Deterministic cloud data deleting method based on sampling and fragmenting of cryptograph

Abstract

The invention discloses a deterministic cloud data deleting method based on sampling and fragmenting of a cryptograph. The method mainly solves the problems that the fine granularity of access control is low and the safety is low in the prior art. The method comprises implementation steps that (1) a data owner carries out sampling and fragmenting on the cryptograph to generate a sampling cryptograph and a residual cryptograph, and the sampling cryptograph and the residual cryptograph are sent to a credible third-party mechanism and a could service provider respectively; (2) a file secret key is shared by a plurality of users in a cloud storage environment; (3) when an authorized user accesses the cloud data, the credible third-party mechanism merges the cryptograph of a file, and the authorized user decrypts the cryptograph of the file; (4) the cryptograph sampling and fragmenting technology is adopted to prevent the cloud service provider from acquiring the integrated cryptograph of the file, the credible third-party mechanism destroys the sampling cryptograph, and then deterministic data deleting is achieved. By means of the method, real-time deterministic deleting of data in cloud storage services can be achieved, and the privacy of user data can be improved. The method can be used for guaranteeing safe access of the user data in the cloud storage mode.

Description

technical field [0001] The invention belongs to the technical field of information security, and in particular relates to a method for deleting cloud data, which is applicable to a scene in which user data needs to be deterministically deleted in cloud storage services. Background technique [0002] With the development of cloud computing technology, more and more individuals and enterprises are beginning to use cheap and convenient cloud services to transfer computing and storage. In the cloud storage mode, data is hosted and stored in a third-party cloud storage platform, out of the control of the data owner DO, and its security is highly dependent on the cloud service provider CSP. [0003] When the CSP is untrustworthy, in order to protect the confidentiality of the data, the DO will first encrypt the data, and then entrust the ciphertext data to the CSP, and the encryption key will be kept by itself or a third-party key management agency. However, even if the data is s...

AI Technical Summary

Problems solved by technology

The disadvantage of this solution is that the time-based key management method is not fine-grained enough. In addition, the data owner DO cannot obtain absolute control over the DHT network, and cannot realize instant deletion of data. It is only an idealized realization

This method is vulnerable to attack and the control key is stolen, and there is a security risk that the key manager is untrustworthy and does not delete or leak the control key

In addition, although FADE can implement policy-based access control, its implementation process introduces metadata information to files, adding additional space overhead and network transmission overhead

[0011] c) In the above scheme, if the data visitor has successfully accessed the data once, save the copy of the data key. Originally recovering plaintext data cannot meet the backward security of data, so the effect of data deterministic deletion has not been achieved

Images