Disclosure of Invention
The application provides a lightweight and deduplication ciphertext integrity auditing method and system, which are suitable for various ciphertext deduplication systems, and under the condition that repeated data exists, a group of user personalized integrity labels for regenerating the file only need constant-level calculation cost and communication cost to be reduced to constant level, and a storage service provider only needs to store constant-level label auxiliary variables, rather than a group of user labels like a traditional scheme, so that repeated label deletion is approximately realized.
To achieve the above object, the present application provides the following solutions:
a lightweight and deduplicatable ciphertext integrity auditing method comprises the following steps:
selecting a user key and an audit private key, and calculating to obtain an audit public key based on the audit private key;
calculating a duplicate removal key, performing first encryption processing on an original file based on the duplicate removal key to obtain a secret file data, performing second encryption processing on the duplicate removal key based on the user key to obtain a secret duplicate removal key, and uploading the secret file data and the secret duplicate removal key to a server;
judging whether the encrypted file data exist in the server, if not, performing a first operation to obtain a block label, an auxiliary variable and an audit material, uploading the block label, the auxiliary variable and the audit material to a storage server, and if so, performing a second operation to obtain a user label conversion auxiliary material and the audit material, and uploading the user label conversion auxiliary material and the audit material to the storage server;
and sending the audit target file name and the total data block to a storage server, wherein the storage server generates an integrity certification based on the audit target file name, the total data block and the secret file data, and verifies the integrity certification based on the audit public key and the audit material to obtain an integrity verification result.
Preferably, the method for calculating the audit public key comprises the following steps: randomly selecting a number x as the audit private key from a cyclic multiplication group
Middle selectionSelecting generator g and calculating g
x As the audit public key.
Preferably, the method for calculating the duplicate removal key comprises the following steps: and calculating a hash value of a message plaintext as the deduplication key.
Preferably, the method for the first encryption processing includes: encrypting, dicing, and encoding the original file based on the deduplication key.
Preferably, the first operation includes:
calculating the block tag based on the block data in the encrypted file data;
generating a file abstract, and calculating the user tag conversion auxiliary variable based on the audit private key and the file abstract;
and encrypting the key parameters and the auxiliary variables based on the user tag conversion auxiliary variables to obtain the auxiliary variables.
Preferably, the second operation includes:
decrypting the encrypted variable in the auxiliary variable based on the duplicate removal key to obtain the user tag conversion auxiliary variable;
and calculating the user tag conversion auxiliary material based on the user tag conversion auxiliary variable.
Preferably, the method for generating the integrity certification comprises the following steps:
generating a set of block indices and a set of random numbers based on the total data blocks;
the integrity manifest is generated based on the set of block indices, the set of random numbers, and the secret document data.
The application also provides a lightweight deduplication ciphertext integrity audit system, comprising: the device comprises a key generation module, an encryption module, a judgment module and a verification module;
the key generation module is used for selecting a user key and an audit private key, and calculating to obtain an audit public key based on the audit private key;
the encryption module is used for calculating a duplicate-removal key, carrying out first encryption processing on an original file based on the duplicate-removal key to obtain encrypted file data, carrying out second encryption processing on the duplicate-removal key based on the user key to obtain an encrypted duplicate-removal key, and uploading the encrypted file data and the encrypted duplicate-removal key to a server;
the judging module is used for judging whether the encrypted file data exist in the server, if not, performing a first operation to obtain a block label, an auxiliary variable and an audit material, uploading the block label, the auxiliary variable and the audit material to a storage server, and if so, performing a second operation to obtain a user label conversion auxiliary material and the audit material, and uploading the user label conversion auxiliary material and the audit material to the storage server;
the checking module is used for sending the audit target file name and the total data block to the storage server, the storage server generates an integrity certification based on the audit target file name, the total data block and the secret file data, and the integrity certification is checked based on the audit public key and the audit material to obtain an integrity checking result.
The beneficial effects of this application are:
(1) The public key for auditing is determined according to the number of the files instead of the number of the files as in the previous scheme, and each user file is provided with an own personalized integrity tag, so that the method has extremely high flexibility, and the problems of more public keys and difficult management of the user auditing under the condition of more files are solved;
(2) Under the condition that repeated files exist, a user does not need to calculate a group of user personalized integrity labels from the beginning, but can realize label conversion by calculating a constant level, so that the time consumption of a file uploading stage is greatly reduced, and the communication cost is also reduced;
(3) The system is decoupled from the specific scheme of the ciphertext deduplication technology, and can be applied to most ciphertext deduplication schemes.
Detailed Description
The following description of the embodiments of the present application will be made clearly and fully with reference to the accompanying drawings, in which it is evident that the embodiments described are only some, but not all, of the embodiments of the present application. All other embodiments, which can be made by one of ordinary skill in the art without undue burden from the present disclosure, are within the scope of the present disclosure.
In order that the above-recited objects, features and advantages of the present application will become more readily apparent, a more particular description of the invention briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings.
First, definitions of some letters and formulas related to the present invention will be described:
cyclic groups of order p, where p is a prime number, the groups being defined as multiplicative groups. />
g: one generator of the multiplicative group G is a public security parameter shared by the whole system.
x, y: secret parameters, respectively as audit private keys of users A, B, are selected from Z p 。
pk A ,pk B ,sk A ,sk B : respectively, a public for integrity auditingA key and a private key, wherein pk A G is g x ,sk A Is x, pk B G is g y ,sk B And is y.
h (.): is an arbitrary hash function that functions to map data m onto a cluster of deduplication keys.
k dedup : a key used in de-encrypting a file.
ku: user key as encryption user deduplication key k dedup The key of the encryption algorithm used at that time, the optional value range of which is related to the encryption algorithm used.
C data : and carrying out deduplication encryption on the file content to obtain the encrypted data.
C key : the used key ku uses an encryption algorithm to pair k dedup Ciphertext obtained after encryption.
dir, filename, ma respectively represent: the file stores a directory, a file name, a digest of the file.
σ i : integrity tag of i-th block data in file.
ω, ω', W: respectively denoted as H 2 (x||ma)、H 2 (y||ma), ω' - ω, where H 2 The function of (-) is to map arbitrary data to Z p 。
H
1 (. Cndot.): the function is to map arbitrary data to
r, r': a temporary secret parameter, a random number, selected from Z p 。
v、v’、h、h’、h 1 、h 1 ', V: u respectively r 、u r′ 、g ω 、g ω′ 、g xω 、g yω′ Abbreviations for v'.
trans:
The user tag conversion auxiliary variable has two functions, firstly, the user can utilize other usersThe variable derives a tag conversion auxiliary variable of the user; second, the server can use this variable to translate the integrity criteria of a particular user into an integrity tag for the variable producer. (e.g., user B generated user B's user tag conversion auxiliary variable via user a's user tag conversion auxiliary variable, then the storage service provider can calculate user B's integrity tag by means of user a's integrity tag and user B's user tag conversion auxiliary variable, i.e., user a is considered to be a particular user herein).
C
trans :
And converting the auxiliary variable by the user tag after encrypting part of the secret parameters.
TAM, TAM': respectively (ma is n is h) 1 )、(ma||n||h′||h 1 '), audited material of auditors.
v i : an ith random number in the challenge generated for the auditor.
An aggregation tag for verifying integrity.
Example 1
In the first embodiment, the method includes three roles of a user, an auditor and a storage server, wherein the storage server selects a storage service provider, as shown in fig. 1, and the method for auditing the integrity of the lightweight and deduplicatable ciphertext includes the following steps:
s1, selecting a user key and an audit private key, and calculating based on the audit private key to obtain an audit public key.
In this embodiment, the user randomly selects the number ku as the user key, the user randomly selects the number x as the audit private key, and the user randomly multiplies the group from the loop
Selecting generator g and calculating g
x As an audit public key. />
S2, calculating a duplicate removal key, performing first encryption processing on the original file based on the duplicate removal key to obtain the encrypted file data, performing second encryption processing on the duplicate removal key based on the user key to obtain the encrypted duplicate removal key, and uploading the encrypted file data and the encrypted duplicate removal key to a server.
The computing method of the duplicate key comprises the following steps: calculating a hash value of a message plaintext as a deduplication key; the first encryption processing method comprises the following steps: the original file is encrypted, diced and encoded based on the deduplication key.
In this embodiment, the hash value h (m) of the plaintext of the message is calculated as k for the deduplication key dedup The method comprises the steps of carrying out a first treatment on the surface of the Using the deduplication key k dedup After encrypting, cutting and encoding the original file data, obtaining the encrypted file data C data . The user key ku is used as an encryption key pair duplicate removal key k dedup Encryption is carried out to obtain a secret state duplicate removal key C key The method comprises the steps of carrying out a first treatment on the surface of the Uploading file directory dir, file name filename and encrypted file data C data And a secret key C key Creating file catalogue according to dir, and setting C to server key Stored in the corresponding directory and named filename.
S3, judging whether the server has the confidential file data, if not, performing a first operation to obtain a block label, an auxiliary variable and an audit material, uploading the block label, the auxiliary variable and the audit material to a storage server, and if so, performing a second operation to obtain a user label conversion auxiliary material and the audit material, and uploading the user label conversion auxiliary material and the audit material to the storage server.
Wherein the first operation comprises: calculating a block tag based on block data in the encrypted file data; generating a file abstract, and calculating a user tag conversion auxiliary variable based on an audit private key and the file abstract; and encrypting the key parameters and the auxiliary variables based on the user tag conversion auxiliary variables to obtain the auxiliary variables. The second operation includes: decrypting the encrypted variable in the auxiliary variable based on the duplicate removal key to obtain a user tag conversion auxiliary variable; and calculating based on the user tag conversion auxiliary variable to obtain the user tag conversion auxiliary material.
In the present embodiment, if the confidential document data C does not exist in the server data Informing the user that the file does not have repetition, and after the user receives the notification that the file does not have repetition, obtaining the file as C data Sequentially calculating the label sigma from the block data in (a) i Generating a file digest ma, calculating a user tag conversion auxiliary variable trans by using an audit private key x and the file digest ma, and then labeling all blocks sigma i Auxiliary variable C after encrypting key parameter r trans And sending the audited material TAM of the auditor to a storage service provider; if the file data in the encrypted state exists, informing the user that the file can be de-duplicated and returning to C trans To the user, the user passes through the rekey k dedup Decrypted C trans The encrypted variable in (2) is obtained by trans, the user tag conversion auxiliary material trans ' is calculated through trans, and then the user tag conversion auxiliary material trans ' and audit material TAM ' of the auditor are sent to a storage service provider.
S4, sending the audit target file name and the total data block to a storage server, generating an integrity certification by the storage server based on the audit target file name, the total data block and the confidential file data, and checking the integrity certification based on the audit public key and the audit material to obtain an integrity checking result.
The method for generating the integrity certification comprises the following steps: generating a set of block indices and a set of random numbers based on the total data block; an integrity manifest is generated based on the set of block indices, the set of random numbers, and the encrypted file data.
In this embodiment, when the auditor wants to audit data, the auditor needs to inform the storage service provider of the file name filename of the audited target file and the total number n of data blocks responded by the storage service provider, and uses the block subscript set and the random number set q= { i, v randomly generated by the total number of data blocks
i }
i∈[1,n] The method comprises the steps of carrying out a first treatment on the surface of the Storage service provider rootData block subscript set and random number set Q and stored corresponding user secret file data C
data Generating data integrity certification
The auditor's audit material TAM is then checked against integrity +.>
And returning to the user. Finally, auditor uses audit public key g
x And checking the integrity certification with the audit material TAM, wherein if the integrity certification passes, the checking indicates that the data subjected to spot check is complete, otherwise, the checking indicates that the data subjected to spot check is damaged.
Example two
In the second embodiment, taking the user a and the user B as examples, a specific workflow of the present application is described:
the uploading stage, as shown in fig. 2: user a owns file m, which has no duplicate data in the server, and first the data owner performs a hash calculation on file m to obtain h (m), and in addition, generates a digest ma of file m. Let de-duplication key k dedup For h (m), use is made of the deduplication key k dedup Encrypting file m to obtain C data The method comprises the steps of carrying out a first treatment on the surface of the Selecting the user key ku, wherein the specific value is determined according to the specific encryption algorithm used, and encrypting the duplicate removal key k by using the user key ku dedup Obtaining a cryptographic deduplication key C key The method comprises the steps of carrying out a first treatment on the surface of the Storing file storage directory dir, file name filename and confidential file data C data Secret deduplication key C key Together with the storage service provider if the storage service provider finds that there is no duplicate data C data Will then store the encrypted file data C data Secret deduplication key C key And respectively naming the file name by file name, storing the file name under a directory dir, informing a user A that the file m does not contain repeated files, and recording a file path in a database.
After receiving the notice of no repeated file, user A will make the data C of the file in the secret state
data Block data of (a) is encoded into group Z
p Integrity tag for up and further computing block data
Calculating the transformation auxiliary variable trans of the user tag to obtain an auxiliary variable C
trans The method comprises the steps of carrying out a first treatment on the surface of the Finally, { σ ] is sent to the storage service provider
1 ,...,σ
n } auxiliary variable C
trans Audit material TAM.
The process of uploading the file which can be subjected to the de-duplication encryption by the user B to the storage service provider is the same as the process of uploading the file which can be subjected to the de-duplication encryption by the user A to the storage service provider, but when the storage service provider detects that the file is duplicated, the storage C named by filename is stored in the directory dir only key And recording the actual storage path dir '/filename ' data of the repeated file in the database, and redirecting to dir '/filename ' data when dir/filename ' data is searched next time.
User tag conversion auxiliary material C is returned to user A together with storage service provider informing user B of the presence of duplicate files trans . When user B obtains user tag conversion auxiliary material C trans When using the deduplication key k dedup And analyzing and decrypting omega, trans and V, calculating Trans ' =omega ' ||trans ' |V, and finally, sending audit materials TAM ' and Trans ' to a storage service provider together, wherein the storage service provider stores the TAM ' and the Trans '.
In the auditing stage, as shown in fig. 3, firstly, an auditor sends a file name filename to be audited to a storage service provider, the storage service provider returns the block number n of the file according to the file name filename, and the auditor generates a challenge according to n
Where c is the total number of data blocks challenged, and then challenge Q, filename, is sent to the storage service provider.
The storage service provider then retrieves the encrypted file data C from the filename
data Corresponding data blocks are indexed according to the index set in the challenge Q, and at this time, there are two cases: the first case is auditor assistanceUser a (i.e., the first storage of the file) audits, then a proof is calculated
The second case is that the auditor helps user B audit, then calculate proof +.>
Finally will->
And auditing materials TAM or TAM' of the user label are audited and returned to the auditor.
Finally, if the auditor receives that the audit material is TAM, the auditor uses the corresponding audit public key to verify whether the following formula is true or not:
if the challenge is established, the challenge passes, if the challenge is not established, the challenge fails, and the integrity of the file is destroyed. If the received audit material is TAM', verifying whether the following holds:
example III
In a third embodiment, as shown in fig. 4, a lightweight deduplication ciphertext integrity audit system includes: the device comprises a key generation module, an encryption module, a judgment module and a verification module.
The key generation module is used for selecting a user key and an audit private key, and obtaining an audit public key based on calculation of the audit private key; in this embodiment, the user randomly selects the number ku as the user key, the user randomly selects the number x as the audit private key, and the user randomly multiplies the group from the loop
Selecting generator g and calculating g
x As an audit public key.
The encryption module is used for calculating a duplicate-removal key, carrying out first encryption processing on the original file based on the duplicate-removal key to obtain the encrypted file data, carrying out second encryption processing on the duplicate-removal key based on the user key to obtain the encrypted duplicate-removal key, and uploading the encrypted file data and the encrypted duplicate-removal key to the server; in this embodiment, the hash value h (m) of the plaintext of the message is calculated as k for the deduplication key dedup The method comprises the steps of carrying out a first treatment on the surface of the Using the deduplication key k dedup After encrypting, cutting and encoding the original file data, obtaining the encrypted file data C data . The user key ku is used as an encryption key pair duplicate removal key k dedup Encryption is carried out to obtain a secret state duplicate removal key C key The method comprises the steps of carrying out a first treatment on the surface of the Uploading file directory dir, file name filename and encrypted file data C data And a secret key C key Creating file catalogue according to dir, and setting C to server key Stored in the corresponding directory and named filename.
The judging module is used for judging whether the server has the confidential file data or not, if not, performing a first operation to obtain a block label, an auxiliary variable and an audit material, uploading the block label, the auxiliary variable and the audit material to the storage server, and if so, performing a second operation to obtain a user label conversion auxiliary material and the audit material, and uploading the user label conversion auxiliary material and the audit material to the storage server; in the present embodiment, if the confidential document data C does not exist in the server data Informing the user that the file does not have repetition, and after the user receives the notification that the file does not have repetition, obtaining the file as C data Sequentially calculating the label sigma from the block data in (a) i Generating a file digest ma, calculating a user tag conversion auxiliary variable trans by using an audit private key x and the file digest ma, and then labeling all blocks sigma i Auxiliary variable C after encrypting key parameter r trans And sending the audited material TAM of the auditor to a storage service provider; if the file data in the encrypted state exists, informing the user that the file can be de-duplicated and returning to C trans To the user, the user passes through the rekey k dedup Decrypted C trans The encrypted variable in (2) is obtained to be trans, the trans' of the user tag conversion auxiliary material is calculated through trans, and then the user tag conversion auxiliary material is sentMaterial trans 'and auditor audit material TAM' to the storage service provider.
The checking module is used for sending the audit target file name and the total data block to the storage server, the storage server generates an integrity certification based on the audit target file name, the total data block and the confidential file data, and the integrity certification is checked based on the audit public key and the audit material to obtain an integrity check result; in this embodiment, when the auditor wants to audit data, the auditor needs to inform the storage service provider of the file name filename of the audited target file and the total number n of data blocks responded by the storage service provider, and uses the block subscript set and the random number set q= { i, v randomly generated by the total number of data blocks
i }
i∈[1,n] The method comprises the steps of carrying out a first treatment on the surface of the The storage service provider stores the corresponding user secret file data C according to the block subscript set, the random number set Q and the stored user secret file data C
data Generating data integrity certification
The auditor's audit material TAM is then checked against integrity +.>
And returning to the user. Finally, auditor uses audit public key g
x And checking the integrity certification with the audit material TAM, wherein if the integrity certification passes, the checking indicates that the data subjected to spot check is complete, otherwise, the checking indicates that the data subjected to spot check is damaged.
The foregoing embodiments are merely illustrative of the preferred embodiments of the present application and are not intended to limit the scope of the present application, and various modifications and improvements made by those skilled in the art to the technical solutions of the present application should fall within the protection scope defined by the claims of the present application.