CN106899406B - A method for proving the integrity of cloud data storage - Google Patents

Abstract

The invention discloses a method for proving the integrity of cloud data storage. The file is sent to the cloud storage server, and only the private key is stored locally; when the integrity of the cloud data storage needs to be verified, the user randomly selects some file blocks and challenges the cloud; the cloud generates a proof of possession of the file block and returns it to the user; the user Perform cloud data integrity verification on proof of cloud ownership of file blocks. Compared with the prior art, the positive effect of the present invention is: by using the additive homomorphism of the bitwise extraction operation of binary data, the integrity of multiple file blocks can be verified at one time, and the method has the advantages of low data expansion rate and complex calculation. low-grade characteristics.

Description

A method for proving the integrity of cloud data storage

technical field

The invention relates to a method for proving the integrity of cloud data storage.

Background technique

With the explosion of data and the popularization of broadband networks, cloud storage has become an important application branch in the field of cloud computing today. Currently very popular cloud storage services include DropBox, Google's Google Drive, Microsoft's SkyDrive, and domestic Baidu Netdisk, Kingsoft Express, Huawei Netdisk, etc. These cloud storage services provide businesses and individuals a solution for safe custody and efficient access to massive amounts of data. More and more enterprises and individuals tend to host their data in cloud storage service providers. Cloud storage has the advantages of low price of storage space, anywhere access, convenient sharing, and disaster recovery backup.

However, while cloud storage brings convenience, security is an important issue. If a user saves a lot of data on the cloud server, how should he check whether the data is lost or damaged. On the surface, the internal security protection and disaster recovery backup technologies of cloud storage service providers avoid the risks caused by the volatility of users' local data. However, security threats such as hacking, equipment failure, and malicious tampering by insiders still exist. For users, the storage server in the cloud is still an incompletely trusted entity.

Clearly, it would be impractical in terms of bandwidth, local capacity, and efficiency for users to verify data integrity by downloading all hosted data. What's more, for some large binary files such as multimedia and databases, it is even more impossible for users to check the integrity of the file by simply opening the file for viewing. Therefore, cloud storage service providers must provide users with proof of data integrity through an efficient method.

The idea of provable data holding techniques originates from the integrity checking of remote data. In October 2007, Ateniese et al. first defined the concept of Provable Data Possession (PDP). There are two roles of user and service provider in the scheme. Users can perform integrity check on files stored on untrusted service providers. The user preprocesses the file, divides the file into blocks, and generates a homomorphic verifiable label for each data block; during verification, the user randomly selects some file blocks, and requires the server to return evidence of complete holding of these blocks; Requested blocks and their tags generate proofs; the user verifies that the proofs are accurate against the private key. Since only some file blocks are sampled during verification, and their labels are homomorphic and can be superimposed on each other, the interaction information between the user and the server is approximately a constant, and the amount of calculation for both parties during verification is also small, and Unlimited verifications are allowed. This scheme is based on public key cryptography, and the computational overhead of file preprocessing and verification is relatively large.

In 2008, Ateniese proposed an extended PDP scheme based on symmetric cryptography. The content and number of challenges are set during initialization, and the response is placed on the client side as metadata, which can modify, delete and append file blocks. However, its challenges and update times are limited by initialization values, and public verification is not supported. The Dynamic Provable Data Possession (DPDP) scheme was proposed by C. Erway et al. Based on the PDP scheme, they introduced a hierarchy-based table to organize file blocks, enabling them to add, modify and delete blocks as a unit, and can be effectively used in file storage systems, database systems and peer-to-peer storage. system. The DPDP scheme needs to access the hierarchical table to determine a specific file block during the checksum update process, and the proof value returned by the server also contains access path information, so its computational complexity and communication complexity are relatively high.

To sum up, the existing scheme has the following two defects:

(1) In the current remote data integrity verification method based on public key cryptography, the computational overhead in the process of user preprocessing and post-verification of the file is relatively large, which is not suitable for use in lightweight devices.

(2) In the current remote data integrity verification method based on symmetric cryptography, the file label is large and the original data expansion rate is high. In the dynamic scheme, the computational overhead and communication overhead are relatively large.

SUMMARY OF THE INVENTION

In order to overcome the above shortcomings of the prior art, the present invention provides a method for proving the integrity of cloud data storage.

The technical solution adopted by the present invention to solve the technical problem is: a method for proving the integrity of cloud data storage, comprising the following steps:

Step 1. The user preprocesses the file to be uploaded: generates a private key, divides the file into blocks and calculates the label of each file block;

Step 2: The user sends the preprocessed file to the cloud storage server, and only the private key is stored locally;

Step 3. When the integrity of cloud data storage needs to be verified, the user randomly selects some file blocks and challenges the cloud;

Step 4. The cloud generates a proof of possession of the file block and returns it to the user;

Step 5: The user performs cloud data integrity verification on the proof that the cloud owns the file block.

Compared with the prior art, the positive effect of the present invention is: in view of the problem of deletion and tampering of the data uploaded by the user to the cloud storage server, the present invention proposes a cloud data based on a pseudo-random function and a pseudo-random permutation function. A proof method of storage integrity to verify the security of user data in the cloud. The method utilizes the additive homomorphism of the bitwise extraction operation of binary data, which can verify the integrity of multiple file blocks at one time, and has the characteristics of low data expansion rate and low computational complexity. The specific performance is as follows:

1. Data initialization has low computational complexity and fast processing speed;

2. The file block label is small and the data expansion rate is low;

3. The integrity of multiple file blocks can be verified at the same time.

Detailed ways

The core idea of the cloud data integrity proof method proposed in this patent is as follows: the user divides the file to be uploaded into blocks, and generates the file block label based on the pseudo-random function with parameters and the pseudo-random permutation function, and then the file block and the file block correspond to The label and the parameters encrypted with the symmetric password are uploaded to the cloud storage server, and the client only saves the symmetric key. When it is necessary to verify the integrity of cloud data storage, the user randomly selects some file blocks and challenges the cloud. The cloud aggregates these file blocks and corresponding tags, and returns the aggregated files, aggregation tags and encrypted parameters to the user. Users utilize additive homomorphism of bitwise decimation operations on binary data to verify the integrity of file blocks.

The whole method consists of two stages: the file preprocessing stage and the "challenge-response" stage between the client and the cloud storage server. In the file preprocessing stage, the user preprocesses the files to be uploaded, and then uploads the processed files to the cloud storage server. In the "challenge-response" phase, when the user wants to verify the integrity of the cloud data, he randomly selects some file blocks to challenge the cloud storage server. The cloud storage server generates a certificate of possession of these file blocks, and the user verifies the certificate to confirm the integrity of the cloud data. sex.

(1) File preprocessing stage

The file preprocessing stage includes two algorithms: the key generation algorithm (KeyGen) and the file block tag generation algorithm (TagBlock).

1) KeyGen(1 ^k )→sk: use a random number generator to generate two random numbers of length k as the symmetric encryption key k _enc and the key k _mac of the hash function, where k is a security parameter. The user's private key is sk=(k _enc ,k _mac ).

2)TagBlock(sk,M)→M ^* : Divide the file M into s blocks {M ₁ , M ₂ ,...,M _s }, and the size of each block is n bits (n=[M size/s], if If the size of the file block is not a multiple of n, it is filled with 0 at the end of the file). Using a random number generator, a random number k _ext is generated as a parameter of the pseudo-random permutation function π. make:

where π( ) is The random permutation function with parameters, l is the number of bits extracted from each file block. Extract the bits corresponding to {i ₁ , i ₂ ,...,i _l } from each file block, and set the extracted result as {m ₁ ,m ₂ ,...,m _s }, denoted as m _i =Extract(M _i ), 1≤i≤s. Using a random number generator, generate a random number k _prf as a parameter of the pseudo-random function f. The label for each file block is calculated as follows:

in is a bitwise XOR operation, is a pseudorandom function with parameters and an output of 1 bits. make File M is labeled as

in is a symmetric encryption algorithm with the key k _enc , is the hash function with key k _mac . The result of file M processing is M ^* = {{M ₁ ,...,Ms}, {σ ₁ ,...,σs},τ}, the user uploads M ^* to the cloud storage server, and only the private key sk = ( k _enc ,k _mac ).

(2) "challenge-response" stage

This stage includes two algorithms: the proof generation algorithm (GenProof) and the verification proof algorithm (CheckProof).

1) GenProof(M ^* ,I)→v: The user randomly selects a subset I of [1,s] and sends it to the cloud storage server as a challenge. The server calculates the aggregated authentication code σ and aggregated message

Then there will be a proof of the file block corresponding to I sent to the user.

2) CheckProof(sk,v)→{0,1}: First, the user uses the k _mac in the private key sk to verify the file label τ, if not satisfied If the verification fails, 0 is returned. Otherwise, the user uses k _enc in the private key sk to decrypt the parameters k _ext and k _prf of the pseudorandom permutation function π and the pseudorandom function f.

The user calculates {i ₁ ,i2,...,i _l } according to formula (1), extracts The bits corresponding to the positions of {i ₁ ,i2,…,i _l } in the marked as The user authenticates that the server owns the file block corresponding to I and returns 1 if and only if

Through multiple challenges, the user can confirm that the cloud storage server has completely stored the file M with a probability close to 1.

(3) Scheme protocol design

Before preprocessing the file M, the user has generated the private key sk=(k _enc , k _mac ) and saved it on the client. The client has a random number generator, which is used to generate the random numbers required in the algorithm. The steps of the proof protocol for the integrity of cloud data storage proposed by the present invention are as follows:

1) for the file M to be uploaded, the user preprocesses M according to the algorithm TagBlock(sk, M), and the processed result is M ^* ;

2) The user sends the processed file M ^* to the cloud storage server, and only the private key sk is stored locally;

3) The user arbitrarily selects a subset I of [1, s], sends it to the cloud storage server as a challenge, and requests the cloud storage server to return the proof that it has the corresponding file block of I;

4) The cloud storage server generates an aggregated message corresponding to I according to the proof generation algorithm GenProof(M ^* ,I). and the aggregated authentication code σ.

5) The cloud storage server aggregates the message corresponding to the file label τ, I and the aggregated authentication code σ is sent to the user.

6) The user returns from the cloud storage server Verify whether the cloud storage server has the file block corresponding to I according to the algorithm CheckProof(sk, v). If 1 is returned, the cloud storage server completely stores the file block corresponding to I.

Claims (4)

1. a kind of method of proof of cloud data storage integrality, characterized by the following steps:

Step 1: user pre-processes file to be uploaded:

(1) it generates private key: utilizing random number generator, generating two length is the random number of k respectively as symmetric password encryption Key k_encWith the key k of hash function_mac, wherein k is security parameter, then private key sk=(k_enc, k_mac)；

(2) to file block and the label of each blocks of files is calculated:

(1) file M is divided into s block { M₁, M₂..., M_s, every block size is n bit；

(2) random number generator is utilized, a random number k is generated_extAs the parameter of pseudo-random permutation function π, enable:

…

Wherein π () isThe random permutation function with parameter, l be each blocks of files extract bit number；Each Blocks of files extracts { i₁, i₂..., i_lCorresponding position bit, if extract after result be { m₁, m₂..., m_s, it is denoted as m_i= Extract(M_i), 1≤i≤s；

(3) random number generator is utilized, a random number k is generated_prfAs the parameter of pseudo-random function f, it is calculated as follows The label of each blocks of files:

Its byFor step-by-step XOR operation,For pseudo-random function with parameter, that output is l bit, enableThe label of file M:

Its byBe key be k_encSymmetric encipherment algorithm,Be key be k_macHash function；

Step 2: pretreated file is sent to cloud storage service device by user, it is local only to save private key；

Step 3: user randomly selects some blocks of files and sends out to cloud when needing to verify the integrality of cloud data storage Play challenge；

Step 4: cloud generates the proof for possessing blocks of files and returns to user；

Step 5: the proof that user possesses blocks of files to cloud carries out cloud data integrity validation.

2. a kind of method of proof of cloud data storage integrality according to claim 1, it is characterised in that: step 2 institute State the pretreated file M that user is sent to cloud storage service device^*={ { M₁..., M_s, { σ₁..., σ_s, τ }.

3. a kind of method of proof of cloud data storage integrality according to claim 2, it is characterised in that: cloud generates Possess the method for the proof of blocks of files are as follows:

(1) cloud storage service device randomly chooses subset I using user and polymerization authentication code σ and syndication message is calculated as follows

(2) what is then generated possesses the proof of I respective file block

4. a kind of method of proof of cloud data storage integrality according to claim 3, it is characterised in that: user is to cloud End possesses the method that the proof of blocks of files carries out cloud data integrity validation are as follows:

(1) user utilizes the k in private key sk_macFile label τ is verified, if be unsatisfactory for Then Authentication failed returns to 0；Otherwise, user utilizes the k in private key sk_encDecrypt k_extAnd k_prf；

(2) user calculates { i₁, i₂..., i_l, it extractsIn { i₁, i₂..., i_lThe corresponding bit in position, if after extracting As a result it isIt is denoted as

(3) and if only ifWhen, user authentication servers possess I respective file block and return 1。