KR101593675B1 - User data integrity verification method and apparatus - Google Patents

Abstract

Disclosed is a method for verifying user data integrity. According to the present invention, the method for verifying user data integrity comprises: a step of generating a pair of signature keys based on a bilinear mapping technique and a BLS short signature technique; a data outsourcing step of dividing a data file to be uploaded into a prescribed number of blocks, encrypting the data file in accordance with the pair of signature keys generated in the signature key pair generation step, and then uploading the data file to a data storage server; a step of generating a challenge value for a portion of the data file to transmit the challenge value to the data storage server to check integrity of the uploaded data file; a step of generating a proof based on information transmitted when uploading data and the challenge value, and transmitting the proof to a second terminal; and a step of using the proof and public keys to verify legitimacy of the proof.

Description

USER DATA INTEGRITY VERIFICATION METHOD AND APPARATUS Document Type and Number: WIPO Patent Application WO /

The present invention relates to a method and apparatus for verifying the integrity of user data, and more particularly, in a cloud environment, after a data owner has uploaded his data to a server, his data is not corrupted from malicious behavior of a server or other attacker And an apparatus for verifying integrity of user data for confirming whether or not the user data is stored.

Recently, as the ubiquitous environment, which refers to an information communication environment where a user can freely access a network regardless of a network or a computer, is becoming common, remote computing is also being expanded. Cloud computing is emerging as a new paradigm that will lead the future computing environment.

Cloud computing is a computer environment in which information is permanently stored on a server on the Internet and is temporarily stored on clients such as IT devices (e.g., desk desktops, tablet computers, notebooks, netbooks, smart phones, etc.). In other words, all the information of the user is stored on a server on the Internet, and this information can be used anytime and anywhere through various IT devices.

In other words, a cloud computing service is a computing service in which computing resources such as hardware and software existing in an intangible form such as a cloud are borrowed and paid for as much as they need, Refers to a technology that integrates computing resources existing in a location with virtualization technology.

With cloud computing, businesses or individuals can reduce the cost and time required to maintain, maintain, and manage computer systems and reduce the cost, time, and manpower required to purchase, install, update, and purchase software on servers . It can also contribute to energy savings. On the other hand, if data is stored on a PC, data may be lost due to a hard disk failure or the like. However, since data is stored in an external server in a cloud computing environment, it is possible to securely store data, You can view and edit documents you have worked on anywhere.

On the other hand, if the server is hacked, personal information can be leaked, and if the server fails, the data can not be used. Therefore, in order for cloud computing to have a dominant position in the future computing environment, the integrity of user data must be ensured.

Accordingly, researches on techniques for checking the integrity of outsourced data to the cloud server have been actively conducted. In the following Prior Art Document 1, a method is proposed in which the integrity of outsourced data can be audited, and data addition / deletion is easy. However, there is a problem that the data stored in the auditor is exposed during the auditing process, resulting in lack of safety. In order to overcome this problem, prior art documents 2, 3 and 4 proposed a technique for auditing the integrity of outsourced data. However, in Prior Art Document 5, these techniques have shown to be insecure due to the homomorphic nature of the values exchanged in the audit process. Thereafter, in the prior art document 6, a new technique for supplementing safety is proposed, but this technique has also proved unsafe by the prior art document 7. On the other hand, Prior Art Document 8 also proposes a new technique for supplementing the safety of data, but this also has a problem unsafe for the attacks proved in the prior art documents 5 and 7. .

1. Q. Wang, C. Wang, K. Ren, W. Lou, J. Li, Enabling public auditability and data dynamics for storage security in IEEE Trans. Parallel Distrib. Syst., 22 (5), (2011), pp. 847859. 2. C. Wang, Q. Wang, K. Ren, N. Cao, W. Lou, Toward secure and dependable storage services in IEEE Trans. Serv. Comput., 5 (2), (2012), pp. 220232. 3. B. Wang, B. Li, H. Li, Oruta: Privacy-preserving public auditing for shared data in the cloud, in: IEEE International Conference on Cloud Computing, 2012, pp. 293302. 4. B. Wang, B. Li, H. Li, and Knox: privacy-preserving auditing for shared data with large groups in the cloud, in: Proc. of ACNS 2012, pp. 507525. 5. Y. Yu, L. Niu, G. Yang, Y. Mu, W. Susil, On the security of auditing mechanisms for secure cloud storage, Future Generation Computer Systems, (2014), pp. 127-132. 6. K. Yang, and X. Jia, An efficient and secure dynamic auditing protocol for data storage in cloud computing. IEEE Transactions on Parallel and Distributed Systems, 24 (9), (2013), 17171726. 7. J. Ni, Y. Yu, Y. Mu, and Q. Xia, On the Security of an Efficient Dynamic Auditing Protocol in Cloud Storage, (2013), IEEE Transactions on Parallel and Distributed Systems. 8. C. Wang, S. S. M. Chow, Q. Wang, K. Ren, and W. Lou, Privacy-preserving public auditing for secure cloud storage, IEEE Transactions on Computers, 62 (2), (2013), pp. 362-375.

Accordingly, the present invention provides a method and apparatus for verifying the integrity of user data in a cloud computing environment.

It is another object of the present invention to provide a method and apparatus for verifying integrity of user data ensuring data security against various attacks in a cloud computing environment.

According to an aspect of the present invention, there is provided a method for verifying integrity of user data, the method comprising: a first terminal for generating a data file; a data storage server on the Internet for storing the data file; A method for verifying the integrity of user data based on a correlation between a first terminal and a second terminal that audits integrity of a first terminal, the method comprising: generating a signature key pair based on a bi- ; A data outsourcing step of dividing a data file to be uploaded by the first terminal into a predetermined number of blocks, encrypting the data file based on the signature key pair generated in the signature key pair generation step, and uploading the encrypted data file to the data storage server; Generating a challenge value for the part of the data file and transmitting the challenge value to the data storage server for the integrity check of the uploaded data file by the second terminal; Generating a proof value based on the information transmitted when the data storage server uploads the data and the challenge value, and transmitting the proof value to the second terminal; And verifying the validity of the proof value using the proof and the public keys by the second terminal.

Preferably, the signature key pair generation step satisfies a secret key including a first random number (x) that is an element of an integer set, a property based on a second random number (k) (V, g, u, e (u, v)), which is a public key.

Preferably, the data outsourcing step comprises the steps of:

)을 소정개로 분할하는 단계; 상기 BLS 짧은 서명 기법에 의거하여, 상기 서명키 쌍 생성 단계에서 생성된 비밀키 및 공개키가 반영된 태그(

)를 상기 분할된 데이터 각각에 대하여 생성하는 단계; 상기 파일 이름(name)에 대한 서명값(SSig_{ssk( name )})을 생성하는 단계; 및 상기 데이터 파일(

), 태그(

) 및 서명값이 부가된 파일명(

)을 함께 업로드하는 단계를 포함할 수 있다. (

) Into a predetermined number; Based on the BLS short signature scheme, a secret key generated in the signature key pair generation step and a tag

) For each of the segmented data; Generating a signature value (SSig ssk _{( name )} ) for the file name (name); And the data file (

), tag(

) And the filename to which the signature value is attached (

) May be uploaded together.

Advantageously, the step of transmitting the challenge value comprises the steps of: receiving, from the data storage server, an arbitrary subset (I) including arbitrarily selected several blocks (c) of the entire data file block (n); Generating a challenge value for the subset (I); And transmitting the challenge value to the data storage server.

According to another aspect of the present invention, there is provided an apparatus for verifying user data integrity, comprising: a communication interface unit for providing an interface with a data storage server for storing a data file; A challenge value generation unit for generating a challenge value for a part of the data file to confirm integrity of the data file uploaded to the data storage server and transmitting the generated challenge value to the data storage server; And a verifying unit for receiving the verification value generated by the data storage server based on the challenge value and information transmitted when the data is uploaded and verifying the validity of the verification value.

Advantageously, the challenge value generator is provided from the data storage server via the communication interface unit to any subset (I) including arbitrarily selected blocks (c) of the entire data file block (n) And generate a challenge value for the subset (I).

The present invention verifies the integrity of user data by applying a bilinear mapping technique and a BLS short signature technique to guarantee the security of data against various attacks in a cloud computing environment .

1 is a block diagram of a system for implementing a user data integrity verification method of the present invention.
2 is a flowchart illustrating an inter-system processing procedure for a user data integrity verification method according to an embodiment of the present invention.
3 is a schematic process flow chart for the encryption process illustrated in FIG.
FIG. 4 is a schematic flowchart of the process of generating the challenge value illustrated in FIG. 2. FIG.
FIG. 5 is a schematic processing flowchart of the procedure for generating a proof value illustrated in FIG. 2. FIG.
6 is a schematic block diagram of a user data integrity verification apparatus according to an embodiment of the present invention.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like reference numerals are used for like elements in describing each drawing.

The terms first, second, A, B, etc. may be used to describe various elements, but the elements should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprises" or "having" and the like are used to specify that there is a feature, a number, a step, an operation, an element, a component or a combination thereof described in the specification, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

Hereinafter, preferred embodiments according to the present invention will be described in detail with reference to the accompanying drawings. Throughout the specification and claims, where a section includes a constituent, it does not exclude other elements unless specifically stated otherwise, but may include other elements.

1 is a block diagram of a system for implementing a user data integrity verification method of the present invention. Referring to FIG. 1, a method for verifying user data integrity according to an exemplary embodiment of the present invention may be implemented by interacting with a data owner 100, a data storage server 200, and an auditor 300 connected to a network. That is, when the data owner 100 uploads its data to the data storage server 200 (S10), the data storage server 200 stores the data file (S20), and the auditor 300 stores the data And performs data integrity verification (S30) on the data file stored in the server (200).

To this end, each device must interact with each other according to a promised protocol, and the present invention employs bilinear maps and a BLS short signature algorithm.

2 is a flowchart illustrating an inter-system processing procedure for a user data integrity verification method according to an embodiment of the present invention. In the example of FIG. 2, the data owner terminal is referred to as a first terminal 100A, the auditor terminal is referred to as a second terminal 300A, and an example of a mutual processing procedure with the data storage server 200 is described. In this case, a multiplicative cyclic group having G ₁ , G _2, and G _T as the power p, and e: G ₁ × G ₂ → G _T are referred to as a double linear mapping. Also g of the generator G _2, H (·): {0,1 } * → hash-to-point (map-to-point hash) function map of G _1, h (·): a G → _T Z _P another Is called a hash function, and E (·) is called a block algorithm such as DES (Data Encryption Standard) and AES (Advanced Encryption Standard).

First, in step S105, the first terminal 100A generates a signature key pair (spk, ssk) based on the double linear mapping and the BLS short signature technique. At this time, the first MS 100A satisfies the secret key including the first random number x, which is an integer set of elements, and the second random number k, which is an element of the integer set, Generates a public key including a plurality of random numbers (v, g, u, e (u, v)). To this end, the first terminal 100A generates a random number x, k ← Z _P , u ← G ₁ , and calculates v ← g ^x . Here, the secret key is sk = (x, ssk) and the public key is pk = (spk, v, g, u, k, e (u, v)).

In step S110, the first terminal 100A divides the data file to be uploaded into a predetermined number of blocks and encrypts based on the signature key pair generated in the signature key pair generation step. At this time, an example of a processing procedure for encryption is illustrated in FIG.

)을 소정개로 분할한다. 그리고, 단계 S112에서는, 상기 BLS 짧은 서명 기법에 의거하여, 상기 서명키 쌍 생성 단계에서 생성된 비밀키 및 공개키가 반영된 태그(

)를 상기 분할된 모든 데이터 각각에 대하여 생성한다. 이를 위해, 제1 단말(100A)은 하기의 수학식1을 적용한다.
FIG. 3 is a schematic flowchart of the encryption process (S110) illustrated in FIG. 2. Referring to FIG. 3, for encryption, in step S111, the first terminal 100A transmits a data file

Is divided into a predetermined number. Then, in step S112, based on the BLS short signature technique, the secret key generated in the signature key pair generation step and the tag

) For each of the segmented data. To this end, the first terminal 100A applies the following Equation (1).

,

은 파일 F의 id,

는 i번째 파일을 공개키k로 암호화한 값, x는 비밀키이다.
At this time, _i is the tag of the i-th file among the divided data,

,

Is the id of the file F,

Is the value obtained by encrypting the i-th file with the public key k, and x is the secret key.

In step S113, the first terminal 100A generates a signature value (SSig ssk _{( name )} ) for the name of the data file to be uploaded. At this time, SSig is a secure digital signature scheme, and various known signature algorithms can be applied.

), 태그(

) 및 서명값이 부가된 파일명(

)을 데이터 저장서버(200)로 업로드한다. When the encryption process (S110) is performed in this way, in step S115 of FIG. 2, the first terminal (100A)

), tag(

) And the filename to which the signature value is attached (

To the data storage server 200.

Meanwhile, in step S120, the data storage server 200 stores the uploaded data. Also, in step S125, the data storage server 200 provides a part of the information on the stored data to the second terminal 300A. This is to allow the second terminal 300A to generate a challenge value for the data. That is, in step S130, the second terminal 300A generates a challenge value for a part of the data file for integrity verification of the data file uploaded to the data storage server 200, and in step S135, And transmits the challenge value to the data storage server 200.

4 is a schematic flowchart of a challenge value generation process (S130) illustrated in FIG. 2. Referring to FIG. 4, in step S131, the second terminal 300A transmits data Select some of the entire blocks of the file. For example, it is possible to select only c blocks arbitrarily among n blocks of the entire data file. Then, the data storage server 200 receives an arbitrary subset I including the selected c blocks. At this time, the second terminal 300A receives a part of the data file arbitrarily selected by the data storage server 200, or the second terminal 300A requests the data storage server 200 to receive a part of the selected data file . On the other hand, in step S132, the second terminal 300A generates a challenge value for some blocks provided from the data storage server 200. [ To this end, the second terminal 300A applies the following equation (2).

는

번째 블록에 해당하는 난수로써 임의로 생성한다.
At this time,

The

Th block.

When the challenge value is generated as described above, the second terminal 300A transmits the challenge value to the data storage server 200 in step S135 of FIG.

)와 상기 챌린지값에 기초하여 증명값(proof)을 생성한다. Then, in step S140, the data storage server 200 transmits the information (t, _mi ,

) And a proof value (proof) based on the challenge value.

5 is a schematic flowchart of a procedure of generating a proof value (S140) illustrated in FIG. 2. Referring to FIG. 5, in step S141, the data storage server 200 generates a random number (r), and generates the first authentication value (R) based on the third random number (r). To this end, the data storage server 200 generates a random number r ← Z _P, and generates a first authentication value (R = e (u, v), ^r) on the basis of the value.

)을 생성한다. 이를 위해, 데이터 저장서버(200)는 제1 증명값(R)을 해시함수에 반영(

= h(R))하여 제2 증명값 생성을 위한 제1 변수(

)를 생성하고, 상기 챌린지값(

) 및 데이터 업로드시 수신된 정보(

)를 하기의 수학식3에 반영하여 제2 증명값 생성을 위한 제2 변수(

)를 생성한다.
Further, in step S142, the data storage server 200 generates the second proof value (r) based on the arbitrary third random number r and the first and second additional variables

). To this end, the data storage server 200 reflects the first proof value R to the hash function (

= h (R)) to generate a first variable for generating a second proof value

), And the challenge value (

) And information received when uploading data (

) To the following equation (3) to generate a second parameter for generating a second proof value

).

는 챌린지값,

는 i번째 파일을 공개키k로 암호화한 값이다.
At this time,

A challenge value,

Is a value obtained by encrypting the i-th file with the public key k.

)은 제1 변수(

)와 제2 변수(

)를 곱한 값을 제3 난수(r)에 합산(

)하여 구할 수 있다. The second proof value (

) Is the first variable (

) And the second variable (

) Is added to the third random number (r) (

).

)에 의거하여 제3 증명값()을 생성한다. 이를 위해, 데이터 저장서버(200)는 하기의 수학식4를 적용한다.
On the other hand, in step S143, the data storage server 200 transmits the tag information

) ≪ / RTI > To this end, the data storage server 200 applies the following Equation (4).

는 데이터 업로드시 수신한 i번째 파일의 태그값,

는 챌린지값이다.
At this time,

The tag value of the i-th file received at the time of data upload,

Is the challenge value.

The data storage server 200 that has generated the proof value proof ([mu], [sigma], R)) transmits it to the second terminal 300A in step S145 of FIG.

2, the second terminal 300A verifies the validity of the proof value proof ([mu], [sigma], R)) using the proof value (proof do. To this end, the second terminal 300A applies the following Equation (5).

At this time, the verification step for establishing Equation (5) is as follows.

When Equation (5) is established in this way, the proof value ([mu], [sigma], R)) is valid and the integrity of the data is considered to be guaranteed.

6 is a schematic block diagram of a user data integrity verification apparatus according to an embodiment of the present invention. Referring to FIG. 6, a user data integrity verification apparatus 300A according to an embodiment of the present invention includes a user interface unit (I / F) 310, a control unit 320, a challenge value generation unit 330, (340) and a communication interface (I / F)

The user interface unit (I / F) 310 provides an interface with the user. For example, user selection information and operation signal, such as data selection information for data integrity verification, are received and transmitted to the controller 320.

The control unit 320 controls the operation of the user data integrity verification apparatus based on a preset control program. In particular, the operation of the challenge value generator 330 and the verification unit 340 is controlled based on the user selection information or the operation signal.

In the cloud computing environment, the challenge value generator 330 generates a challenge value for a part of the data file in order to check the integrity of the data file uploaded to the data storage server ('200' in FIG. 1) serving as a cloud server . And transmits the challenge value to the data storage server 200 'in FIG. 1 through the communication interface unit (I / F) 350. To this end, the challenge value generating unit 330 generates a challenge value generating unit 330 from the data storage server ('200' in FIG. 1) through the communication interface unit (I / F) (I) comprising blocks of (c), and generates a challenge value for the subset (I). Further, the challenge value generator 330 preferably generates a challenge value based on Equation (2) mentioned in the description with reference to Fig.

The verification unit 340 receives the challenge value generated in the data storage server based on the challenge value and the information transmitted when the data is uploaded, and verifies the validity of the challenge value. To this end, the verifying unit 240 preferably verifies the proof value based on Equation (5) mentioned in the explanation with reference to Fig.

The communication interface unit (I / F) 350 provides an interface with a data storage server ('200' in FIG. 1) for storing data files.

The above-described embodiments of the present invention can be embodied in a general-purpose digital computer that can be embodied as a program that can be executed by a computer and operates the program using a computer-readable recording medium.

The computer readable recording medium includes a magnetic storage medium (e.g., ROM, floppy disk, hard disk, etc.), optical reading medium (e.g., CD ROM, DVD, etc.).

The present invention has been described with reference to the preferred embodiments.

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The scope of the present invention is defined by the appended claims rather than by the foregoing description, and all differences within the scope of equivalents thereof should be construed as being included in the present invention.

Claims (12)

A system for verifying the integrity of user data based on a correlation between a first terminal for generating a data file, a data storage server on the Internet for storing the data file, and a second terminal for auditing the integrity of the data file stored in the data storage server A method for verifying user data integrity,
The first terminal generating a signature key pair based on a double linear mapping and a BLS short signature scheme;
A data outsourcing step of dividing a data file to be uploaded by the first terminal into a predetermined number of blocks, encrypting the data file based on the signature key pair generated in the signature key pair generation step, and uploading the encrypted data file to the data storage server;
Generating a challenge value for the part of the data file and transmitting the challenge value to the data storage server for the integrity check of the uploaded data file by the second terminal;
Generating a proof value based on the information transmitted when the data storage server uploads the data and the challenge value, and transmitting the proof value to the second terminal; And
And verifying the validity of the proof value using the proof and the public keys by the second terminal.
2. The method of claim 1,
A secret key including a first random number x that is an element of an integer set, a second random number k that is an integer set of elements, and a plurality of random numbers v, g, u , e (u, v)). < / RTI >
3. The method of claim 2, wherein the data outsourcing comprises:
Data file to upload (

) Into a predetermined number;
Based on the BLS short signature scheme, a secret key generated in the signature key pair generation step and a tag

) For each of the segmented data;
Generating a signature value (SSig ssk _(name) ) for the file name (name); And
The data file (

), tag(

) And the filename to which the signature value is attached (

The method comprising the steps of: (a) uploading the user data to the server;
4. The method according to claim 3,
A method for verifying integrity of user data, comprising: generating a tag for all of the divided data based on Equation (1).
(1)

At this time, _i is the tag of the i-th file among the divided data,

,

Is the id of the file F,

Is the value obtained by encrypting the i-th file with the public key k, and x is the secret key.
The method of claim 1, wherein the challenge value transmission step comprises:
Receiving from the data storage server an arbitrary subset (I) comprising arbitrarily selected several (c) blocks of the entire data file block (n);
Generating a challenge value for the subset (I); And
And transmitting the challenge value to the data storage server.
6. The method of claim 5, wherein the generating the challenge value comprises:
Wherein a challenge value is generated based on Equation (2) below.
(2)

At this time,

The

Th block.
2. The method according to claim 1, wherein the proof value generation step
Generating a third random number (r) which is an element of the integer set and generating a first authentication value (R) based on the third random number (r);
The first proof value (R) is reflected in the hash function to generate a first proof value

);
The challenge value and the information received at the time of data upload are reflected in the following equation (3) to obtain the second parameter for generating the second authentication value

);
The third random number r, the first variable

) And the second variable (

On the basis of the second proof value (

);
Based on the following equation (4), the third proof value (

); And
And determining the first to third authentication values as a proof value for the challenge value.
(3)

At this time,

A challenge value,

Is a value obtained by encrypting the i-th file with the public key k.
(4)

At this time,

The tag value of the i-th file received at the time of data upload,

Is the challenge value.
The method according to claim 1, wherein the verification value verification step
Wherein the verification value is verified based on Equation (5) below.
(5)

A communication interface unit for providing an interface with a data storage server for storing a data file;
A challenge value generation unit for generating a challenge value for a part of the data file to confirm integrity of the data file uploaded to the data storage server and transmitting the generated challenge value to the data storage server; And
And a verification unit that receives the challenge value and the authentication value generated by the data storage server based on the information transmitted when the data is uploaded and verifies the validity of the authentication value using the public keys,
Wherein each of the public keys is one of a signature key pair generated based on a double linear mapping and a BLS short signature technique and a data file uploaded to the data storage server is encrypted based on the generated signature key pair User data integrity verification device.
10. The apparatus of claim 9, wherein the challenge value generator
(I) including some arbitrarily selected blocks (c) of the entire data file block (n) from the data storage server via the communication interface, and a challenge for the subset (I) Value of the user data.
11. The apparatus of claim 10, wherein the challenge value generator
And generates a challenge value based on Equation (2) below.
(2)

At this time,

The

Th block.
The apparatus of claim 9, wherein the verifying unit
Wherein the verification unit verifies the verification value based on Equation (5) below.
(5)

Images