CN107800688B - Cloud data deduplication and integrity auditing method based on convergence encryption - Google Patents

Abstract

The invention discloses a cloud data deduplication and integrity auditing method based on convergence encryption. The method is based on a convergence key encapsulation/decapsulation algorithm of blind signatures, can realize the duplication removal of the convergence key while safely storing the convergence key, and is based on a BLS signature algorithm of the convergence key, stores an audit public key by using a trusted third party TTP and acts for audit, thereby realizing the duplication removal of the audit signature and the audit public key, and comprises the following specific steps: initializing a system; initializing a secret key; initializing a file; initializing authentication evidence; key encapsulation; storing data; repeating the challenge; repeating the response; repeating authentication; requesting an audit; agent auditing; auditing response; auditing and authenticating; and (5) downloading the file. The invention improves the utilization rate of the cloud storage space, realizes the duplicate removal of the audit signature and the audit public key, and reduces the storage and calculation cost of the client.

Description

Cloud data deduplication and integrity auditing method based on convergence encryption

Technical Field

The invention relates to the technical field of cloud storage and information security, in particular to a cloud data deduplication and integrity auditing method based on convergence encryption.

Background

With the wide application of cloud storage services, more and more users store data to the cloud. According to EMC research, about 75% of cloud storage space is occupied by repeated data, and because a cloud server is semi-credible, how to eliminate redundant data under the condition of protecting data privacy becomes a serious problem of cloud storage application development; in addition, since the data is stored in the cloud, the user loses control over the data, and therefore it cannot be determined whether the cloud data is complete, and therefore, how to efficiently verify the integrity of the data is also a problem to be considered in the security guarantee of the cloud storage.

In order to solve the problem of how to remove the duplicate of cloud privacy protection data, researchers usually adopt an encryption mode to protect data privacy, and on the basis, data duplication removal on a ciphertext is realized through mechanisms such as secret key safe sharing, ciphertext conversion, convergence encryption and the like, wherein the convergence encryption mechanism is a commonly used method for solving the problem of ciphertext data duplication at present, but as the convergence key is derived from a data original text, a large amount of data needs to be stored with a corresponding convergence key, so that extra overhead is added to a user.

In addition, some schemes propose a mode of encrypting a convergence key by using a main key and then outsourcing a storage key ciphertext to reduce the local storage overhead of a user, but the mode causes the redundant storage of the key ciphertext. In the scheme, key distribution is provided in a threshold mode, and key components are stored in n cloud servers, however, extra cloud server overhead is introduced, and meanwhile, the verification process is complicated.

For the problem of integrity verification, researchers provide a public auditing and sampling auditing mode to realize the integrity verification of remote data. However, signatures required by audit authentication are generated by a signature private key randomly generated by a user and file information, and the corresponding signatures of redundant data originals among users are inevitably redundant, so that cloud storage stores a large number of redundant signatures.

Disclosure of Invention

The invention aims to provide a safe and efficient cloud data deduplication and integrity auditing method based on a convergence key.

The technical solution for realizing the purpose of the invention is as follows: a cloud data duplicate removal and integrity auditing method based on convergence encryption comprises a Client side (Client), a cloud storage server side (CSP) and a trusted third party side (TTP); the method comprises the following steps:

step 1, system initialization:

the system randomly selects a prime number q and creates an elliptic curve equation G of order q₁，G₂And generates an acceptable linear pair e G₁×G₁→G₂，g₁、g₂Is G₁Two different generators of (2), a hash functionh(·):{0,1}^*∈Z_q，Z_qRepresenting a q-th prime field, hash function H (·) {0,1}^*∈G₁Then the system part discloses the parameters as { e, g₁,g₂,G₁,G₂H (-), H (-) }; TTP randomly selects x ∈ Z_qLet private parameter tsk be x, and calculate y₁＝g₁ ^x，

TTP public key public parameter y₁And y₂And keeping tsk private;

step 2, key initialization:

the client calculates a corresponding convergence key k for the file F_FPrivate file signature key ssk_FAnd a file signature public key spk_F；

Step 3, file initialization:

client computing ciphertext C for File F_F＝Enc(k_FF), while generating the file identification Tag ═ Sha1 (C)_F) Wherein, Tag is a file identifier and is used for detecting the repeatability of the file;

step 4, initializing the authentication evidence:

the client firstly divides the file F into data blocks B with equal size_iI is more than or equal to 1 and less than or equal to n, n is the total number of data blocks, and then a file convergence key k is utilized_FEncrypting a block of data to obtain a block cipher text

Finally for each data block B_iComputing a data Block authentication evidence σ_iWhere σ is_iFor repeated authentications and audit authentications;

step 5, key encapsulation:

when the CSP does not have the file identifier Tag, the client randomly generates a blinding factor r, and uses the blinding factor r to converge the key k_FBlinding, and then sending the blinded convergence key a to a TTP (time to live) by the client for signature and returning to b; the client de-blinding the return value b to obtain a convergence key k_FCiphertext CK of_F；

Step 6, data storage:

when the CSP does not have the file identification Tag, the client uploads the file identification Tag and the file ciphertext C_FAnd a file key ciphertext CK_FBlock cipher text C_BiAnd data Block authentication evidence σ_iTo the CSP, the CSP verifies whether the document ID and the document ciphertext are from the same document, and verifies the block signature σ_iThe correctness of the test; meanwhile, the client uploads the file attribute, the user identification and the file audit public key to the TTP; finally, the CSP stores a file identifier, a file ciphertext, a file block ciphertext and a file block authentication evidence for each file, and the TTP stores a file attribute, a user identifier and a file audit public key;

and 7, repeating the challenge:

when the CSP has the file identification Tag, executing a file repeated authentication protocol; CSP generates challenge information chal ═ (i, v)_i)_i∈IAnd returning the challenge information to the client, wherein I is [1, n ]]Random number v_i∈Z_qWherein Z is_qIs a q-th prime field;

and 8, repeating response:

after receiving the challenge set, the client analyzes the challenge set chal to obtain a block index set I of the file, then processes the file F ' to be uploaded to generate a repeated response evidence sigma ', and feeds back the repeated response evidence sigma ' to the CSP;

step 9, repeating authentication:

after the CSP sends the challenge set to the designated client, the CSP utilizes the meta-evidence σ_iCalculating a challenge set chal to obtain a document authentication evidence sigma; after the CSP receives the response evidence sigma' returned by the client, the verification is carried out

If the client ID and the file ID are the same, the CSP successfully repeatedly authenticates the file, and adds the client ID to an ownership list of the file; otherwise, the repeated authentication fails, the client continuously uploads the file, and the CSP feeds back the repeated authentication result to the client;

step 10, request audit:

if the client needs to audit the integrity of the CSP data, sending audit request information to the TTP, wherein the audit request information comprises a user identifier U and a file identifier Tag;

step 11, agent audit:

TTP analyzes the auditing request of client and executes auditing protocol, firstly, according to user identification and file identification Tag, basic information of file is retrieved, and challenge set chal is generated as (i, v)_i)_i∈IThen send the challenge set to the CSP; wherein I is [1, n ]]A subset of, random number v_i∈Z_qWherein Z is_qIs a q-th prime field;

step 12, auditing response:

after receiving the audit request from the TTP, the CSP analyzes the user identification U and the file identification Tag, and retrieves to obtain the file audit evidence sigma_iCiphertext block C_iCloud according to chal, sigma_i、C_iCalculating out corresponding polymerization evidence

And aggregating the ciphertext mu ═ sigma_i∈IC_iv_iThen, returning the response evidence { mu, sigma }, the user identifier U and the file identifier Tag to the TTP;

step 13, auditing and authenticating:

after the TTP receives the feedback from the CSP, the TTP depends on the public key information spk of the file_FVerifying the response evidence of the CSP, then recording the audit result into a log table, and returning the audit result to the client;

step 14, downloading the file:

when the client needs to download the file from the CSP, the CSP firstly verifies the validity of the client identity and encrypts the cipher text CK of the key_FAnd ciphertext C_FReturning to the client; the client and the TTP execute a key decapsulation algorithm to obtain a key plaintext k_FThen use the key plaintext k_FAnd decrypting to obtain the data plaintext F.

As a specific scheme, the key initialization in step 2 includes the following specific steps:

1) calculating to obtain a file convergence key k by taking the file F as a parameter_F＝H(F)；

2) Using the file F as a parameter, calculating to obtain a file signature private key ssk_F＝h(F)；

3) Signing private key ssk with a file_FCalculating a file signature public key as a parameter

As a specific scheme, the authentication evidence in step 4 is initialized, and the specific steps are as follows:

1) the client divides the file F into n data blocks B according to the block size set by the system_i(1≤i≤n)；

2) Using a convergent key k_FEncrypt the data block to obtain C_i＝Enc(B_i,k_F)(1≤i≤n)；

3) Generation of File signature private Key ssk from File F_FH (f) and file signature public key

4) Calculating data block B corresponding to file F_iAuthentication evidence collection

Wherein sigma_iIs an essential element of security deduplication and integrity audit authentication.

As a specific scheme, the key encapsulation in step 5 specifically includes the following steps:

1) the client randomly selects a blinding factor r, which belongs to Z_qAnd blinding the convergence key k to obtain a blinded convergence key a ═ k_F·g₁ ^rSending the data to the TTP;

2) the TTP signs the blinded convergence secret key a by using a private key tsk to obtain b as a^tskAnd returning the b to the client U;

3) the client performs de-blinding processing on the b to obtain an encapsulated convergence key CK_F，CK_F＝b·y₁ ^-rAnd CK is verified by the following equation_FThe legitimacy of (c):

if the verification is successful, CK_FFor key ciphertext, the client can securely encrypt the CK_FOutsourcing and storing to the CSP; otherwise, the signature may be subject to malicious attacks and fail.

As a specific scheme, in the file downloading in step 14, the specific steps of client file decryption are as follows:

1) the client randomly selects a blinding factor r, which belongs to Z_qAnd blinding the key ciphertext CK_FObtaining the blinded key ciphertext a ═ CK_F·g₁ ^rSending the data to the TTP;

2) TTP signs the blinded key ciphertext a by using a private key tsk to obtain

And returning b to the user U;

3) the client performs de-blinding processing on the b to obtain a convergence key k_F，k_F＝b·y₁ ^-rAnd k is verified by the following equation_FThe legitimacy of (c):

if the verification is successful, k_FTo converge the key, the client utilizes k_FDecryption C_FObtaining a plaintext F, and ending the file decryption operation; otherwise, the identity authentication fails, the blind signature fails, the key is discarded, and the ciphertext unsealing algorithm is continuously executed with the TTP.

Compared with the prior art, the invention has the remarkable advantages that: (1) managing convergence keys securely and efficiently: the convergence secret key is safely packaged by using the idea of combining the blind signature and the convergence secret key, and meanwhile, the duplication removal of the convergence secret key is realized; (2) the authentication signature with the same elimination effect has two purposes: the construction mode of the authentication signature is improved, the signature is carried out by using a convergence key method, and the same signature can be used for repeated authentication and audit authentication; (3) the file key plaintext does not need to be obtained, and the safety is high: the trusted third party processes the blinded key during key encapsulation, so that the plaintext of the file key does not need to be acquired, and the security is high; when the trusted third party agent conducts audit, the trusted third party only obtains some attribute information of the file, and plaintext information of the file cannot be leaked in the audit authentication process; meanwhile, the bilinear mapping relation is utilized to carry out safe signature verification, so that inconsistent attacks of malicious users can be resisted; (4) by means of safe and unified encapsulation of the convergence key, efficient transformation of the authentication signature and proxy storage of the public key, safe cloud data duplication removal and integrity verification services are provided, waste of potential redundant data on cloud storage space is saved, and computing cost of the client is reduced.

Drawings

Fig. 1 is a system structure diagram of a cloud data deduplication and integrity auditing method based on convergence encryption according to the present invention.

Fig. 2 is a basic flowchart of the cloud data deduplication and integrity auditing method based on convergence encryption according to the present invention.

Detailed Description

The invention is described in further detail below with reference to the drawings and the examples of embodiment.

The invention provides a cloud data deduplication and integrity auditing method based on convergence encryption, wherein a system model of the method is shown in figure 1 and comprises three types of entities: the system comprises a Client (Client), a cloud storage server (cloud storage provider) and a Trusted Third Party (Trusted Third Party). The CSP is composed of a main server and a storage server, has enough storage space and computing capacity, and provides private data storage and repeated authentication and audit authentication services for users. TTP interacts with user, encapsulates/decapsulates convergence key safely, stores audit public key and acts audit. The Client comprises a plurality of common users, and the service provided by the cloud storage is also an important ring in realizing the security authentication.

With reference to fig. 2, a cloud data deduplication and integrity auditing method based on convergence encryption includes the following specific implementation steps:

step 1, initializing system parameters: the system selects the public parameters and initializes the public key and the private key of the TTP terminal. The method comprises the following specific steps:

1) the system randomly selects a prime number q and creates an elliptic curve equation G of order q₁，G₂And generates an acceptable linear pair e G₁×G₁→G₂，g₁、g₂Is G₁Let hash function h (·) → {0,1}^*∈Z_q，Z_qRepresenting a q-th prime field, hash function H (·) → {0,1}^*∈G₁Then the system part discloses the parameters as { e, g₁,g₂,G₁,G₂,h(·),H(·)}；

2) TTP randomly selects x ∈ Z_qLet private parameter tsk be x, and calculate y₁∈g₁ ^x，

Let the common parameter tpk be { y ═ y₁,y₂TTP discloses tpk and keeps tsk private.

Step 2, key initialization: the client calculates a corresponding convergence key k for the file F_FPrivate file signature key ssk_FAnd a file signature public key spk_F(ii) a The method comprises the following specific steps:

1) calculating a file convergence key k by using a one-way hash function H by taking the file F as a parameter_F＝H(F)。

2) Using file F as parameter, utilizing one-way hash function h to calculate file signature private key ssk_F＝h(F)。

3) Signing private key ssk with a file_FCalculating a file signature public key as a parameter

Step 3, file initialization: the client side encrypts the file F by using the generated convergence key to obtain a ciphertext C_F，C_F＝Enc(K_FF) and generates a file unique identifier Tag-SHA 1 (C) according to the digest algorithm SHA1_F) Which isThe middle Tag is a file identifier and is used for detecting the repeatability of the file.

Step 4, initializing the authentication evidence: the client firstly divides the file F into data blocks B with equal size_iI is more than or equal to 1 and less than or equal to n, n is the total number of data blocks, and then a file convergence key k is utilized_FEncrypting a block of data to obtain a block cipher text

Finally for each data block B_iComputing a data Block authentication evidence σ_iWhere σ is_iFor repeated authentications and audit authentications. The method comprises the following specific steps:

1) the client divides the file F into n data blocks B according to the block size set by the system_i(1≤i≤n)；

2) Using a convergent key k_FEncrypt the data block to obtain C_i＝Enc(B_i,k_F)(1≤i≤n)；

3) Generation of File signature private Key ssk from File F_FH (f) and file signature public key

4) Calculating data block B corresponding to file F_iAuthentication evidence collection

Wherein sigma_iIs an essential element of security deduplication and integrity audit authentication.

Step 5, key encapsulation: when the CSP does not have the file identifier Tag, the user randomly generates a blinding factor r and uses the blinding factor r to converge the key k_FAnd (4) blinding, and then sending the blinded convergence key a to the TTP by the client for signature and returning to the step b. The client de-blinding the return value b to obtain a convergence key k_FCiphertext CK of_F. The method comprises the following specific steps:

1) the client randomly selects a blinding factor r, r ← Z_q。

2) Using r pairs of convergence keys k_FBlinding to obtain a ═ k_F·g₁ ^rAnd transmitSend r to TTP.

3) The TTP signs a by using a self-signature private key tsk to obtain b ═ a^tskAnd returns to the user.

4) The client firstly carries out de-blinding to obtain a ciphertext CK of a convergence key_F＝b·y₁ ^-rEncrypted by the private key tsk of the TTP.

5) Client pairs CK using equation (1)_FIf the verification is passed, the user can verify the CK_FAs k is_FAnd the ciphertext is outsourced and stored to the cloud end, and the convergence key is safely stored. Otherwise, the CK is discarded_FRe-performing the key encapsulation algorithm with the TTP to obtain the CK_F。

Step 6, data storage: when the CSP does not have the file identification Tag, the client uploads the file identification Tag and the file ciphertext C_FAnd a file key ciphertext CK_FBlock cipher text C_BiAnd data Block authentication evidence σ_iTo the CSP, the CSP verifies whether the document ID and the document ciphertext are from the same document, and verifies the block signature σ_iThe correctness of the test; meanwhile, the client uploads the file attribute, the user identification and the file audit public key to the TTP; finally, the CSP stores file identification, file ciphertext, file block authentication evidence and TTP stores file attribute, user identification and file audit public key for each file. The method comprises the following specific steps:

1) client uploads file identification Tag and file ciphertext C_FAnd a file key ciphertext CK_FBlock cipher text

And data Block authentication evidence σ_iTo the CSP, the CSP verifies whether the document ID and the document ciphertext are from the same document, and verifies the block signature σ_iThe correctness of the operation.

2) The client uploads file attributes (file block number, file identification and file name), user identification and a file audit public key to the TTP.

And 7, repeating the challenge: when the CSP has the file identification Tag, executing a file repeated authentication protocol; CSP generates challenge information chal ═ (i, v)_i)_i∈IAnd returning the challenge information to the client, wherein I is [1, n ]]Random number v_i∈Z_qWherein Z is_qIs the q-th prime field. The method comprises the following specific steps:

1) the CSP generates a challenge set chal according to the cloud record of the duplicate file F, wherein chal is (i, v)_i)_i∈IWherein I is [1, n ]]Represents a set of block indices; random number v_i∈Z_qAnd is used for resisting replay attack by a malicious attacker.

2) The CSP sends a challenge set chal to the designated client.

And 8, repeating response: after receiving the challenge set, the client analyzes the challenge set chal to obtain a block index set I of the file, then processes the file F ' to be uploaded to generate a repeated response evidence sigma ', and feeds back the repeated response evidence sigma ' to the CSP. The method comprises the following specific steps:

1) the client resolves the challenge set chal to obtain a block index set I.

2) The client initializes a duplicate file F' to be uploaded:

(2a) computing a file convergence key k_F＝H(F)。

(2b) Compute document signature private key ssk_F＝h(F)。

(2c) Splitting files F' to B according to system set size_i(i is more than or equal to 1 and less than or equal to n) and encrypted to obtain ciphertext data block

C_i(1≤i≤n)。

3) For all data blocks in I, a block signature is calculated

From all σ_i' calculation of duplicate proof of authentication

And sends σ' to the cloud.

Step 9, repeating authentication: after the CSP sends the challenge set to the designated client, the CSP utilizes the meta-evidence σ_iCalculating a challenge set chal to obtain a document authentication evidence sigma; after the CSP receives the response evidence sigma' returned by the client, the verification is carried out

If the client ID and the file ID are the same, the CSP successfully repeatedly authenticates the file, and adds the client ID to an ownership list of the file; otherwise, the repeated authentication fails, the client continuously uploads the file, and the CSP feeds back the repeated authentication result to the client. The method comprises the following specific steps:

1) CSP retrieves the meta authentication evidence sigma' and the ciphertext block corresponding to the file by Tag

2) CSP calculates out repeated authentication evidence according to challenge set

3) After the CSP receives the client response evidence sigma ', the client response evidence sigma' is compared

If the equation is established, the file repetition evidence is successful, the client does not need to upload the file F' and related data, and the CSP gives ownership of the file F to the user U (adds a user U identifier in the file F authority table); otherwise, the client needs to upload all files.

Step 10, request audit: when the user needs to audit the integrity of the cloud data, the user can send audit request information (user identification U and file identification Tag) to the TTP.

Step 11, agent audit: TTP analyzes the auditing request of client and executes auditing protocol, firstly, according to user identification and file identification Tag, basic information of file is retrieved, and challenge set chal is generated as (i, v)_i)_i∈IThen send the challenge set to the CSP; wherein, I is a group of a [1,n]a subset of, random number v_i∈Z_qWherein Z is_qIs the q-th prime field. The method comprises the following specific steps:

1) TTP analyzes audit request information from client U to obtain file identification Tag

2) The TTP retrieves a local storage file library according to the Tag to obtain file attributes, and generates a challenge set chal (i, v) by taking the total number n of the file blocks as a reference_i)_i∈I. And sending the chal and the file identification Tag to the cloud.

Step 12, auditing response: after receiving the audit request from the TTP, the CSP analyzes the user identification U and the file identification Tag, and retrieves to obtain the file audit evidence sigma_iCiphertext block C_iCloud according to chal, sigma_i、C_iCalculating out corresponding polymerization evidence

And aggregating the ciphertext mu ═ sigma_i∈IC_iv_iThen, the response evidence { μ, σ }, the user identifier U and the file identifier Tag are returned to the TTP. The method comprises the following specific steps:

1) CSP analyzes audit information sent by TTP end to obtain file identification Tag

2) CSP retrieves the meta authentication evidence sigma according to the identification Tag_iCiphertext block C_iUsing chal, sigma_i、C_iCalculating to obtain corresponding homomorphic audit authentication evidence

And homomorphic ciphertext mu ═ sigma_i∈IC_iv_iAnd returns { σ, μ, Tag } to the TTP terminal.

Step 13, auditing and authenticating: and after receiving the feedback from the CSP, the TTP verifies the cloud response evidence according to the file public key information. And then the TTP records the auditing result into a log table and returns the auditing result to the client. The method comprises the following specific steps:

1) TTP analyzes the feedback information and retrieves the local document library to obtain the corresponding document audit public key spk_F

2) The TTP verifies whether the equation (3) is established or not by utilizing the CSP return information { sigma, mu, Tag }, and if the equation is established, the file stored in the CSP by the user is complete; otherwise, the file is corrupted. And then the TTP records the auditing result into a log table and returns the auditing result to the specified client U.

Step 14, downloading the file: when the client needs to download the file from the CSP, the CSP firstly verifies the validity of the client identity and encrypts the cipher text CK of the key_FAnd ciphertext C_FReturning to the client; the client and the TTP execute a key decapsulation algorithm to obtain a key plaintext k_FThen use the key plaintext k_FAnd decrypting to obtain the data plaintext F. The method comprises the following specific steps:

1) the client randomly selects a blinding factor r, which belongs to Z_qAnd blinding the key ciphertext CK_FObtaining the blinded key ciphertext a ═ CK_F·g₁ ^rAnd sending a to TTP.

2) TTP signs a by using private key tsk to obtain

And returns b to user U.

3) The client performs de-blinding processing on the b to obtain a convergence key k_F，k_F＝b·y₁ ^-rAnd verifies k by equation (4)_FIf the verification is successful, k_FTo converge the key, the client utilizes k_FDecryption C_FObtaining a plaintext F, and ending the file decryption operation; otherwise, the client fails to verify the identity, the blind signature fails, the key is discarded, and the ciphertext unsealing algorithm is continuously executed with the TTP.

In conclusion, the convergence key encapsulation/decapsulation algorithm based on the blind signature can safely store the convergence key and simultaneously realize the duplication removal of the convergence key, so that the utilization rate of a cloud storage space is improved; on the other hand, the BLS signature algorithm based on the convergence key stores the audit public key and performs proxy audit by using a Trusted Third Party (TTP), thereby realizing the duplicate removal of the audit signature and the audit public key and reducing the storage and calculation expenses of the client.

Claims (5)

1. A cloud data duplicate removal and integrity auditing method based on convergence encryption is characterized by comprising a Client, a cloud storage server, a trusted third party, a Client side and a server side (CSP), wherein the Client is a Client; the method comprises the following steps:

step 1, system initialization:

the system randomly selects a prime number q and creates an elliptic curve equation G of order q₁，G₂And generates an acceptable linear pair e G₁×G₁→G₂，g₁、g₂Is G₁Let the hash function h (·) be {0,1}^*∈Z_q，Z_qRepresenting a q-th prime field, hash function H (·) {0,1}^*∈G₁Then the system part discloses the parameters as { e, g₁,g₂,G₁,G₂H (-), H (-) }; TTP randomly selects x ∈ Z_qLet private parameter tsk be x, and calculate y₁＝g₁ ^x，

TTP public key public parameter y₁And y₂And keeping tsk private;

step 2, key initialization:

the client calculates a corresponding convergence key k for the file F_FPrivate file signature key ssk_FAnd a file signature public key spk_F；

Step 3, file initialization:

client computing ciphertext C for File F_F＝Enc(k_FF), while generating the file identification Tag ═ Sha1 (C)_F) Wherein, Tag is a file identifier and is used for detecting the repeatability of the file;

step 4, initializing the authentication evidence:

the client firstly divides the file F into data blocks B with equal size_iI is more than or equal to 1 and less than or equal to n, n is the total number of data blocks, and then a file convergence key k is utilized_FEncrypting a block of data to obtain a block cipher text

Finally for each data block B_iComputing a data Block authentication evidence σ_iWhere σ is_iFor repeated authentications and audit authentications;

step 5, key encapsulation:

when the CSP does not have the file identifier Tag, the client randomly generates a blinding factor r, and uses the blinding factor r to converge the key k_FBlinding, and then sending the blinded convergence key a to a TTP (time to live) by the client for signature and returning to b; the client de-blinding the return value b to obtain a convergence key k_FCiphertext CK of_F；

Step 6, data storage:

when the CSP does not have the file identification Tag, the client uploads the file identification Tag and the file ciphertext C_FAnd a file key ciphertext CK_FBlock cipher text C_BiAnd data Block authentication evidence σ_iTo the CSP, the CSP verifies whether the document ID and the document ciphertext are from the same document, and verifies the block signature σ_iThe correctness of the test; meanwhile, the client uploads the file attribute, the user identification and the file audit public key to the TTP; finally, the CSP stores a file identifier, a file ciphertext, a file block ciphertext and a file block authentication evidence for each file, and the TTP stores a file attribute, a user identifier and a file audit public key;

and 7, repeating the challenge:

when the CSP has the file identification Tag, executing a file repeated authentication protocol; CSP generates challenge information chal ═ (i, v)_i)_i∈IAnd returning the challenge information to the client, wherein I is [1, n ]]Random number v_i∈Z_qWherein Z is_qIs a q-th prime field;

and 8, repeating response:

after receiving the challenge set, the client analyzes the challenge set chal to obtain a block index set I of the file, then processes the file F ' to be uploaded to generate a repeated response evidence sigma ', and feeds back the repeated response evidence sigma ' to the CSP;

step 9, repeating authentication:

after the CSP sends the challenge set to the designated client, the CSP utilizes the meta-evidence σ_iCalculating a challenge set chal to obtain a document authentication evidence sigma; after the CSP receives the response evidence sigma' returned by the client, the verification is carried out

If the client ID and the file ID are the same, the CSP successfully repeatedly authenticates the file, and adds the client ID to an ownership list of the file; otherwise, the repeated authentication fails, the client continuously uploads the file, and the CSP feeds back the repeated authentication result to the client;

step 10, request audit:

if the client needs to audit the integrity of the CSP data, sending audit request information to the TTP, wherein the audit request information comprises a user identifier U and a file identifier Tag;

step 11, agent audit:

TTP analyzes the auditing request of client and executes auditing protocol, firstly, according to user identification and file identification Tag, basic information of file is retrieved, and challenge set chal is generated as (i, v)_i)_i∈IThen send the challenge set to the CSP; wherein I is [1, n ]]A subset of, random number v_i∈Z_qWherein Z is_qIs a q-th prime field;

step 12, auditing response:

after receiving the audit request from the TTP, the CSP analyzes the user identification U and the file identification Tag, and retrieves to obtain the file audit evidence sigma_iCiphertext block C_iCloud according to chal, sigma_i、C_iCalculating out corresponding polymerization evidence

And aggregating the ciphertext mu ═ sigma_i∈IC_iv_iThen, returning the response evidence { mu, sigma }, the user identifier U and the file identifier Tag to the TTP;

step 13, auditing and authenticating:

after the TTP receives the feedback from the CSP, the TTP depends on the public key information spk of the file_FVerifying the response evidence of the CSP, then recording the audit result into a log table, and returning the audit result to the client;

step 14, downloading the file:

when the client needs to download the file from the CSP, the CSP firstly verifies the validity of the client identity and encrypts the cipher text CK of the key_FAnd ciphertext C_FReturning to the client; the client and the TTP execute a key decapsulation algorithm to obtain a key plaintext k_FThen use the key plaintext k_FAnd decrypting to obtain the data plaintext F.

2. The cloud data deduplication and integrity auditing method based on convergent encryption according to claim 1, characterized in that the key initialization of step 2 specifically comprises the following steps:

1) calculating to obtain a file convergence key k by taking the file F as a parameter_F＝H(F)；

2) Using the file F as a parameter, calculating to obtain a file signature private key ssk_F＝h(F)；

3) Signing private key ssk with a file_FCalculating a file signature public key as a parameter

3. The cloud data deduplication and integrity auditing method based on convergence encryption according to claim 1, characterized in that the authentication evidence in step 4 is initialized, specifically including the following steps:

1) the client divides the file F into n data blocks B according to the block size set by the system_i，1≤i≤n；

2) Using a convergent key k_FEncrypt the data block to obtain C_i＝Enc(B_i,k_F)，1≤i≤n；

3) Generation of File signature private Key ssk from File F_F＝h(F)And file signature public key

4) Calculating data block B corresponding to file F_iAuthentication evidence collection

I is more than or equal to 1 and less than or equal to n, wherein sigma_iIs an essential element of security deduplication and integrity audit authentication.

4. The cloud data deduplication and integrity auditing method based on convergent encryption according to claim 1, characterized in that the key encapsulation in step 5 specifically comprises the following steps:

1) the client randomly selects a blinding factor r, which belongs to Z_qAnd blinding the convergence key k_FObtaining a blinded convergence key a ═ k_F·g₁ ^rSending the data to the TTP;

2) the TTP signs the blinded convergence secret key a by using a private key tsk to obtain b as a^tskAnd returning the b to the client U;

3) the client performs de-blinding processing on the b to obtain an encapsulated convergence key CK_F，CK_F＝b·y₁ ^-rAnd CK is verified by the following equation_FThe legitimacy of (c):

if the verification is successful, CK_FFor key ciphertext, the client can securely encrypt the CK_FOutsourcing and storing to the CSP; otherwise, the signature may be subject to malicious attacks and fail.

5. The cloud data deduplication and integrity auditing method based on convergent encryption according to claim 1, wherein in the file downloading in step 14, the specific steps of client file decryption are as follows:

1) customerRandomly selecting a blinding factor r from the terminal, wherein r belongs to Z_qAnd blinding the key ciphertext CK_FObtaining the blinded key ciphertext a ═ CK_F·g₁ ^rSending the data to the TTP;

2) TTP signs the blinded key ciphertext a by using a private key tsk to obtain

And returning b to the user U;

3) the client performs de-blinding processing on the b to obtain a convergence key k_F，k_F＝b·y₁ ^-rAnd k is verified by the following equation_FThe legitimacy of (c):

if the verification is successful, k_FTo converge the key, the client utilizes k_FDecryption C_FObtaining a plaintext F, and ending the file decryption operation; otherwise, the identity authentication fails, the blind signature fails, the key is discarded, and the ciphertext unsealing algorithm is continuously executed with the TTP.

Images