CN108229208A - A kind of public audit method of more copy datas in cloud storage service - Google Patents
A kind of public audit method of more copy datas in cloud storage service Download PDFInfo
- Publication number
- CN108229208A CN108229208A CN201810015840.3A CN201810015840A CN108229208A CN 108229208 A CN108229208 A CN 108229208A CN 201810015840 A CN201810015840 A CN 201810015840A CN 108229208 A CN108229208 A CN 108229208A
- Authority
- CN
- China
- Prior art keywords
- data block
- user
- file
- data
- auditing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
- G06F21/645—Protecting data integrity, e.g. using checksums, certificates or signatures using a third party
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Bioethics (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Storage Device Security (AREA)
Abstract
The invention discloses a kind of public audit methods of more copy datas in cloud storage service, belong to information security field, and the purpose is to realize the efficient audit for the more copy data integralities of dynamic in cloud storage environment；The present invention includes (1) key generation step；(2) user data pre-treatment step；(3) cloud service number formulary Data preprocess step；(4) auditing by third party person data prediction step；(5) step is challenged；(6) evidence generation step；(7) proof validation step；(8) data dynamic update step；(9) batch audit steps.Public audit method proposed by the invention while more copy cloud data efficient audits are ensured, can support that the dynamic of more copy datas updates and the batch of more copy datas is audited.
Description
Technical field
The invention belongs to information security fields, more particularly to audit towards the data safety of cloud storage, suitable for cloud storage
The integrality public audit of more copy datas in environment.
Background technology
With the rapid development of cloud storage technology and its related industry, more and more personal and enterprises tend to be counted
According to being outsourced on cloud, to improve the reliability of data storage and reduce its maintenance costs.However, cloud storage brings advantage to the user
While, also result in many safety problems.Especially since the separation of data ownership and administrative power, makes user be difficult to use
Traditional mode verifies the integrality of data, trusts wide gap so that existing between user and cloud service side.
Appearance recently as copy storage services more in cloud and universal, towards the security audit problem of more copy datas
Also it gradually attracts attention.Curtmola et al. pays close attention to this problem earliest, it is proposed that the more copy data property held cards
Bright scheme, the program use RSA signature and random mask technology, realize the integrality audit to more copy datas, but the program
Do not support public audit (see Curtmola R, Khan O, Burns R, et al.MR-PDP:Multiple-replica
provable data possession[C]//Distributed Computing Systems,2008.ICDCS'08.The
28th International Conference on.IEEE,2008:411-420)；Hao et al. is proposed based on Boneh-
Lynn-Shacham signature schemes are realized to the public audit of more copy datas (see Hao Z, Yu N.A multiple-
replica remote data possession checking protocol with public verifiability
[C]//Data,Privacy and E-Commerce(ISDPE),2010Second International Symposium
on.IEEE,2010:84-89)；Chen et al. gives the more copy data property the held batch auditing parties of multi-user on this basis
(see Chen Hefeng, Lin Bai, poplar Yang waits the more copy data property held batch audit [J] password journals of multi-users of the based on BLS to case
.2014,(04):368-378).However, these schemes can not support the dynamic of more copy datas to update.To realize more copies
The dynamic auditing of data, Liu et al. people is (see Liu C, Chen J, Yang L T, et al.Authorized public
auditing of dynamic big data storage on cloud with efficient verifiable fine-
grained updates[J].IEEE Transactions on Parallel and Distributed Systems,
2014,25(9):2234-2244) and Barsoum et al. is (see Barsoum AF, Hasan M A.On Verifying
Dynamic Multiple Data Copies over Cloud Servers[J].IACR Cryptology ePrint
Archive,2011,2011:447) audit program based on Merkle Hash trees and index Hash table is set forth.The former is sharp
By the use of the MR-MHT trees that multiple Merkle Hash trees are merged into as the authentication structures of more copy dynamic datas.The latter has abandoned index
Hash table records data block sequence number, devises version mapping table as authentication structures, avoids label generation and corresponding data
Block serial number is related.Compared with the former so that data dynamic updates highly efficient.However, because it must be to same sequence number in different copies
Label polymerize, therefore label generation expense it is larger.
For existing research there are the problem of, the present invention proposes a kind of integrality auditing party of new more copy datas
Case.While the audit of more copy cloud data efficients is ensured, support that the dynamics of more copy datas updates and more copy datas
Batch audit (i.e. auditing by third party person can disposably audit the audit task from multiple users).
Invention content
The present invention provides a kind of public audit methods of more copy datas in cloud storage service, it is desirable to provide efficient more
Copy cloud data integrity public audit simultaneously, supports that the dynamic of more copy datas updates and the batch of more copy datas is examined
Meter.
Present invention employs following technical solutions：
A kind of public audit method of more copy datas in cloud storage service, including：
(1) key generation step：User generates key pair, i.e. private key SK={ x }, public key PK={ g, u, v, y }；User protects
Private key SK is deposited, and public key PK is distributed to cloud service side and auditing by third party person；Wherein x is integer set ZpIn random number,
U, v are the cyclic group G that rank is prime number p1In random element, g be rank be prime number p cyclic group G2Generation member, and y=gx；
(2) user data pre-treatment step：User generates file identification ID for pending file F first；And by file F
It is divided into n data block, i.e. F={ b1, b2, bn, wherein bi(i=1,2 ..., n) it is i-th of data block；Simultaneously
The version information of each data block is recorded, obtains set Ф={ (vi, ti) | 1≤i≤n }, wherein, vi, tiRespectively data block bi's
Version number and timestamp；In addition, user is also each data block biGenerate corresponding digital signature σi, so as to obtain digital signature
Set Λ={ σi|1≤i≤n}；Then, t different copy texts are generated by being inserted into different random masks to each data block
Part remembers that more copy sets are combined into FS={ F '1,F’2,…,F’t, wherein F 'j(j=1,2 ..., t) be j-th of wave file；Most
Afterwards, user preserves file identification ID and version information the Ф person that transfers to auditing by third party, by file identification ID, data block signature collection
It closes Λ and more copy set FS and is sent to cloud service side, delete all data except private key later；
(3) cloud service number formulary Data preprocess step：Cloud service side receives more copy set FS, the number that user sends over
After block signature set Λ and file identification ID, first to each data block signature sigmaiIt carries out Bilinear Pairing and data block is calculated
Label ωi, i.e. ωi=e (σi, g), and by tag set Ω={ ωi| 1≤i≤n } it preserves, while each copy is deposited in not
Same server；
(4) auditing by third party person data prediction step：File identification ID that auditing by third party person sends user and
Version information Ф={ (vi, ti) | 1≤i≤n } it is stored in dynamic Hash table, to realize data carry mechanism (latest edition state)
Audit.Dynamic Hash table be propose recently for support an authentication data structure of data dynamic (see Tian H,
Chen Y,Chang C C,et al.Dynamic-hash-table based public auditing for secure
Cloud storage [J] .IEEE Transactions on Services Computing, 2017,10 (5):701-714),
It is substantially a bivariate table, and multiple files are carried out tissue in a manner of array in table, and each data block in each file
Version information carries out tissue in a manner of chained list.
(5) step is challenged：Auditing by third party person responds user's audit request or regularly represents user and its data is carried out
Audit, needs to firstly generate challenge information thus, including randomly selected data block sequence number set Ψ={ ψs| s=1,2 ..., c },
Set of random numbers Τ={ rs|rs∈Zp, s=1,2 ..., c } and random mask R=ya, wherein, c is to be needed in each wave file
The number of data blocks of challenge, a are integer set ZpMiddle random number；Then, auditing by third party person sends out challenge information (Ψ, Τ, R)
Give cloud service side；
(6) evidence generation step：After the challenge information of cloud service side receives auditing by third party person, one of the main divisions of the male role in traditional opera is into the data property held
Evidence, including label evidence Θ and data block evidence set Ρ={ ρj| 1≤j≤t }, wherein ρjNumber for j-th of wave file
According to block evidence；Then by evident information (Θ, the Ρ) person that returns to auditing by third party；
(7) proof validation step：The evident information (Θ, Ρ) that auditing by third party person returns to cloud service side is verified；
If being proved to be successful, it is complete to illustrate more wave files；Otherwise, illustrate that the data in certain more wave files have been damaged；
(8) data dynamic update step：When need to data be updated with (including changing, being inserted into and delete), Yong Huxu
Fresh information U is sent to auditing by third party personTPA, fresh information U is sent to cloud service sideCSP；After fresh information is received, third party
Audit person will update dynamic Hash table therewith, and cloud service side will update corresponding data block and label.
(9) batch audit steps：When there is w different user to initiate audit request simultaneously, cloud service side is each user
Generation label evidence Θ respectivelykWith data block evidence set Ρk={ ρk,j| 1≤j≤t }, wherein k=1,2 ..., w；Then, will
All label evidences carry out polymerization again and obtain label batch audit evidence ΘB, by the data of each user's difference wave file
Block evidence carries out polymerization again and obtains data block batch audit evidence set Г={ ΡBj|1≤j≤t}；Then, cloud service side will
Batch audit evidence (ΘB, Г) and it is sent to tripartite audit person；Auditing by third party person verifies batch audit evidence；If it tests
It demonstrate,proves successfully, then the more wave files for illustrating all users are all complete；Otherwise, illustrate data in certain more wave files
It is damaged.
Preferably, the user data pre-treatment step includes following process：
(2.1) user generates file identification ID for pending file F first；And file F is divided into n data block,
That is F=(b1, b2, bn), wherein biFor i-th of data block；The version information of each data block is recorded simultaneously, is gathered
Ф={ (vi, ti) | 1≤i≤n }, wherein, vi, tiRespectively data block biVersion number and timestamp；In addition, user is also every
A data block biGenerate corresponding digital signature σi, calculating process is：
Wherein, H () is secure hash function, and function is by character string maps to integer set ZpOn；
(2.2) user generates t different wave files to each data block by being inserted into different random masks, and note is mostly secondary
This collection is combined into FS=(F '1,F’2,…,F’t), wherein F 'j={ mj,1, mj,2..., mj,n, j=1,2 ..., t, and mj,i(i=
1,2 ..., n) by data block biDifferentiation obtains, and calculating process is：
mj,i=bi+H(vi||ti||j)。
(2.3) user preserves file identification ID and version information the Ф person that transfers to auditing by third party, by file identification ID, number
According to block signature set Λ={ σi| 1≤i≤n } and multiple copy set FS be sent to cloud service side, later delete private key except
All data.
Preferably, the evidence generation step includes following process：
(6.1) it is more wave files generation label card first after the challenge information of the cloud service side person that receives auditing by third party
According to calculating process is：
Wherein,It is more wave file ψsThe label of a data block；
(6.2) cloud service side generates data block evidence ρ for each wave filej(j=1,2 ..., t), calculating process
For：
Wherein, e is bilinear map function；It is the ψ of j-th of wave filesA data block；
(6.3) cloud service side is by evident information (Θ, Ρ={ ρj| 1≤j≤t }) person that returns to auditing by third party.
Preferably, the proof validation step includes following process：
The evident information (Θ, Ρ) that auditing by third party person returns to cloud service side substitutes into following equation and is verified：
Wherein, Respectively ψsA data blockVersion number and timestamp；If equation is set up, illustrate mostly secondary
This document is complete；Otherwise, illustrate that the data in certain more wave files have been damaged.
Preferably, the data dynamic update step includes following process：
(8.1) data block is changed：As user is needed i-th of data block b of file FiIt is revised as bi', user is b firsti’
Build version information (vi', ti'), then send fresh information UTPA=(ID, modify, i, vi', ti') to auditing by third party
Person, wherein, ID is the identifier of file F；Modify represents update operation as modification.Auditing by third party person receives fresh information
UTPAAfterwards, the version information of i-th of data block of file F is found in dynamic Hash table, is replaced with (vi', ti’).In addition,
User need to be that modified data block generates new signatureAnd t data block copy M '={ m 'j,i=
bi’+H(vi’||ti' | | j) | 1≤j≤t }, then send fresh information UCSP=(ID, modify, i, M ', σ 'i) to cloud service
Side, wherein, ID is the identifier of file F；Modify represents update operation as modification.Cloud service side receives fresh information UCSPAfterwards,
To digital signature sigma 'iReprocessing obtains data block label ω 'i=e (σ 'i, g), then to i-th of data block label and multiple pairs
Originally it is updated, i.e., by ωiReplace with ω 'i, by data block copy mj,iReplace with m 'j,i, j=1,2 ..., t.
(8.2) data block is inserted into：As user needs to be inserted into b behind i-th of data block of file F*, user is b first*It is raw
Into version information (v*, t*), then send fresh information UTPA=(ID, insert, i, v*, t*) auditing by third party person is given, wherein,
ID is the identifier of file F；Insert represents update operation to be inserted into.Auditing by third party person receives fresh information UTPAAfterwards, dynamic
The position of i-th of data block version information of file F is found in state Hash table, and version information (v is inserted into behind this position*,
t*).In addition, user, which need to be the data block being inserted into, generates new signature sigma*=(vH(v*||t*)ub*)xAnd t data block copy M*=
{m* j=b*+H(v*||t*| | j) | 1≤j≤t }, then send fresh information UCSP=(ID, insert, i, M*, σ*) to cloud service
Side, wherein, ID is the identifier of file F；Insert represents update operation to be inserted into.Cloud service side receives fresh information UCSPAfterwards,
To digital signature sigma*Reprocessing obtains data block label ω*=e (σ*, g), it then will be in i-th of data block label ωiAfter be inserted into
Label ω*And in data block copy mj,iIt is inserted into data block m afterwards* j, j=1,2 ..., t.
(8.3) data block is deleted：As user is needed i-th of data block b of file FiIt deletes, user sends fresh information
UTPA=(ID, delete, i) gives auditing by third party person, wherein, ID is the identifier of file F；Delete represent update operation as
It deletes.Auditing by third party person receives fresh information UTPAAfterwards, the version of i-th of data block of file F is found in dynamic Hash table
Information, and be deleted.In addition, user sends fresh information UCSP=(ID, delete, i) to cloud service side, wherein, ID for text
The identifier of part F；Delete represents update operation to delete.Cloud service side receives fresh information UCSPIt afterwards, will be in i-th of data
Block label ωiIt deletes, and deletes b simultaneouslyiAll data block copies, i.e. { mj,i| j=1,2 ..., t }.
Preferably, the batch audit steps include following process：
(9.1) when there is w different user to initiate audit request simultaneously, cloud service side generates label respectively for each user
Evidence ΘkWith data block evidence set Ρk={ ρk,j|1≤j≤t}；Wherein, label evidence ΘkCalculating process be：
Wherein,It is the ψ of k-th of usersA label；rk,sIt is random number in the challenge information about k-th of user
S-th of random number of set；
Each element ρ in data block evidence setk,jCalculating process be：
Wherein, ukIt is the public key of k-th of user；RkIt is the random mask of k-th of user in challenge information；It is kth
ψ in j-th of wave file of a usersA data block；
(9.2) all label evidences are carried out polymerization again and obtain label batch audit evidence Θ by cloud service sideB, meter
Calculation process is：
And the data block evidence of each user's difference wave file is subjected to polymerization again and obtains data block batch audit evidence
Set Г={ Ρ Bj| 1≤j≤t }, wherein ΡBjCalculating process be：
(9.3) cloud service side is by batch audit evidence (ΘB, Г) and it is sent to tripartite audit person.
(9.4) the batch audit evidence (Θ that auditing by third party person returns to cloud service sideB, Г) and substitute into following equation progress
Verification：
Wherein, vk, ukIt is the public key of k-th of user； The ψ of respectively k-th usersA data block
Version number and timestamp；RkIt is the random mask of k-th of user in challenge information, andWherein ykFor k-th of user
Public key, a be integer set ZpMiddle random number；
If equation is set up, it is complete to illustrate more wave files；Otherwise, illustrate data in certain more wave files
It is damaged.
The advantageous effect that technical solution provided by the invention is brought is：
Public audit method proposed by the invention can be supported mostly secondary while more copy cloud data efficient audits are ensured
The dynamic update of notebook data and the batch audit of more copy datas.
The present invention is described in further detail with reference to the accompanying drawings and embodiments, but a kind of cloud storage service of the present invention
In the public audit methods of more copy datas be not limited to embodiment.
Description of the drawings
Fig. 1 is the sequence diagram of public audit of the embodiment of the present invention；
Fig. 2 is dynamic Hash table figure of the embodiment of the present invention；
Fig. 3 is the newer sequence diagram of data of embodiment of the present invention dynamic.
Specific embodiment
The present invention is further described below by way of specific embodiment.
The present invention provides a kind of public audit method of more copy datas in cloud storage service, below in conjunction with attached drawing to this
Invention further illustrates.
Shown in Figure 1, the public audit method of more copy datas, gives birth to including key in a kind of cloud storage service of the present invention
Into step, user data pre-treatment step, cloud service number formulary Data preprocess step, auditing by third party person's data prediction step,
Step, evidence generation step and proof validation step are challenged, it is specific as follows：
1. key generation step：User generates key pair, i.e. private key SK={ x }, public key PK={ g, u, v, y }；User protects
Private key SK is deposited, and public key PK is distributed to cloud service side and auditing by third party person；Wherein x is integer set ZpIn random number,
U, v are the cyclic group G that rank is prime number p1In random element, g be rank be prime number p cyclic group G2Generation member, and y=gx；
2. user data pre-treatment step includes following process：
2.1 users generate file identification ID for pending file F first；And file F is divided into n data block, i.e. F
=(b1, b2, bn), wherein biFor i-th of data block；The version information of each data block is recorded simultaneously, obtains set Ф
={ (vi, ti) | 1≤i≤n }, wherein, vi, tiRespectively data block biVersion number and timestamp；In addition, user is also each
Data block biGenerate corresponding digital signature σi, calculating process is：
Wherein, H () is secure hash function, and function is by character string maps to integer set ZpOn；
2.2 users generate t different wave files to each data block by being inserted into different random masks, remember more copies
Collection is combined into FS=(F '1,F’2,…,F’t), wherein F 'j={ mj,1, mj,2..., mj,n, j=1,2 ..., t, and mj,i(i=1,
2 ..., n) by data block biDifferentiation obtains, and calculating process is：
mj,i=bi+H(vi||ti||j)。
2.3 users preserve file identification ID and version information the Ф person that transfers to auditing by third party, by file identification ID, data
Block signature set Λ={ σi| 1≤i≤n } and multiple copy set FS be sent to cloud service side, later delete private key except institute
There are data.
3. cloud service number formulary Data preprocess step：Cloud service side receives more copy set FS, the number that user sends over
After block signature set Λ and file identification ID, first to each data block signature sigmaiIt carries out Bilinear Pairing and data block is calculated
Label ωi, i.e. ωi=e (σi, g), and by tag set Ω={ ωi| 1≤i≤n } it preserves, while each copy is deposited in not
Same server；
4. auditing by third party person's data prediction step：The file identification ID and version that auditing by third party person sends user
This information Ф={ (vi, ti) | 1≤i≤n } it is stored in dynamic Hash table, to realize data carry mechanism (latest edition state)
It can audit.Dynamic Hash table be propose recently for support an authentication data structure of data dynamic (see Tian H,
Chen Y,Chang C C,et al.Dynamic-hash-table based public auditing for secure
Cloud storage [J] .IEEE Transactions on Services Computing, 2017,10 (5):701-714),
Shown in Figure 2, dynamic Hash table is substantially a bivariate table, and multiple files are carried out tissue in a manner of array in table,
And the version information of each data block carries out tissue in a manner of chained list in each file.
5. challenge step：Auditing by third party person responds user's audit request or regularly represents user and its data is examined
Meter, needs to firstly generate challenge information thus, including randomly selected data block sequence number set Ψ={ ψs| s=1,2 ..., c }, with
Machine manifold closes Τ={ rs|rs∈Zp, s=1,2 ..., c } and random mask R=ya, wherein, c is to need to choose in each wave file
The number of data blocks of war, a are integer set ZpMiddle random number；Then, auditing by third party person sends challenge information (Ψ, Τ, R)
To cloud service side；
6. evidence generation step includes following process：
It is more wave files generation label evidence first after the challenge information of 6.1 cloud service sides receive auditing by third party person,
Its calculating process is：
Wherein,It is more wave file ψsThe label of a data block；
6.2 cloud service sides generate data block evidence ρ for each wave filej(j=1,2 ..., t), calculating process is：
Wherein, e is bilinear map function；It is the ψ of j-th of wave filesA data block；
6.3 cloud service sides are by evident information (Θ, Ρ={ ρj| 1≤j≤t }) person that returns to auditing by third party.
7. the evident information (Θ, Ρ) that auditing by third party person returns to cloud service side substitutes into following equation and is verified：
Wherein, Respectively ψsA data blockVersion number and timestamp；If equation is set up, illustrate mostly secondary
This document is complete；Otherwise, illustrate that the data in certain more wave files have been damaged.
The newer sequence diagram of data dynamic shown in Figure 3, of the invention, fresh information, third party are sent including user
Audit person performs update and cloud service side performs update.
8. data dynamic update step includes following process：
8.1 when need to be updated data (including changing, being inserted into and delete), and user need to send to auditing by third party person
Fresh information UTPA, fresh information U is sent to cloud service sideCSP；After fresh information is received, auditing by third party person will update dynamic therewith
State Hash table, cloud service side will update corresponding data block and label.
8.2 data blocks are changed：As user is needed i-th of data block b of file FiIt is revised as bi ’, user is b firsti' raw
Into version information (vi', ti'), then send fresh information UTPA=(ID, modify, i, vi', ti') auditing by third party person is given,
Wherein, ID is the identifier of file F；Modify represents update operation as modification.Auditing by third party person receives fresh information UTPA
Afterwards, the version information of i-th of data block of file F is found in dynamic Hash table, is replaced with (vi', ti’).In addition, with
Family need to be that modified data block generates new signatureAnd t data block copy M '={ m 'j,i=
bi’+H(vi’||ti' | | j) | 1≤j≤t }, then send fresh information UCSP=(ID, modify, i, M ', σ’ i) to cloud service
Side, wherein, ID is the identifier of file F；Modify represents update operation as modification.Cloud service side receives fresh information UCSPAfterwards,
To digital signature sigma 'iReprocessing obtains data block label ω 'i=e (σ 'i, g), then to i-th of data block label and multiple pairs
Originally it is updated, i.e., by ωiReplace with ω 'i, by data block copy mj,iReplace with m 'j,i, j=1,2 ..., t.
8.3 data blocks are inserted into：As user needs to be inserted into b behind i-th of data block of file F*, user is b first*Generation
Version information (v*, t*), then send fresh information UTPA=(ID, insert, i, v*, t*) auditing by third party person is given, wherein, ID
Identifier for file F；Insert represents update operation to be inserted into.Auditing by third party person receives fresh information UTPAAfterwards, in dynamic
The position of i-th of data block version information of file F is found in Hash table, and version information (v is inserted into behind this position*, t*)。
In addition, user, which need to be the data block being inserted into, generates new signature sigma*=(vH(v*||t*)ub*)xAnd t data block copy M*={ m* j
=b*+H(v*||t*| | j) | 1≤j≤t }, then send fresh information UCSP=(ID, insert, i, M*, σ*) to cloud service side,
Wherein, ID is the identifier of file F；Insert represents update operation to be inserted into.Cloud service side receives fresh information UCSPAfterwards, it is right
Digital signature σ*Reprocessing obtains data block label ω*=e (σ*, g), it then will be in i-th of data block label ωiIt is inserted into mark afterwards
Sign ω*And in data block copy mj,iIt is inserted into data block m afterwards* j, j=1,2 ..., t.
8.4 data blocks are deleted：As user is needed i-th of data block b of file FiIt deletes, user sends fresh information UTPA
=(ID, delete, i) gives auditing by third party person, wherein, ID is the identifier of file F；Delete represents update operation to delete
It removes.Auditing by third party person receives fresh information UTPAAfterwards, the version letter of i-th of data block of file F is found in dynamic Hash table
Breath, and be deleted.In addition, user sends fresh information UCSP=(ID, delete, i) to cloud service side, wherein, ID is file
The identifier of F；Delete represents update operation to delete.Cloud service side receives fresh information UCSPIt afterwards, will be in i-th of data block
Label ωiIt deletes, and deletes b simultaneouslyiAll data block copies, i.e. { mj,i| j=1,2 ..., t }.
9. batch audit steps include following process：
9.1 when there is w different user to initiate audit request simultaneously, and cloud service side generates label card respectively for each user
According to ΘkWith data block evidence set Ρk={ ρk,j|1≤j≤t}；Wherein, label evidence ΘkCalculating process be：
Wherein,It is the ψ of k-th of usersA label；rk,sIt is random number in the challenge information about k-th of user
S-th of random number of set；
Each element ρ in data block evidence setk,jCalculating process be：
Wherein, ukIt is the public key of k-th of user；RkIt is the random mask of k-th of user in challenge information；It is kth
ψ in j-th of wave file of a usersA data block；
All label evidences are carried out polymerization again and obtain label batch audit evidence Θ by 9.2 cloud service sidesB, calculate
Process is：
And the data block evidence of each user's difference wave file is subjected to polymerization again and obtains data block batch audit evidence
Set Г={ Ρ Bj| 1≤j≤t }, wherein Ρ BjCalculating process be：
9.3 cloud service sides are by batch audit evidence (ΘB, Г) and it is sent to tripartite audit person.
Batch audit evidence (the Θ that 9.4 auditing by third party persons return to cloud service sideB, Г) and it substitutes into following equation and is tested
Card：
Wherein, vk, ukIt is the public key of k-th of user； The ψ of respectively k-th usersA data block
Version number and timestamp；RkIt is the random mask of k-th of user in challenge information, andWherein ykFor k-th of user
Public key, a be integer set ZpMiddle random number；
If equation is set up, it is complete to illustrate more wave files；Otherwise, illustrate data in certain more wave files
It is damaged.
The foregoing is merely presently preferred embodiments of the present invention, is not intended to limit the invention, it is all the present invention spirit and
Within principle, any modification, equivalent replacement, improvement and so on should all be included in the protection scope of the present invention.
Claims (6)
1. a kind of public audit method of more copy datas in cloud storage service, which is characterized in that including：
(1) key generation step：User generates key pair, i.e. private key SK={ x }, public key PK={ g, u, v, y }；User preserves private
Key SK, and public key PK is distributed to cloud service side and auditing by third party person；Wherein x is integer set ZpIn random number, u, v are
Rank is the cyclic group G of prime number p1In random element, g be rank be prime number p cyclic group G2Generation member, and y=gx；
(2) user data pre-treatment step：User generates file identification ID for pending file F first；And file F is divided
For n data block, i.e. F={ b1, b2, bn, wherein bi(i=1,2 ..., n) it is i-th of data block；It records simultaneously
The version information of each data block obtains set Ф={ (vi, ti) | 1≤i≤n }, wherein, vi, tiRespectively data block biVersion
Number and timestamp；In addition, user is also each data block biGenerate corresponding digital signature σi, so as to obtain digital signature set
Λ={ σi|1≤i≤n}；Then, t different wave files are generated by being inserted into different random masks to each data block,
Remember that more copy sets are combined into FS={ F '1,F’2,…,F’t, wherein F 'j(j=1,2 ..., t) be j-th of wave file；Finally,
User preserves file identification ID and version information the Ф person that transfers to auditing by third party, by file identification ID, data block signature set
Λ and more copy set FS are sent to cloud service side, delete all data except private key later；
(3) cloud service number formulary Data preprocess step：Cloud service side receives more copy set FS, the data block that user sends over
After signature set Λ and file identification ID, first to each data block signature sigmaiIt carries out Bilinear Pairing and data block label is calculated
ωi, i.e. ωi=e (σi, g), and by tag set Ω={ ωi| 1≤i≤n } it preserves, while each copy deposited in different
Server；
(4) auditing by third party person data prediction step：The file identification ID and version that auditing by third party person sends user
Information Ф={ (vi, ti) | 1≤i≤n } it is stored in dynamic Hash table, to realize auditing for data carry mechanism；
(5) step is challenged：Auditing by third party person responds user's audit request or regularly represents user and audits to its data,
It needs to firstly generate challenge information thus, including randomly selected data block sequence number set Ψ={ ψs| s=1,2 ..., c }, at random
Manifold closes Τ={ rs|rs∈Zp, s=1,2 ..., c } and random mask R=ya, wherein, c is to need to challenge in each wave file
Number of data blocks, a be integer set ZpMiddle random number；Then, challenge information (Ψ, Τ, R) is sent to by auditing by third party person
Cloud service side；
(6) evidence generation step：After the challenge information of cloud service side receives auditing by third party person, one of the main divisions of the male role in traditional opera demonstrate,proves into the data property held
According to including label evidence Θ and data block evidence set Ρ={ ρj| 1≤j≤t }, wherein ρjData for j-th of wave file
Block evidence；Then by evident information (Θ, the Ρ) person that returns to auditing by third party；
(7) proof validation step：The evident information (Θ, Ρ) that auditing by third party person returns to cloud service side is verified；If it tests
It demonstrate,proves successfully, then it is complete to illustrate more wave files；Otherwise, illustrate that the data in certain more wave files have been damaged；
(8) data dynamic update step：When that need to be updated to data, user need to send fresh information to auditing by third party person
UTPA, fresh information U is sent to cloud service sideCSP；After fresh information is received, auditing by third party person will update dynamic Hash therewith
Table, cloud service side will update corresponding data block and label；
(9) batch audit steps：When there is w different user to initiate audit request simultaneously, cloud service side is distinguished for each user
Generate label evidence ΘkWith data block evidence set Ρk={ ρk,j| 1≤j≤t }, wherein k=1,2 ..., w；It then, will be all
Label evidence carry out again polymerization obtain label batch audit evidence ΘB, the data block of each user's difference wave file is demonstrate,proved
Data block batch audit evidence set is obtained according to polymerization again is carried outThen, cloud service side will batch
Audit evidence (ΘB, Г) and it is sent to tripartite audit person；Auditing by third party person verifies batch audit evidence；If verification into
Work(, the then more wave files for illustrating all users are all complete；Otherwise, illustrate that the data in certain more wave files are damaged
It is bad.
2. the public audit method of more copy datas in a kind of cloud storage service according to claim 1, which is characterized in that
The user data pre-treatment step includes following process：
(2.1) user generates file identification ID for pending file F first；And file F is divided into n data block, i.e. F=
(b1, b2, bn), wherein biFor i-th of data block；Record the version information of each data block simultaneously, obtain set Ф=
{(vi, ti) | 1≤i≤n }, wherein, vi, tiRespectively data block biVersion number and timestamp；In addition, user is also per number
According to block biGenerate corresponding digital signature σi, calculating process is：
Wherein, H () is secure hash function, and function is by character string maps to integer set ZpOn；
(2.2) user generates t different wave files to each data block by being inserted into different random masks, remembers more copy sets
It is combined into FS=(F '1,F’2,…,F’t), wherein F 'j={ mj,1, mj,2..., mj,n, and mj,iBy data block biDifferentiation obtains,
Calculating process is：
mj,i=bi+H(vi||ti||j)；
(2.3) user preserves file identification ID and version information the Ф person that transfers to auditing by third party, by file identification ID, data block
Signature set Λ={ σi| 1≤i≤n } and multiple copy set FS be sent to cloud service side, delete later all except private key
Data.
3. the public audit method of more copy datas in a kind of cloud storage service according to claim 1, which is characterized in that
The evidence generation step includes following process：
(3.1) it is more wave files generation label evidence first after the challenge information of the cloud service side person that receives auditing by third party,
Calculating process is：
Wherein,It is more wave file ψsThe label of a data block；
(3.2) cloud service side generates data block evidence ρ for each wave filej, calculating process is：
Wherein, e is bilinear map function；It is the ψ of j-th of wave filesA data block；
(3.3) cloud service side is by evident information (Θ, Ρ={ ρj| 1≤j≤t }) person that returns to auditing by third party.
4. the public audit method of more copy datas in a kind of cloud storage service according to claim 1, which is characterized in that
The proof validation step includes following process：
The evident information (Θ, Ρ) that auditing by third party person returns to cloud service side substitutes into following equation and is verified：
Wherein,Respectively ψsA data blockVersion number and timestamp；If equation is set up, illustrate more copies
File is complete；Otherwise, illustrate that the data in certain more wave files have been damaged.
5. the public audit method of more copy datas in a kind of cloud storage service according to claim 1, which is characterized in that
The data dynamic update step includes following process：
(5.1) data block is changed：As user is needed i-th of data block b of file FiIt is revised as bi', user is b firsti' generation
Version information (vi', ti'), then send fresh information UTPA=(ID, modify, i, vi', ti') auditing by third party person is given,
In, ID is the identifier of file F；Modify represents update operation as modification；Auditing by third party person receives fresh information UTPAAfterwards,
The version information of i-th of data block of file F is found in dynamic Hash table, is replaced with (vi', ti’)；In addition, user needs
New signature is generated for modified data blockAnd t data block copy M '={ m 'j,i=bi’+H
(vi’||ti' | | j) | 1≤j≤t }, then send fresh information UCSP=(ID, modify, i, M ', σ 'i) to cloud service side,
In, ID is the identifier of file F；Modify represents update operation as modification；Cloud service side receives fresh information UCSPAfterwards, logarithm
Word signature sigma 'iReprocessing obtains data block label ω 'i=e (σ 'i, g), then to i-th of data block label and multiple copies into
Row update, i.e., by ωiReplace with ω 'i, by data block copy mj,iReplace with m 'j,i；
(5.2) data block is inserted into：As user needs to be inserted into b behind i-th of data block of file F*, user is b first*Generate version
This information (v*, t*), then send fresh information UTPA=(ID, insert, i, v*, t*) auditing by third party person is given, wherein, ID is
The identifier of file F；Insert represents update operation to be inserted into；Auditing by third party person receives fresh information UTPAAfterwards, it is breathed out in dynamic
The position of i-th of data block version information of file F is found in uncommon table, and version information (v is inserted into behind this position*, t*)；This
Outside, user need to be that the data block being inserted into generates new signatureAnd t data block copy M*={ m* j=b*
+H(v*||t*| | j) | 1≤j≤t }, then send fresh information UCSP=(ID, insert, i, M*, σ*) to cloud service side,
In, ID is the identifier of file F；Insert represents update operation to be inserted into；Cloud service side receives fresh information UCSPAfterwards, logarithm
Word signature sigma*Reprocessing obtains data block label ω*=e (σ*, g), it then will be in i-th of data block label ωiAfter be inserted into label
ω*And in data block copy mj,iIt is inserted into data block m afterwards* j；
(5.3) data block is deleted：As user is needed i-th of data block b of file FiIt deletes, user sends fresh information UTPA=
(ID, delete, i) gives auditing by third party person, wherein, ID is the identifier of file F；Delete represents update operation to delete；
Auditing by third party person receives fresh information UTPAAfterwards, the version information of i-th of data block of file F is found in dynamic Hash table,
And it is deleted；In addition, user sends fresh information UCSP=(ID, delete, i) to cloud service side, wherein, ID is file F
Identifier；Delete represents update operation to delete；Cloud service side receives fresh information UCSPIt afterwards, will be in i-th of data block label
ωiIt deletes, and deletes b simultaneouslyiAll data block copies, i.e. { mj,i| j=1,2 ..., t }.
6. the public audit method of more copy datas in a kind of cloud storage service according to claim 1, which is characterized in that
The batch audit steps include following process：
(6.1) when there is w different user to initiate audit request simultaneously, cloud service side generates label evidence respectively for each user
ΘkWith data block evidence set Ρk={ ρk,j|1≤j≤t}；Wherein, label evidence ΘkCalculating process be：
Wherein,It is the ψ of k-th of usersA label；rk,sIt is set of random numbers in the challenge information about k-th of user
S-th of random number；
Each element ρ in data block evidence setK, jCalculating process be：
Wherein, ukIt is the public key of k-th of user；RkIt is the random mask of k-th of user in challenge information；It is k-th of use
ψ in j-th of wave file at familysA data block；
(6.2) all label evidences are carried out polymerization again and obtain label batch audit evidence Θ by cloud service sideB, calculated
Cheng Wei：
And the data block evidence of each user's difference wave file is subjected to polymerization again and obtains data block batch audit evidence setWhereinCalculating process be：
(6.3) cloud service side is by batch audit evidence (ΘB, Г) and it is sent to tripartite audit person；
(6.4) the batch audit evidence (Θ that auditing by third party person returns to cloud service sideB, Г) and it substitutes into following equation and is verified：
Wherein, vk, ukIt is the public key of k-th of user；The ψ of respectively k-th usersA data block's
Version number and timestamp；RkIt is the random mask of k-th of user in challenge information, andWherein ykFor k-th user's
Public key, a are integer set ZpMiddle random number；
If equation is set up, it is complete to illustrate more wave files；Otherwise, illustrate that the data in certain more wave files are damaged
It is bad.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810015840.3A CN108229208B (en) | 2018-01-08 | 2018-01-08 | Public auditing method for multi-copy data in cloud storage service |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810015840.3A CN108229208B (en) | 2018-01-08 | 2018-01-08 | Public auditing method for multi-copy data in cloud storage service |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108229208A true CN108229208A (en) | 2018-06-29 |
| CN108229208B CN108229208B (en) | 2021-03-23 |
Family
ID=62643080
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810015840.3A Active CN108229208B (en) | 2018-01-08 | 2018-01-08 | Public auditing method for multi-copy data in cloud storage service |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108229208B (en) |
Cited By (10)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109525403A (en) * | 2018-12-29 | 2019-03-26 | 陕西师范大学 | A kind of anti-leakage that supporting user's full dynamic parallel operation discloses cloud auditing method |
| CN110011998A (en) * | 2019-03-29 | 2019-07-12 | 福建师范大学 | A kind of prepare more part teledata of identity-based holds verification method |
| CN110266475A (en) * | 2019-05-20 | 2019-09-20 | 广东工业大学 | A kind of cloud storage data safety auditing method |
| CN111783148A (en) * | 2020-06-30 | 2020-10-16 | 中国工商银行股份有限公司 | Justice-supporting lightweight multi-copy data cloud auditing method and device |
| WO2021007863A1 (en) * | 2019-07-18 | 2021-01-21 | Nokia Technologies Oy | Integrity auditing for multi-copy storage |
| CN112311548A (en) * | 2020-03-25 | 2021-02-02 | 北京沃东天骏信息技术有限公司 | Data possession verification method, system, apparatus, and computer-readable storage medium |
| CN112688990A (en) * | 2020-12-14 | 2021-04-20 | 百果园技术(新加坡)有限公司 | Hybrid cloud data auditing method and system, electronic equipment and storage medium |
| CN114415943A (en) * | 2021-12-23 | 2022-04-29 | 贵州航天计量测试技术研究所 | Public auditing method and system for cloud multi-copy data |
| CN115242454A (en) * | 2022-06-27 | 2022-10-25 | 中国电子科技集团公司第三十研究所 | Real-time video data integrity protection method and system |
| CN117555864A (en) * | 2024-01-11 | 2024-02-13 | 华侨大学 | Cloud data safe deleting method based on trusted execution environment |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105787389A (en) * | 2016-03-02 | 2016-07-20 | 四川师范大学 | Cloud file integrity public audit evidence generating method and public auditing method |
| US20170041395A1 (en) * | 2015-08-06 | 2017-02-09 | Koc University | Efficient dynamic proofs of retrievability |
| CN106845280A (en) * | 2017-03-14 | 2017-06-13 | 广东工业大学 | A kind of Merkle Hash trees cloud data integrity auditing method and system |
| CN107423637A (en) * | 2017-07-31 | 2017-12-01 | 南京理工大学 | Support the traceable integrality auditing method of electronic health record data on cloud |
| CN107566118A (en) * | 2017-09-13 | 2018-01-09 | 陕西师范大学 | The cloud auditing method that lightweight user Dynamic Revocable and data can dynamically update |
| CN107612687A (en) * | 2017-09-25 | 2018-01-19 | 西安建筑科技大学 | A kind of more copy data property held verification methods of dynamic based on ElGamal encryptions |
-
2018
- 2018-01-08 CN CN201810015840.3A patent/CN108229208B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20170041395A1 (en) * | 2015-08-06 | 2017-02-09 | Koc University | Efficient dynamic proofs of retrievability |
| CN105787389A (en) * | 2016-03-02 | 2016-07-20 | 四川师范大学 | Cloud file integrity public audit evidence generating method and public auditing method |
| CN106845280A (en) * | 2017-03-14 | 2017-06-13 | 广东工业大学 | A kind of Merkle Hash trees cloud data integrity auditing method and system |
| CN107423637A (en) * | 2017-07-31 | 2017-12-01 | 南京理工大学 | Support the traceable integrality auditing method of electronic health record data on cloud |
| CN107566118A (en) * | 2017-09-13 | 2018-01-09 | 陕西师范大学 | The cloud auditing method that lightweight user Dynamic Revocable and data can dynamically update |
| CN107612687A (en) * | 2017-09-25 | 2018-01-19 | 西安建筑科技大学 | A kind of more copy data property held verification methods of dynamic based on ElGamal encryptions |
Non-Patent Citations (1)
| Title |
|---|
| CHANG LIU ET AL: ""MuR-DPA:Top-Down Levelled Multi-Replica Merkle HashTree Based Secure PublicAuditing for Dynamic Big Data Storage on Cloud"", 《IEEE TRANSACTIONS ON COMPUTERS》 * |
Cited By (16)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109525403B (en) * | 2018-12-29 | 2021-11-02 | 广州市溢信科技股份有限公司 | Anti-leakage public cloud auditing method supporting full-dynamic parallel operation of user |
| CN109525403A (en) * | 2018-12-29 | 2019-03-26 | 陕西师范大学 | A kind of anti-leakage that supporting user's full dynamic parallel operation discloses cloud auditing method |
| CN110011998B (en) * | 2019-03-29 | 2021-07-27 | 福建师范大学 | Identity-based multi-backup remote data holding verification method |
| CN110011998A (en) * | 2019-03-29 | 2019-07-12 | 福建师范大学 | A kind of prepare more part teledata of identity-based holds verification method |
| CN110266475A (en) * | 2019-05-20 | 2019-09-20 | 广东工业大学 | A kind of cloud storage data safety auditing method |
| WO2021007863A1 (en) * | 2019-07-18 | 2021-01-21 | Nokia Technologies Oy | Integrity auditing for multi-copy storage |
| US20220318415A1 (en) * | 2019-07-18 | 2022-10-06 | Nokia Technologies Oy | Integrity auditing for multi-copy storage |
| CN112311548A (en) * | 2020-03-25 | 2021-02-02 | 北京沃东天骏信息技术有限公司 | Data possession verification method, system, apparatus, and computer-readable storage medium |
| CN111783148A (en) * | 2020-06-30 | 2020-10-16 | 中国工商银行股份有限公司 | Justice-supporting lightweight multi-copy data cloud auditing method and device |
| CN112688990A (en) * | 2020-12-14 | 2021-04-20 | 百果园技术(新加坡)有限公司 | Hybrid cloud data auditing method and system, electronic equipment and storage medium |
| CN114415943A (en) * | 2021-12-23 | 2022-04-29 | 贵州航天计量测试技术研究所 | Public auditing method and system for cloud multi-copy data |
| CN114415943B (en) * | 2021-12-23 | 2023-08-15 | 贵州航天计量测试技术研究所 | Public auditing method and auditing system for cloud multi-copy data |
| CN115242454A (en) * | 2022-06-27 | 2022-10-25 | 中国电子科技集团公司第三十研究所 | Real-time video data integrity protection method and system |
| CN115242454B (en) * | 2022-06-27 | 2023-05-12 | 中国电子科技集团公司第三十研究所 | Real-time video data integrity protection method and system |
| CN117555864A (en) * | 2024-01-11 | 2024-02-13 | 华侨大学 | Cloud data safe deleting method based on trusted execution environment |
| CN117555864B (en) * | 2024-01-11 | 2024-04-16 | 华侨大学 | Cloud data safe deleting method based on trusted execution environment |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108229208B (en) | 2021-03-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108229208A (en) | A kind of public audit method of more copy datas in cloud storage service | |
| CN110771095B (en) | System and method for implementing blockchain-based digital certificates | |
| CN110622165B (en) | Security measures for determining privacy set intersections | |
| Jin et al. | Dynamic and public auditing with fair arbitration for cloud data | |
| CN110800254B (en) | System and method for generating digital signature | |
| US6035398A (en) | Cryptographic key generation using biometric data | |
| JP7499852B2 (en) | Random Node Selection for Permissioned Blockchains | |
| Heiberg et al. | Improving the verifiability of the Estonian internet voting scheme | |
| CN110300112A (en) | Block chain key tiered management approach | |
| CN110197082A (en) | Data processing method, data processing equipment and computer system | |
| CN111881109B (en) | Database mergeable ledgers | |
| US10735204B2 (en) | System and method for generating digital marks | |
| CN116361823A (en) | Selective audit processing of blockchains for privacy protection | |
| CN108733783A (en) | A kind of student status information management system based on privately owned block chain | |
| CN104182525A (en) | Electronic record management device applying multimedia files with copyright protection function and applying state encryption algorithm | |
| CN112541035A (en) | Block chain based information verification method, device, equipment and readable storage medium | |
| CN116263834A (en) | Multi-issuer anonymous credentials for licensed blockchains | |
| CN112084533B (en) | Block chain-based multi-level position information sharing method | |
| CN110049054A (en) | The plaintext shared data auditing method and system for supporting privacy information hiding | |
| Chen et al. | Adjacency‐Hash‐Table Based Public Auditing for Data Integrity in Mobile Cloud Computing | |
| Poonguzhali et al. | Securing Aadhaar details using blockchain | |
| CN107908975A (en) | software technology state control system based on digital signature | |
| CN110535663A (en) | A kind of realization method and system of the trusted timestamp service based on block chain | |
| CN110532747A (en) | A kind of data desensitization method based on certification with biological characteristic | |
| CN109145642B (en) | Data storage method, terminal and database based on CPK digital seal |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |