server modifies the data block according to The subscript i of the to-be-modified data block u _i is replaced by the modified data block The signature e _i is replaced by get file signature collection Calculate the value of the new root node according to the signature set Φ ^* Cloud server will prove sent to the user; According to (Ω _i , e _i ), the user obtains the value h′ _R corresponding to the root node of the Merkle hash tree MTH, and judges that A·Sig(h _R )=h′ _R and Whether they are all true, if A·Sig(h _R )≠h′ _R , it means that the data block before modifying the data is incomplete; if it is true, the user will and (Ω _i , e _i ) to find the value h _R of the root node, if Then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification. After the data integrity verification is successful, the local modified data block sign P _Update and Sig(h _R ) delete. 9. The application according to claim 6 is based on the dynamic verification method of the cloud storage data of the linear homomorphic signature of lattice, it is characterized in that, described dynamic verification method also comprises inserting data: The user uses the lattice-based linear homomorphic signature algorithm to obtain the signature e ^*' inserted into the data block u ^* ', and sends the update information Update={I,i,u ^*' ,e ^*' } to the cloud server; The cloud server executes the polynomial time algorithm ExeUpdate(F,Φ,Update), stores the inserted data block u ^*' in the cloud server, puts the signature e ^*' after the signature e _i , and obtains the file signature collection Calculate the value of the new root node The cloud server will sent to the user; The user obtains the value h” _R of the root node of the Merkle hash tree according to (Ω _i , e _i ), and judges that A·Sig(h _R )=h″ _R and Whether all are true, if A·Sig(h _R )≠h” _R , it means that the data block before inserting the data is incomplete; if it is true, the user can find the root node according to the signature e ^*' and (Ω _i , e _i ) value of h _R , if Then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification. After the data integrity verification is successful, the local block is inserted into the data block u ^*' , signature e ^*' , P _Update , and Sig(h _R ) delete. 10. the application according to claim 1 is based on the dynamic verification method of the cloud storage data of the linear homomorphic signature of lattice, it is characterized in that, described dynamic verification method also comprises deletion data: The user sends update information Update={D,i} to the cloud server, and the cloud server executes the polynomial time algorithm ExeUpdate(F,Φ,Update), deletes the data block u _i and its signature e _i stored on the cloud server, and obtains the file F＝{u ₁ ,u ₂ ,…,u _i-1 ,u _i+1 ,…,u _l }, signature set Φ*”＝{e ₁ ,e ₂ ,…,e _i-1 ,e _{i+ 1} ,…,e _l }, calculate the value of the new root node The cloud server will sent to the user; The user obtains the value h”' _R of the root node of the Merkle hash tree according to (Ω _i , e _i ), and judges that A·Sig(h _R )=h″' _R and Whether all are true, if A·Sig(h _R )≠h”' _R , it means that the data block before deleting the data is incomplete; if it is true, the user can find the value h _R of the root node according to Ω _i , if Then the user signs the value h _R of the root node to obtain Sig(h _R ), and sends Sig(h _R ) to the cloud server to perform data integrity verification. After the data integrity verification is successful, the local P _Update and Sig (h _R ) Deleted.