CN109858283B

CN109858283B - Cloud storage security data sharing method based on Chaum-Pedersen

Info

Publication number: CN109858283B
Application number: CN201910142859.9A
Authority: CN
Inventors: 王鑫; 韩志宇; 周彦伟; 张磊
Original assignee: Shaanxi University of Science and Technology
Current assignee: Shaanxi University of Science and Technology
Priority date: 2019-02-26
Filing date: 2019-02-26
Publication date: 2022-11-01
Anticipated expiration: 2039-02-26
Also published as: CN109858283A

Abstract

With the development of cloud computing technology, data can be outsourced to the cloud, so that sharing among users is facilitated. However, in many cases, users may worry about the reliability and integrity of their data outsourced to the cloud, and it is therefore crucial to provide a data sharing service that meets these security requirements. The invention provides a reliable and safe data sharing scheme by adopting a threshold secret key sharing technology and a Chaum-Pedersen zero-knowledge proving method. The scheme is not only flexible and effective, but also can realize semantic security characteristics. Furthermore, this solution enables the security of the user's decryption key and the identification of fraudsters if some of the users are dishonest. Efficiency analysis shows that this scheme has better performance in terms of computational cost than other related work. In particular, the scheme is suitable for protecting cloud medical insurance data of the user.

Description

Cloud storage safety data sharing method based on Chaum-Pedersen

Technical Field

The invention belongs to the technical field of information security, is particularly suitable for protecting cloud medical insurance data of a user, and relates to a cloud storage security data sharing method based on Chaum-Pedersen.

Background

Under the strong push of the innovative development trend of cloud technology, the data sharing technology of cloud computing and cloud storage becomes a promising technology which allows file owners to store and users to access conveniently. However, in storing, sharing data, file owners are increasingly concerned about the privacy of the storage and the reliable access of the data. Medical care data covers aspects of human life and includes a variety of data such as medical record information, medical insurance information, health records, genetic information, medical experimental and scientific data, and the like. Medical experimental data, scientific research data and insurance information not only relate to the privacy of data owners, but also influence the development trend of the pharmaceutical industry and even influence the national security. Therefore, in the development process and application of healthcare data, it is necessary to provide targeted compliance assurance for data source certification and medical data types.

When a person stores her medical insurance data in the cloud for occasional needs (sudden death, insurance claims, etc.), careful consideration should be given to who is allowed access to the data. In this process, due to the diversity and complexity of medical data, not only the confidentiality of the data itself but also the specificity of the actual situation need to be considered in the data storage process.

In a cloud-based medical service scenario, a patient (data owner) stores the above important personal information (e.g., electronic medical records, health files, consulting information, and financial information) in a ciphertext form, divides the access rights of a file into a plurality of copies, and assigns them to different types of groups, such as a family group, a friend group, a medical staff group, and a financial information management group, each of which is composed of a plurality of users. The proof that the patient (data owner) is in an emergency or an unexpected death and needs to retrieve the above information can be provided by a group of users even if the patient cannot. In this process, in order to ensure fairness of information extraction, it is critical to allow rights of a few users to fail, prevent a fraudster from infringing on personal interests and provide false rights by a dishonest user.

Disclosure of Invention

In order to overcome the above-mentioned shortcomings of the prior art and achieve the above-mentioned needs, the present invention provides a cloud storage security data sharing method based on Chaum-Pedersen, which combines symmetric encryption and key sharing technologies, can verify and can deceive, and a data owner can designate an authorized user by himself to ensure the security of personal data; grouping management is carried out according to the types of users so as to supervise when accessing data, thereby realizing decentralized management of authority; in addition, according to the validity and fairness of the data, any behavior interfering with normal data access can be thoroughly identified, so that the stability of the system is ensured and the system can normally operate. The invention adopts a threshold secret key sharing technology and a Chaum-Pedersen zero-knowledge proving method, has the characteristics of reliability and safety, and can play a fundamental and inspirational role in the aspect of solving the medical data management in the personal health environment of the Internet.

In order to achieve the purpose, the invention adopts the technical scheme that:

a cloud storage security data sharing method based on Chaum-Pedersen is characterized in that:

hiding confidential information irrelevant to the important data, encrypting the important data and storing the important data in the cloud;

dividing the types of important data corresponding to authorized users into a plurality of groups;

each important data corresponds to a group of secret shares, each group of secret shares consists of secret shares of a plurality of different owners, each secret share is distributed to a corresponding authorized user group by using a threshold secret sharing method of Shamir, a decryption key is assigned to each authorized user group, the authorized users of each authorized user group distribute private keys, namely sub-keys of the group of decryption keys, according to the decryption keys of the group, and when the decryption keys are correctly reconstructed, the corresponding secret shares of the important data can be decrypted, so that the important data can be decrypted under mutual supervision among the groups.

The data is medical insurance data, and the confidential information irrelevant to the important data refers to personal information of an owner, including name, age, work family, address and the like; the important data refers to data of an owner directly related to medical insurance, and comprises electronic medical records, health records, consultation information and financial information, and the identity of the authorized user corresponds to the type of the important data, and comprises a family group, a friend group, a medical staff group and a financial information management group.

The confidential information irrelevant to the important data is hidden by a Bloom filter and the like.

Compared with the existing data sharing scheme, the scheme can provide the following advantages of safety and efficiency:

1) The cloud server may utilize data file tags to assist in record searching and may not be able to obtain any meaningful information about the owner data or the owner's personal confidential data.

2) The user who has access to the data file is authorized by the data owner, who can verify the decryption key sent by the owner. Even if some decryption keys from authorized users are incorrect, the system can still function properly without affecting the reliability of the data.

3) It is possible to identify in advance a dishonest user who provides a pseudo decryption key without revealing the decryption key of a dishonest user. Thus, the data file can be decrypted safely and correctly under supervision of these user groups.

Drawings

FIG. 1 is a framework for a secure shared data protection service in a cloud environment of the present invention.

Detailed Description

The embodiments of the present invention will be described in detail below with reference to the drawings and examples.

As shown in fig. 1, the present invention proposes an efficient, reliable and integrated internet medical data sharing scheme to ensure semantic security and efficient use of owner data on cloud storage. Confidential information of a patient, such as name, age, work, home address and the like, which is irrelevant to important data, is hidden through a Bloom filter and the like, and important data files, such as electronic medical records, health records, consultation information and financial information, are encrypted and stored in the cloud.

In order to achieve decryption of secret data files under mutual supervision between groups, decryption keys are used for assigning rights among cloud decryption users, which are divided into groups according to their identities when registered in an agreement, such as family groups, friend groups, medical staff groups, financial information management groups, etc. Each data file corresponds to a set of secret shares, each secret share is assigned to a corresponding group of users by using Shamir's threshold secret sharing method, each group is assigned a decryption key, and authorized users of each group assign their private keys, i.e., sub-keys of the group of decryption keys, based on the group's decryption keys, and when the decryption keys are properly reconstructed, the corresponding secret shares of the data file can be successfully decrypted.

First, preliminary knowledge required for understanding the present invention is introduced:

1. key sharing scheme

The key sharing scheme divides the key into a number of parts, each part being referred to as a shared key, and the key can be recovered when the required number of shared keys is in possession.

A sharing stage: to share the key, the issuer generates shared keys for different authorized users by constructing different polynomials and then sends the shared keys to each authorized user through a dedicated channel.

A reconstruction stage: any subset of these authorized users can reconstruct the key using polynomial interpolation as long as given conditions are met.

2. Threshold encryption cryptosystem

In our protocol, a threshold key sharing system is adopted to design an encryption scheme, and the cryptosystem consists of the following five algorithms:

and (3) generating a key: taking a security parameter k, the number n of decryption groups (n is more than or equal to 1), a threshold value t (t is more than or equal to 1 and less than or equal to n) and a random character string x as input, and outputting a public key pk and a group of shared keys { y₁…y_nAnd a set of verification keys v, { v }₁…v_n}。

Encryption: the public key pk, the random character string x and the plaintext

As an input, and outputs the ciphertext CT.

Partial decryption: the public key pk, the ciphertext CT, the index i (i is more than or equal to 1 and less than or equal to n) and the corresponding shared secret key y_iAs input, and outputs a corresponding decrypted share c_iAnd proving that the share decryption is validDemonstration of p_i。

And (3) verification: the cipher text CT, the index i (i is more than or equal to 1 and less than or equal to n), the verification key v, and the { v {₁…v_n}, decryption fraction c_iAnd its demonstration p_iAs an input. And if the result is valid, outputting 1, and otherwise, outputting ^ T.

Combining: taking any subset of the public key pk and the valid decryption group t as input and outputting the plaintext

3. Bloom filter

A Bloom filter is a random data storage structure made up of a set of Hash functions BF (x) = (bh)₁(x),…,bh_k(x) ) is prepared. The Bloom filter is used to hide the value of the attribute or part of the information of the attribute during the access process. In this scheme, bloom filters are used to anonymously store data files, with a verification output (bh)₁(x),…,bh_k(x) Is matched with the input x, the searched tag is verified.

4. Proof of discrete logarithm equation

The Chaum-Pedersen attestation protocol may be used to prove equations for discrete logarithms. Let p, q be two large prime numbers, and q | p-1, let G_qIs marked as

The sub-group of order q of (a),

is a non-zero integer ring of modulo p, G and h being G_qTwo generators. Without the need to inform a specific formula, y ≡ g can be demonstrated^x(modp) and t ≡ h^xThe index value x of (modp) is the same, which proves to work as follows:

prover

Randomly selecting a value r ∈ Z_pThen U.ident.g^r(modp) and V ≡ h^r(modp) to the verifier

-

Let the random value e be Z_pSending back

-

Calculate z = r + xe mod p and send z to

If g is^z≡Uy^e(modp) and h^z≡Vt^e(modp)，

The proof is accepted; otherwise, the proof is rejected. Its reliability is that the two accepted dialog processes have the same first step, and honest verifier zero knowledge is true because for any random value e Z_pAnd Z ∈ Z_pArray of generated (g)^zy^-e，h^zt^-eE, z) are reliable, the distribution of values cannot be predicted from random values.

Based on the above preliminary knowledge, the present invention performs the following process:

1. system initialization

(1) The public key generator selects a group G with the order of prime number p₁，G₁A generator g and an anti-collision hash function H.

(2) Using grouping functions

Dividing a user set U which wants to share important data of an owner into N different groups according to different identities, such as a family group, a friend group, a medical staff group and legal staffGroup, etc., denoted as U₁,…,U_NAnd satisfies U = U₁∪…∪U_N. I.e. associating user IDs in a set of users_iIs divided into

Wherein

Is defined as

Is provided with

k belongs to {1, \ 8230;, N }, and then the user group

Also referred to as U for short_kWherein the number of users is n_k；

(3) Data owner at t_kZ of degree-1_pUpper selection of random number s_kAnd a random polynomial

Wherein Z_pRepresenting modulo-p integer rings, each group U_kIn (a) of_k,0＝s_k，k＝1～N。

2. Key generation

ID_iRepresenting users of a set of users by means of a grouping function

Divide it into groups U_kWherein the number of users is n_k. Is a marker group U_kUser ID in (1)_iNeed to be a group U_kUser renumbering, user ID in_iIs a group U_kThe jth user in (1) is represented as ID_jk。

(1) Data owner is group U_kEach user ID in (1)_jkUsing a set of polynomials f_k(x) Calculate its shared secret y_j|k＝f_k(x_jk) Wherein

Is with the user

An associated common value.

(2) Data owner first calculates

Let the validation key v = g then, the other validation keys are then calculated:

wherein j =1,2, \8230;, n_kFinally, disclose

The value of (c). G is G₁Known generator of, s_kFor the selected random number, a_k,iIs a random polynomial f_k(x) The coefficients are known.

(3) Next, the data owner will share the secret key over the dedicated channel

Sent to corresponding authorized users

(4) At the user ID_jkReceiving a shared secret SK_jkThereafter, the received shared key SK is first verified_jkWhether valid, i.e. verification

Wherein t is_k-1 is the highest degree,

(5) Validating shared secret SK_jkThen useHome-general SK_jkAs its shared key.

3. Data file generation

(1)

Is the data to be encrypted, the owner of the data selects a random number r_k∈Z_p(k =1, \ 8230;, N) and a random index s_kI K belongs to {1, \ 8230;, N } }, and the encrypted data file is

G₁Item 1 representing the ciphertext, item N of the ciphertext denoted G_NAnd the N +1 th item of the ciphertext is marked as C₀。

(2) The owner information is expressed as (Value)_owner) The label of the file is Tag_owner＝H(Value_owner). Label BF which is then used for retrieval and matching_owner＝BF(Tag_owner) May be constructed by Bloom filters.

(3) The owner anonymously uploads his encrypted data file CP to the cloud server. The format of each stored data file is as follows:

4. partial decryption algorithm

A_kIs a group U_kIs used to determine the set of rights to be granted,

is the union of N subsets of permissions of N groups.

(1) The authorized users of these N sets of permissions calculate the Tag of the data file they want to decrypt_owner＝H(Value_owner) And then transmits it to the cloud server.

(2) The cloud server receives a Tag provided by a user_ownerAnd verifying BF_owner＝BF(Tag_owner). If so, the ciphertext CT is sent back to the user.

(3) For a given ciphertext CT, each authorized user decrypts a portion of it. Authorized user ID_jkUsing his decryption key y_jkTo partially decrypt

Simultaneous generation of a non-interactive proof p_jkTo prove C_jkAnd v_jkHave been promoted to the same rights.

5. Data file decryption

Set of authorized users A_kReceiving a corresponding data file sent by the cloud server: g₁,…,G_N,C₀。

(1) From these sets of rights A_kIs used by an authorized user

Checking equation

If there is no interactive proof p_jkValid, it is the honest user who provides the decryption key

(2) If no dishonest of the authorized users is present, these users may recover the data

For the sake of simplicity, note

In the arrangement shown in fig. 1, in order to ensure the security of personal data, the data owner may specify an authorized user himself. In addition, for efficient and convenient management, grouping management is carried out according to the types of users so as to access data in a supervision mode, and therefore a scattered authority management mechanism is achieved. In addition, due to the validity and fairness of the data, any behavior interfering with normal data access can be thoroughly identified to ensure the stability of the system for its normal operation.

Therefore, the safety and the reliability of the data file can be fully guaranteed. The scheme is not only flexible and effective, but also can realize semantic security characteristics. Furthermore, the solution enables identification of fraudsters without infringing the honesty rights. Compared with the existing fraudster identification method such as the RS code, the method can detect each dishonest user. Efficiency analysis shows that the scheme is low in calculation cost and low in bandwidth utilization rate.

Claims

1. A cloud storage security data sharing method based on Chaum-Pedersen is characterized in that:

dividing the types of the important data corresponding to the authorized users into a plurality of groups;

each important data corresponds to a group of secret shares, each group of secret shares consists of secret shares of a plurality of different owners, each secret share is distributed to a corresponding authorized user group by using a Shamir threshold secret sharing method, a decryption key is assigned to each authorized user group, the authorized users of each authorized user group distribute private keys, namely sub-keys of the group of decryption keys, according to the decryption keys of the group, and when the decryption keys are correctly reconstructed, the corresponding secret shares of the important data can be decrypted, so that the important data can be decrypted under mutual supervision among the groups;

the data is medical insurance data, and the confidential information irrelevant to the important data refers to personal information of an owner, including name, age, work family and address; the important data refers to data of an owner directly related to medical insurance, and comprises electronic medical records, health records, consultation information and financial information, and the identity of the authorized user corresponds to the type of the important data, and comprises a family group, a friend group, a medical staff group and a financial information management group;

the method comprises the following specific steps:

1) System initialization

(1.1) public key generator selects a group G with order prime p₁，G₁The anti-collision hash function is H;

(1.2) Using grouping function

Dividing a user set U which wants to share important data of an owner into N different groups according to different identities, and expressing the groups as U₁,…,U_NAnd satisfies U = U₁∪…∪U_N(ii) a I.e. associating user IDs in a set of users_iIs divided into

Wherein

Is defined as

Is provided with

Then the user group

Referred to as U for short_kWhere the number of users is n_k；

(1.3) data owner at t_kZ of degree-1_pUpper selection of random number s_kAnd a random polynomial

Wherein Z_pRepresenting modulo-p integer rings, each group U_kIn (a)_k,0＝s_k，k＝1～N；

2) Key generation

(2.1)ID_j|kIndicating the user ID_iIs a group U_kThe jth user in (1), the data owner is the group U_kEach user ID in (1)_j|kUsing a set of polynomials f_k(x) Calculate its shared secret y_j|k＝f_k(x_j|k) Where j =1, \ 8230;, n_k，

Is with the user

An associated common value;

(2.2) data owner first calculates

wherein j =1,2, \8230;, n_kFinally, disclose

G is G₁Known generator of (2), s_kFor the selected random number, a_k,iIs a random polynomial f_k(x) Known coefficients of (1);

(2.3) data owner will share secret key through dedicated channel

Sent to corresponding authorized users

(2.4) at user ID_j|kReceiving a shared secret SK_j|kThereafter, the received shares are first verifiedKey SK_j|kWhether it is valid, i.e. verify

Wherein t is_k-1 is the highest degree of the image,

(2.5) verification of shared secret SK_j|kThe user then sends SK_j|kAs its shared key;

3) Data file generation

(3.1)

Is the data to be encrypted, the owner of the data selects a random number r_k∈Z_p(k =1, \8230;, N) and a random index s_kI K belongs to {1, \ 8230;, N } }, and the encrypted data file is

G₁Item 1 representing the ciphertext, item N of the ciphertext denoted G_NAnd the N +1 th item of the ciphertext is marked as C₀；

(3.2) express the owner's information as (Value)_owner) The label of the file is Tag_owner＝H(Value_owner) BF as a tag for retrieval and matching_owner＝BF(Tag_owner) Constructed by a Bloom filter;

(3.3) the owner anonymously uploads its encrypted data file CP to the cloud server, and the format of each stored data file is as follows:

4) Partial decryption algorithm

(4.1)A_kIs a group U_kIs used to determine the set of rights to be granted,

is the union of N subsets of permissions of N groups, the authorized user of which calculates the Tag of the data file that he wants to decrypt_owner＝H(Value_owner) Then sending the data to a cloud server;

(4.2) the cloud Server receives the Tag_ownerAnd verify BF_owner＝BF(Tag_owner) If yes, sending the ciphertext CT back to the user;

(4.3) for a given ciphertext CT, each authorized user decrypts a portion of it, an authorized user ID_j|kUsing its shared secret y_j|kTo partially decrypt

Simultaneous generation of a non-interactive proof p_j|kTo prove C_j|kAnd v_j|kHave been promoted to the same privilege;

5) Decrypting the data file

(5.1) set of authorized users A_kReceiving a corresponding data file sent by the cloud server: g₁,…,G_N,C₀(ii) a From a set of authorized users A_kAuthorized user of (2) using the authentication key

Checking equation

If there is no interactive proof p_j|kIf the decryption key is valid, the truthful user provides the decryption key;

(5.2) if there are no dishonest ones of the authorized users, then these users are able to recover the data

2. The method for Chaum-Pedersen based cloud storage secure data sharing according to claim 1, wherein the confidential information that is not related to important data is hidden by a Bloom filter.