CN109145612B

CN109145612B - Block chain-based cloud data sharing method for preventing data tampering and user collusion

Info

Publication number: CN109145612B
Application number: CN201810733972.XA
Authority: CN
Inventors: 徐光伟; 马永东; 王文涛
Original assignee: Donghua University
Current assignee: Donghua University
Priority date: 2018-07-05
Filing date: 2018-07-05
Publication date: 2021-11-16
Anticipated expiration: 2038-07-05
Also published as: CN109145612A

Abstract

In recent years, with the more and more wide application of cloud, the problem of privacy disclosure of cloud sharing data at home and abroad is continuously generated, the privacy disclosure problem in cloud data sharing becomes a focus of people's attention, and related solutions are also continuously provided. Most of the existing solutions consist of a single sharer or a specific user. However, in an actual data sharing scenario, the shared data is usually provided by a multi-bit data owner, which brings a new series of problems to protect the privacy of the data, such as malicious tampering of the shared data, collusion between malicious users, and collusion between users and cloud service providers. The invention provides a cloud data sharing method for realizing data tampering prevention and user collusion based on a block chain. The method realizes that data is not tampered by malicious users during sharing by adopting methods of public accounting and intelligent contracts in a block chain, and simultaneously realizes confidentiality of shared data by adopting a (p, t) threshold Paillier cryptosystem, thereby avoiding the problem that the malicious users collude to steal the shared data.

Description

Block chain-based cloud data sharing method for preventing data tampering and user collusion

Technical Field

The invention relates to a block chain-based cloud data sharing method for achieving data tamper resistance and user collusion resistance, and belongs to the field of cloud data sharing, data privacy and block chains.

Background

With the rapid development of network technologies and cloud computing, the amount of enterprise or personal data is rapidly increasing. In order to conveniently store and share data, more and more enterprises or individuals transfer own data storage and sharing to a cloud space, and compared with the traditional information sharing and communication technology, the cloud computing has the characteristics of low energy consumption and efficient resource sharing. However, this presents a significant challenge to information security, such as data loss and privacy leakage. Moreover, when data is stored in the cloud, users will simply not have control over their personal data, which is a major concern for ensuring confidentiality and privacy of shared data.

In order to solve the above problem, a conventional solution is to adopt a Central Authority (CA) or a Third-party certification authority (TPA) in the data sharing mode to manage the certification work of the data and the keys, or to protect a dedicated root certificate key in the certification authority. However, the above solutions still have disadvantages, and the central authority and the third party are not trusted, so that collusion or rights collection problems are easy to occur. And CA and TPA are not required in some scenarios. In a scientific research and study sharing scenario, users with similar data can trade data according to their needs, or obtain meaningful results through sharing calculation. There is no need to establish a trust center authority CA between them to manage their own shared data, and no special certification authority TPA is needed to do so. Moreover, if the method is adopted, the system processing steps are complicated, the shared data is easily tampered, and collusion among malicious users is easy to happen.

Disclosure of Invention

The purpose of the invention is: under the cloud data sharing environment, data is prevented from being maliciously tampered and shared data is prevented from being stolen by means of collusion of malicious users, and a safe cloud sharing method is provided.

In order to achieve the above object, a technical solution of the present invention is to provide a method for sharing cloud data based on a block chain to achieve data tampering prevention and user collusion, which is characterized by comprising the following steps:

step 1, obtaining system parameters through initialization calculation

Wherein G is a randomly selected generator, and G belongs to G₁，G₁Is a circulating group; p ═ γ · g, γ is a random integer,

a set of integers that are non-zero; H. h₀To belong to the circulation group G₁Two elements of (a); h₁＝ξ₁·H₀，H₂＝ξ₂·H₀，ξ₁、ξ₂Is an integer that is randomly selected and is,

a set of non-zero prime numbers;

W＝γ*P；h₁、h₂two hash functions; f is a random integer and f is a random integer,

is an encryption algorithm;

step 2, a (p, t) threshold Paillier cipher system is adopted, a private key sk is separated and distributed to p users, p ═ 2, in the distribution process, a data owner group leader DOL is recommended according to the data sharing contribution rate, the distribution of the user private key is responsible for the data owner group leader DOL, the DOL, CA and TPA are different, and the authority of the DOL is not higher than that of the CA and TPA. In the method, DOL is only used for distributing and verifying the private key, and the maximum authority (member verification, data tampering) is taken charge of by each member. The data owner group leader DOL sends the secret key to a corresponding user through a secure channel;

step 3, generating a file by adopting a homomorphic encryption method, and then uploading the file;

step 4, when the user passes the authentication, the user performs the shared data access operation, when the user needs to update the data block, the user must perform the signature operation on the data block after the data block is updated, and the user i is set to perform the signature operation on the data block m_iAfter the update, at data block m_iIn the process, a signature operation is performed, and the signature is composed of an ID_i，m_i，σ_i，S_iFour components, wherein, ID_iFor a data block m_iId, m of_iFor a data block m_i、σ_iIs a signature, S_iIs the identity of the signer;

in the process of data sharing, if data is maliciously tampered by a certain user, other users are subjected to collective verification, if the data does not pass a verification formula, the current user is indicated to be a condition that the current user does not meet the honest user in sharing, and a data owner group leader DOL executes the revocation operation of the current user;

step 5, user group detection, wherein each user in the user group is a member, and the method comprises the following steps:

step 501, each member submits to the data owner group leader DOL

And a signature delta_i，A_iFor unique identification of member i, verify

If the determination is true, if the determination is false, the step 502 is executed, and if the determination is true, the step 503 is executed;

step 502, the member i sends an error report to the data owner group leader DOL, where the error report is (N, ID)_i，γ_i，m_i-1) In the formula: n ═ h₂(ID_iT is not less than | t |0 and not more than n-1), and t is an effective time threshold of the error report; r is_jA random integer selected for member i; m is_t-1Is a data block representing the updating at the time t-1; data owner group leader DOL checks against error reports A_i＝W_i*t_tmpIf yes, then (indicating that the member is not a malicious user); if the error report is not satisfied, the message that the member i sends to other members is different from the message that the member i submits to the data owner group leader DOL, the member i must resend the error report within a period of time, and if the member i resends the error report within the threshold value t, the data owner group leader DOL rechecks A according to the error report_i＝W_i*t_tmpIf the member i is not in the threshold value t, the error report is not sent again, the member i is indicated to be an untrusted node, the member i is deleted from the member, and the data owner group leader DOL executes the revocation operation of the member i;

step 503, the member i is an honest member, and the judgment operation of the next member is continuously executed;

and 6, publicly accounting, broadcasting after user data access, verifying and recording operation records of the broadcasting users by other users, applying for initiating error verification operation after a plurality of users find errors in the whole sharing process, and allowing at least t members to participate in verification. All data in the method are stored in a data block mode:

to ensure that the recorded content is authentic and has not been tampered with, the data hash value is stored in an item block structure, the data block is composed of a plurality of item blocks, and the hash value is calculated to obtain the Merkle root of the data block. The Merkle root is submitted to the blockchain so that the data cannot be tampered, and each item block only stores the hash value and the header information of the item;

each data contains five kinds of information: ith data block m_iC, signature σ_iData block m_iidID of_iIdentity of signer S_iThe user records the request, takes the public key as the identity and realizes the updating operation of the node information by representing whether the node receives the broadcast request or not;

step 7, key updating:

the data owner group leader DOL periodically performs the updating operation of the user secret key, and meanwhile, in a certain time interval, after the problem of multiple times of malicious data tampering occurs in the model, the data owner group leader DOL initiates the updating operation of the user secret key.

The invention has the following advantages:

1) the cloud sharing data processing method and device can solve the problem that the cloud sharing data is tampered. By using the blockchain technology, each access of a user is recorded in the blockchain, and public key information based on identity is recorded in each access, so that once data is tampered, other users can efficiently trace back to the malicious user. Also, in this scheme, shared data can be exchanged between users, and transaction information is encrypted between a plurality of users to ensure security and reliability thereof.

2) The invention can solve the problem that the user is in the cloud sharing environmentThe problem of collusion. A (p, t) threshold Paillier cryptosystem is adopted to protect the privacy of multi-party data in a block chain. In the present invention, a (p, t) threshold Paillier cipher is applied to the block chain. The private key sk is divided (sk)₁，sk₂，...，sk_p) And is assigned to p participants. If one party wants to decrypt the ciphertext C, at least (t-1) private keys of the other parties need to be aggregated. This is difficult to achieve in practice.

3) The honest users in the invention are equal to each other, and update and maintenance operation of data is performed equally, so that the problem that the data is maintained by traditional central authority CA, third party certification authority TPA and the like, but the security of shared data is maintained by the participation of users in accounting is solved. Meanwhile, the problem that the cloud server is not trusted is solved, the calculated amount is decomposed, and the actual scene needs are met.

Drawings

FIG. 1 is a schematic diagram of a model of the method;

FIG. 2 is a diagram of a data block signature format structure of the method;

FIG. 3 is a schematic view of a user detection process;

FIG. 4 is a memory format of a Merkle tree;

fig. 5 is a project data structure.

Detailed Description

In order to make the invention more comprehensible, preferred embodiments are described in detail below with reference to the accompanying drawings.

As shown in fig. 1, the model of the method is composed of three roles, namely, a data owner (data owner), a Cloud Service Provider (CSP), and a user (user). (1) The data owner firstly encrypts the data and then uploads the data to the cloud server for sharing, wherein the data owner comprises two roles of special sharing and part-time sharing (user). That is, the users in the scene can share all their data. In the Data Owner, a Data Owner group Leader (DOL) is recommended according to the Data sharing contribution rate, and some work of Data operation is responsible, and the DOL is the roles of honest Data sharer and responsible person in the scheme of the invention. (2) The cloud service provider is responsible for data storage of the data owner, is honest and curious, can honestly store data, and can also continuously detect the stored data content. (3) The user is a data demander in the scheme, and the user can continuously access or update the data in the cloud after passing the identity authentication. Meanwhile, the user can also be a data owner in the model, the uploaded data can be updated, and the data of other users can be accessed.

The cloud data sharing method for realizing data tampering prevention and user collusion based on the block chain can be divided into eight parts: initialization, key generation, user detection, file generation and uploading, file sharing, user accounting, user revocation and key updating.

Step 1: the initialization, the initialization part mainly includes the parameter initialization, the user registration and so on, including the following steps:

step 101: two elements H, H0 are selected, and H, H0 ∈ G₁，G₁For cyclic groups, and randomly selecting two prime numbers

Is a non-zero number set. This step is responsible for DOL. The DOL is recommended and selected for a data owner, the DOL has user registration and revocation authority of a user key, other authorities are the same as those of a data common owner, and the detailed formula (1):

step 102: randomly selecting a generator G E G₁And a random integer

Is a non-zero integer set, and then P ═ γ · g, W ═ γ · P, are calculated^q. In addition, the DOL selects two hash functions h₁、h₂Mapping its arbitrary length to G respectively₁Non-zero interval and non-zero point of

Step 103: another integer f is selected, and

after the calculation from step 101 to step 103, the system parameters can be obtained

Wherein

The method is a system encryption algorithm and is mainly used for data encryption.

Step 2: a secret key generation stage, adopting a (p, t) threshold Paillier cryptosystem, wherein: private key sk splitting (denoted as sk)₁，sk₂，...，sk_p) And distributed to p (p > ═ 2) users; t is the number threshold of people needing to decrypt the ciphertext, namely, the ciphertext can be decrypted only by t persons or more than t persons. In a practical scenario, the data is maintained by multiple parties, so if one party wants to decrypt the entire ciphertext C, at least (t-1) private keys of other parities need to be aggregated. In practical situations, it is difficult to achieve collusion. The step 2 specifically comprises the following steps:

step 201: key generation (sk, pk), pk being the public key. The DOL distributes the secret value to the group users as follows:

step 2011: creating a user polynomial f (x), and generating a private key as shown in formula (2):

in the formula (2), the reaction mixture is,

is secret, i.e. the complete private key; a. the_iAll identities representing i users; sk_iTo represent the private key of i user, wherein the value range of i is [1, p ]]In the meantime. Finally, each user has a secret value, i.e. a shared secret key. When they need to be kept secret, the administrator reconstructs the key and sends a very secure channel to the corresponding user.

Step 2012: generating a public key pk

The generation of the public key pk is realized by the existing method. The data owner then sends the ciphertext C to the cloud data center along with the identity-based public key pk.

And step 3: file generation and upload

The file generation and uploading mainly comprises the operation between a data owner and a cloud server, the data owner firstly encrypts a file to be shared and then uploads the encrypted file to a cloud data center, and the method comprises the following steps:

step 301: file generation operations

The method mainly comprises the steps of carrying out blocking and encryption operation on uploaded files, wherein the method is homomorphic encryption. Homomorphic encryption allows users to directly perform ciphertext-specific algebraic operations, obtain results, and perform the same operations on the same plaintext encryption results. The public key pk and the private key sk are generated by a security parameter α. The public key pk is used to encrypt plaintext and the private key sk is used to decrypt ciphertext. Assuming that m is Zn, n is a large positive integer, Z_nIs a set of integers modulo n, the encryption of the plaintext m in the present invention is denoted as E_pk(m) of the reaction mixture. Homomorphic encryption has the attribute:

in the formulae (3) and (4), m₁And m₂Is the plaintext to be encrypted; and a is a constant.

Step 302 File upload

Uploading a file f between a user and a cloud, and carrying out hash operation on the file f, so that H: {0,1}^*→{0，1}^lAnd l denotes the length of the hash. Namely, after the user carries out hash operation on the file f, a hash key K is generated_fH (f), use K_fA unique markup file f is made.

Step 303: in step 301, the encryption algorithm used in the encryption method is introduced, using the formula f^*＝E_pkThe representative file f is encrypted. Since K is mentioned in step 302_fAnd stored locally. Thus, it is possible to provide

Will be stored in the cloud.

Step 304: after the above steps, the user will f^*And

and sending the data to a cloud data center.

And 4, step 4: file sharing, when the user passes the authentication, the user performs the shared data access operation, which comprises the following steps:

step 401: after the user passes the identity authentication, the user can access the data in the cloud sharing;

step 402: when a user needs to update a data block, the user must perform a signature operation on the data block after the data block is updated, and the format of the signature operation performed by the user on the data block is shown in fig. 2. Taking user i as an example, pair data block m at user i_iAfter the update, at data block m_iIn the process, a signature operation is performed, and the signature is composed of an ID_i，m_i，σ_i，S_iFour parts of which ID_iRepresenting a data block m_iId, m of_iRepresenting a data block m_i、σ_iRepresentative signature, S_iRepresenting the identity of the signer. The signature structure diagram is shown in fig. 2.

In the process of data sharing, if data is maliciously tampered by a certain user, other users read the damaged data, and the other users perform collective verification to indicate that the user does not meet the condition of a honest user in sharing, and then delete operation is performed.

The user collective authentication formula is as follows:

equation (5), f (x) is the ciphertext decrypted by the combination of t users.

And when the deleting operation is executed, the DOL destroys the key of the user and the access authority of the data. Meanwhile, other users can record records of dishonest users in the account book of the other users, and when the user makes a data access request next time, the system can execute the operation of rejecting the request.

And 5: user detection cannot ensure that each user is trusted in a user group consisting of blind users, and the possibility that malicious users destroy shared data exists. This will result in the other users in the user group accessing the wrong data. Therefore, user detection needs to be performed in sharing, and the method for performing the sharing revocation operation on the malicious user comprises the following steps

Step 501: user detection

First, DOL broadcasts { N, ID for all members_dol，A_iI is more than or equal to |0 and less than or equal to v-1}, wherein N is h₂(ID_i||t|0≤i≤n-1)，ID_dolIs an identity of DOL, A_iIs a unique identification of a member. Each member is then required to send a verification report. Each user submits A to DOL_i＝γ²*g*t_tmpAnd a signature delta_iF is an integer other than 0,

when the verification is passed, verifying A_i＝W_i*t_tmp(6) Whether or not equal.

Step 502: error discovery

If the verification equation (6) is not equal, DOL requires the current user i to send an error report (N, ID)_j，γ_i，m_t-1). The error report contains the key of user i and the message he receives from the intended user. Subsequently, DOL checks again whether equation (6) holds. If not, the message sent by the user i to other users is different from the message submitted by the user i to the DOL. Therefore, user i must resend the error report within a period of time. If so, the i user is not a malicious user.

In the case where equation (6) does not hold, if user i does not resend the report within threshold t, indicating that user i is an untrustworthy user, user i should be deleted from the user group and the DOL performs the revocation operation of user i. If user i resends the report within threshold t, the equation (6x holds true or not) is re-determined.

And if the verification formula (6) is equal, the current user i is an honest user, the DOL detects other users in the user group, and the detection form and the content are the same as the detection form of the user i. And if a user similar to the user i appears in the detection process, deleting the user. Fig. 3 shows a flowchart of the entire user detection.

Step 6: the method comprises the following steps of publicly accounting, broadcasting after user data access, verifying and recording operation records of other users to the broadcasting user, and the method comprises the following steps:

step 601: and storing the data blocks, wherein all data are stored in the form of the data blocks in the invention. To ensure that the recorded content is authentic and has not been tampered with, the data hash value will be stored in the project structure we build. The hash value of each item is put into the item block structure, so that the search space can be effectively reduced, and the record checking speed of a user is accelerated.

The data block is composed of multiple item blocks, and the hash value is calculatedTo obtain the Merkle root of the data block. The Merkle root is committed to the blockchain so that the data is not tampered with. Each item block stores only the hash value and header information of the item. Each data contains five kinds of information: m is_i、σ_i、ID_i、S_iAnd a hash value. The memory structure and the project data structure of the Merkle tree are shown in fig. 4 and 5, respectively.

Step 602 Intelligent contract

The intelligent contract is used for writing data information into the block chain. The specification of the intelligent contract program is as follows:

step 6021: the user initiates a recording request and takes the public key as the identity authentication of the user.

Step 6022: the delegate node accepts the request and broadcasts the accepted request. If not, no response operation is performed.

Step 6023: the user submits a record that is added to the project on behalf of the node according to the user's public key.

Step 6024: and broadcasting project verification information on behalf of the node, verifying records on behalf of the node, and updating data by other nodes.

Step 6025: the number of project blocks is periodically checked and the Merkle root of the block is calculated. The Merkle roots of all newly generated data blocks are anchored to the blockchain.

Step 6026: returning to step 6021, proceed to execute the next contract operation.

And 7: in order to ensure the security of the shared data, the DOL periodically performs an operation of updating the user key. Meanwhile, in a certain time interval, after the data is maliciously tampered for many times in the model, the DOL initiates a user key updating operation in order to ensure the safety of the data.

Claims

1. A cloud data sharing method for realizing data tampering prevention and user collusion based on a block chain is characterized by comprising the following steps:

step 1, obtaining system parameters through initialization calculation

is a non-zero integer set; H. h₀To belong to the circulation group G₁Two elements of (a); h₁＝ξ₁·H₀，H₂＝ξ₂·H₀，ξ₁、ξ₂Is an integer that is randomly selected and is,

is a non-zero number set;

is an encryption algorithm;

step 2, a (p, t) threshold Paillier cryptosystem is adopted, the private key sk is separated and distributed to p users, p > is 2, in the distribution process, a data owner group leader DOL is recommended according to the data sharing contribution rate, the distribution of the user private key is responsible for by the data owner group leader DOL, and the data owner group leader DOL only has the functions of private key distribution and verification;

the data owner group leader DOL sends the secret key to a corresponding user through a secure channel;

step 3, generating a file by adopting a homomorphic encryption method, and then uploading the file to a cloud server;

step 4, when the user passes the authentication, the user performs the shared data access operation, when the user needs to update the data block, the user must perform the signature operation on the data block after the data block is updated, and the user i is set to perform the signature operation on the data block m_iAfter the update, at data block m_iIn the process, a signature operation is performed, and the signature is composed of an ID_i,m_i,σ_i，S_iFour components, wherein, ID_iFor a data block m_iId, m of_iFor a data block m_i、σ_iIs a signature, S_iIs the identity of the signer;

step 501, each member submits A to the data owner group leader DOL_i＝γ²*g*t_tmpAnd a signature delta_i，A_iFor unique identification of member i, verify A_i＝W_i*t_tmpIf the determination is true, if the determination is false, the step 502 is executed, and if the determination is true, the step 503 is executed;

step 502, the member i sends an error report to the data owner group leader DOL, where the error report is (N, ID)_i,γ_i,m_t-1) In the formula: n ═ h₂(ID_iI is more than or equal to | t |0 and less than or equal to n-1), and t is an effective time threshold of the error report; gamma ray_iA random number selected to represent member i; m is_t-1To indicate a block of data updated at time t-1, the data owner group leader DOL checks against the error report A_i＝W_i*t_tmpWhether the member is a malicious user or not is judged, if so, the member is not the malicious user; if not, the member i is sent to other membersThe member's message is different from the message submitted by member i to the data owner group leader DOL, and member i must resend the error report within a period of time, if member i resends the error report within threshold t, the data owner group leader DOL rechecks A according to the error report_i＝W_i*t_tmpIf the member i is not in the threshold value t, the error report is not sent again, the member i is indicated to be an untrusted node, the member i is deleted from the member, and the data owner group leader DOL executes the revocation operation of the member i;

step 6, open accounting, after user data access, broadcasting, verifying and recording operation records of the broadcasting users by other users, applying for initiating error verification operation after a plurality of users find errors in the whole sharing process, and allowing at least t members to participate in verification, wherein all data are stored in a data block mode:

in order to ensure that the recorded content is credible and is not tampered, a data hash value is stored in an item block structure, a data block is composed of a plurality of item blocks, and the hash value is calculated to obtain a Merkle root of the data block; the Merkle root is submitted to the blockchain so that the data cannot be tampered, and each item block only stores the hash value and the header information of the item;

each data contains five kinds of information: ith data block m_iC, signature σ_iData block m_iId of (2), identity of signer S_iThe user records the request, takes the public key as the identity and realizes the updating operation of the node information by representing whether the node receives the broadcast request or not;

step 7, key updating: