CN113037732B - Multi-user security encryption de-duplication method based on wide area network scene - Google Patents
Multi-user security encryption de-duplication method based on wide area network scene Download PDFInfo
- Publication number
- CN113037732B CN113037732B CN202110222902.XA CN202110222902A CN113037732B CN 113037732 B CN113037732 B CN 113037732B CN 202110222902 A CN202110222902 A CN 202110222902A CN 113037732 B CN113037732 B CN 113037732B
- Authority
- CN
- China
- Prior art keywords
- fingerprint
- area network
- information
- data block
- duplication
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L47/00—Traffic control in data switching networks
- H04L47/10—Flow control; Congestion control
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses a multi-user safe encryption de-duplication method based on a wide area network scene.A sending end preprocesses a plaintext message to be sent, and then compares the preprocessed plaintext message with a local cache to replace de-duplication information; the sending end establishes an end-to-end trusted connection to transmit the encrypted processed information to the receiving end; the receiving end receives the encrypted information and decrypts the encrypted information to obtain processed information; the receiving end interactively communicates with the duplicate removal agent of the local area network to obtain the encrypted ciphertext of the information which can be subjected to duplicate removal in a convergence manner, so that the corresponding plaintext information is obtained by decryption, and then the plaintext information is combined with the received information which cannot be subjected to duplicate removal to obtain the original information. And the sending end/the receiving end of the receiving end carries out updating synchronization with the duplicate removal agent of the local area network after each transmission. The method can be applied to encrypted flow, can relieve the transmission pressure of the wide area network, effectively saves the bandwidth of the wide area network, and can ensure the safety and the privacy of user information.
Description
Technical Field
The invention relates to the technical field of redundant flow elimination of wide area network communication, in particular to a multi-user security encryption de-duplication method based on a wide area network scene.
Background
A redundant traffic cancellation system for a wide area network involves two or more local area networks connected by links of the wide area network. In such a system, a deduplication agent (e.g., a gateway router) is deployed at each edge node of the lan. Before the information to be sent enters the wide area network, the sending end and a local duplicate removal agent cooperate to carry out redundancy elimination on the information. The sending end firstly carries out block processing on the information according to the data characteristics of the sending end, and then searches for a matched block in the information to be sent and the sent information. All the sent blocks are stored in the cache of the deduplication agent, which may be referred to as a dictionary. And storing fingerprint information corresponding to the blocks in the dictionary. Each matchable block of information is then replaced by fingerprint information to complete the de-duplication process of the message, thus requiring an effective reduction in the amount of data to be transmitted over the wide area network. Eliminating redundant or duplicate data in wide area network traffic can improve network efficiency and save bandwidth, so that the redundant traffic elimination system has a very high application value for large enterprises, internet service providers and network equipment providers.
Although redundant traffic cancellation systems have been successfully deployed for unencrypted traffic, it remains a significant challenge to apply them for encrypted traffic and to support multi-user deduplication. In particular, existing secure transport protocols such as TLS and IPSec use end-to-end encryption, which requires that information be encrypted by the sender before entering the network and only decrypted by the receiver after leaving the network. The deduplication agent between the sender and receiver sees only the encrypted meaningless bytes, and there is no way to find the matching parts as in unencrypted traffic. In addition, the task of the deduplication agent is further complicated by the multiuser deduplication system, because matching with not only information already sent by the sending end but also historical information of other users is required.
In addition to the above problems, a malicious attacker may also launch a poisoning attack during the transmission of information. In a multi-user redundant traffic cancellation system, the proxy uses a global cache to perform deduplication while all users participate to update and maintain the cache. A malicious user may insert incorrect content into the cache to launch a virus attack, and subsequent users may not obtain correct content when recovering the deduplicated information using the content in the cache. In fact, there are a large number of users in the lan, the probability of a poison attack is high and even if only one user is controlled by a malicious attacker, this will cause system level harm to all users. A simple idea is that the transmitting end attaches an error detection code to the information so that the receiving end can detect whether the recovered information corresponds to it. However, this does not address the virus-inflicted attack because the tampered content is still present in the agent's cache and continues to affect subsequent users. The only solution is to remove the tampered content from the proxy cache, but this is also very difficult. Specifically, the user needs to trust the agent that a certain piece of information in the cache has been tampered with, while not compromising the confidentiality of the information.
Disclosure of Invention
Aiming at the defects that the prior art has repeated flow in wide area network transmission and the existing duplicate Removal (RE) system is in a non-encrypted scene, the invention provides a multi-user safe encryption and duplicate removal method based on the wide area network scene, which can effectively realize the safety of messages and reduce the bandwidth overhead by realizing the duplicate removal of cross users in an encryption environment; in addition, the system is also enabled to defend against the toxic attack of a malicious user, which has not been studied in the existing deduplication system.
In order to achieve the purpose, the invention adopts the following technical scheme:
a multi-user security encryption and de-duplication method based on a wide area network scene comprises the following steps:
s1, for each original text message to be sent, the sending end decomposes the original message into an array composed of a certain amount of data blocks according to the data characteristics;
s2, aiming at each data block, the sending end calculates and obtains a corresponding key and a unique fingerprint for distinguishing different data blocks;
s3, the sending end compares the fingerprint of each data block with all fingerprint information in the local cache, and replaces the data block which can be deduplicated with the corresponding key;
s4, the sending end encrypts the de-duplicated data blocks and sends the data blocks to the receiving end, and meanwhile, the < fingerprint, ciphertext > sets corresponding to all the sent data blocks are updated to the local cache of the sending end and the de-duplication proxy of the sending end local area network;
s5, acquiring the data block after duplication elimination by combining the substitute key by the receiving end with the help of the duplication elimination agent of the receiving end local area network, fusing the acquired result with the data block information acquired by decryption and transmitted by the transmitting end, and recovering to acquire the original text information; and simultaneously updating the < fingerprint, ciphertext > sets corresponding to all the sending data blocks to the receiving end and the duplicate removal agent of the local area network of the receiving end.
In order to optimize the technical scheme, the specific measures adopted further comprise:
further, in step S1, the sending end decomposes the original information into an array composed of a certain number of data blocks according to the data characteristics by using a CDC algorithm; the data blocks are chunked based on content, and the length of each data block is between a defined minimum and maximum value.
Further, in step S4, the sending end uploads the < fingerprint, ciphertext > sets corresponding to all sending data blocks to the deduplication agent of the sending end local area network, and then updates all fingerprint information sets in the deduplication agent to the local cache of the sending end;
the local cache of the sending end maintains the fingerprint information corresponding to all data blocks sent or received by all users under the local area network where the sending end is located only through a fingerprint cache table; and the duplicate removal agent of the sending end simultaneously maintains the fingerprint cache table and the corresponding ciphertext table, and the ciphertext table stores the ciphertexts of the data blocks corresponding to all the fingerprints in the fingerprint cache table.
Further, in step S5, the receiving end uploads the < fingerprint, ciphertext > corresponding to the received data block to the deduplication agent of the receiving end local area network, and the deduplication agent of the receiving end local area network integrates all fingerprint information sets and then returns the integration result to the receiving end.
Further, in step S3, the sending end compares the fingerprint of each data block with all the fingerprint information in the local cache, and replaces the deduplicated data block with the corresponding key means that,
for each data block, the sending end retrieves the fingerprint table in the local cache and checks whether the corresponding fingerprint is stored in the fingerprint table; if there is a matching fingerprint, determining that the data block has been transmitted, allowing deduplication, and replacing the original data block with the key corresponding to the data block generated in step S2; if there is no matching fingerprint, the original data block is retained.
Further, the receiving end and the transmitting end are connected by adopting TLS.
Further, in step S5, the process of acquiring the deduplicated data block by combining the substitute key with the receiving end by means of the deduplication agent of the receiving end lan, and recovering the original text information after fusing the acquired result with the data block sent by the sending end includes the following steps:
s51, the receiving end receives the TLS encrypted data block information, and decrypts to obtain the key corresponding to the data block after the duplication elimination in the step S3;
s52, aiming at each data block after the duplication removal, the receiving terminal calculates fingerprint information corresponding to the data block according to the received secret key, uploads the calculated fingerprint information to the duplication removal agent of the receiving terminal local area network, and the duplication removal agent of the receiving terminal local area network returns the ciphertext of the data block corresponding to the fingerprint information to the receiving terminal;
and S53, the receiving end carries out decryption to obtain a data block subjected to de-duplication processing, and replaces the key in the received ciphertext information with the corresponding data block to recover the original complete information.
Further, the sending end encrypts the data block by adopting a convergence encryption algorithm.
Further, the encryption and de-duplication method further comprises the following steps:
s6, the receiving end adopts guard decryption algorithm to detect whether the ciphertext is poisoned, and uses key check algorithm to confirm whether the current user is honest, and removes the poisoned ciphertext.
Further, the encryption and de-duplication method further comprises the following steps:
based on the bilinear map e: g 1 ×G 2 →G 3 The MLEvd encryption of (1) processes the data block; for any one of the symmetrically determined encryption algorithms SDE ═ (SK, SE, SD), the following MLEvd algorithm is constructed, where SK is the key generation algorithm, SE is the encryption algorithm, and SD is the decryption algorithm:
a, parameter Generation Algorithm PG (1) λ )→P：
For input safety parameters 1 λ The parameter generation algorithm generates a group G 1 ＝<g 1 >，G 2 ＝<g 2 >And the order of the groups is the prime number p, and their corresponding bilinear mappings are e.
Target group G 3 ；H 1 ：{0，1} * →G 1 ，H 2 ：{0，1} * →G 2 ，h：
H：{0，1} * K is a cryptographically secure hash function, and the returned public parameter P contains { e, g } 1 ，g 2 ，p，H 1 ，H 2 ，h，H}；
B, fingerprint generation algorithm FG (P, m) → F:
for input plaintext m, fingerprint
C, key generation algorithm KG (P, m) → (k (t), t):
sampling a random number t to obtain a secret key
Output (K (t), t);
d, encryption algorithm ENC (P, m) → C:
obtaining (K (t), t) by calling KG, calculating
c＝SE(m，H(K(t)))
Output ciphertext C ═ (C, T);
e, decryption algorithm DEC (C, k (t)) → m':
calculating the corresponding plaintext m ═ SD (c, H (k (t));
f, guard decryption algorithm GDEC (C, k (t)) → { m', }:
on the basis of the decryption algorithm, it is checked whether T is present h(m′) If the ciphertext is not satisfied with the problem, returning T;
g, key verification algorithm KV (C, F, K) → {0,1 }:
test e (F, T) e (g) 1 K), satisfying that returning 1 represents that the key is correct, otherwise returning 0.
The invention has the beneficial effects that:
(1) the invention can remove the duplication of the flow of the wide area network under the condition of ensuring the data safety, thereby greatly reducing the useless flow of the network. For the virus attack of the malicious user, the MLEvd can support the verification of the dynamic key and the key. The content uploaded by the user is verified through the new characteristic of MLEvd, so that the virus attack is prevented. This greatly improves the safety and reliability of the system.
(2) The invention reduces the flow transmitted by the wide area network, can help teams in different areas to communicate with each other more quickly, and reduces the occupation of the wide area network in limited areas
Drawings
Fig. 1 is a flowchart of a multi-user secure encryption deduplication method based on a wide area network scenario of the present invention.
FIG. 2 is a model diagram of one embodiment of an application.
Detailed Description
The present invention will now be described in further detail with reference to the accompanying drawings.
It should be noted that the terms "upper", "lower", "left", "right", "front", "back", etc. used in the present invention are for clarity of description only, and are not intended to limit the scope of the present invention, and the relative relationship between the terms and the terms is not limited by the technical contents of the essential changes.
With reference to fig. 1, the present invention provides an encryption and deduplication method based on multi-user security in a wide area network scenario, where the encryption and deduplication method includes the following steps:
and S1, for each original text message to be sent, the sending end decomposes the original message into an array composed of a certain amount of data blocks according to the data characteristics.
In step S1, the sender decomposes the original information into an array composed of a certain number of data blocks according to data characteristics by using a CDC algorithm; the data blocks are chunked based on content, each data block having a length between a defined minimum and maximum value.
S2, for each data block, the sender calculates a corresponding key and a unique fingerprint for distinguishing different data blocks.
The key in step S2 is generated according to the data block, and the fingerprint is a unique identifier of the data block and can be used to distinguish the data block from other data blocks. After receiving the key, the receiving end can find the ciphertext corresponding to the data block, and then decrypt to obtain the data block.
And S3, the sending end compares the fingerprint of each data block with all the fingerprint information in the local cache, and replaces the data block which can be deduplicated with the corresponding key.
The deduplication process in step S3 means that, for each data block, the sending end retrieves the fingerprint table in the local cache to see whether the fingerprint corresponding to the sending end appears in the fingerprint table. If it can be found, the sender regards the data block as having been transmitted and can remove the duplicate, and then replaces the original data block with the key generated in step S2. If there is no matching fingerprint, the original data block is retained.
And S4, the sending end encrypts the de-duplicated data blocks and sends the data blocks to the receiving end, and meanwhile, the < fingerprint, ciphertext > sets corresponding to all the sent data blocks are updated to the local cache of the sending end and the de-duplication agent of the local area network of the sending end. Here, a trusted connection, such as a TLS connection, is constructed between the sender and the receiver, so that end-to-end security can be ensured. The ciphertext is encrypted by the key generated in step S2. The encryption algorithm is a convergence encryption algorithm, and is different from the traditional encryption method. The key is generated based on plaintext information, and ciphertexts obtained by ciphering the same plaintext information are completely the same.
The update in step S4 means: (1) a sending end maintains a fingerprint cache table and records fingerprint information corresponding to all data blocks sent/received by all users under a local area network where the sending end is positioned; (2) the local duplicate removal agent of the sending end maintains a fingerprint cache table and a corresponding ciphertext table, the fingerprint cache table records fingerprints of blocks passing through the agent, and the ciphertext table stores ciphertexts of data blocks corresponding to the fingerprints in the fingerprint cache table.
S5, acquiring the data block after duplication elimination by combining the substitute key by the receiving end with the help of the duplication elimination agent of the receiving end local area network, fusing the acquired result with the data block information acquired by decryption and transmitted by the transmitting end, and recovering to acquire the original text information; and meanwhile, updating the < fingerprint, ciphertext > sets corresponding to all the sending data blocks to the receiving end and the deduplication agents of the local area network of the receiving end.
In step S5, the recovery procedure of the receiving end means that after receiving the TLS encrypted message, the receiving end first decrypts the TLS encrypted message to obtain the information after performing the deduplication in step S3. Then, for the block which can be deduplicated, the receiving end calculates the fingerprint information corresponding to the data block according to the received secret key, and then uploads the fingerprint information to the local area network deduplication agent. The duplication removing agent returns the ciphertext of the data block corresponding to the fingerprint information to the receiving end, the receiving end then executes decryption to obtain the corresponding data block, and then the key in the information is replaced by the corresponding data block, so that the original complete information is restored.
As a preferred example, the encryption and de-duplication method further includes the following steps:
s6, the receiving end adopts guard decryption algorithm to detect whether the ciphertext is poisoned, uses key check algorithm to confirm whether the current user is honest, and removes the poisoned ciphertext. Specifically, the invention provides a DETP protocol to prevent virus attack, after steps similar to DETs are performed, virus message detection and recovery steps are added, a guard decryption algorithm is adopted to detect whether a ciphertext is infected, a key verification algorithm is utilized to confirm that the current user is an honest user, and the poisoned ciphertext is removed.
Two protocols for cross-user deduplication in a cryptographic environment comprise the following steps:
(1) a problem model for encryption and de-duplication across a wide area network is extracted, and an adversary model and safety are defined.
(2) The DETs deduplication protocol was designed to implement a type of deduplication-encrypted cross-user protocol.
(3) Message locked encryption (message locked encryption) is optimized, and MLEvd is proposed to further support dynamic key and key verification.
(4) The DETP deduplication protocol is designed to prevent the virus attack of malicious users.
Problem model as shown in fig. 2, the present invention considers the case where a company has two divisions in different cities, and can also be extended to multiple divisions. Each branch has its own Local Area Network (LAN) to connect internal users (users). For example, the left subsection has a user, Alice, while the right subsection has a user, Bob. With the two subsections being connected by a common Wide Area Network (WAN). A gateway node, where an agent resides in each branch, helps the user nodes of both lans to perform deduplication over their wan traffic. For example, the agent for the left part is Carol and the agent for the right part is David.
The invention provides a DETs duplicate removal protocol, which comprises the steps of partitioning a message, generating a fingerprint and an encryption key corresponding to the message block by using a single hash function meeting the cryptology safety, judging whether the message block is repeated or not according to the fingerprint, then removing the duplicate message block, carrying out end-to-end safe transmission based on TLS, recovering the duplicate removal message after receiving the message, and synchronizing the message of a user and an agent.
In addition, the invention proposes a method based on bilinear map (bilinear map) e:
MLEvd of (1) encrypted. For any symmetric determined encryption algorithm SDE (SK, SE, SD), where SK is a key generation algorithm, SE is an encryption algorithm, and SD is a decryption algorithm, the invention can construct the following seven-step MLEvd algorithm:
a, parameter generating algorithm PG (1) λ )→P：
For input safety parameters 1 λ The parameter generation algorithm generates a group G 1 ＝<g 1 >，G 2 ＝<g 2 >And the order of the group is prime number p, and their corresponding bilinear mappings are e;
target group G 3 ；H 1 ：{0，1} * →G 1 ，H 2 ：{0，1} ★* →G 2 ，h：
H：{0，1} * K is a cryptographically secure hash function, and the returned public parameter P contains { e, g } 1 ，g 2 ，p，H 1 ，H 2 ，h，H}；
B, fingerprint Generation Algorithm FG (P, m) → F:
for input plaintext m, fingerprint
C, key generation algorithm KG (P, m) → (k (t), t):
sampling a random number t to obtain a secret key
Outputs (K (t), t);
d, encryption algorithm ENC (P, m) → C:
obtaining (K (t), t) by calling KG, calculating
c＝SE(m，H(K(t)))
Outputting the ciphertext C ═ (C, T);
e, decryption algorithm DEC (C, k (t)) → m':
calculating the corresponding plaintext m ═ SD (c, H (k) (t));
f, guard decryption algorithm GDEC (C, k (t)) → { m', }:
on the basis of the decryption algorithm, it is checked whether T is present h(m′) If the ciphertext is not satisfied with the problem, returning T;
g, key verification algorithm KV (C, F, K) → {0,1 }:
checking e (F, T) e (g) 1 K), satisfying that returning 1 represents that the key is correct, otherwise returning 0.
As shown in FIG. one, the present invention contemplates a company having two divisions in different cities, and may be extended to multiple divisions. Each branch has its own Local Area Network (LAN) to connect internal users (users). With the two subsections being connected by a common Wide Area Network (WAN). A gateway node, where an agent resides in each branch, helps the user nodes of both lans to perform deduplication over their wan traffic. The users communicate over the TLS connection for security reasons, which provides complimentary end-to-end security. The user and the agent cooperate to run the DTEs (DTEp) protocol safely, and the deduplication is realized on the encrypted connection.
The DTEs protocol provided by the invention comprises the following steps:
1. partitioning: for each piece of information M sent by Alice, Alice runs a CDC chunking algorithm to divide M into a series of information blocks:
M＝{m 1 ，m 2 ，...，m n }。
2. generating a key and a fingerprint: for each information block m i Alice calculates its secret key
K i ＝h(m i )
And fingerprints
F i ＝h(K i )
Where h is a one-way hash function that satisfies the cryptographic security.
3. Removing weight: for each information block, Alice goes to the local fingerprint library T La The fingerprint of this block of information is checked for the presence. If present, this block of information is said to have been sent and may be de-duplicated, requiring only the key to be sent instead of the complete block of information. This may significantly reduce communication. With this key, the recipient can find the correct ciphertext and decrypt the file. After the duplication removal, the information M' sent by Alice is { M ═ M 1 '，m 2 '，...，m n ' }, where m i ' is:
4. end-to-end transmission: alice establishes a TLS connection with Bob, and then Alice sends M' to Bob through the connection. The TLS connection ensures that only Bob can see the message.
5. And (3) message recovery: after Bob receives the message M', he needs to recover the message with the help of David. David here is the deduplication agent for the local area network where Bob is located. Specific details are as follows, for each K in M i Bob calculates its fingerprint F i At the same time, David downloads the encrypted message block c corresponding to the fingerprint i . Then Bob decrypts:
m i ＝DEC(c i ，K i )
simultaneously processing each K in M i By substitution of m i Thus, M is recovered.
Alice synchronization: for each one
Alice uses K i Encrypt m i To obtain
c i ＝ENC(m i ，K i )
Alice sends all<F i ，c i >Giving his home local area network the proxy Carol. At the same time Alice downloads global fingerprint table T from Carol side Gc And updates its local fingerprint table T La 。
Carol sync: receive to<F i ，c i >Then Carol inserts them into the global fingerprint table T Gc And meanwhile, synchronizing the latest global fingerprint table to Alice.
Bob sync: for each received, Bob computes and then encrypts to get, Bob computes simultaneously, sending all the local area network agents David to him. At the same time Bob downloads the global fingerprint table from David's side and updates its local fingerprint table.
David sync: receive to<F i ，c i >Thereafter, David inserts them into the global fingerprint table T Gd Synchronizing the latest global fingerprint table at the same timeAnd (4) giving Bob.
Under the DTEs protocol, the user can upload the wrong encrypted message block, so that the receiving end can acquire the wrong information, in order to prevent this, the invention further provides DTEp, and the protocol details are as follows:
1. partitioning: for each piece of information M sent by Alice, Alice runs the CDC chunking algorithm, dividing M into a series of information blocks:
M＝{m 1 ，m 2 ，...，m n }。
2. generating a key and a fingerprint: to achieve efficient query operations, DETP uses certain fingerprints
For the key used for encryption and decryption, the invention achieves that David can verify whether the key and the fingerprint match while he cannot know how to calculate the key from the fingerprint. To achieve this, the key is:
3. removing weight: for each information block, Alice goes to the local fingerprint library T La It is checked whether a fingerprint of this block of information is present. Unlike DTEs, for repeated message blocks, we send their hash value h (m) i ). After the duplication removal, the information M' sent by Alice is { M ═ M 1 '，m 2 '，...，m n ' }, where m i ' is:
4. end-to-end transmission: alice establishes a TLS connection with Bob, and then Alice sends M' to Bob through the connection. The TLS connection ensures that only Bob can see the message.
5. And (3) message recovery: after Bob receives the message M', he needs to be atThe message is recovered with the help of David. Specific details are as follows, for each h (M) in M i ) Bob calculates its fingerprint F i And a secret key K i (t) simultaneously downloading the encrypted message block C corresponding to the fingerprint by the David side i (t) of (d). Because of the support of dynamic keys, the cryptograph of DETp needs to be added with a random number (nonce) that can only be used once:
C i (t)＝(c i (t)，T)
wherein:
c i ＝ENC(m i ，K i (t))
then obtain the ciphertext C i After (t), Bob calculates the key:
K i (t)＝(T) h(m) 。
then decrypt c i (t) obtaining a plaintext:
m i ＝DEC(c i (t)，K i (t))。
finally, to ensure that the recovered message is correct, Bob can calculate the recovered message m i And compares it with the fingerprint that he received from Alice. If the two are the same, the message is correct. Otherwise, the recovered message is false, and Bob needs to request Alice to send a correct message, which cannot be the hash value sent after deduplication.
Alice synchronization: for each one
Alice uses K i Encrypt m i To obtain c i Simultaneously generating a random number T, calculating T to obtain a ciphertext C i (t)。
Alice sends all<F i ，C i (t)>Giving his home local area network the proxy Carol. At the same time, Alice downloads the global fingerprint table T from Carol Gc And updates its local fingerprint table T La 。
Carol sync: receive to<F i ，C i (t)>Then Carol inserts them into the global fingerprint table T Gc And meanwhile, synchronizing the latest global fingerprint table to Alice.
Bob sync: for each received m i Bob calculates K i Then encrypt m i To obtain C i (t), Bob calculates F at the same time i Sending all of<F i ，C i (t)>And (4) giving a proxy David to the local area network where the local area network is located. At the same time, Bob downloads the global fingerprint table T from David side Gd And updates its local fingerprint table T Lb 。
David sync: receive to<F i ，C i (t)>Thereafter, David inserts them into the global fingerprint table T Gd While the latest global fingerprint table is synchronized to Bob.
10. Detection and correction of poisoned data: if Bob sees that the ciphertext was poisoned, he needs to submit the correct one<F i ，K i (t)>。
David verification
e(F i ，T)＝e(g 1 ，K i (t))
If so, David considers K i (t) is the correct key, he will verify the ciphertext in his hand. The method of verification is the same as Bob. If the ciphertext is in error, he will use the ciphertext that lets Bob synchronize correctly.
The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above-mentioned embodiments, and all technical solutions belonging to the idea of the present invention belong to the protection scope of the present invention. It should be noted that modifications and embellishments within the scope of the invention may be made by those skilled in the art without departing from the principle of the invention.
Claims (8)
1. A multi-user security encryption and de-duplication method based on a wide area network scene is characterized by comprising the following steps:
s1, for each original text message to be sent, the sending end decomposes the original message into an array composed of a certain amount of data blocks according to the data characteristics;
s2, aiming at each data block, the sending end calculates and obtains a corresponding key and a unique fingerprint for distinguishing different data blocks;
s3, the sending end compares the fingerprint of each data block with all fingerprint information in the local cache, and replaces the data block which can be deduplicated with the corresponding key;
s4, the sending end encrypts the de-duplicated data blocks and sends the data blocks to the receiving end, and meanwhile, the < fingerprint, ciphertext > sets corresponding to all the sent data blocks are updated to the local cache of the sending end and the de-duplicated agent of the local area network of the sending end;
s5, acquiring the data block after duplication by combining the substitute key by the receiving terminal with the help of the duplication removal agent of the receiving terminal local area network, fusing the acquired result with the data block information acquired by decryption and then recovering to acquire the original text information; and meanwhile, updating the < fingerprint, ciphertext > sets corresponding to all the sending data blocks to the receiving end and the deduplication agents of the local area network of the receiving end.
2. The multi-user secure encryption and de-duplication method under the wide area network scenario as claimed in claim 1, wherein in step S1, the sender decomposes the original information into an array consisting of a certain amount of data blocks according to data characteristics by using a CDC algorithm; the data blocks are chunked based on content, each data block having a length between a defined minimum and maximum value.
3. The multi-user secure encryption and deduplication method based on the wide area network scenario of claim 1, wherein in step S4, the sending end uploads the < fingerprint, ciphertext > sets corresponding to all the sending data blocks to the deduplication agent of the sending end local area network, and then updates all fingerprint information sets in the deduplication agent to a local cache of the sending end;
the local cache of the sending end maintains the fingerprint information corresponding to all data blocks sent or received by all users under the local area network where the sending end is located only through a fingerprint cache table; and the duplicate removal agent of the sending end simultaneously maintains the fingerprint cache table and the corresponding ciphertext table, and the ciphertext table stores the ciphertexts of the data blocks corresponding to all the fingerprints in the fingerprint cache table.
4. The multi-user secure encryption and de-duplication method based on the wide area network scenario as claimed in claim 1, wherein in step S5, the receiving end uploads the < fingerprint, ciphertext > corresponding to the received data block to the de-duplication agent of the receiving end local area network, and the de-duplication agent of the receiving end local area network integrates all fingerprint information sets and then returns the integrated result to the receiving end.
5. The multi-user secure encryption and de-duplication method in the wide area network scenario as claimed in claim 1, wherein in step S3, the sending end compares the fingerprint of each data block with all fingerprint information in the local cache, and replaces the de-duplicated data block with the corresponding key,
for each data block, the sending end searches the fingerprint table in the local cache and checks whether the corresponding fingerprint is stored in the fingerprint table; if there is a matching fingerprint, determining that the data block has been transmitted, allowing deduplication, and replacing the original data block with the key corresponding to the data block generated in step S2; if there is no matching fingerprint, the original data block is retained.
6. The multi-user secure encryption and de-duplication method in a wide area network scenario as claimed in claim 1, wherein the receiving end and the sending end are connected by TLS.
7. The multi-user secure encryption and de-duplication method based on the wide area network scenario as claimed in claim 1, wherein in step S5, the process of acquiring the original text information by combining the data block obtained after de-duplication with the substitute key by the de-duplication agent of the receiving-side local area network and the receiving side, and fusing the acquired result with the data block sent by the sending side, comprises the following steps:
s51, the receiving end receives the TLS encrypted data block information, and decrypts to obtain the key corresponding to the data block after the duplication elimination in the step S3;
s52, aiming at each data block after the duplication removal, the receiving terminal calculates fingerprint information corresponding to the data block according to the received secret key, uploads the calculated fingerprint information to the duplication removal agent of the receiving terminal local area network, and the duplication removal agent of the receiving terminal local area network returns the ciphertext of the data block corresponding to the fingerprint information to the receiving terminal;
s53, the receiving end executes decryption to obtain the data block after the deduplication processing, and replaces the key in the received ciphertext information with the corresponding data block to recover the original complete information.
8. The multi-user secure encryption and decryption method in the wide area network scenario as claimed in claim 1, wherein the encryption and decryption method further comprises the following steps:
the receiving end adopts a guard decryption algorithm to detect whether the ciphertext is poisoned, a key verification algorithm is utilized to confirm whether the current user is honest and honest, and the poisoned ciphertext is removed, and the method specifically comprises the following steps:
based on bilinear mapping e G 1 ×G 2 →G 3 The MLEvd encryption processes the data blocks; for any one of the symmetrically determined encryption algorithms SDE ═ (SK, SE, SD), the following MLEvd algorithm is constructed, where SK is the key generation algorithm, SE is the encryption algorithm, and SD is the decryption algorithm:
a, parameter generating algorithm PG (1) λ )→P：
For input safety parameters 1 λ The parameter generation algorithm generates a group G 1 ＝<g 1 >,G 2 ＝<g 2 >And the order of the group is prime number p, and their corresponding bilinear mappings are e;
target group G 3 ；H 1 :{0,1} * →G 1 ,H 2 :{0,1} ★* →G 2 ，
H:{0,1} * K is a cryptographically secure hash function, and the returned public parameter P contains { e, g } 1 ,g 2 ,p,H 1 ,H 2 ,h,H}；
B, fingerprint generation algorithm FG (P, m) → F:
for input plaintext m, fingerprint
C, key generation algorithm KG (P, m) → (k (t), t):
sampling a random number t to obtain a secret key
Output (K (t), t);
d, encryption algorithm ENC (P, m) → C:
obtaining (K (t), t) by calling KG, calculating
c＝SE(m,H(K(t)))
Outputting the ciphertext C ═ (C, T);
e, decryption algorithm DEC (C, k (t)) → m':
calculating the corresponding plaintext m ═ SD (c, H (k (t));
f, guard decryption algorithm GDEC (C, k (t)) → { m', }:
on the basis of the decryption algorithm, it is checked whether T is present h(m′) K (t), if the ciphertext is not satisfied, returning T;
g, key verification algorithm KV (C, F, K) → {0,1 }:
checking e (F, T) e (g) 1 K), satisfying that returning 1 represents that the key is correct, otherwise returning 0.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110222902.XA CN113037732B (en) | 2021-02-26 | 2021-02-26 | Multi-user security encryption de-duplication method based on wide area network scene |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110222902.XA CN113037732B (en) | 2021-02-26 | 2021-02-26 | Multi-user security encryption de-duplication method based on wide area network scene |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113037732A CN113037732A (en) | 2021-06-25 |
| CN113037732B true CN113037732B (en) | 2022-09-23 |
Family
ID=76465072
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110222902.XA Active CN113037732B (en) | 2021-02-26 | 2021-02-26 | Multi-user security encryption de-duplication method based on wide area network scene |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113037732B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105939191A (en) * | 2016-07-08 | 2016-09-14 | 南京理工大学 | Client secure deduplication method of ciphertext data in cloud storage |
| CN107659401A (en) * | 2017-10-09 | 2018-02-02 | 华中科技大学 | The secure data duplicate removal encryption method that a kind of similitude perceives |
| CN108200172A (en) * | 2018-01-03 | 2018-06-22 | 西安电子科技大学 | A kind of cloud storage system and method supported secure data duplicate removal and deleted |
| CN110213042A (en) * | 2019-05-09 | 2019-09-06 | 电子科技大学 | A kind of cloud data duplicate removal method based on no certification agency re-encryption |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103530201B (en) * | 2013-07-17 | 2016-03-02 | 华中科技大学 | A kind of secure data De-weight method and system being applicable to standby system |
| SG10201610516RA (en) * | 2015-12-17 | 2017-07-28 | Agency Science Tech & Res | Encrypted data deduplication in cloud storage |
-
2021
- 2021-02-26 CN CN202110222902.XA patent/CN113037732B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105939191A (en) * | 2016-07-08 | 2016-09-14 | 南京理工大学 | Client secure deduplication method of ciphertext data in cloud storage |
| CN107659401A (en) * | 2017-10-09 | 2018-02-02 | 华中科技大学 | The secure data duplicate removal encryption method that a kind of similitude perceives |
| CN108200172A (en) * | 2018-01-03 | 2018-06-22 | 西安电子科技大学 | A kind of cloud storage system and method supported secure data duplicate removal and deleted |
| CN110213042A (en) * | 2019-05-09 | 2019-09-06 | 电子科技大学 | A kind of cloud data duplicate removal method based on no certification agency re-encryption |
Non-Patent Citations (2)
| Title |
|---|
| Yuan Zhang ; Chunxiang Xu ; Nan Cheng ; Xuemin Shen.Secure Encrypted Data Deduplication for Cloud Storage against Compromised Key Servers.《2019 IEEE Global Communications Conference (GLOBECOM)》.2019,第1-6页. * |
| 云存储中加密数据去重安全问题研究;梁三来;《信息与电脑》;20200228;第18-22页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113037732A (en) | 2021-06-25 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| EP0916209B1 (en) | Cryptographic key recovery system | |
| CN106130716B (en) | Key exchange system and method based on authentication information | |
| US9130744B1 (en) | Sending an encrypted key pair and a secret shared by two devices to a trusted intermediary | |
| JP2004515117A (en) | Encrypted data security system and method | |
| AU5811598A (en) | Improved network security device | |
| CN111447276A (en) | Encryption continuous transmission method with key agreement function | |
| CN103338185B (en) | A kind of method and system of file-sharing | |
| US10586065B2 (en) | Method for secure data management in a computer network | |
| EP3036864A1 (en) | Multiparty secret protection system | |
| CN106941404A (en) | Cryptographic key protection method and device | |
| CN107306274A (en) | Data de-duplication method based on digital digest | |
| CN105681362B (en) | The client and server communications method of the geographical location privacy of protection | |
| CN115174520B (en) | Network address information hiding method and system | |
| CN114710558B (en) | Asynchronous secure transmission channel construction method based on cloud storage | |
| CN104735094A (en) | Information separation based data security transmission system and method | |
| US7031469B2 (en) | Optimized enveloping via key reuse | |
| WO2021213922A1 (en) | Block propagation with poisoned transactions in a blockchain network | |
| CN116405320B (en) | Data transmission method and device | |
| CN113037732B (en) | Multi-user security encryption de-duplication method based on wide area network scene | |
| JP2010011122A (en) | Encrypted packet processing system | |
| CN115150076A (en) | Encryption system and method based on quantum random number | |
| CN116095033A (en) | Social communication method, device, equipment and storage medium | |
| CN113918971B (en) | Block chain-based message transmission method, device, equipment and readable storage medium | |
| Zhang et al. | On designing secure cross-user redundancy elimination for WAN optimization | |
| CN111698212B (en) | Unidirectional transmission method based on virtual receiving end |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |