Cloud storage data integrity auditing method and device for 5g environment

Abstract

The application discloses a cloud storage data integrity auditing method and device for a 5G environment, which realizes auditing of data in the cloud based on zero-knowledge proof, wherein the method comprises the following steps: receiving a data integrity auditing request sent by a PSP (Proxy Service Processor) to an audited database; executing an auditing protocol according to the data integrity auditing request to obtain a calculation value; and determining the integrity of suspicious file data based on the calculation value to realize cloud storage data integrity auditing. Thus, the problems that related technologies cannot realize data integrity design, cannot recover damaged data, cannot dynamically operate cloud storage data, are difficult to resist replay attacks, impersonation attacks and the like, are not suitable for a lightweight distributed storage environment, have complex calculation, low security and the like are solved.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for auditing the integrity of cloud storage data in a 5G environment. Background Technology

[0002] With the continuous development and maturation of 5G technology, its advantages such as wide connectivity, low power consumption, low latency, high speed, and high stability are providing a high-quality network environment for the development and growth of the cloud computing industry.

[0003] As a cloud computing system centered on data storage and management, cloud storage provides users or organizations with a public storage space, freeing up users' local space. With the increasing frequency of dynamic operations and the growing volume of data in today's network environment, cloud storage, playing a crucial role, faces more severe challenges, placing higher demands on data integrity and security auditing. Simultaneously, the ever-increasing data volume and the massive number of end-users have significantly increased users' business needs for cloud storage data integrity auditing, including typical PIR (Private Information Retrieval) services. The following section uses typical PIR service examples to illustrate data integrity auditing solutions.

[0004] In 1998, researchers extracted the Privacy Integrity Problem (PIR) from the context of privacy protection, which subsequently garnered widespread attention in the field of computer science. The PIR problem is defined as follows: A database contains files uniformly divided into N files, namely W1, W2, ..., W... N They are of equal length. User DOs wants to retrieve one of the files. To protect privacy, the user does not want the database to know their search, query, or content of interest. Therefore, the user must design their search request to the database that meets the following two conditions:

[0005] Decryption conditions are met: Users can correctly decode and recover the target content based on the database's response;

[0006] Privacy protection conditions: When user DOs enters a search request, the database cannot obtain the user's content interests from the search request.

[0007] Relevant theories indicate that when the search target is only a single database, there is only one type of search request that simultaneously satisfies both of the above conditions: downloading all the contents of the database (K files) to the DOS server and then filtering them. It's clear that protecting user privacy requires a significant investment of communication and bandwidth. If multiple datasets are used to back up and store the relevant K files simultaneously, as you can imagine, users can input search requests into multiple databases. Through special processing, this can significantly reduce the download volume while ensuring that each database is completely unaware of the user's search privacy.

[0008] In related technologies, we will use two simple databases as examples to illustrate how to implement PIR: assuming that each piece of content stored in the database is a finite field F q The elements in the dataset are assumed to be related to the user's interest in W7. The user then privately generates two sets of h = [h1, h2, ..., h...]. k The vectors are sent to two databases respectively. The user requests database 1 to send back a linear combination. At the same time, request database 2 to send back a linear combination Where when i≠7, h i ′=h i h7′=h7+1. It can be seen that this retrieval request satisfies the decoding condition. Subtracting the linear combination from the linear combination returned by database 1 from the linear combination returned by database 2 yields the user's target retrieval content W7. Simultaneously, according to the properties of underconstrained mathematical equations, each database cannot decipher the user's retrieval interests from a single set of retrieval requests. Assuming the storage space of each file is L, then the data stored in database 1 and database 2 are KL respectively, and the user DOs's download volume is 2KL. That is to say, PIR sacrifices communication traffic and bandwidth to achieve privacy protection; the user DOs's download volume is 2K times the useful information. Current related technologies also provide a general case for this scheme, where the database is expanded to N, and each database downloads a linear combination of data from K files to the user DOs. The user DOs recovers the target file W7 by solving the equation system. We can see that a necessary prerequisite for the above PIR method is that the K files in each database are not corrupted or tampered with; otherwise, the user DOs cannot accurately recover file W7 using the PIR method. The above approach fails to consider a crucial fact: if any partial file in any of the N databases is corrupted, accurate search results will be impossible to obtain.

[0009] Furthermore, related technologies point out the fundamental assumptions of the PIR problem: in the traditional PIR problem, N databases do not communicate with each other, and existing PIR schemes all assume that K files in the N databases are consistent and that the files in the databases will not be corrupted or maliciously tampered with, which is inconsistent with real-world scenarios. Based on the above analysis, the integrity of the data in the database DBi directly determines the correctness of the PIR scheme's output. Therefore, designing a cloud data integrity auditing scheme for distributed databases is crucial in PIR scenarios, a point that existing PIR schemes do not consider.

[0010] Currently, the most classic data integrity verification method in related technologies generally uses secure hash functions and digital signature technology to verify data integrity. However, this verification method is not suitable for distributed storage environments. In a distributed storage environment, users store their personal data files on a distributed storage device (DBi) without storing a copy locally. Therefore, verifying data integrity requires downloading the entire data file, which consumes significant time and communication resources. Therefore, considering the specific characteristics of cloud storage environments, it is necessary to research cloud-based data integrity verification schemes and propose more efficient and secure ones.

[0011] In 2007, researchers designed a Provable Data Ownership Scheme (PDP) based on homomorphic authentication tags, which realized an efficient cloud data integrity check mechanism. This method innovatively solved the problem of cloud data integrity auditing, but it could not achieve dynamic update operations.

[0012] Furthermore, the related technologies not only propose an improved DPDP scheme to enable user data update operations, but also utilize improved hash trees and bilinear mapping data results to achieve cloud data integrity auditing and support dynamic update operations.

[0013] In 2007, researchers proposed a cloud data integrity auditing scheme, also known as the POR scheme. This scheme achieves data recovery by randomly embedding data blocks called "sentinels" into files. However, this scheme is computationally complex and has low security.

[0014] In 2014, researchers proposed a multi-copy file integrity verification scheme for cloud storage, which can achieve cloud data integrity auditing and recover damaged data based on copies, ensuring data integrity. Shen proposed a cloud storage data integrity verification scheme based on bilinear mapping, but this scheme cannot resist replay attacks. In 2016, an efficient cloud data integrity auditing scheme was proposed, which recovers damaged data based on copies and has good security.

[0015] A cloud data integrity auditing solution needs to support dynamic operations. If the integrity verification solution cannot support user updates to their personal data in the cloud, it will fail to meet user needs. This is because dynamic user operations require updating file data blocks and corresponding verification information, which may cause the CSP to recalculate a large amount of verification information. Furthermore, malicious CSPs may exploit dynamic user operations to deceive users' data integrity check requests. Therefore, a cloud data integrity verification solution should have the capability to support dynamic user operations.

[0016] In summary, traditional hash functions and digital signature technologies are unsuitable for lightweight distributed storage environments. Furthermore, these technologies cannot recover corrupted data or dynamically manipulate cloud storage data, and they are vulnerable to replay attacks, impersonation attacks, and other malicious attacks. They also involve complex computations and have low security, necessitating urgent solutions. Summary of the Invention

[0017] This application provides a cloud storage data integrity auditing method and apparatus for 5G environments, which solves the problems that related technologies cannot achieve data integrity design, cannot recover damaged data, and cannot dynamically operate cloud storage data. Furthermore, related technologies are difficult to resist replay attacks, impersonation attacks, etc., and are not suitable for lightweight distributed storage environments, with complex computation and low security.

[0018] The first aspect of this application provides a cloud storage data integrity auditing method for a 5G environment, comprising the following steps: receiving a data audit integrity request sent by a PSP to the audited database; executing an audit protocol according to the data audit integrity request to obtain a calculated value; and determining whether suspicious file data is damaged based on the calculated value, thereby completing the cloud data integrity audit.

[0019] Optionally, in one embodiment of this application, determining the integrity of suspicious file data based on the calculated value includes: generating a pseudo-random function for the data owner; calculating a first public key based on a first private key generated after the data owner agrees to data auditing, and broadcasting it across the network; randomly selecting a second private key of the data auditor to calculate a second public key, and broadcasting it across the network to obtain a key pair, and randomly selecting public parameters; calculating Cert when the data owner initiates the data audit integrity request to verify whether the Cert meets a preset condition; if it does, obtaining locally backed-up data from the data owner, calculating corresponding tags for the stored data to obtain a tag set, and uploading the tag set and Hash algorithm to the audited database to generate evidence according to a preset protocol.

[0020] Optionally, in one embodiment of this application, determining the integrity of suspicious file data based on the calculated value further includes: after receiving the evidence, determining whether a preset equation holds; if the preset equation holds, then passing the cloud data integrity audit; otherwise, failing the cloud data integrity audit and providing feedback to the data owner and / or the data auditor.

[0021] Optionally, in one embodiment of this application, after verifying whether the Cert meets the preset conditions, the method further includes: if it does not meet the conditions, it indicates that an illegal audit request or replay attack was initiated by another entity impersonating the data owner, and the operation is terminated.

[0022] Optionally, in one embodiment of this application, before storing data in the database, the method further includes: generating a hash value for each proposed storage document based on the hash algorithm, and storing it in the database, wherein the hash value set composed of the hash algorithm and the hash value is stored in the local backup of the data owner.

[0023] A second aspect of this application provides a cloud storage data integrity auditing device for a 5G environment, comprising: a receiving module for receiving a data audit integrity request sent by a PSP to an audited database; an execution module for executing an audit protocol according to the data audit integrity request to obtain a calculated value; and an implementation module for determining whether suspicious file data is damaged based on the calculated value, thereby realizing cloud data integrity auditing.

[0024] Optionally, in one embodiment of this application, the implementation module includes: a generation unit for generating a pseudo-random function for the data owner; a first calculation unit for calculating a first public key based on a first private key generated after the data owner agrees to data auditing, and broadcasting it across the network; a second calculation unit for randomly selecting a second private key of the data auditor to calculate a second public key, and broadcasting it across the network to obtain a key pair, and randomly selecting public parameters; a third calculation unit for calculating Cert when the data owner initiates the data audit integrity request, to verify whether the Cert meets a preset condition; and a fourth calculation unit for obtaining locally backed-up data from the data owner if the condition is met, calculating corresponding tags for the stored data to obtain a tag set, and uploading the tag set and Hash algorithm to the audited database to generate evidence according to a preset protocol.

[0025] Optionally, in one embodiment of this application, the implementation module further includes: a judgment unit, configured to determine whether a preset equation is true after receiving the evidence; and a feedback unit, configured to pass the cloud data integrity audit if the preset equation is true, otherwise fail the cloud data integrity audit and provide feedback to the data owner and / or the data auditor.

[0026] Optionally, in one embodiment of this application, it further includes: a termination module, used to terminate the operation if, after verifying whether the Cert meets the preset conditions, it does not meet the conditions, indicating that an illegal audit request or replay attack was initiated by another entity impersonating the data owner.

[0027] Optionally, in one embodiment of this application, it further includes: a storage module, configured to generate a hash value for each proposed storage document based on the Hash algorithm before storing data in the database, for storage in the database, wherein the hash value set composed of the Hash algorithm and the hash value is stored in the local backup of the data owner.

[0028] A third aspect of this application provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the cloud storage data integrity auditing method for 5G environments as described in the above embodiments.

[0029] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described cloud storage data integrity auditing method for a 5G environment.

[0030] Therefore, the embodiments of this application have the following beneficial effects:

[0031] The embodiments of this application can receive data audit integrity requests sent by users to the audited database; execute an audit protocol according to the data audit integrity request to obtain a calculated value; and determine the integrity of suspicious file data based on the calculated value. The embodiments of this application embed cloud data integrity auditing steps into traditional PIR schemes, searchable encryption, and cloud computing schemes, thereby designing a dual-line mapping cloud data integrity auditing scheme. This scheme is not only applicable to scenarios such as PIR but also simplifies computation, improving security performance. Therefore, it solves the problems of related technologies being unable to achieve data integrity design, unable to recover damaged data, and unable to dynamically manipulate cloud storage data. Furthermore, related technologies are difficult to resist replay attacks and impersonation attacks, are unsuitable for lightweight distributed storage environments, have complex computational requirements, and are not highly secure.

[0032] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0033] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0034] Figure 1 This is a flowchart illustrating a cloud storage data integrity auditing method for a 5G environment, according to an embodiment of this application.

[0035] Figure 2 This is a schematic diagram of cloud data integrity auditing in PIR according to an embodiment of this application;

[0036] Figure 3 This is an example diagram of a cloud storage data integrity auditing device for a 5G environment according to an embodiment of this application;

[0037] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0038] Explanation of reference numerals in the attached figures: Cloud storage data integrity auditing device for 5G environment-10; receiving module-100, execution module-200, implementation module-300; memory-401, processor-402, communication interface-403. Detailed Implementation

[0039] The embodiments of this application are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this application, and should not be construed as limiting this application.

[0040] The following describes a cloud storage data integrity auditing method and apparatus for 5G environments, based on embodiments of the present application, with reference to the accompanying drawings. Addressing the problems mentioned in the background section, this application provides a cloud storage data integrity auditing method for 5G environments. This method audits data in the cloud based on zero-knowledge proofs. The method involves receiving a data audit integrity request sent by a user to the audited database; executing an audit protocol according to the data audit integrity request to obtain a calculated value; and determining whether suspicious file data is corrupted based on the calculated value, thus completing the cloud data integrity audit. This serves applications such as private information retrieval, searchable encryption, and cloud computing. The embodiments of this application are not only applicable to lightweight distributed storage environments but also enable the recovery of damaged data and dynamic operations on cloud storage data. Furthermore, the embodiments of this application simplify computation and can resist replay attacks or impersonation attacks, thereby improving security performance. Therefore, this solves the problems of related technologies being unable to achieve data integrity design, unable to recover damaged data, and unable to perform dynamic operations on cloud storage data. It also addresses the difficulties of related technologies in resisting replay attacks and impersonation attacks, their unsuitability for lightweight distributed storage environments, their complex computational workload, and their low security.

[0041] To facilitate the explanation of the cloud storage data integrity auditing method for 5G environments proposed in the embodiments of this application, the embodiments of this application first provide a brief introduction to the properties of bilinear mapping, as detailed below:

[0042] Suppose there exists a large prime number p and two cyclic groups G1 and G2, both of order p, and g is a generator of G1. Then, there exists a mapping e from G1 to G2: G1 × G1 → G2, which has the following properties:

[0043] (1) Bilinear: For and All of the following are available:

[0044] (2)e(g a g b )=e(g b g a ) = e(g, g) ab .

[0045] (3) Non-degeneracy: There exist a, b∈G1 such that e(a, b)≠1, where 1 is the identity element of group G2.

[0046] (4) Computability: For If e(u, v) can be computed by an efficient algorithm, then we call the above mapping e a bilinear mapping. In general, the cyclic group G1 is a multiplicative cyclic group, and the cyclic group G2 is a multiplicative cyclic group.

[0047] Specifically, Figure 1 This is a flowchart illustrating a cloud storage data integrity auditing method for a 5G environment, provided as an embodiment of this application.

[0048] like Figure 1 As shown, this cloud storage data integrity auditing method for 5G environments includes the following steps:

[0049] In step S101, a data audit integrity request sent by the PSP to the audited database is received.

[0050] In step S102, the audit protocol is executed according to the data audit integrity request to obtain the calculated value.

[0051] It should be noted that existing cloud data integrity auditing solutions all originate from cloud computing scenarios. The embodiments in this application take typical PIR services as an example to provide a detailed introduction to the implementation of data integrity auditing.

[0052] The embodiments of this application assume a total of M distributed storage databases, and take the integrity audit of the i-th database DBi (i = 1, 2, ..., M) as an example. First, the data auditor PSP (or a user) can select a suspicious set of files and send a data audit integrity request to database DBi. Database DBi executes the audit protocol to obtain calculated values, such as... Figure 2 As shown, this provides data support for the subsequent implementation of 5G service data integrity auditing.

[0053] In step S103, the integrity of the suspicious file data is determined based on the calculated value in order to achieve the private information retrieval (PIR) problem.

[0054] After receiving a data audit integrity request sent by a user to the audited database and executing the audit protocol according to the data audit integrity request to obtain a calculated value, embodiments of this application can further determine the integrity of suspicious file data based on the calculated value to serve fields such as Private Information Retrieval (PIR), searchable encryption, and cloud computing.

[0055] Optionally, in one embodiment of this application, determining the integrity of suspicious file data based on calculated values ​​includes: generating a pseudo-random function for the data owner; calculating a first public key based on a first private key generated after the data owner agrees to data auditing, and broadcasting it across the entire network; randomly selecting a second private key of the data auditor to calculate a second public key, and broadcasting it across the entire network to obtain a key pair, and randomly selecting public parameters; calculating Cert when the data owner initiates a data audit integrity request to verify whether Cert meets preset conditions; if it meets the conditions, obtaining locally backed-up data from the data owner, calculating corresponding tags for the stored data to obtain a tag set, and uploading the tag set and Hash algorithm to the audited database to generate evidence according to a preset protocol.

[0056] In real-world scenarios, Data Owners (DOs) entrust data storage to cloud servers or database service providers (CSPs), and Data Users (DUs) retrieve or download target data from the cloud storage CSPs. Therefore, data auditors are typically proxy servers (PSPs) (or other trusted entities) entrusted by Data Owners (DUs). The auditee is usually the cloud server (CSP) or distributed database (DBi) storing the data. Each data audit requires verification of the authenticity and legality of the audit commands to prevent DDoS attacks, impersonation attacks, and other attacks that could deplete or consume cloud server resources.

[0057] The business process is as follows: The data auditor (proxy server PSP) requests data audit permissions from the data owner (DOs); upon approval, the data owner (DOs) agrees to the data audit and authorizes the data auditor (PSP) to audit the data. It should be noted that when data users (DUs) do not trust the integrity of the obtained data, they will also entrust the PSP to audit it; the PSP executes the audit protocol based on the same auditing methods, and the PSP feeds back the audit results to the user (DUs).

[0058] Based on this logic and scenario, the specific steps for data auditors (PSPs) or users to determine the completeness of suspicious file data based on calculated values ​​are as follows:

[0059] (1) Setup(1 λ The system executes the algorithm (Rand(time)) to generate a pseudo-random function Rand(time) for DOs. The input to this function is time, and the output is...

[0060] (2)GenKey(1 λ )→(y, Y), data auditor PSP randomly selects Using its own private key, calculate Y = g yThe auditor's public key is used and broadcast across the network. This obtains the data auditor's key pair (y, Y). The auditor also selects a random public parameter μ∈G1 and requests cloud data integrity audit permissions from the data owner DOs.

[0061] (3) Rand(time) → C. After agreeing to the PSP's audit request, the data owner DOs executes the pseudo-random function algorithm Rand(time), where the input is the local time time and the output is a positive integer. As a timestamp, subsequent data integrity verification algorithms are all designed based on the timestamp C, thus resisting replay attacks, etc.

[0062] (4) GenKeyGert(C) → (SK, PK), the data owner DOs selects a positive integer x = C as its private key and calculates X = g x It is used as its own public key (audit timestamp) and broadcast throughout the network, where g is the generator. When the data owner DOs agrees to PSP performing an integrity audit on cloud data, the audit credential Gert = e(g) is calculated. x (Gert, Y); and send the audit credentials Gert to the auditor PSP, which will eventually send (Gert, Y) = (e(g x Y) is sent to the auditee DBi (or CSP).

[0063] (5) Judge(X,Y)→(0,1), the auditee (DBi or CSP) verifies that Gert=e(X,Y) is true; if it is not true, it means that other entities are impersonating the data owner DOs or the data auditor PSP to launch an illegal audit request or a replay attack, and the operation is terminated; if it is true, it means that it is a legitimate audit request agreed upon by the data owner DOs and the data auditor PSP, and the following audit operation continues;

[0064] (6) GenValue(E) → (Hash, Φ), the auditor PSP obtains the hash value h of the locally backed-up data file from the data owner DOs. i (i = 1, 2, ..., N) and a hash algorithm, for all stored files W i ∈W calculates its label tag set The hash algorithm is uploaded to the audited database DBi (or CSP);

[0065] (7) GenProof(M, C, Φ) → Proof: When the data auditor PSP initiates a data audit on the database DBi (cloud server CSP), the database DBi (cloud server CSP) generates proof Proof according to the protocol. Specifically, assuming the set of suspicious document tags is audit, the data auditor PSP selects each suspicious document. Label i, generate a set of random coefficients Send to database DBi (cloud server CSP).

[0066] 1) Database DBi (Cloud Server CSP) recalculates h = ∑ using a shared hash algorithm. i∈audit h i v i Based on a tag set derived from PSP calculate

[0067] 2) The database DBi (cloud server CSP) obtains the final evidence Proof = {h, ​​σ} and returns it to the data auditor.

[0068] Optionally, in one embodiment of this application, determining the integrity of suspicious file data based on the calculated value further includes: after receiving evidence, determining whether a preset equation holds true; if the preset equation holds true, then the cloud data integrity audit is passed; otherwise, the cloud data integrity audit is not passed, and feedback is given to the data owner and / or data auditor.

[0069] Furthermore, once the data auditor (or user) receives the proof from the database DBi (cloud server CSP), Verify(Proof) → {False, True}, and the equation e(σ, g) = e(Π) is evaluated. i∈audit h i μ h Does the equation e(σ, g) = e(Π) hold true? i∈audit h i μ h If Y) is true, it means that the data has not been damaged or tampered with, and the cloud data integrity audit is passed, as shown in the following mathematical formula; otherwise, the cloud data integrity audit is not passed. The result is then fed back to Dos and DUs.

[0070]

[0071] Optionally, in one embodiment of this application, after verifying whether Cert meets the preset conditions, the method further includes: if it does not meet the conditions, it indicates that an illegal audit request or replay attack was initiated by another entity impersonating the data owner, and the operation is terminated.

[0072] It should be noted that in the cloud data integrity audit scheme, when Judge(x, y) → (0, 1) and the data owner DOs agrees to the audit request, another method for calculating the audit proof by the data owner DOs is Cert = X·Y = g x+y The data owner, DOs, sends Cert to the PSP, which then sends (Cert, Y) to the auditee. The auditee verifies whether Cert = X·Y holds true. If not, it indicates an illegal audit request or replay attack initiated by another entity impersonating the data owner, DOs, or PSP, and the operation is terminated. If true, it indicates an audit request agreed upon by DOs and PSP, and the audit operation continues, thus effectively resisting replay attacks or impersonation attacks. This method of auditing proves that the Cert calculation method is equivalent to the one described above.

[0073] Optionally, in one embodiment of this application, before storing data in the database, the method further includes: generating a hash value for each intended storage document based on a hash algorithm for storage in the database, wherein the hash value set h composed of the hash algorithm and the hash value is... i (i = 1, 2, ..., N) are all stored in the local backup of the data owner DOs, which serves as a lightweight backup storage.

[0074] In a cloud data integrity auditing solution, before storing data, the data owner (DO)... s First, execute the hash algorithm for each intended storage document W. i ∈W hash operation, generating hash value h i =Hash(W i (i = 1, 2, ..., N), hash value set {h i The hash algorithm (Hash) is stored locally on the data owner's (DO) backup for lightweight backup. During the data integrity audit phase, the hash value set {h} stored locally on the DO's backup... i The hash algorithm was shared with the auditee's DBi (or CSP) for later generation of audit evidence proof. A storage document W was drafted. i All values ​​∈W are stored in the same way in multiple databases DBi (i = 1, 2, ..., M) (which can be multiple distributed databases or a single database). In the specific implementation process, technicians may also use other methods to generate hash values ​​or back up the original data; no specific restrictions are imposed here.

[0075] Furthermore, based on the above analysis of the characteristics of cloud data integrity verification schemes, it can be seen that the embodiments of this application have some features in addition to the basic functions. For example, in some scenarios, data owners not only need to be certain of the integrity of their personal data in the cloud, but also need to be certain that the original data can be recovered after the personal data in the cloud is damaged. The process of recovering damaged data will be described below.

[0076] Assuming that a cloud data integrity audit confirms that the data stored in database DBi (i=2) is incomplete or corrupted, for each audit file W in DBi... i 'Execute hash algorithm h i =Hash(W) i ')(i = 1, 2, ..., N), and with the hash value h of the DUs backup. i The comparison is performed on (i = 1, 2, ..., N). When h i ≠h i 'At that time, from the W of the database DBj that will pass the integrity audit. i The image is copied to the corresponding location in this database's DBi.

[0077] It should be noted that, in data corruption recovery solutions, those skilled in the art can also use other methods based on network coding, solving systems of equations, etc., to restore data in database DBi, and no specific restrictions are imposed here.

[0078] It is understood that the cloud data integrity auditing method designed in the embodiments of this application generates the data to be stored, W. i The hash value is used to implement lightweight backup on the data owner's side DOs, as well as to restore incomplete data in the database DBi and recover damaged data.

[0079] The cloud storage data integrity auditing method for 5G environments proposed in this application receives a data audit integrity request sent by a user to the audited database; executes an audit protocol according to the data audit integrity request to obtain a calculated value; and determines the integrity of suspicious file data based on the calculated value to resolve related issues. This method is applicable not only to lightweight distributed storage environments but also to the recovery of damaged data and dynamic operations on cloud storage data. Furthermore, the embodiments of this application simplify computation and can resist replay attacks or impersonation attacks, thus improving security performance.

[0080] Next, referring to the accompanying drawings, a cloud storage data integrity auditing device for a 5G environment is described according to an embodiment of this application.

[0081] Figure 3 This is a block diagram of a cloud storage data integrity auditing device for a 5G environment according to an embodiment of this application.

[0082] like Figure 3 As shown, the cloud storage data integrity auditing device 10 for 5G environment includes: a receiving module 100, an execution module 200, and an implementation module 300.

[0083] The receiving module 100 is used to receive data audit integrity requests sent by the PSP to the audited database.

[0084] The execution module 200 is used to execute the audit protocol according to the data audit integrity request and obtain the calculated value.

[0085] Module 300 is used to determine whether suspicious file data is damaged based on calculated values, thereby enabling cloud data integrity auditing.

[0086] Optionally, in one embodiment of this application, the implementation module 300 includes: a generation unit, a first calculation unit, a second calculation unit, a third calculation unit, and a fourth calculation unit.

[0087] The generation unit is used to generate a pseudo-random function for the data owner.

[0088] The first computing unit is used to calculate the first public key based on the first private key generated after the data owner agrees to data auditing, and then broadcast it across the entire network.

[0089] The second computing unit is used to randomly select the data auditor's second private key to calculate the second public key, broadcast it across the entire network to obtain the key pair, and randomly select public parameters.

[0090] The third calculation unit is used to calculate Cert when the data owner initiates a data audit integrity request, in order to verify whether Cert meets the preset conditions for success.

[0091] The fourth calculation unit is used to obtain locally backed-up data from the data owner if the condition is met, calculate corresponding tags for the stored data, obtain a tag set, and upload the tag set and hash algorithm to the audited database to generate evidence according to a preset protocol.

[0092] Optionally, in one embodiment of this application, the implementation module 300 further includes a judgment unit and a feedback unit.

[0093] The judgment unit is used to determine whether the preset equation is true after receiving the evidence.

[0094] The feedback unit is used to pass the cloud data integrity audit if the preset equation is true; otherwise, it will fail the cloud data integrity audit and provide feedback to the data owner and / or data auditor.

[0095] Optionally, in one embodiment of this application, the cloud storage data integrity auditing device 10 for 5G environment further includes: a termination module, used to terminate the operation if the Cert fails to meet the preset conditions after verification, indicating that an illegal audit request or replay attack was initiated by another entity impersonating the data owner.

[0096] Optionally, in one embodiment of this application, the cloud storage data integrity auditing device 10 for 5G environment of this application embodiment further includes: a storage module, used to generate a hash value for each proposed storage document based on a hash algorithm before storing data in the database, so as to store it in the database, wherein the hash value set composed of the hash algorithm and the hash value is stored in the local backup of the data owner.

[0097] It should be noted that the foregoing explanation of the cloud storage data integrity auditing method embodiment for 5G environment also applies to the cloud storage data integrity auditing device for 5G environment in this embodiment, and will not be repeated here.

[0098] The cloud storage data integrity auditing device for 5G environments proposed in this application receives a data audit integrity request sent by a user to the audited database; executes an audit protocol according to the data audit integrity request to obtain a calculated value; and determines the integrity of suspicious file data based on the calculated value to solve the Private Information Retrieval (PIR) problem. Therefore, it is not only suitable for lightweight distributed storage environments, but also enables the recovery of damaged data and dynamic operations on cloud storage data. Furthermore, the embodiments of this application simplify the computational load and can resist replay attacks or impersonation attacks, thus improving security performance.

[0099] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include:

[0100] The memory 401, the processor 402, and the computer program stored on the memory 401 and capable of running on the processor 402.

[0101] When the processor 402 executes the program, it implements the cloud storage data integrity auditing method for 5G environment provided in the above embodiments.

[0102] Furthermore, electronic devices also include:

[0103] Communication interface 403 is used for communication between memory 401 and processor 402.

[0104] The memory 401 is used to store computer programs that can run on the processor 402.

[0105] The memory 401 may include high-speed RAM memory, and may also include non-volatile memory, such as at least one disk storage device.

[0106] If the memory 401, processor 402, and communication interface 403 are implemented independently, then the communication interface 403, memory 401, and processor 402 can be interconnected via a bus to complete communication between them. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be divided into address buses, data buses, control buses, etc. For ease of representation, Figure 4 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0107] Optionally, in a specific implementation, if the memory 401, processor 402, and communication interface 403 are integrated on a single chip, then the memory 401, processor 402, and communication interface 403 can communicate with each other through an internal interface.

[0108] Processor 402 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application.

[0109] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the above-described cloud storage data integrity auditing method for 5G environments.

[0110] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0111] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "N" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0112] Any process or method described in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or N executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0113] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0114] It should be understood that the various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, the N steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. If implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0115] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0116] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0117] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of this application have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting this application. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of this application.

Claims

1. A cloud storage data integrity auditing method for 5G environments, characterized in that, Includes the following steps: Receive data audit integrity requests sent by the PSP to the audited database; Execution of audit protocols based on zero-knowledge proofs; The audit protocol is executed based on the data audit integrity request to obtain the calculated value; as well as Based on the calculated values, it is determined whether the suspicious file data is corrupted, thereby enabling cloud data integrity auditing. The determination of the integrity of suspicious file data based on the calculated value includes: A pseudo-random function that generates data owners; After the data owner agrees to data auditing, the first public key is calculated from the first private key generated and broadcast across the entire network. The second public key is calculated using the second private key of a randomly selected data auditor and broadcast across the entire network to obtain the key pair. Then, the public parameters are randomly selected. A time stamp for auditing is generated based on the pseudo-random function of the data owner. When the data owner initiates the data audit integrity request, Cert is calculated to verify whether the Cert meets the preset conditions for success. If true, the local backup data is obtained from the data owner, and corresponding tags are calculated for the stored data to obtain a tag set. The tag set and the hash algorithm are then uploaded to the audited database to generate audit evidence according to a preset protocol. After verifying whether the Cert satisfies the preset condition, the process further includes: If this is not the case, it indicates that an illegal audit request or replay attack was initiated by another entity impersonating the data owner, and the operation will be terminated.

2. The method according to claim 1, characterized in that, The process of determining the integrity of suspicious file data based on the calculated value also includes: Upon receiving the evidence, determine whether the preset equation holds true; If the preset equation is true, the cloud data integrity audit is passed; otherwise, the cloud data integrity audit is not passed, and feedback is given to the data owner and / or the data auditor.

3. The method according to claim 1, characterized in that, Before the database stores the data, it also includes: A hash value is generated for each intended storage document based on the hash algorithm, and stored in the database. The hash value set consisting of the hash algorithm and the hash value is stored in the local backup of the data owner.

4. A cloud storage data integrity auditing device for 5G environments, characterized in that, include: The receiving module is used to receive data audit integrity requests sent by the PSP to the audited database; Execution of audit protocols based on zero-knowledge proofs; The execution module is used to execute the audit protocol according to the data audit integrity request and obtain the calculated value; as well as The implementation module is used to determine whether suspicious file data is damaged based on the calculated value, thereby enabling cloud data integrity auditing. The implementation module includes: The generation unit is used to generate a pseudo-random function for the data owner; The first computing unit is used to calculate the first public key based on the first private key generated after the data owner agrees to data auditing, and then broadcast it across the entire network. The second computing unit is used to randomly select the data auditor's second private key to calculate the second public key, broadcast it across the entire network, obtain the key pair, and randomly select public parameters; The third calculation unit generates a time stamp for auditing based on the pseudo-random function of the data owner. When the data owner initiates the data audit integrity request, it calculates Cert to verify whether the Cert meets the preset conditions for success. The fourth calculation unit is used to obtain locally backed-up data from the data owner if the condition is met, calculate corresponding tags for the stored data to obtain a tag set, and upload the tag set and Hash algorithm to the audited database to generate evidence according to a preset protocol. The termination module is used to terminate the operation if, after verifying whether the Cert meets the preset conditions, it indicates that an illegal audit request or replay attack was initiated by another entity impersonating the data owner.

5. The apparatus according to claim 4, characterized in that, The implementation module also includes: The judgment unit is used to determine whether the preset equation is true after receiving the evidence; The feedback unit is used to pass the cloud data integrity audit if the preset equation is true, otherwise it fails the cloud data integrity audit and provides feedback to the data owner and / or the data auditor.

6. The apparatus according to claim 4, characterized in that, Also includes: A storage module is used to generate a hash value for each proposed storage document based on the Hash algorithm before storing data in the database, and store the hash value set consisting of the Hash algorithm and the hash value in the local backup of the data owner.

7. An electronic device, characterized in that, include: A memory, a processor, and a computer program stored on the memory and executable on the processor, the processor executing the program to implement the cloud storage data integrity auditing method for a 5G environment as described in any one of claims 1-3.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program is executed by the processor to implement the cloud storage data integrity auditing method for 5G environments as described in any one of claims 1-3.

Images