CN109508552B - Privacy protection method of distributed cloud storage system - Google Patents

Abstract

The invention discloses a privacy protection method of a distributed cloud storage system, which comprises a user, a miner and a storage provider, and realizes the operations of system initialization, file uploading, file sharing, file downloading, file deletion and the like. The invention combines the distributed cloud storage system with the block chain technology, takes the file ownership processing process as transaction processing, and realizes the privacy protection of the file ownership processing process in the distributed cloud storage system, including the hiding of a sender, a receiver and transaction contents. In addition, the invention can effectively resist replay attack and data forgery attack while ensuring the privacy of the user.

Description

Privacy Protection Method of Distributed Cloud Storage System

technical field

The invention relates to a distributed storage technology, in particular to a privacy protection method of a distributed cloud storage system.

Background technique

With the development of cloud storage technology, users can easily outsource data to the cloud, and share, download, and modify data in the cloud. However, the traditional cloud storage model almost exclusively relies on centralized cloud servers to provide services. This client-server trust-based model has some inherent weaknesses and is vulnerable to attacks, such as man-in-the-middle attacks, malware attacks, central Servers that are decentralised may also cause data unavailability and leakage of user privacy due to technical failures. Distributed cloud storage can better solve these problems. Common distributed cloud storage systems include HDFS, Ceph, Pangu, etc. The distributed cloud storage system removes the centralized server and ensures the reliability of data. At the same time, it also has the advantages of large storage capacity, high throughput, high service availability, efficient operation and maintenance, and low cost.

In addition, the rapid development of blockchain technology makes more and more applications use blockchain in distributed cloud storage. The introduction of blockchain provides a reward mechanism for the system, allowing more users to participate in the system. Further, the tamper-proof function of blockchain can be used to provide convenience for cloud storage systems and increase security. This improvement makes blockchain-based distributed cloud storage systems more and more popular. Distributed cloud storage systems include Storj, IPFS, etc.

Blockchain-based distributed cloud storage systems do not have centralized servers. Therefore, it has some advantages that the centralized cloud storage model does not have: first, without a centralized server, the problem of data unavailability caused by server failure and server security loopholes is greatly reduced; second, the use of user-side encryption ensures data Security, the use of recoverability proofs to ensure data integrity; in addition, an open storage market can reduce storage costs, and has certain advantages in resisting censorship, external intervention, and unauthorized access.

Taking Storj as an example, the storage process of distributed cloud storage: Storj encourages users to rent their free hard disk space to the network to form a distributed storage space. Such users are called farmers, which are equivalent to miners in the Bitcoin network. . When a user wants to upload a file, first, the user blocks and encrypts the file on the client side, and then stores it in a decentralized manner on the network, and uses a distributed hash table (DHT) to store the location information of the file fragments. Fragmented file access can better protect data security because no farmer has a complete copy. Second, to ensure file availability, Storj provides recoverability proofs and redundancy strategies. In addition, Storj uses the blockchain to record information, rather than a centralized database. The file content is not stored on the blockchain, but the metadata of the file, including the hash of the file, the merkle root, and other necessary information. Finally, Storj provides a reward mechanism that provides token rewards to blockchain miners and farmers who provide storage space. However, Storj uses a Nakamoto-style blockchain, and the ledger is open, and everyone can see every transaction in it and the trace of the transaction, so there is a privacy leak problem.

There has been some work on the issue of blockchain data privacy protection. DASH uses mixing technology to provide payment confidentiality by mixing different transactions and then distributing them to recipients, thereby achieving transaction anonymity. ZCASH uses zero-knowledge proof technology, which guarantees that only those with the viewing key can see the contents of the transaction. Users have full control, and they can choose to provide viewing keys to others. Monero completely hides the transaction, and can hide the transaction sender, receiver, and transaction content. For the privacy protection scheme of distributed cloud storage, there are some works, mainly to hide the reward mechanism of distributed cloud storage, to realize the privacy protection of the token transaction process in the process of distributed cloud storage, and to protect the transaction sender, The recipient and transaction content are hidden. For the transaction sender, the ring signature is used for hiding; for the transaction receiver, the hidden address technology is used; for the transaction content, the currency mixing method is used. However, this solution only protects the privacy of the token transaction process of distributed cloud storage. For the file storage process, the problem of privacy leakage still exists.

SUMMARY OF THE INVENTION

Purpose of the invention: The purpose of the present invention is to solve the deficiencies in the prior art, and to provide a privacy protection method for a distributed cloud storage system. The present invention realizes the privacy protection in the distributed cloud storage process, and not only realizes the privacy protection in the transaction process. , and realize user-related and file-related privacy protection in the storage process.

Technical solution: a privacy protection method for a distributed cloud storage system of the present invention, the distributed cloud storage system includes users, miners and storage providers; users include data owners μ _i and data users μ _j , and data owners The user μ _i uses system services to outsource the data to the storage provider for download and deletion operations, while the data owner μ _i shares the file with the data user μ _j ; miners and storage providers provide users with distributed cloud storage services, Among them, miners are responsible for packaging blocks and maintaining blocks, and storage providers rent their free hard disk space to the network to form distributed storage space; in addition, miners and storage providers obtain token rewards for providing services;

The privacy protection method specifically includes the following steps:

(1) System initialization: input common parameters (l, G), l is the prime order of the base point, G is the base point of the elliptic curve; the user selects random numbers a∈[1,l-1], b∈[1,l- 1] Form a private key pair (a, b), a≠b; at the same time, the user calculates A=aG, B=bG as the public key pair (A, B); in addition, the user calculates the ripemd160(sha256(A,B) ) as its standard address and also as its ID;

l=2 ²⁵² +27742317777372353535851937790883648493;

(2) file upload, that is, the data owner μ _i will upload the file F _i to the distributed storage system;

(3) File deletion, that is, the data owner μ _i wants to delete his ownership of the file F _i ;

(4) File sharing, that is, the owner μ _{i of the file F i grants} the data user μ _j the ownership of the file F _i ;

(5) File download.

Further, the detailed process of the step (2) is as follows:

例如SHA-256，并计算文件F_i的哈希值hash_i＝H(F_i)，然后数据所有者μ_i向系统广播上传请求：(2.1) The data owner μ _i selects the hash function

For example, SHA-256, and calculate the hash value of file F _i , hash _i =H(F _i ), and then the data owner μ _i broadcasts the upload request to the system:

为数据所有者μ_i的标准地址；Among them, hash _i is the hash value of file F _i ,

is the standard address of the data owner μ _i ;

(2.2) When the system receives the upload request from the data owner μ _i , the miners in the system begin to execute the proof-of-work algorithm POW to strive for the right of bookkeeping (that is, the right to package the transaction); after executing the POW algorithm, it is assumed that the miner Node _j obtains the to the accounting right; then the miner Node _j notifies the data owner μ _i to start uploading files:

Node _j →μ _i :upload,hash _i

(2.3) When the data owner μ _i receives the upload instruction, μ _i uses the homomorphic encryption algorithm AES256-CTR to encrypt the file F _i on the client side: F _i ′=Enc(F _i ), where the encryption key is the file hash Then, μ _{i divides the encrypted file F i ′} into blocks on the client side to obtain file fragments {shard ₁ , shard ₂ ,..., shard _n }, wherein the size of each fragment is 8M, which is not enough The 8M space is filled with 0; then the data owner μ _i obtains each fragment hash {hash _sh1 , hash _sh2 ,..., hash _shn } and establishes a Merkle Tree for file auditing; finally, μ _i fragments the file Distributed storage in the system, and generate file index in distributed hash table (DHT); at the same time, miner Node _j packs file metadata (Merkle root, file hash value, etc.) into blocks, where metadata={ hash _i , MerkleRoot _i }; the miner Node _j notifies the data owner μ _i to start packaging transactions:

Node _j → μ _i : transaction, hash _i

(2.4) When the data owner μ _i receives the transaction packaging instruction, μ _i starts to generate the file upload transaction Tx _k , and the transaction sender and receiver in the upload transaction are both the data owner μ _i .

Further, the specific process of generating the file upload transaction in the step (2.4) is as follows:

交易公钥R_k＝r_kG，其中

为数据所有者μ_i的公钥对，

为密码散列函数；(2.4.1) μ _i selects a random number r _k ∈[1,l-1]; then μ _i calculates the hidden address

The transaction public key R _k =r _k G, where

is the public key pair of the data owner μ _i ,

is a cryptographic hash function;

其中，

为确定性哈希函数；(2.4.2) μ _i selects a random number x _k ∈ [1,l-1] as the private key, and calculates the corresponding public key PK _k = x _k G, the key mirror image

in,

is a deterministic hash function;

作为交易内容Proof_k，用于授予交易接收方文件所有权，并可用于文件所有权验证，其中

R为随机数，

为μ_i的标准地址，同时作为对称加密密钥；(2.4.3) μ _i is calculated using symmetric encryption algorithm

As the transaction content Proof _k , it is used to grant the transaction recipient file ownership and can be used for file ownership verification, where

R is a random number,

is the standard address of μ _i , and is also used as a symmetric encryption key;

(2.4.4) μ _i packs R _k , P _k , I _k and Proof _k into the transaction Tx _k , then μ _i calculates the ring signature σ _k , signs the transaction Tx _k and sends it to the network; any party in the network can Transaction signatures can be verified without revealing the sender of the transaction;

(2.4.5) The miner node Node _j verifies the transaction and packs the transaction into the block;

Among them, the data owner μ _i as the transaction receiver sends the transaction Tx _k information P _k , I _k , Proof _k to the miner node Node _j to verify μ _i 's ownership of the file F _i and use it for consumption (share, delete, download operations) .

Further, in described step (3), the detailed process that data owner deletes file ownership is as follows:

(3.1) First, the data owner μ _i broadcasts a deletion request to the system:

为数据所有者μ_i标准地址；Among them, hash _i is the hash of the file F _i ; P _k is the hidden address of the transaction that can prove the ownership of μ _i to the file F _i ,

is the standard address of the data owner _μi ;

(3.2) When the system receives the deletion request of μ _i , the miners in the system start to execute the proof-of-work algorithm POW to strive for the accounting right; after executing the POW algorithm, it is assumed that the miner node Node _j obtains the accounting right;

(3.3) The miner node Node _j verifies the ownership of the file F _i by μ _i ;

(3.4) After the data owner μ _i passes the ownership verification, the miner node Node _j obtains its key image I _k from the transaction whose address is P _k , adds I _k to the transaction invalidation list Blacklist, and broadcasts it to the entire network; After receiving the broadcast, the miner nodes in the network update the transaction invalidation list Blacklist;

The above ownership verification methods are:

Further, in the step (4), the detailed process of the data owner μ _i to share the file F _i to the data user μ _j is as follows:

(4.1) First, μ _i broadcasts a sharing request to the system:

分别为数据所有者μ_i和数据使用者μ_j的标准地址；Among them, hash _i is the hash of the file F _i ; P _k is the hidden address of the transaction that can prove the ownership of the file F _i by μ _i ;

are the standard addresses of data owner μ _i and data user μ _j , respectively;

(4.2) When the system receives the sharing request of μ _i , the miners in the system start to execute the proof-of-work algorithm POW to strive for the accounting right; after the POW algorithm is executed, it is assumed that the miner node Node _j obtains the accounting right;

(4.3) The miner node Node _j verifies the ownership of the file F _i by μ _i ;

(4.4) After μ _i passes the ownership verification, Node _j sends a sharing instruction to μ _i :

(4.5) When μ _i receives the instruction, it starts to generate the file sharing transaction Tx _τ , where μ _i is the transaction sender and μ _j is the transaction receiver;

计算

判断

其中，

为密码散列函数；由于

如果μ_j为该交易的接收方，则等式成立；反之，不成立；(4.6) μ _j , as the transaction receiver, checks the transaction in each newly generated block, extracts the hidden address P and the transaction public key R′ in the transaction, and uses its own private key pair

calculate

judge

in,

is a cryptographic hash function; since

If μ _j is the receiver of the transaction, the equation holds; otherwise, it does not hold;

μ_j使用x_τ恢复交易Tx_τ，并在消费交易(分享、下载、删除)Tx_τ时使用x_τ作为交易私钥。(4.7) After μ _j finds the transaction Tx _τ , μ _j calculates

μ _j restores the transaction Tx _τ using x _τ , and uses x _τ as the transaction private key when consuming the transaction (sharing, downloading, deleting) Tx _τ .

Further, the method for file sharing transaction generation in the step (4.5) is:

然后μ_i计算隐匿地址

交易公钥R_τ＝r_τG，其中，

为密码散列函数；(4.5.1) The transaction sender μ _i selects a random number r _τ ∈[1,l-1], and obtains the public key pair of the transaction receiver μ _j

Then _μi computes the stealth address

The transaction public key R _τ =r _τ G, where,

is a cryptographic hash function;

作为交易内容Proof_τ，用于授予交易接收方文件所有权，并可用于文件所有权验证，其中

R为随机数，加密密钥为μ_j的标准地址

(4.5.2) The transaction sender μ _i uses the symmetric encryption algorithm to calculate

As the transaction content Proof _τ , it is used to grant the transaction recipient file ownership and can be used for file ownership verification, where

R is a random number, and the encryption key is the standard address of μ _j

其中，

为确定性哈希函数；(4.5.3) The transaction sender μ _i selects the random number x _τ ∈[1,l-1], which is also used as the signature private key, and calculates the corresponding public key PK _τ = x _τ G, the key mirror image

in,

is a deterministic hash function;

(4.5.4) The transaction sender μ _i packs R _τ , P _τ , I _τ and Proof _τ into the transaction Tx _τ , further, μ _i calculates the ring signature σ _τ , signs the transaction Tx _τ and sends it to the network, Any party in the network can verify the transaction signature without revealing the transaction sender;

(4.5.5) The miner node Node _j verifies the transaction and packs the transaction into the block.

In the present invention, Tx _k is a file upload transaction, Tx _τ is a file sharing transaction, the transaction sender and receiver of Tx _k are both data owners μ _i , the transaction sender of Tx _τ is μ _i , and the transaction receiver is μ _j .

Further, the detailed process of (5) is as follows:

(5.1) The data owner μ _i broadcasts the download request to the system:

为数据所有者μ_i标准地址；Among them, hash _i is the hash of the file F _i ; P _k is the hidden address of the transaction that can prove the ownership of μ _i to the file F _i ,

is the standard address of the data owner _μi ;

(5.2) When the system receives the download request of μ _i , the miners in the system start to execute the proof-of-work algorithm (POW) to strive for the accounting right; after executing the POW algorithm, it is assumed that the miner node Node _j obtains the accounting right;

(5.3) The miner node Node _j verifies the ownership of μ _i to the file F _i ;

(5.4) After μ _i passes the ownership verification, Node _j queries the actual file storage address addr _i in the DHT network, and returns the download address addr _i to μ _i :

Node _j →μ _i :hash _i ,addr _i ;

(5.5) μ _i uses the download tool to restore the file from the address addr _i to the local.

The ring signature generation method in the present invention is as follows:

The ring signature verification method of the present invention is:

Beneficial effect: Compared with the prior art, the present invention has the following advantages:

1. The present invention combines the distributed storage technology with the blockchain technology. While realizing safe and effective distributed cloud storage, the process of file ownership is regarded as the processing of the blockchain transaction process, and the distributed storage process is further realized. The privacy protection of the transaction, including the privacy protection of the transaction sender, receiver and transaction content, ensures that only the real receiver can accurately locate the transaction, obtain the ownership of the file, and further perform the file processing process (file sharing, downloading , delete, etc.).

2. The solution of the present invention can effectively resist data forgery attacks: in the system model of the present invention, a malicious user may initiate a data forgery attack on the system, that is, a user without file ownership attempts to send transactions that do not belong to him to the system. Defrauding file ownership. In order to deal with data forgery attacks, the present invention designs an ownership verification scheme, which ensures that only authorized users with correct standard addresses can complete ownership verification. Since the user's standard address is only disclosed to miners and transaction parties, it can resist data forgery attacks.

3. The solution of the present invention can effectively resist replay attacks: in the system model of the present invention, a malicious user may launch a replay attack on the system, that is, a user whose file ownership has been cancelled may use his original transaction to attack the system. Prove its ownership. To deal with replay attacks, the solution of the present invention uses the transaction invalidation list Blacklist to record invalid transactions. When the user is revoked the ownership of the file, the corresponding transaction will be added to the transaction invalidation list. Further, before performing ownership verification, the system first checks whether the transaction is in the transaction invalidation list. If the transaction exists in the invalidation list, the ownership verification cannot be passed. Thus, replay attacks can be resisted.

Description of drawings

1 is a system structure diagram in an embodiment of the present invention;

Fig. 2 is the block structure diagram in the embodiment of the present invention;

3 is a transaction structure diagram in an embodiment of the present invention;

4 is a schematic diagram of transaction generation in an embodiment of the present invention;

5 is a schematic diagram of a transaction search in an embodiment of the present invention;

FIG. 6 is a time-cost relationship diagram of ring signature generation and ring signature verification under different ring sizes in the embodiment.

Detailed ways

The technical solutions of the present invention are described in detail below, but the protection scope of the present invention is not limited to the embodiments.

As shown in FIG. 1, a privacy protection method for a distributed cloud storage system of the present invention, the distributed cloud storage system includes users, miners and storage providers; users include data owner μ _i and data user μ _j , the data owner μ _i outsources the data to the storage provider for download and deletion operations, and the data owner μ _i can share the file with the data user μ _j ; miners and storage providers provide users with distributed cloud storage services , among which, miners are responsible for packing blocks and maintaining blocks, and storage providers rent their free hard disk space to the network to form distributed storage space; in addition, miners and storage providers obtain token rewards for providing services;

The privacy protection method specifically includes the following steps:

Step 1. System initialization: input the public parameters (l, G), where l is the prime order of the base point, and G is the base point of the elliptic curve; the user selects random numbers a∈[1,l-1], b∈[1,l- 1] Form a private key pair (a, b), a≠b; at the same time, the user calculates A=aG, B=bG as the public key pair (A, B); in addition, the user calculates the ripemd160(sha256(A,B) ) as its standard address and also as its ID;

l=2 ²⁵² +27742317777372353535851937790883648493;

Step 2, file upload, that is, the data owner μ _i will upload the file F _i to the distributed storage system; the detailed process of step (2) is shown in Figure 4:

例如SHA-256，并计算文件F_i的哈希值hash_i＝H(F_i)，然后数据所有者μ_i向系统广播上传请求：(2.1) The data owner μ _i selects the hash function

For example, SHA-256, and calculate the hash value of file F _i , hash _i =H(F _i ), and then the data owner μ _i broadcasts the upload request to the system:

为数据所有者μ_i的标准地址；Among them, hash _i is the hash value of file F _i ,

is the standard address of the data owner μ _i ;

(2.2) When the system receives the upload request from the data owner μ _i , the miners in the system begin to execute the proof-of-work algorithm POW to strive for the right of bookkeeping (that is, the right to package the transaction); after executing the POW algorithm, it is assumed that the miner Node _j obtains the to the accounting right; then the miner Node _j notifies μ _i to start uploading files:

Node _j →μ _i :upload,hash _i

(2.3) When the data owner μ _i receives the upload instruction, μ _i uses the homomorphic encryption algorithm AES256-CTR to encrypt the file F _i on the client side: F _i ′=Enc(F _i ), where the encryption key is the file hash Then, μ _{i divides the encrypted file F i ′} into blocks on the client side to obtain file fragments {shard ₁ , shard ₂ ,..., shard _n }, wherein the size of each fragment is 8M, which is not enough The 8M space is filled with 0, as shown in Figure 2; then the data owner μ _i obtains each fragment hash {hash _sh1 , hash _sh2 ,..., hash _shn } and establishes a Merkle Tree for file auditing; finally , μ _i stores the file fragments scattered in the system, and generates the file index in the distributed hash table (DHT); at the same time, the miner Node _j packs the file metadata (Merkle root, file hash value, etc.) into the zone block, where metadata={hash _i , MerkleRoot _i }; the miner Node _j notifies the data owner μ _i to start packaging transactions:

Node _j → μ _i : transaction, hash _i

(2.4) When the data owner μ _i receives the transaction packaging instruction, it starts to generate the upload transaction Tx _k , and the transaction sender and receiver in the upload transaction are both the data owner μ _i .

As shown in Figure 3, the specific process of transaction generation in step (2.4) is as follows:

交易公钥R_k＝r_kG，其中

为μ_i的公钥对，

为密码散列函数；(2.4.1) μ _i selects a random number r _k ∈[1,l-1]; then μ _i calculates the hidden address

The transaction public key R _k =r _k G, where

is the public key pair of μ _i ,

is a cryptographic hash function;

其中，

为确定性哈希函数；(2.4.2) μ _i selects a random number x _k ∈ [1,l-1] as the private key, and calculates the corresponding public key PK _k = x _k G, the key mirror image

in,

is a deterministic hash function;

作为交易内容Proof_k，用于授予交易接收方文件所有权，并可用于文件所有权验证，其中

R为随机数，

为μ_i的标准地址，同时作为对称加密密钥；(2.4.3) μ _i is calculated using symmetric encryption algorithm

As the transaction content Proof _k , it is used to grant the transaction recipient file ownership and can be used for file ownership verification, where

R is a random number,

is the standard address of μ _i , and is also used as a symmetric encryption key;

(2.4.4) μ _i packs R _k , P _k , I _k and Proof _k into the transaction Tx _k , then μ _i calculates the ring signature σ _k , signs the transaction Tx _k and sends it to the network; any party in the network can Transaction signatures can be verified without revealing the sender of the transaction;

(2.4.5) The miner node Node _j verifies the transaction and packs the transaction into the block;

Among them, the data owner μ _i as the transaction receiver sends the transaction Tx _k information P _k , I _k , Proof _k to the miner node Node _j to verify μ _i 's ownership of the file F _i and use it for consumption (share, delete, download operations) .

Step 3, file deletion, that is, if the data owner μi wants to delete his ownership of the file F _{i ,} the detailed process is as follows:

(3.1) First, the data owner μ _i broadcasts a deletion request to the system:

为数据所有者μ_i标准地址；Among them, hash _i is the hash of the file F _i ; P _k is the hidden address of the transaction that can prove the ownership of μ _i to the file F _i ,

is the standard address of the data owner _μi ;

(3.2) When the system receives the deletion request of μ _i , the miners in the system start to execute the proof-of-work algorithm POW to strive for the accounting right; after executing the POW algorithm, it is assumed that the miner node Node _j obtains the accounting right;

(3.3) The miner node Node _j verifies the ownership of the file F _i by μ _i ;

(3.4) After the data owner μ _i passes the ownership verification, the miner node Node _j obtains its key image I _k from the transaction whose address is P _k , adds I _k to the transaction invalidation list Blacklist, and broadcasts it to the entire network; After receiving the broadcast, the miner nodes in the network update the transaction invalidation list Blacklist;

The above ownership verification methods are:

Step 4: File sharing, that is, the owner μ _{i of the file F i grants} the data user μ _j the ownership of the file F _i . The detailed process is as follows:

(4.1) First, the data owner μ _i broadcasts a sharing request to the system:

分别为数据所有者μ_i和数据使用者μ_j的标准地址；Among them, hash _i is the hash of the file F _i ; P _k is the hidden address of the transaction that can prove the ownership of the file F _i by μ _i ;

are the standard addresses of data owner μ _i and data user μ _j , respectively;

(4.2) When the system receives the sharing request of μ _i , the miners in the system start to execute the proof-of-work algorithm POW to strive for the accounting right; after the POW algorithm is executed, it is assumed that the miner node Node _j obtains the accounting right;

(4.3) The miner node Node _j verifies the ownership of the file F _i by μ _i ;

(4.4) After μ _i passes the ownership verification, Node _j sends a sharing instruction to μ _i :

(4.5) When μ _i receives the instruction, it starts to generate transaction Tx _τ , where μ _i is the transaction sender and μ _j is the transaction receiver;

计算

判断

其中，

为密码散列函数；由于

如果μ_j为该交易的接收方，则等式成立；反之，不成立；(4.6) As shown in Figure 5, μ _j , as the transaction receiver, checks the transaction in each block, extracts the hidden address P and the transaction public key R' in the transaction, and uses its own private key pair

calculate

judge

in,

is a cryptographic hash function; since

If μ _j is the receiver of the transaction, the equation holds; otherwise, it does not hold;

μ_j使用x_τ恢复交易Tx_τ，并在消费交易(分享、下载、删除)Tx_τ时使用x_τ作为交易私钥。(4.7) After μ _j finds the transaction Tx _τ , μ _j calculates

μ _j restores the transaction Tx _τ using x _τ , and uses x _τ as the transaction private key when consuming the transaction (sharing, downloading, deleting) Tx _τ .

The transaction generation method in the above step (4.5) is:

然后μ_i计算隐匿地址

交易公钥R_τ＝r_τG，其中，

为密码散列函数；(4.5.1) The transaction sender μ _i selects a random number r _τ ∈[1,l-1], and obtains the public key pair of the transaction receiver μ _j

Then _μi computes the stealth address

The transaction public key R _τ =r _τ G, where,

is a cryptographic hash function;

作为交易内容Proof_τ，用于授予交易接收方文件所有权，并可用于文件所有权验证，其中

R为随机数，加密密钥为μ_j的标准地址

(4.5.2) The transaction sender μ _i uses the symmetric encryption algorithm to calculate

As the transaction content Proof _τ , it is used to grant the transaction recipient file ownership and can be used for file ownership verification, where

R is a random number, and the encryption key is the standard address of μ _j

其中，

为确定性哈希函数；(4.5.3) The transaction sender μ _i selects the random number x _τ ∈[1,l-1], which is also used as the signature private key, and calculates the corresponding public key PK _τ = x _τ G, the key mirror image

in,

is a deterministic hash function;

(4.5.4) The transaction sender μ _i packs R _τ , P _τ , I _τ and Proof _τ into the transaction Tx _τ , and μ _i calculates the ring signature σ _τ , signs the transaction Tx _τ and sends it to the network. Either party can verify the transaction signature without revealing the sender of the transaction;

(4.5.5) The miner node Node _j verifies the transaction and packs the transaction into the block.

Step 5. The detailed process of file download is as follows:

(5.1) The data owner μ _i broadcasts the download request to the system:

为数据所有者μ_i标准地址；Among them, hash _i is the hash of the file F _i ; P _k is the hidden address of the transaction that can prove the ownership of μ _i to the file F _i ,

is the standard address of the data owner _μi ;

(5.2) When the system receives the download request of μ _i , the miners in the system start to execute the proof-of-work algorithm (POW) to strive for the accounting right; after executing the POW algorithm, it is assumed that the miner node Node _j obtains the accounting right;

(5.3) The miner node Node _j verifies the ownership of μ _i to the file F _i ;

(5.4) After μ _i passes the ownership verification, Node _j queries the actual file storage address addr _i in the DHT network, and returns the download address addr _i to μ _i :

Node _j →μ _i :hash _i ,addr _i ;

(5.5) μ _i uses the download tool to restore the file from the address addr _i to the local.

Example

In order to evaluate the performance of the present invention, the time overhead of some algorithms is measured in the following embodiment.

In order to evaluate the system overhead, the implementation process adopts the open source DigitalNote platform based on the CryptoNote protocol, and completes the implementation of the relevant algorithms according to the system requirements. In order to evaluate the system overhead, the test chain experimental environment was deployed locally during the implementation process, in which three miner nodes and three wallet terminals were deployed locally for experiments, and the time overhead of the main algorithm of the main steps of the system was analyzed and carried out. Measurement of time overhead. Among them, T _File is the time overhead of file processing on the client side, including file hash operation time, file block operation time, and file block upload time; T _Tx is the time for generating transaction operations on the user side, including the time for calculating the destination address. , calculation time of ring signature operation, time of sending transaction operation; in addition, T _del , T _chk , T _POW , T _DHT are the time of delete transaction operation, the time of transaction verification operation, the time of file ownership verification operation and the time of DHT query respectively time. See Table 1 for a summary of the time cost analysis of each stage.

Table 1 System time overhead analysis table

In addition, the time overhead of the algorithm in this embodiment is shown in Table 2.

Table 2 Time cost of main algorithms

algorithm time overhead generate destination address 36ms send transaction 31ms Create transaction 0.0093ms Find deals 22ms Generate key image 0.164ms

In addition, as shown in Fig. 6, it is the ring signature generation time and the ring signature verification time in the case of different ring sizes.

Claims (5)

1. A privacy protection method of a distributed cloud storage system is characterized in that: the distributed cloud storage system comprises users, miners and storage providers; the user is the entity using the system service, including the data owner mu_iAnd data user mu_jData owner μ_iOutsourcing the data to a storage provider and using system services for download and deletion operations, while the data owner mu_iFile F_iSharing to data user mu_j(ii) a The method comprises the steps that a miner and a storage provider provide cloud storage service for a user, wherein the miner is responsible for packing blocks and maintaining the blocks, and the storage provider rents free hard disk space to a distributed storage space formed by a network; in addition, miners and storage providers receive rewards for tokens by providing services;

the privacy protection method specifically comprises the following steps:

(1) initializing a system: inputting common parameters (l, G), wherein l is a prime order of a base point, and G is the base point of an elliptic curve; a user selects a random number a belonging to [1, l-1], b belonging to [1, l-1] to form a private key pair (a, b), wherein a is not equal to b; meanwhile, the user calculates a ═ aG and B ═ bG as a public key pair (a, B); in addition, the user calculates ripemd160(sha256(a, B)) as its standard address and also as its ID;

l＝2²⁵²+27742317777372353535851937790883648493；

(2) file upload, i.e. data owner mu_iTo be matched with file F_iUploading to a distributed storage system; the detailed process of the step (2) is as follows:

(2.1) data owner μ_iSelecting a Hash function H:

and calculates the file F_iHash value hash of_i＝H(F_i) Then data owner μ_iBroadcasting an upload request to the system:

wherein, the hash_iAs a file F_iThe hash value of (a) of (b),

for data owner mu_iThe standard address of (2);

(2.2) when the system receives the data owner mu_iThe miners in the system begin to execute the workload certification algorithm POW to strive for the billing right; after the POW algorithm is executed, the miners Node is assumed_jAcquiring the billing right; then the miner Node_jNotifying data owner mu_iStarting to upload the file:

Node_j→μ_i:upload,hash_i

(2.3) when data owner is mu_iReceiving an upload instruction, data owner mu_iEncrypting file F at client side using a homomorphic encryption algorithm AES256-CTR_i：F_i′＝Enc(F_i) Wherein the encryption key is a file hash_i(ii) a Then, mu_iOn the client side, the encrypted file F_i' obtaining file fragment by blocking₁,shard₂,...,shard_n-wherein each fragment has a size of 8M, and less than 8M of space is filled with 0; then data owner μ_iSolving each fragment hash { hash_sh1,hash_sh2,...,hash_shnEstablishing a Merkle Tree for file auditing; last mu_iStoring the file fragments in the system in a scattered manner, and generating a file index in a DHT (distributed hash table); meanwhile, the miner Node_jPacking file metadata into a block, wherein metadata is { hash } ═ hash_i,MerkleRoot_i}; miner Node_jNotifying data owner mu_iStarting a packaging transaction:

Node_j→μ_i:transaction,hash_i

(2.4) when data owner is mu_iReceiving a transaction packaging instruction, mu_iInitiating a File upload transaction Tx_kIn the uploading transaction, the transaction sender and the transaction receiver are both the data owner mu_i；

The specific process of file upload transaction generation in (2.4) above is as follows:

(2.4.1)μ_iselecting a random number r_k∈[1,l-1](ii) a Then mu_iComputing a hidden address

Transaction public key R_k＝r_kG, wherein

Is mu_iThe public key pair of (a) is,

is a passwordA hash function;

(2.4.2)μ_iselecting a random number x_k∈[1,l-1]As a private key and calculates the corresponding public key PK_k＝x_kG, key mirroring

Wherein,

is a deterministic hash function;

(2.4.3)μ_icomputing using symmetric cryptographic algorithms

As a transaction content Proof_kFor granting ownership of the file to the transaction recipient and for verification of the ownership of the file, wherein

R is a random number, and R is a random number,

is mu_iThe standard address of (2) and simultaneously used as a symmetric encryption key;

(2.4.4)μ_ir is to be_k，P_k，I_kAnd Proof of_kPacked in transaction Tx_kThen mu_iCalculating the Ring signature σ_kTo transaction Tx_kSigning and sending to a network; any party in the network can verify the transaction signature and can not reveal the information of the transaction sender;

(2.4.5) Miner Node_jVerifying the transaction and packaging the transaction into a block; here, data owner μ_iSending a transaction Tx to a system as a transaction receiver_kInformation P_k，I_k，Proof_kTo verify mu_iFor filesF_iAnd for consumption;

(3) file deletion, i.e. data owner mu_iTo delete its file F_iOwnership of (1);

(4) file sharing, i.e. file F_iData owner mu of_iGranting data to user mu_jFile F_iOwnership of (1);

(5) and (5) downloading the file.

2. The privacy protection method of the distributed cloud storage system according to claim 1, wherein: the detailed process of deleting the ownership of the file by the data owner in the step (3) is as follows:

(3.1) first, data owner μ_iBroadcasting a delete request to the system:

wherein, the hash_iAs a file F_iHashing; p_kIs capable of proving mu_iFor file F_iThe covert address of the transaction for ownership of,

for data owner mu_iA standard address;

(3.2) when the system receives the data owner mu_iThe miners in the system begin to execute the workload certification algorithm POW to gain the accounting right; after the POW algorithm is executed, a miner Node is assumed_jAcquiring the billing right;

(3.3) Miner Node_jVerification of mu_iFor file F_iOwnership of (1);

(3.4) when the owner of data is mu_iAfter passing ownership verification, the miner Node_jThe slave address is P_kTo obtain its key image I_kAnd is combined with_kAdding the transaction invalidation list into the transaction invalidation list and broadcasting the transaction invalidation list to the whole network miner nodes; in a networkThe miner node updates the transaction invalidation list Blacklist after receiving the broadcast;

the ownership verification method comprises the following steps:

wherein R is_k′,hash_i′,MAC_k' is decryption Proof_k' the meanings of the contents acquired later correspond to the Proof_kR in (1)_k、hash_i、MAC_k。

3. The privacy protection method of the distributed cloud storage system according to claim 1, wherein: data owner mu in the step (4)_iSharing file F_iTo data user mu_jThe detailed process is as follows:

(4.1) first, μ_iBroadcasting a sharing request to a system:

wherein, the hash_iAs a file F_iHashing; p_kIs capable of proving mu_iFor file F_iA private address of the transaction of ownership;

are respectively data owners mu_iAnd data user mu_jThe standard address of (2);

(4.2) when the system receives mu_iThe miners in the system begin to execute the workload certification algorithm POW to strive for the billing right; after the POW algorithm is executed, a miner Node is assumed_jAcquiring the billing right;

(4.3) Miner Node_jVerifying data owner mu_iFor file F_iOwnership of (1);

(4.4)μ_iafter passing ownership verification, Node_jTo mu_iSending a sharing instruction:

(4.5) when μ_iReceiving an instruction, μ_iInitiating a File sharing transaction Tx_τWherein, mu_iAs sender of the transaction, mu_jAs a transaction recipient;

(4.6)μ_jas the transaction receiver, the transaction in each newly generated block is checked, the secret address P and the transaction public key R' in the transaction are extracted, and the own private key pair is used

Computing

Judgment of

Wherein,

is a cryptographic hash function; due to the fact that

If μ_jThe equation is established for the recipient of the transaction; otherwise, it is not true;

(4.7) when μ_jFinding transaction Tx_τAfter that, mu_jComputing

μ_jUsing x_τResume transaction Tx_τAnd in a consumption transaction Tx_τUsing x_τAs a transaction private key.

4. The privacy protection method of the distributed cloud storage system according to claim 3, wherein: the method for generating the file sharing transaction in the step (4.5) comprises the following steps:

(4.5.1) sender of transaction μ_iSelecting a random number r_τ∈[1,l-1]And obtaining the transaction receiver mu_jIs a public key pair

Then mu_iComputing a hidden address

Transaction public key R_τ＝r_τG, wherein,

is a cryptographic hash function;

(4.5.2) sender of transaction μ_iComputing using symmetric cryptographic algorithms

As a transaction content Proof_τFor granting ownership of the file to the transaction recipient and for verification of the ownership of the file, wherein

R is random number, and the encryption key is mu_jStandard address of

(4.5.3) sender of transaction mu_iSelecting a random number x_τ∈[1,l-1]And simultaneously also used as a signature private key and a corresponding public key PK is calculated_τ＝x_τG, key mirroring

Wherein,

is a deterministic hash function;

(4.5.4) sender of transaction mu_iR is to be_τ，P_τ，I_τAnd Proof of_τPacked in transaction Tx_τAnd μ_iCalculating the Ring signature σ_τTo transaction Tx_τThe signature is carried out and sent to the network, any party in the network can verify the transaction signature, and the information of a transaction sender cannot be leaked;

(4.5.5) Miner Node_jThe transaction is verified and packaged into blocks.

5. The privacy protection method of the distributed cloud storage system according to claim 1, wherein: the detailed process of the step (5) is as follows:

(5.1) data owner μ_iBroadcasting a download request to the system:

wherein, the hash_iAs a file F_iHash of (2); p_kTo prove mu_iFor file F_iThe covert address of the transaction for ownership of,

is mu_iA standard address;

(5.2) when the system receives mu_iThe miners in the system begin to execute a workload attestation algorithm (POW) to contend for billing rights; after the POW algorithm is executed, a miner Node is assumed_jAcquiring the billing right;

(5.3) Miner Node_jVerification of mu_iFor file F_iOwnership of (1);

(5.4)μ_iafter passing ownership verification, Node_jInquiring the actual storage address addr of the file in the DHT_iAnd will download the address addr_iIs returned to mu_i：

Node_j→μ_i:hash_i,addr_i；

(5.5)μ_iUsing a download tool to slave a file from address addr_iAnd reverting to the local.

Images