Anti-random block generation attack cloud data security deduplication method based on marking strategy

Abstract

This application proposes a cloud data security deduplication method based on a tagging strategy to resist random block generation attacks. The method includes: receiving a deduplication request from a user client, wherein the request contains tags for file blocks corresponding to the file to be uploaded; if the file block is determined to exist on the cloud server based on its tags, a deduplication response is generated and sent to the user client; receiving a linear combination uploaded by the user client in response to the deduplication response, wherein the linear combination includes data generated by encoding the file block using a Vandermonde matrix; decoding the linear combination to obtain the file block; determining whether the file block meets preset conditions; if the file block meets the preset conditions, processing the file block to obtain actual miss blocks; and storing the actual miss blocks. This application can ensure the security of cloud data in cross-user deduplication scenarios while effectively saving communication overhead during the deduplication process.

Description

Technical Field

[0001] This application relates to the field of cloud data deduplication technology, and in particular to a cloud data security deduplication method and apparatus based on a tagging strategy to resist random block generation attacks. Background Technology

[0002] With the continuous advancement and widespread adoption of cloud computing and big data technologies, an increasing number of individual and enterprise users are choosing to outsource data storage and management to cloud service providers, resulting in an explosive growth in cloud data volume. Research shows that redundant duplicate copies account for over 40% of this data. While cloud storage technology provides an effective solution for storing and managing massive amounts of data, the storage efficiency issues caused by numerous duplicate copies pose significant challenges for cloud service providers. Furthermore, once data is stored in the cloud, it is no longer under the user's physical control, making data privacy a crucial factor for cloud users to consider.

[0003] Cross-user cloud data deduplication technology is an effective means of addressing redundant data storage. It eliminates data redundancy in cloud storage by storing only a single copy of duplicate data. For plaintext data, before uploading, users first send a deduplication request to the cloud service provider. The provider then provides a definitive response based on the existence of the target data in the cloud, thus requiring users to upload only data that does not exist in the cloud. Data already existing in the cloud is not required to be uploaded. This effectively controls the communication and storage overhead of redundant data.

[0004] However, in the process of cross-user deduplication of cloud data, deterministic responses actually provide attackers with a side channel. If templated and predictable files are stored in the cloud, attackers can launch side-channel attacks, upload guessed query tags of target files, and observe the deduplication responses to steal the existence privacy of target files. Since it is difficult to completely obfuscate the responses in block-level deduplication depending on whether the target block exists or not, the side-channel attack problem is difficult to completely solve. Meanwhile, a complex form of statistical attack—the random block generation attack—is also a thorny problem. Attackers combine a certain number of randomly generated miss blocks with the target block of interest to generate a deduplication request, and determine the existence of the target block by observing the response. Currently, there are dirty block handling mechanisms to deal with statistical attacks. File blocks that are not fully uploaded according to the deduplication response in a block-level deduplication request are added to the dirty block list. Subsequent deduplication requests containing file blocks from the dirty block list, regardless of whether they exist in the cloud, must upload all file blocks in the request. However, under a random block generation attack, attackers can easily re-add randomly generated miss blocks in each deduplication request to avoid being added to the dirty block list, thus still launching an effective statistical attack. Furthermore, even if existing dirty block handling mechanisms can achieve limited security, their obvious drawback is that they increase a significant amount of communication overhead. Summary of the Invention

[0005] This application aims to at least partially address one of the technical problems in the related art.

[0006] Therefore, the first objective of this application is to propose a cloud data security deduplication method based on a marking strategy to resist random block generation attacks. This method solves the technical problems of side-channel attacks and random block generation attacks in the cross-user cloud data deduplication process. By selecting a random number of hit blocks in the cloud and marking them as misses, the return value of the deduplication response is obfuscated to achieve plaintext block deduplication and resist random block generation attacks launched by external attackers during the deduplication process. This ensures the security of cloud data in cross-user deduplication scenarios and can effectively save communication overhead in the deduplication process.

[0007] The second objective of this application is to propose a cloud data security deduplication device based on a tagging strategy that resists random block generation attacks.

[0008] The third objective of this application is to provide a non-transitory computer-readable storage medium.

[0009] To achieve the above objectives, the first aspect of this application proposes a cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, comprising: receiving a deduplication request sent by a user terminal, wherein the deduplication request includes tags of file blocks corresponding to the file to be uploaded; if it is determined that the file block already exists on the cloud server based on the tags of the file block, generating a deduplication response and sending the deduplication response to the user terminal; receiving a linear combination uploaded by the user terminal in response to the deduplication response, wherein the linear combination includes data generated by encoding the file block using a Vandermonde matrix; decoding the linear combination to obtain the file block, determining whether the file block meets a preset condition, and if the file block meets the preset condition, processing the file block to obtain an actual miss block and storing the actual miss block.

[0010] Optionally, in one embodiment of this application, generating a deduplication response and sending the deduplication response to the user terminal includes:

[0011] Calculate the number of tags for the tagging strategy, and randomly select file blocks to be marked as missing based on the number of tags for the tagging strategy. The missing state indicates that the file blocks in the deduplication request do not exist on the cloud server.

[0012] Calculate the number of missing blocks in the deduplication request after the marking process is completed, and send the number of missing blocks as the return value of the first deduplication response to the client.

[0013] Optionally, in one embodiment of this application, after receiving the deduplication request sent by the user terminal, the method further includes:

[0014] If it is determined from the file block's label that the file block already exists on the cloud server, and the deduplication request contains dirty blocks, then calculate the number of marks for the marking strategy, and randomly select file blocks to mark as missing based on the number of marks for the marking strategy.

[0015] Get the counter counts of all dirty blocks in the deduplication request, where a counter is set for the label of each dirty block in the dirty block list, and the technology is enabled to count the number of times a dirty block is added to the dirty block list;

[0016] Based on the counter count, the number of marks in the marking strategy is added to the maximum counter count to obtain the number of marks in the dirty block processing process. Based on the number of marks in the dirty block processing process, file blocks are randomly selected and marked as missed.

[0017] Calculate the number of missing blocks in the deduplication request after dirty block processing is completed, and send the number of missing blocks as the return value of the second deduplication response to the user.

[0018] Optionally, in one embodiment of this application, the formula for calculating the number of tags in the tagging strategy is expressed as:

[0019] k∈[1,N-H+1]

[0020]

[0021]

[0022] Where k represents the number of tags in the tagging strategy, N represents the total number of file blocks in the file to be uploaded, and H represents the number of hit blocks. This represents the probability that all k marked file blocks are miss blocks. denoted by , represents the probability that all k-1 marked file blocks are miss blocks, and p represents the probability that at least one of the marked file blocks is a hit block.

[0023] Optionally, in one embodiment of this application, before calculating the number of tags for the tagging strategy, the following steps are included:

[0024] Determine whether the hit rate of deduplication requests is greater than the preset hit rate threshold. If so, preprocess the deduplication requests.

[0025] The preprocessing of deduplication requests includes:

[0026] Randomly obtain the number of preprocessed tags, and based on this number, randomly select file blocks and mark them as missed blocks.

[0027] The number of preprocessed tags is expressed as:

[0028] u∈[N×p1,N×p2],0 <p1<p2<1

[0029] Where u represents the number of preprocessed tags, N represents the total number of file blocks of the file to be uploaded, p1 represents the lower limit of the preprocessing ratio, and p2 represents the upper limit of the preprocessing ratio.

[0030] Optionally, in one embodiment of this application, the preset condition is to pass integrity verification, decode the linear combination to obtain a file block, determine whether the file block meets the preset condition, and if the file block meets the preset condition, process the file block to obtain the actual miss block, and store the actual miss block, including:

[0031] Get the number of actual missing blocks in the deduplication request, randomly select a linear combination based on the number of actual missing blocks, decode the selected linear combination with the hit blocks of the file to be uploaded, and get the file blocks in the deduplication request.

[0032] Determine whether a file block has passed integrity verification;

[0033] If the file block passes the integrity verification, delete the existing file block on the cloud server based on the file block to obtain the actual missing block, and store the actual missing block;

[0034] The decoding formula is expressed as follows:

[0035]

[0036]

[0037] Where V represents the Vandermonde matrix, N represents the total number of file blocks in the file to be uploaded, r represents the return value of the deduplication response, C represents the decoded file block content, w represents the actual number of missing blocks, and I N-w Let C represent an Nw-row identity matrix. N-w Indicates a file block hit, V w Describes the w rows and m rows of the Vandermonde matrix. w This represents a linear combination of the actual number of blocks missed.

[0038] Optionally, in one embodiment of this application, after determining whether a file block has passed integrity verification, the method further includes:

[0039] If the file block passes the integrity check, the dirty block in the deduplication request will be removed from the dirty block list;

[0040] If a file block fails the integrity check, the file block is added to the dirty block list.

[0041] Optionally, in one embodiment of this application, after receiving the deduplication request sent by the user terminal, the method further includes:

[0042] If it is determined from the file block's tag that the file block does not exist on the cloud server, then the number of file blocks in the deduplication request is calculated, and the number of file blocks is sent to the user as the return value of the third deduplication response.

[0043] To achieve the above objectives, a second aspect of this application proposes a cloud data security deduplication device based on a tagging strategy to resist random block generation attacks, comprising:

[0044] The receiving module is used to receive a deduplication request sent by the user, wherein the deduplication request contains the tags of the file blocks corresponding to the file to be uploaded; it is also used to receive a linear combination uploaded by the user in response to the deduplication response, wherein the linear combination includes data generated by encoding the file blocks using the Vandermonde matrix;

[0045] The generation module is used to generate a deduplication response if it is determined from the file block's tag that the file block already exists on the cloud server.

[0046] The sending module is used to send the deduplication response to the user terminal;

[0047] The storage module is used to decode the linear combination to obtain file blocks, determine whether the file blocks meet the preset conditions, and if the file blocks meet the preset conditions, process the file blocks to obtain the actual miss blocks and store the actual miss blocks.

[0048] To achieve the above objectives, a third aspect of this application proposes a non-transitory computer-readable storage medium that, when instructions in the storage medium are executed by a processor, can perform a cloud data security deduplication method based on a tagging strategy to resist random block generation attacks.

[0049] The cloud data security deduplication method, apparatus, and non-transitory computer-readable storage medium based on the marking strategy based in this application solve the technical problems of side-channel attacks and random block generation attacks in the cross-user cloud data deduplication process. By selecting a random number of hit blocks in the cloud and marking them as misses, the return value of the deduplication response is obfuscated to achieve plaintext block deduplication and resist random block generation attacks launched by external attackers in the deduplication process. This ensures the security of cloud data in cross-user deduplication scenarios and can effectively save communication overhead in the deduplication process.

[0050] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0051] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0052] Figure 1 This is a flowchart illustrating a cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, provided in Embodiment 1 of this application.

[0053] Figure 2 This is an example diagram of a cross-user cloud data security deduplication model for a cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, as described in an embodiment of this application.

[0054] Figure 3 This is an example diagram illustrating the preprocessing and marking process of the cloud data security deduplication method based on a marking strategy to resist random block generation attacks in an embodiment of this application.

[0055] Figure 4 This is an example diagram illustrating the dirty block processing process of the cloud data security deduplication method based on a marking strategy to resist random block generation attacks, as described in this application embodiment.

[0056] Figure 5This is an example diagram illustrating the client-cloud encoding / decoding interaction of the cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, as described in this application embodiment.

[0057] Figure 6 This is an example diagram illustrating the deduplication request processing flow under different scenarios of the cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, as described in this application embodiment.

[0058] Figure 7 This is an example diagram of the deduplication request processing flow for the cloud data security deduplication method based on the tagging strategy to resist random block generation attacks, which is an embodiment of this application.

[0059] Figure 8 This is an example diagram illustrating the deduplication request processing flow of a dirty block in the cloud data security deduplication method based on a marking strategy to resist random block generation attacks, as described in an embodiment of this application.

[0060] Figure 9 This is a schematic diagram of a cloud data security deduplication device based on a tagging strategy to resist random block generation attacks, provided in Embodiment 2 of this application. Detailed Implementation

[0061] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0062] The following describes, with reference to the accompanying drawings, a cloud data security deduplication method and apparatus based on a tagging strategy to resist random block generation attacks.

[0063] Figure 1 This is a flowchart of a cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, provided in Embodiment 1 of this application.

[0064] like Figure 1 As shown, this cloud data security deduplication method based on a tagging strategy to resist random block generation attacks includes the following steps:

[0065] Step 101: Receive a deduplication request sent by the user, wherein the deduplication request contains the tags of the file blocks corresponding to the file to be uploaded.

[0066] In this application, "user" refers to an entity that has already registered with a CSP (Cloud Server Provider) and needs to send its data or files to the CSP. A CSP is an entity that manages a large number of cloud servers to provide substantial storage space and computing resources.

[0067] In this application, the label of the file block in the deduplication request is the hash value of the file block content.

[0068] Step 102: If it is determined that the file block already exists on the cloud server based on the file block's tag, then generate a deduplication response and send the deduplication response to the user.

[0069] This application obfuscates the return value of the response through a marking strategy. The cloud server will calculate the number of marks based on the proportion of hit blocks, requiring that at least one hit block be marked with a very high probability. The marking has no effect on the missing blocks, and the marked hit blocks will be treated as missing blocks.

[0070] Step 103: Receive the linear combination of the user's response to the deduplication response uploaded, wherein the linear combination includes data generated by encoding file blocks using the Vandermonde matrix.

[0071] This application receives a linear combination of the user's response to the deduplication response uploaded, wherein the user uses the Vandermonde matrix to encode file blocks to generate the linear combination.

[0072] Step 104: Decode the linear combination to obtain a file block, determine whether the file block meets the preset conditions, if the file block meets the preset conditions, process the file block to obtain the actual miss block, and store the actual miss block.

[0073] The prerequisite for this application is passing integrity verification, which includes verifying whether the file block uploaded by the user is complete and whether the user has uploaded the file block.

[0074] Upon receiving the linear combination, this application decodes it to obtain all file blocks in the deduplication request. It then determines whether the file blocks pass the integrity verification. If the file blocks pass the integrity verification, the file blocks that already exist on the cloud server are deleted to obtain the actual miss blocks. The actual miss blocks are stored. If the deduplication request contains dirty blocks, the dirty blocks must be removed from the dirty block list. If the file blocks fail the integrity verification, the file blocks are added to the dirty block list.

[0075] This application's embodiment of a tag-based cloud data security deduplication method against random block generation attacks involves receiving a deduplication request from a user, where the request includes tags for file blocks corresponding to the file to be uploaded. If the file block's tags indicate it already exists on the cloud server, a deduplication response is generated and sent to the user. The method then receives a linear combination uploaded in response to the deduplication response from the user, where the linear combination includes data generated by encoding the file block using a Vandermonde matrix. The linear combination is decoded to obtain the file block, and it is determined whether the file block meets preset conditions. If the file block meets the preset conditions, it is processed to obtain actual miss blocks, which are then stored. This method effectively solves the side-channel attack problem and the technical problem of random block generation attacks in cross-user cloud data deduplication. By selecting a random number of hit blocks in the cloud and marking them as misses, the return value of the deduplication response is obfuscated, achieving plaintext block deduplication and resisting random block generation attacks launched by external attackers during the deduplication process. This ensures the security of cross-user cloud data deduplication scenarios and effectively saves communication overhead during the deduplication process.

[0076] The cloud data security deduplication method based on the tagging strategy proposed in this application has beneficial effects in terms of both security and efficiency.

[0077] Firstly, in terms of security, this application is the first to achieve secure deduplication of cloud data from the perspective of resisting random block generation attacks. Compared with previous methods, it offers a significant improvement in security. Specifically, this application first calculates the number of blocks to be marked to ensure that at least one hit block can be marked as a miss with a very high probability. Then, the file blocks in the current deduplication request are randomly marked. Regardless of whether the marked file block is a hit or not, it will be treated as a miss. This application also extends the marking strategy to the handling of dirty blocks. When the deduplication request contains dirty blocks, an additional round of dirty block marking is added. When some dirty blocks are repeatedly requested for upload, their corresponding counter is incremented by 1 after each request, and the number of subsequent dirty block marking processes may also increase accordingly. The randomness and monotonically increasing nature of the marking number greatly reduces the probability of attackers stealing boundary values ​​by repeatedly requesting uploads. Attackers can hardly infer the existence of sensitive information in the cloud from the return value r.

[0078] Secondly, in terms of efficiency, this application exhibits lower communication overhead in dirty block handling compared to other solutions. When a deduplication request is found to contain dirty blocks, existing solutions require the user to upload all file blocks included in the request. This application, however, uses dirty block marking to further obfuscate the request, resulting in a significantly lower probability of uploaded file blocks compared to the total number of file blocks, thus substantially reducing communication overhead. Furthermore, to further reduce communication overhead, this application proposes a dirty block removal mechanism for the first time. Once a file block added to the dirty block list is successfully uploaded in a subsequent request, it is removed from the dirty block list. Subsequent deduplication requests containing this dirty block do not require dirty block marking. This dirty block removal mechanism further reduces the communication overhead caused by dirty blocks.

[0079] Furthermore, in this embodiment of the application, generating a deduplication response and sending the deduplication response to the user terminal includes:

[0080] Calculate the number of tags for the tagging strategy, and randomly select file blocks to be marked as missing based on the number of tags for the tagging strategy. The missing state indicates that the file blocks in the deduplication request do not exist on the cloud server.

[0081] Calculate the number of missing blocks in the deduplication request after the marking process is completed, and send the number of missing blocks as the return value of the first deduplication response to the client.

[0082] In this embodiment of the application, the file block in the missing state is the missing block.

[0083] When the CSP receives a deduplication request from the client, it first needs to classify the request based on the hit rate of the requested file and whether it contains dirty blocks. The CSP needs to set a hit rate threshold v and preprocessing mark ratios p1 and p2. Once the hit rate of the requested file exceeds the threshold v, the preprocessing mechanism of this application will be triggered. Simultaneously, the CSP also needs to set a parameter p. During the marking phase, this application marks a hit block with a probability of at least p, changing it to a miss state. The CSP needs to maintain a dirty block list D to record file blocks that were not uploaded normally or that failed integrity verification after upload. For files containing dirty blocks, the CSP also needs to set a corresponding counter s for the label of each dirty block to record the number of times the dirty block is added to the dirty block list.

[0084] Furthermore, in this embodiment of the application, after receiving the deduplication request sent by the user terminal, the method further includes:

[0085] If it is determined from the file block's label that the file block already exists on the cloud server, and the deduplication request contains dirty blocks, then calculate the number of marks for the marking strategy, and randomly select file blocks to mark as missing based on the number of marks for the marking strategy.

[0086] Get the counter counts of all dirty blocks in the deduplication request, where a counter is set for the label of each dirty block in the dirty block list, and the technology is enabled to count the number of times a dirty block is added to the dirty block list;

[0087] Based on the counter count, the number of marks in the marking strategy is added to the maximum counter count to obtain the number of marks in the dirty block processing process. Based on the number of marks in the dirty block processing process, file blocks are randomly selected and marked as missed.

[0088] Calculate the number of missing blocks in the deduplication request after dirty block processing is completed, and send the number of missing blocks as the return value of the second deduplication response to the user.

[0089] For files containing dirty blocks in the deduplication request, this application performs corresponding dirty block processing. Unlike previous dirty block processing mechanisms that required uploading the entire file containing dirty blocks, this application sets a corresponding counter for each dirty block's tag to record the number of times the dirty block is added to the dirty block list. This value determines the number of tags that need to be added in subsequent dirty block processing. In addition, this application introduces a dirty block removal mechanism to reduce the huge communication overhead problem existing in previous dirty block processing mechanisms.

[0090] Specifically, consider a deduplication request T1 containing dirty blocks. Once this request arrives at the CSP, after preprocessing and marking, the dirty block processing flow is triggered. The deduplication request T1' contains labels t1, t2, ..., t N These correspond to file blocks C1, C2, ..., C, respectively. N In this process, blocks C1 and C4, corresponding to tags t1 and t4, are already hit blocks in the CSP. Blocks C2 and C5, corresponding to tags t2 and t5, are dirty blocks in the dirty block list. All other remaining file blocks, regardless of their original hit status, are considered miss blocks at this stage. The CSP first compares the counters s2 and s5 corresponding to t2 and t5. Assuming s2 is greater than or equal to s5, the number of blocks to be marked during dirty block processing is k + s2, where k is the number of marks required. Furthermore, when k + s2 is greater than or equal to N, all blocks in the request must be uploaded. After the deduplication request T1' is processed by dirty block marking, at least one block from C1 and C4 is marked with probability p, making it a miss. This design not only ensures that the number of blocks to be marked during dirty block processing changes with the number of dirty block requests uploaded, but also significantly reduces the probability of returning the minimum boundary value and thus exposing the privacy of sensitive block existence.

[0091] Furthermore, in the embodiments of this application, the formula for calculating the number of tags in the tagging strategy is expressed as follows:

[0092] k∈[1,N-H+1]

[0093]

[0094]

[0095] Where k represents the number of tags in the tagging strategy, N represents the total number of file blocks in the file to be uploaded, and H represents the number of hit blocks. This represents the probability that all k marked file blocks are miss blocks. denoted by , represents the probability that all k-1 marked file blocks are miss blocks, and p represents the probability that at least one of the marked file blocks is a hit block.

[0096] To obfuscate the return value, this application introduces a marking strategy. For all requests containing a hit block, the marking strategy must ensure that at least one hit block is marked as a miss with probability p. It is worth noting that the choice of the value of p is a trade-off between security and efficiency. A larger value of p means that more blocks may be marked, thus increasing the corresponding communication overhead.

[0097] This application defines the number of file blocks to be marked as k (k∈[1, N-H+1]). The probability that at least one of these k randomly selected blocks is a hit block is... and It is greater than or equal to a pre-defined p. Specifically, the method for calculating the minimum k value that satisfies the above conditions is to traverse the interval [1, N-H+1] and find the minimum k value that simultaneously satisfies the above conditions. and The value of is the minimum value of k.

[0098] Furthermore, in this embodiment of the application, before calculating the number of tags for the tagging strategy, the following steps are included:

[0099] Determine whether the hit rate of deduplication requests is greater than the preset hit rate threshold. If so, preprocess the deduplication requests.

[0100] The preprocessing of deduplication requests includes:

[0101] Randomly obtain the number of preprocessed tags, and based on this number, randomly select file blocks and mark them as missed blocks.

[0102] The number of preprocessed tags is expressed as:

[0103] u∈[N×p1, N×p2], 0<p1<p2<1

[0104] Where u represents the number of preprocessed tags, N represents the total number of file blocks of the file to be uploaded, p1 represents the lower limit of the preprocessing ratio, and p2 represents the upper limit of the preprocessing ratio.

[0105] When a deduplication request for a target file is received, the CSP first determines the existence of the file blocks in the deduplication request in the cloud by comparing the tags corresponding to the file blocks with the tags corresponding to the file blocks in local storage. To achieve fuzziness in the return value, this application needs to randomly mark some hit blocks existing in the cloud as missing, so that the cloud generates different return values ​​for the same deduplication request. Specifically, assuming that the target file has a total of N blocks, of which H are hit blocks, this application marks at least one hit block from the H hit blocks with probability p. To ensure that the range of return values ​​is large enough, if the file hit rate H / N is greater than the hit rate threshold v, the file needs to be preprocessed.

[0106] For files requiring preprocessing, this application randomly selects a certain proportion of blocks and renders them as misses before executing the subsequent marking strategy. Specifically, this application sets the hit rate threshold v to be equal to p, because when the hit rate is greater than p, only one block needs to be marked without considering preprocessing. If this block is a hit block, the return value r is N-H+1. Otherwise, if this block is a miss block, the return value r is NH, at which point the existence privacy of the H hit blocks will be immediately exposed. In fact, the range of the return value at this time is [NH, N-H+1]. Malicious attackers can easily obtain the existence privacy of these H blocks by attaching NH randomly generated miss blocks to these H target blocks to generate deduplication requests. To address this issue, this application introduces a preprocessing procedure, which randomly selects u blocks to make them miss-indicating, disregarding the actual hit states of these u blocks beforehand, where u ∈ [N×p1, N×p2], 0 < p1 < p2 < 1. This reduces the file hit rate and expands the return value range. Consequently, the probability of NH appearing in the return value is significantly reduced. Furthermore, since the number of preprocessed blocks is randomly selected within a range, even a statistical attack would be difficult for an attacker to steal the existence privacy of sensitive blocks.

[0107] After completing preprocessing and the marking strategy, CSP calculates the number of missing blocks in the file and sends it to the user as a return value 'r'. Because more blocks are considered missing, the probability of CSP returning 'NH' is greatly reduced, effectively protecting the existence privacy of the target blocks even in the face of random block generation attacks.

[0108] Further, in this embodiment, the preset condition is to pass integrity verification, decode the linear combination to obtain a file block, determine whether the file block meets the preset condition, and if the file block meets the preset condition, process the file block to obtain the actual miss block, and store the actual miss block, including:

[0109] Get the number of actual missing blocks in the deduplication request, randomly select a linear combination based on the number of actual missing blocks, decode the selected linear combination with the hit blocks of the file to be uploaded, and get the file blocks in the deduplication request.

[0110] Determine whether a file block has passed integrity verification;

[0111] If the file block passes the integrity verification, delete the existing file block on the cloud server based on the file block to obtain the actual missing block, and store the actual missing block;

[0112] The decoding formula is expressed as follows:

[0113]

[0114]

[0115] Where V represents the Vandermonde matrix, N represents the total number of file blocks in the file to be uploaded, r represents the return value of the deduplication response, C represents the decoded file block content, w represents the actual number of missing blocks, and I N-w Let C represent an Nw-row identity matrix. N-w Indicates a file block hit, V w Describes the w rows and m rows of the Vandermonde matrix. w This represents a linear combination of the actual number of blocks missed.

[0116] After receiving r linear combinations in the cloud, CSP randomly selects w linear combinations, where w is the actual number of missed blocks. These w linear combinations are then decoded along with the remaining Nw hit blocks to extract the file content of the w missed blocks. Specifically, decoding utilizes an r×N Vandermonde matrix and calculates... To recover N file blocks, where the r×N Vandermonde matrix is ​​represented as:

[0117]

[0118] Where V represents the Vandermonde matrix, N represents the total number of file blocks of the file to be uploaded, and r represents the return value of the deduplication response.

[0119] Furthermore, in this embodiment of the application, after determining whether the file block has passed the integrity verification, the method further includes:

[0120] If the file block passes the integrity check, the dirty block in the deduplication request will be removed from the dirty block list;

[0121] If a file block fails the integrity check, the file block is added to the dirty block list.

[0122] After the user receives the response from the cloud, if they upload the corresponding linear combination L1 and pass the CSP integrity verification, t2 and t5 will be removed from the dirty block list. Subsequent deduplication requests that contain file blocks corresponding to these two tags will be treated as non-dirty blocks. This significantly reduces communication overhead for other normal users. If the user fails to upload the linear combination in time or fails the integrity verification after decoding, all file blocks corresponding to tags in the request will be added to the dirty block list D.

[0123] Furthermore, in this embodiment of the application, after receiving the deduplication request sent by the user terminal, the method further includes:

[0124] If it is determined from the file block's tag that the file block does not exist on the cloud server, then the number of file blocks in the deduplication request is calculated, and the number of file blocks is sent to the user as the return value of the third deduplication response.

[0125] After receiving the deduplication request from the user, if it is determined from the file block tags that the file block does not exist on the cloud server, the user is required to directly upload all file blocks without encoding, and then verify the integrity of the file blocks.

[0126] This application also proposes a cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, including the following steps:

[0127] S1: Obtain the file to be uploaded, divide the file into blocks, and calculate the hash value of each file block to generate the corresponding tag.

[0128] Before sending a deduplication request, the client in this application needs to divide the file to be uploaded into blocks and calculate the hash value of each file block to generate a corresponding tag. The process of dividing the file to be uploaded into blocks of fixed lengths and using a padding strategy to ensure that the length of the last block is consistent with the length of the other blocks.

[0129] S2: Send a deduplication request to the cloud server. The deduplication request contains the tags corresponding to all file blocks of the file to be uploaded.

[0130] The user client in this application will include the file blocks (C1, C2, ..., C...) contained in the file F to be uploaded. N The tag T (usually the hash value of the file block content) corresponding to file F is sent as a deduplication request to the cloud server. If none of the file blocks contained in file F exist in the CSP, the user needs to upload the entire file block directly; otherwise, the user needs to encode all file blocks according to the return value r of the cloud response, generate r corresponding linear combinations, and then upload these r linear combinations to the CSP. Only one copy of the duplicate file is kept in the CSP.

[0131] S3: Receive the deduplication response sent by the cloud server and upload the file block to the cloud server according to the return value of the deduplication response.

[0132] After receiving the deduplication response, if the cloud server does not find any file blocks related to the deduplication request, the client will directly upload all file blocks without encoding. If the cloud server contains matching blocks, the client will encode the file to be uploaded into r independent linear combinations based on the return value r of the deduplication response and send the r linear combinations to the cloud.

[0133] The client in this application needs to upload a certain number of file blocks or linear combinations based on the deduplication response returned by the cloud server. With the help of encoding techniques, even if an attacker knows the cloud's return value, they cannot determine the existence of a specific block. For the deduplication request containing N tags, if the return value r equals N, then the N blocks can be uploaded directly without encoding.

[0134] Otherwise, when the return value r is less than N, encoding is required, where the N blocks C1, C2, ..., C in the request are encoded using an r×N Vandermonde matrix. N Encode it into r independent linear combinations;

[0135] Wherein, the r×N Vandermonde matrix is ​​represented as:

[0136]

[0137] Where V represents the Vandermonde matrix, N represents the total number of file blocks of the file to be uploaded, and r represents the return value of the deduplication response;

[0138] Each of the r independent linear combinations can be computed;

[0139] The formula for calculating linear combinations is as follows:

[0140]

[0141] Where, m i Let V represent the i-th linear combination, N represent the total number of file blocks to be uploaded, and V represent the total number of file blocks to be uploaded. i,j Let C represent the element in the i-th row and j-th column of the matrix. j This represents the j-th file block, and r represents the return value of the deduplication response.

[0142] Figure 2 This is an example diagram of a cross-user cloud data security deduplication model for a cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, as described in an embodiment of this application.

[0143] like Figure 2As shown, the system model includes two entities: the user client and the Cloud Server Provider (CSP). The user client refers to an entity that has registered with the CSP and needs to send its data or files to the CSP. The CSP is an entity that manages a large number of cloud servers to provide a large amount of storage space and computing resources. First, the user client sends a set of file block tags (usually hash values ​​of the file block content) as a deduplication request to the CSP. Based on the received file block tags, the CSP first checks whether these file blocks already exist in the cloud. If not, as shown in (a), the CSP generates a deduplication response and returns it to the user client, requiring the user client to directly upload all file blocks; after the user client uploads, the CSP performs an integrity check. If some file blocks already exist, as shown in (b), the cloud will obfuscate the response value through a marking strategy. The cloud will calculate the number of tags based on the proportion of hit blocks, requiring at least one hit block to be marked with a very high probability. Marking has no effect on missing blocks; marked hit blocks are treated as missing blocks. If a file block contains dirty blocks as shown in (c), the cloud will use a counter for each dirty block in the dirty block list to record the number of times it is added. The cloud will calculate the number of dirty block markers to be added based on the size of each counter to further obfuscate the return value. After marking, the cloud will respond to the user with a return value r based on the number of missing blocks, which is the number of linear combinations the user is required to upload. After receiving the value r, the user will encode the file block using the Vandermonde determinant to generate r linear combinations. The CSP will decode the linear combinations, discard the file blocks already existing in the cloud, and check the integrity of the missing file blocks. If the integrity check passes, the file block is successfully uploaded. If the deduplication request contains dirty blocks, the dirty blocks must be removed from the dirty block list.

[0144] Once the CSP receives a deduplication request from the cloud user, it checks the file blocks in the request in local storage to see if there are any hit blocks or dirty blocks. If none of the file blocks in the cloud for the deduplication request are hit, as shown in Figure (a), the cloud user is required to upload all file blocks directly, and the CSP only needs to verify the integrity; otherwise, as shown in Figures (b) and (c), the CSP will execute a specific marking strategy based on whether there are dirty blocks.

[0145] Figure 3 This is an example diagram illustrating the preprocessing and marking process of the cloud data security deduplication method based on marking strategy to resist random block generation attacks, as described in this application embodiment.

[0146] like Figure 3 As shown, the user client will store the file blocks (C1, C2, ..., C...) contained in file F. NThe tag T (usually the hash value of the file block content) corresponding to the file block is sent to the CSP as a deduplication request. When the CSP receives the deduplication request, it first determines the existence of the file block in the cloud by comparing the tag corresponding to the file block with the tag corresponding to the file block in the local storage, and determines whether the file duplication rate is greater than the threshold v. If so, the file is preprocessed first and then marked. If not, it is marked directly. After completing the above preprocessing and marking strategy, the CSP calculates the number of hit blocks contained in the file at this time and sends it as the return value r to the client.

[0147] Figure 4 This is an example diagram illustrating the dirty block processing process of the cloud data security deduplication method based on a marking strategy to resist random block generation attacks, as described in an embodiment of this application.

[0148] like Figure 4 As shown, the deduplication request T1' contains tags t1, t2, ..., t N These correspond to file blocks C1, C2, ..., C, respectively. N In this process, blocks C1 and C4, corresponding to tags t1 and t4, are already hit blocks in the CSP. Blocks C2 and C5, corresponding to tags t2 and t5, are dirty blocks in the dirty block list. All other remaining file blocks, regardless of their original hit status, are considered miss blocks at this point. The CSP first compares the counters s2 and s5 corresponding to t2 and t5. Assuming s2 is greater than or equal to s5, the number of blocks to be marked during dirty block processing is k + s2, where k is the number of marks required. Furthermore, when k + s2 is greater than or equal to N, all blocks in the request need to be uploaded. After the deduplication request T1' passes the dirty block marking process, at least one block from C1 and C4 is marked with probability p, making it a miss. After completing the dirty block marking process, the CSP calculates the number of hit blocks currently contained in the file and sends it as a return value r to the client. After receiving the return value from the cloud, if the client uploads its corresponding linear combination L1 and passes the CSP's integrity verification, t2 and t5 will be removed from the dirty block list. If the user fails to upload the linear combination in a timely manner or fails the integrity verification after decoding, the file blocks corresponding to all tags in the request will be added to the dirty block list D.

[0149] Figure 5 This is an example diagram illustrating the client-cloud encoding / decoding interaction of the cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, as described in this application embodiment.

[0150] like Figure 5As shown, the client sends the file block's tag as a deduplication request to the cloud. The cloud determines the existence of the file block in the deduplication request by comparing the tag corresponding to the file block with the tag corresponding to the file block in local storage, and generates a corresponding deduplication response. The return value r of the deduplication response is then sent to the client. Based on the return value r from the cloud, the client encodes the file to be uploaded into r independent linear combinations and sends the r linear combinations to the cloud.

[0151] Figure 6 This is an example diagram illustrating the deduplication request processing flow under different scenarios of the cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, as described in this application embodiment.

[0152] like Figure 6 As shown, the client divides the file into fixed-length blocks according to the agreed-upon size with the cloud, and calculates the tag corresponding to each block (usually a hash value of the block content) as a deduplication request and sends it to the cloud. The cloud determines the existence of the file blocks in the deduplication request by comparing the tags corresponding to the file blocks with the tags corresponding to the file blocks in local storage, generates a corresponding deduplication response, and sends the deduplication response to the client.

[0153] If it is the first upload, the user does not encode the file and uploads all file blocks directly. The cloud performs an integrity check on the uploaded file blocks. If the check passes, the file is stored normally. If the check fails or the user does not upload any file blocks, the file block is added to the dirty block list.

[0154] If this is not the first upload and does not contain dirty blocks, the deduplication request is preprocessed and marked to generate a deduplication response. The return value r of the deduplication response is sent to the client. The client encodes the file block using the Vandermonde determinant to generate r linear combinations, and sends the r linear combinations to the cloud. The cloud decodes the r linear combinations into file blocks and performs an integrity check on the uploaded file blocks. If the check passes, the file blocks are stored normally. If the check fails or the user has not uploaded the file blocks, the file blocks are added to the dirty block list.

[0155] If this is not the first upload and contains dirty blocks, the deduplication request undergoes preprocessing, marking, and dirty block processing to generate a deduplication response. The return value 'r' of the deduplication response is sent to the client. The client encodes the file blocks using the Vandermonde determinant, generating 'r' linear combinations, which are then sent to the cloud. The cloud decodes these 'r' linear combinations into file blocks and performs an integrity check on the uploaded file blocks. If the check passes, the file blocks are stored normally. If the check fails or the user did not upload the file blocks, the file blocks are added to the dirty block list. Dirty blocks that are uploaded normally are removed from the dirty block list.

[0156] Figure 7This is an example diagram illustrating the deduplication request processing flow of the cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, which is an embodiment of this application.

[0157] like Figure 7 As shown, the client sends the file block's tag as a deduplication request to the cloud. The cloud determines the existence of the file block in the deduplication request by comparing the tag corresponding to the file block with the tag corresponding to the file block in local storage. The cloud preprocesses and marks the deduplication request, generates a deduplication response, and sends the return value r of the deduplication response to the client. The client uses the Vandermonde determinant to encode the file block to generate r linear combinations and uploads the r linear combinations to the cloud. The cloud decodes the r linear combinations into file blocks and performs an integrity check on the uploaded file blocks. If the check passes, the file blocks are stored normally. If the check fails or the user has not uploaded the file blocks, the file blocks are added to the dirty block list.

[0158] Figure 8 This is an example diagram illustrating the deduplication request processing flow of a dirty block in the cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, as described in an embodiment of this application.

[0159] like Figure 8 As shown, the client sends the file block's tag as a deduplication request to the cloud. The cloud determines the existence of the file block in the deduplication request by comparing the tag corresponding to the file block with the tag corresponding to the file block in local storage. After preprocessing and marking the deduplication request, dirty block processing is performed to generate a deduplication response. The return value r of the deduplication response is sent to the client. The client uses the Vandermonde determinant to encode the file block to generate r linear combinations and uploads the r linear combinations to the cloud. The cloud decodes the r linear combinations into file blocks and performs an integrity check on the uploaded file blocks. If the check passes, the file blocks are stored normally. If the check fails or the user has not uploaded the file blocks, the file blocks are added to the dirty block list.

[0160] Figure 9 This is a schematic diagram of a cloud data security deduplication device based on a tagging strategy to resist random block generation attacks, provided in Embodiment 2 of this application.

[0161] like Figure 9 As shown, this cloud data security deduplication device based on a tagging strategy to resist random block generation attacks includes:

[0162] The receiving module 10 is used to receive a deduplication request sent by the user terminal, wherein the deduplication request contains the tags of the file blocks corresponding to the file to be uploaded; it is also used to receive a linear combination uploaded by the user terminal in response to the deduplication response, wherein the linear combination includes data generated by encoding the file blocks using the Vandermonde matrix;

[0163] The generation module 20 is used to generate a deduplication response if it is determined from the file block's tag that the file block already exists on the cloud server.

[0164] Sending module 30 is used to send the deduplication response to the user terminal;

[0165] The storage module 40 is used to decode the linear combination to obtain a file block, determine whether the file block meets the preset conditions, and if the file block meets the preset conditions, process the file block to obtain the actual miss block and store the actual miss block.

[0166] This application's embodiment of a tag-based anti-random block generation attack cloud data security deduplication device includes a receiving module for receiving a deduplication request sent by a user terminal, wherein the deduplication request includes tags of file blocks corresponding to the file to be uploaded; and a receiving module for receiving a linear combination uploaded by the user terminal in response to the deduplication response, wherein the linear combination includes data generated by encoding the file blocks using a Vandermonde matrix; a generating module for generating a deduplication response if it is determined from the tags of the file blocks that the file blocks already exist on the cloud server; a sending module for sending the deduplication response to the user terminal; and a storage module for decoding the linear combination to obtain the file blocks, determining whether the file blocks meet preset conditions, and if the file blocks meet the preset conditions, processing the file blocks to obtain actual miss blocks and storing the actual miss blocks. Therefore, it can solve the technical problems of side-channel attacks and random block generation attacks in the process of cross-user cloud data deduplication. By selecting a random number of hit blocks in the cloud and marking them as missing, the return value of the deduplication response is obfuscated to achieve plaintext block deduplication and resist random block generation attacks launched by external attackers in the deduplication process. This ensures the security of cloud data in cross-user deduplication scenarios and can effectively save communication overhead in the deduplication process.

[0167] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it implements the cloud data security deduplication method based on a tagging strategy to resist random block generation attacks as described in the above embodiments.

[0168] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0169] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "multiple" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0170] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0171] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0172] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0173] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0174] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0175] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A cloud data security deduplication method based on a tagging strategy to resist random block generation attacks, characterized in that, Includes the following steps: Receive a deduplication request sent by the user, wherein the deduplication request contains tags for the file blocks corresponding to the file to be uploaded; If it is determined from the tag of the file block that the file block already exists on the cloud server, a deduplication response is generated and sent to the user terminal; The system receives a linear combination of the deduplication response uploaded by the user terminal, wherein the linear combination includes data generated by encoding file blocks using the Vandermonde matrix. The linear combination is decoded to obtain a file block. It is determined whether the file block meets a preset condition. If the file block meets the preset condition, the file block is processed to obtain an actual miss block, and the actual miss block is stored. The step of generating a deduplication response and sending the deduplication response to the user terminal includes: Calculate the number of tags for the tagging strategy, and randomly select file blocks to be marked as missing based on the number of tags for the tagging strategy, wherein the missing state indicates that the file blocks in the deduplication request do not exist on the cloud server; The number of missing blocks in the deduplication request after the marking process is completed is calculated, and the number of missing blocks is sent to the user as the return value of the first deduplication response. The formula for calculating the number of tags in the tagging strategy is expressed as follows: in, This indicates the number of tags in the tagging strategy. N This indicates the total number of file blocks in the file to be uploaded. H Indicates the number of blocks hit. Indicates the mark k The probability that all file blocks are miss blocks. Indicates the mark k The probability that all -1 file blocks are miss blocks. p This indicates the probability that at least one of the marked file blocks is a hit block.

2. The method as described in claim 1, characterized in that, After receiving the deduplication request sent by the user terminal, the method further includes: If it is determined that the file block already exists on the cloud server based on the tag of the file block, and the deduplication request contains dirty blocks, then the number of tags for the tagging strategy is calculated, and a file block is randomly selected and marked as a miss based on the number of tags for the tagging strategy. Obtain the counter counts of all dirty blocks in the deduplication request, wherein a counter is set for the label of each dirty block in the dirty block list, and the counter is used to count the number of times the dirty block is added to the dirty block list; Based on the counter count, the number of marks in the marking strategy is added to the maximum counter count to obtain the number of marks in the dirty block processing process. Based on the number of marks in the dirty block processing process, file blocks are randomly selected and marked as missing. The number of missing blocks in the deduplication request after dirty block processing is calculated, and the number of missing blocks is sent to the user as the return value of the second deduplication response.

3. The method as described in claim 1, characterized in that, Before calculating the number of tags for the tagging strategy, the following is included: Determine whether the hit rate of the deduplication request is greater than a preset hit rate threshold. If so, preprocess the deduplication request. The preprocessing of the deduplication request includes: The number of preprocessed tags is randomly obtained, and based on this number, file blocks are randomly selected and marked as missed blocks. The number of preprocessed tags is expressed as follows: ， in, u Indicates the number of preprocessed tags. N This indicates the total number of file blocks in the file to be uploaded. p 1 indicates the lower limit of the preprocessing ratio. p 2 indicates the upper limit of the preprocessing ratio.

4. The method as described in claim 1, characterized in that, The preset condition is passing integrity verification. The process involves decoding the linear combination to obtain a file block, determining whether the file block meets the preset condition, and if so, processing the file block to obtain an actual miss block. The actual miss block is then stored, including: Obtain the number of actual missing blocks in the deduplication request, randomly select a linear combination based on the number of actual missing blocks, decode the selected linear combination with the hit blocks of the file to be uploaded, and obtain the file blocks in the deduplication request. Determine whether the file block has passed integrity verification; If the file block passes the integrity verification, delete the existing file block on the cloud server based on the file block to obtain the actual missed block, and store the actual missed block; The decoding formula is expressed as follows: C= in, V Represents the Vandermonde matrix. N This indicates the total number of file blocks in the file to be uploaded. r This indicates the return value of the deduplication response. C This represents the decoded file block content. This indicates the actual number of blocks that were not hit. express Nw Row identity matrix This indicates that a file block has been hit. Representing the Vandermonde matrix w OK, This represents a linear combination of the actual number of blocks that were not hit.

5. The method as described in claim 4, characterized in that, After determining whether the file block has passed integrity verification, the method further includes: If the file block passes the integrity check, the dirty block in the deduplication request will be removed from the dirty block list; If the file block fails the integrity check, the file block is added to the dirty block list.

6. The method as described in claim 1, characterized in that, After receiving the deduplication request sent by the user terminal, the method further includes: If it is determined that the file block does not exist on the cloud server based on the tag of the file block, then the number of file blocks in the deduplication request is calculated, and the number of file blocks is sent to the user as the return value of the third deduplication response.

7. A cloud data security deduplication device based on a tagging strategy to resist random block generation attacks, characterized in that, include: The receiving module is used to receive a deduplication request sent by the user terminal, wherein the deduplication request includes the tags of the file blocks corresponding to the file to be uploaded; The generation module is used to generate a deduplication response if it is determined from the tags of the file block that the file block already exists on the cloud server; The sending module is used to send the deduplication response to the user terminal; The receiving module is further configured to receive a linear combination of the user terminal's response to the deduplication response, wherein the linear combination includes data generated by encoding file blocks using the Vandermonde matrix; The storage module is used to decode the linear combination to obtain a file block, determine whether the file block meets a preset condition, and if the file block meets the preset condition, process the file block to obtain an actual miss block and store the actual miss block. The step of generating a deduplication response and sending the deduplication response to the user terminal includes: Calculate the number of tags for the tagging strategy, and randomly select file blocks to be marked as missing based on the number of tags for the tagging strategy, wherein the missing state indicates that the file blocks in the deduplication request do not exist on the cloud server; The number of missing blocks in the deduplication request after the marking process is completed is calculated, and the number of missing blocks is sent to the user as the return value of the first deduplication response. The formula for calculating the number of tags in the tagging strategy is expressed as follows: in, This indicates the number of tags in the tagging strategy. N This indicates the total number of file blocks in the file to be uploaded. H Indicates the number of blocks hit. Indicates the mark k The probability that all file blocks are miss blocks. Indicates the mark k The probability that all -1 file blocks are miss blocks. p This indicates the probability that at least one of the marked file blocks is a hit block.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1-6.

Images