Dynamic ownership management method based on data popularity and related device

Abstract

This invention provides a dynamic ownership management method based on data popularity, comprising: classifying data by setting a popularity threshold; dividing data into non-popular data, popular-transitional data, and popular data according to the relationship between the data's repetition rate and the popularity threshold; performing double encryption on popular-transitional data using a proxy re-encryption algorithm to prevent users who have revoked their rights from decrypting the ciphertext of popular data, thus ensuring backward security of popular data; and invalidating the proof stored locally by the revoking user through a redesigned ownership proof algorithm and proof update algorithm, making it impossible for the revoking user to pass ownership verification. This invention ensures that both popular and non-popular data are semantically safe for users who have revoked their rights.

Description

Technical Field

[0001] This invention belongs to the field of information security technology and relates to a dynamic ownership management method and related equipment based on data popularity, which is applicable to corresponding fields or scenarios that use popularity-based secure encrypted data deduplication. Background Technology

[0002] Users upload data to a cloud server to save local storage space. The data stored on the cloud server can be retrieved at any time later. The cloud server is used to store encrypted data from the user's device.

[0003] In encrypted data deduplication schemes based on data popularity, the security of popular data is relatively low, especially for users who wish to revoke their accounts.

[0004] For non-prevalent data, when a revoked client (a client whose access has been revoked) deletes the data from the cloud, the cloud server deletes the corresponding symmetric ciphertext. This means the revoked client can no longer obtain the plaintext data because it cannot decrypt the ciphertext data from other clients.

[0005] For popular data, when a client deletes the data from the cloud, the cloud server does not delete the corresponding converged ciphertext. Even after a client's permissions are revoked, they can still obtain the converged ciphertext by monitoring communications between other clients and the cloud server. The revoked client can save the converged key locally before its revocation, allowing it to decrypt the ciphertext and obtain the plaintext data. The revoked client can also save the data tag locally before its revocation, allowing it to impersonate a new client and upload the data tag to request data upload. Because the data is popular, the revoked client doesn't actually need to upload the data; as long as the cloud server adds the revoked client's identity ID to the holder set, the revoked client regains access to the data.

[0006] Therefore, how to provide a dynamic ownership management method and related equipment based on data popularity that can effectively prevent users from regaining access to data after their permissions have been revoked is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of this, the present invention proposes a dynamic ownership management method and related equipment based on data popularity, which solves the technical problems in the prior art.

[0008] To achieve the above objectives, the present invention adopts the following technical solution:

[0009] This invention discloses a dynamic ownership management method based on data popularity. The method is based on a system model including a user terminal, a cloud server, and an index server. The method includes: a popularity check algorithm, an encryption / decryption algorithm, a proof generation algorithm, an ownership proof algorithm, and a proof update algorithm; wherein,

[0010] The encryption and decryption algorithm performs a convergent encryption on the data before the popularity check algorithm is executed on the index server to obtain ciphertext C1 and data tag T. After the popularity check algorithm is executed, a second convergent encryption or proxy re-encryption is performed.

[0011] In the popularity check algorithm, the index server receives the data tag T after the data has been encrypted using the key K through an encryption and decryption algorithm. The index server checks whether the data is non-popular data, popularity-transformed data, or popular data based on the number of times the data tag T has been uploaded to the index server.

[0012] If the data is popularity conversion data, the encryption and decryption algorithm performs proxy re-encryption on the ciphertext C1 to obtain ciphertext C3. Both ciphertext C3 and data tag T are uploaded to the cloud server. The cloud server executes the proof generation algorithm. In the proof generation algorithm, the encryption and decryption algorithm performs the decryption algorithm on the ciphertext C3 to verify the correspondence between ciphertext C1 and data tag T. If the verification is correct, the cloud server selects a random number R and performs encryption calculation with the ciphertext C1 to obtain proof V and stores it. The current data is also stored in the cloud server as popularity data.

[0013] If the data is popular, the ownership proof algorithm is executed. In the ownership proof algorithm, the cloud server returns a random number R corresponding to the data tag T to the user terminal. The user terminal uses the random number R to encrypt and calculate the ciphertext C1 to obtain the proof V. W And upload it to the cloud server, where the cloud server verifies and proves V. W The system verifies whether V matches the data. If they do, it grants the user download permission. The cloud server receives the data tag T uploaded by the user and determines whether the user has data download permission. If so, it uses an encryption / decryption algorithm to perform proxy re-encryption on the ciphertext C3 to obtain the ciphertext. The data is sent to the user's device, where the user uses encryption and decryption algorithms to decrypt it and obtain the data.

[0014] In the proof update algorithm, when a user logs out, the cloud server deletes the user's data download permission. For popular data, the cloud server deletes the random number R and the proof V, and uses the cloud server's private key sk. CSP The ciphertext C3 is decrypted by performing a proxy re-encryption algorithm to obtain ciphertext C1. The ciphertext C1 is then encrypted using a new random number R' to obtain a new proof V', which is then stored and updated.

[0015] Preferably, the convergence encryption process in the encryption algorithm employs a symmetric encryption algorithm.

[0016] Preferably, the index server receives user U w Data tag T and personal identity ID uploaded via secure channel w If the data tag T is uploaded for the first time, the index server generates a record of the number of duplicate data tags and the authorized user's ID. w The tuple; if the data tag T is not uploaded for the first time, the index server will increment the count corresponding to the data tag T by 1 and add the user's identity information ID. w Add it to the authorized user client collection.

[0017] Preferably, when the popularity check algorithm checks whether the data is non-popular based on the number of times the data tag T is uploaded to the index server, the encryption / decryption algorithm uses the key L to perform secondary convergence encryption on the data to obtain ciphertext C2 and random tag RT, and uploads them to the cloud server; the cloud server grants the user terminal data download permission;

[0018] When converting popularity data, the encryption and decryption algorithm performs proxy re-encryption on ciphertext C1 to obtain ciphertext C3. Ciphertext C3 and data tag T are both uploaded to the cloud server. The cloud server executes the proof generation algorithm and deletes ciphertext C2 and random tag RT.

[0019] Preferably, the popularity check algorithm checks whether the data is popularity-transformed data based on the number of times the data tag T is uploaded to the index server. The user terminal executes the encryption / decryption algorithm and uses the cloud server's public key PK. CSP Encrypting ciphertext C1 using a proxy yields ciphertext C3, which is then processed using the cloud server's private key sk. CSP The ciphertext C3 is decrypted by performing a proxy re-encryption algorithm to obtain ciphertext C1.

[0020] Preferably, in the proof generation algorithm, the cloud server selects a random number R and ciphertext C1 to perform encryption calculations to obtain the proof V, including:

[0021] V = H(C1||R)

[0022] Where H(*) is the collision-resistant hash function H:{0,1} * →{0,1} λ .

[0023] Preferably, the cloud server verification certificate V W And prove whether V is consistent. If they are consistent, grant the user the data download permission, including:

[0024] The cloud server will connect the user's U w Identity information ID wIt is added to the set of authorized client terminals stored in the cloud server. This set of authorized client terminals is built by the cloud server when the data corresponding to the current data tag is popularity conversion data.

[0025] Preferably, if the data uploaded to the cloud server by the user client is non-current data after the user client logs out, the cloud server will directly delete the user client's data. w The random tag RT and the symmetric ciphertext C2.

[0026] Preferably, if the user terminal U w If the data being uploaded and downloaded is non-traditional, then the cloud server receives the user's data via U. w The cloud server returns the symmetric ciphertext C2 corresponding to the uploaded random tag RT to the user's U. w User-side U w The data is decrypted using the key L.

[0027] Preferably, if the user terminal U w If the downloaded data is popular data, then the cloud server will send it to the user's U... w Return error information and receive user terminal U w The uploaded data is tagged T, and its download permission is checked. If permission is granted, the ciphertext C3 is re-encrypted using an encryption / decryption algorithm to obtain the ciphertext. The data is sent to the user's end, where it is decrypted using encryption and decryption algorithms to obtain the data, including:

[0028] The cloud server receives the data tag T uploaded by the user and determines whether the user has data download permission. If so, it uses an encryption algorithm based on the user's public key to perform a PK (peer-key) operation. W Cloud server public key PK CSP Cloud server private key sk CSP The proxy re-encrypts the ciphertext C3. Send to the user's client, the user's client uses the user's private key sk W Decrypt to obtain ciphertext C1, then use key K to decrypt again to obtain the data.

[0029] The present invention also discloses an apparatus comprising: a memory and a processor; wherein the memory is used to store a computer program, and the processor is used to implement the dynamic ownership management method based on data popularity when executing the computer program.

[0030] As can be seen from the above technical solution, compared with the prior art, the beneficial effects of the present invention include:

[0031] This invention provides a method and related equipment for dynamic ownership management based on data popularity. It introduces a proxy re-encryption algorithm to achieve dynamic ownership management of popular data. Even if a revoked user obtains the ciphertext obtained through proxy re-encryption, it can prevent the revoked user from obtaining the plaintext data, ensuring backward security of popular data. This invention also introduces an ownership proof algorithm and a proof update algorithm. The proof update algorithm invalidates the proof stored locally by the revoked user. Thus, the revoked user cannot regain access to the data by impersonating a new user and uploading data. Therefore, this invention ensures that both popular and non-popular data are semantically safe for the revoked user. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0033] Figure 1 A system model diagram of a dynamic ownership management method based on data popularity provided in an embodiment of the present invention;

[0034] Figure 2 A data upload flowchart for a dynamic ownership management method based on data popularity provided in one embodiment of the present invention;

[0035] Figure 3 A user cancellation flowchart for a dynamic ownership management method based on data popularity provided in one embodiment of the present invention;

[0036] Figure 4 This is a data download flowchart for a dynamic ownership management method based on data popularity, provided as an embodiment of the present invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] like Figure 1 As shown, one embodiment of the present invention provides a dynamic ownership management method based on data popularity. First, the symbols involved in the embodiment are explained:

[0039]

[0040]

[0041] The method is based on a system model that includes the client, cloud server, and index server:

[0042] Users: This embodiment includes two types of users: legitimate users and revoked users (users who have logged out). A legitimate user is one who has the right to access data. Legitimate users are honest and trustworthy. A revoked user is one who previously had access to data but has now been deprived of that right. Revoked users are untrustworthy and may attempt to obtain the data content. In this embodiment, revoked users are considered attackers.

[0043] Index Server: The index server is a fully trusted server. It is responsible for managing legitimate users and checking the popularity of data.

[0044] Cloud servers: Cloud servers possess powerful computing capabilities and massive storage space. They provide storage services to users and are responsible for managing data ownership. Cloud servers are honest and curious; they will honestly execute system-assigned tasks while remaining interested in the content of the data. In this embodiment, it is also assumed that the cloud server will not collude with any attackers.

[0045] The method in this embodiment includes: a popularity check algorithm, an encryption / decryption algorithm, a proof generation algorithm, an ownership proof algorithm, and a proof update algorithm;

[0046] The encryption and decryption algorithms in the system model include: given a security parameter λ, selecting a symmetric encryption algorithm E(·) (such as AES) and a corresponding symmetric decryption algorithm D(·). In addition, a collision-resistant hash function H:{0,1} is selected. * →{0,1} λ Enc(·) is the encryption algorithm for proxy re-encryption, and Dec(·) is the corresponding decryption algorithm. The index server assigns each user an identity ID and a public-private key pair (pk, sk), and assigns a public-private key pair (pk, sk) to the cloud server. CSP ,sk CSP ).

[0047] The encryption and decryption algorithm performs a convergent encryption on the data before the popularity check algorithm is executed on the index server to obtain the ciphertext C1 and the data tag T. After the popularity check algorithm is executed, a second convergent encryption or proxy re-encryption is performed.

[0048] In the popularity check algorithm, the index server receives the data tag T after the data has been encrypted using the key K through an encryption / decryption algorithm. The index server then checks whether the data is non-popular data, popularity-transformed data, or popular data based on the number of times the data tag T has been uploaded to the index server.

[0049] If the data is popularity-converted, the encryption and decryption algorithm performs proxy re-encryption on the ciphertext C1 to obtain ciphertext C3. Both ciphertext C3 and data tag T are uploaded to the cloud server, and the cloud server executes the proof generation algorithm. In the proof generation algorithm, the encryption and decryption algorithm performs the decryption algorithm on the ciphertext C3 to verify the correspondence between ciphertext C1 and data tag T. If the verification is correct, the cloud server selects a random number R and performs encryption calculation with ciphertext C1 to obtain proof V and stores it.

[0050] If the data is popular, the ownership proof algorithm is executed. In the ownership proof algorithm, the cloud server returns a random number R corresponding to the data tag T to the user terminal. The user terminal uses the random number R to encrypt and calculate the ciphertext C1 to obtain the proof V. W And upload it to the cloud server, where the cloud server verifies and proves V. W The system verifies whether V matches the data. If they do, it grants the user download permission. The cloud server receives the data tag T uploaded by the user and determines whether the user has data download permission. If so, it uses an encryption / decryption algorithm to perform proxy re-encryption on the ciphertext C3 to obtain the ciphertext. The data is sent to the user's device, where it is decrypted using encryption and decryption algorithms.

[0051] In the proof update algorithm, when a user logs out, the cloud server removes the user's data download permission. For popular data, the cloud server deletes the random number R and the proof V, and uses the cloud server's private key sk. CSP The ciphertext C3 is decrypted by performing a proxy re-encryption algorithm to obtain ciphertext C1. The ciphertext C1 is then encrypted using a new random number R' to obtain a new proof V', which is then stored and updated.

[0052] The specific implementation includes the plaintext data upload process, the user-side cancellation process, and the plaintext data download process. The specific execution steps are as follows:

[0053] The process of uploading plaintext data:

[0054] When a user U w I want to upload data M to the cloud server. w First, the encryption and decryption algorithm is used to perform a convergence encryption calculation to calculate the convergence key K = H(M) and the convergence ciphertext C1 = E(K,M). Then, the data tag T = H(C1) is calculated.

[0055] To obtain the popularity ranking of data M, U wUpload the data label T and its own identity ID w to the index server through a secure channel. Then, the index server checks the popularity of the data M.

[0056] If the data label T is not saved in the index server, it means that this user is the first one to upload this data, that is, the initial uploader. The index server generates a tuple (T, count, O RT , O ID ), where T is the data label; count is a counter used to record the number of duplicate data; O RT is a set of random tags used to store random tags; O ID is a set of holder identities used to store the user's ID. The index server first initializes this tuple, setting count = 0, O RT = NULL, O ID = NULL.

[0057] If the data label T is saved in the index server, U w is not the first one to upload this data, that is, a subsequent uploader. The index server increments the counter count corresponding to the data label T by 1 and adds the user's identity information ID w to the corresponding holder set O ID . Then, the index server checks the data popularity based on the counter count. The system model sets a value t as the popularity threshold. If count < t, the index server returns -1 to U w and the cloud server. If count = t, the index server returns 0 to U w and the cloud server, and then returns (0, T, O RT , O ID ) to the cloud server. If count > t, the index server returns 1 to U w and the cloud server.

[0058] In one embodiment, if U w receives -1, it means that the data M is unpopular data.

[0059] U w performs quadratic convergent encryption, randomly selects a symmetric key L of λ bit length, then calculates the symmetric ciphertext C2 = E(L, M), and then calculates the random tag RT = H(C2). U w uploads the random tag RT and the symmetric ciphertext C2 to the cloud server, and uploads the random tag RT to the index server. Finally, U w locally saves (T, K, L, RT). After receiving RT, the index server adds RT to the random tag set ORT middle.

[0060] In one embodiment, if U w If the received value is 0, it means that data M triggered a popularity transformation. Popularity transformation refers to the transformation of data from non-popular data to popular data.

[0061] U w Calculate the re-encrypted ciphertext C3 = Enc(pk) CSP C1), and then C3 is uploaded to the cloud server. Finally, U w Store the data label T and the convergence key K locally.

[0062] After receiving the re-encrypted ciphertext C3, the cloud server uses its own private key sk CSP Decrypt the convergent ciphertext C1 = Dec(sk) from C3. CSP (,C3), and then use the index service area to return (0,T,O) RT O ID The data tag T in the ciphertext is used to verify the correctness of C3 by checking whether the equation T = H(C1) holds true. If the equation holds true, then the re-encrypted ciphertext C3 is correct.

[0063] Next, the cloud server selects a random number R and then computes a proof V = H(C1||R). This proof is used to check whether subsequent uploaders possess the complete data content. The cloud server stores the tuple (T,R,V,O) for the data M. ID C3), then delete O. RT The random label in the array corresponds to (RT, C2).

[0064] The triggering of popularity conversion is a process, not a state maintained by the data on the cloud server. When the repetition rate of data uploaded by a user reaches the popularity threshold t, the data is converted from non-popular to popular. Even if a user later withdraws their account, causing the repetition rate to drop back below the popularity threshold, the data will not be converted back from popular to non-popular. In other words, popularity conversion is irreversible.

[0065] When data triggers a popularity shift, the index server will change the holder set O. ID and random label set O RT The data is then passed to the cloud server. For popular data, if the cloud server needs to delete the data due to reasons such as user withdrawal, both the cloud server and the index server need to remove the user's identity from their respective identity sets, ensuring that their identity sets remain consistent.

[0066] In one embodiment, if U wThe received value is 1, indicating that data M is popular data.

[0067] Because cloud servers can perform deduplication on popular data, U w There is no need to upload the converged ciphertext to the cloud server. To ensure U w The cloud server does indeed possess the data content and requires U verification. w The ownership of data M is determined. The detailed process of the ownership proof algorithm is shown in Algorithm 1.

[0068] U w Combine the data tag T with your own identity ID. w The data is uploaded to the cloud server via a secure channel. The cloud server then returns the random number R corresponding to the data tag T to U. w U w Proof of V based on convergent ciphertext computation w =H(C1||R), then V w Upload to the cloud server. The cloud server checks equation V. w Does the equation =V hold true? If the equation holds true, it means that U... w It does indeed possess data M. The cloud server will... w Identity information ID w Join the corresponding holder set O ID In the middle. Finally, U w Store the data label T and the converged ciphertext K locally.

[0069]

[0070] The cancellation process on the user's end:

[0071] Assume user U w For some reason, U was deprived of access to data M by cloud servers and index servers. w Data M or U was deleted. w I have resigned from the company. Please follow these steps:

[0072] If M is non-popular data, the cloud server can directly delete U. w The random label RT and the symmetric ciphertext C2, because U w Do not share RT and C2 with other users. That is, delete U. w The random tags and symmetric ciphertext will not affect other users. Furthermore, the index server obtains the data from the corresponding holder set O. ID Delete U w Identity information ID w Then, decrement the counter count in the corresponding index server by 1.

[0073] If M is popular data, the cloud server cannot delete the corresponding convergent ciphertext because multiple users share the same convergent ciphertext. The cloud server first deletes the identity information ID of U from the holder set O ID and then deletes the random number R and the proof V. The cloud server does not need to decrement the counter count because even if count < t, the popular data cannot be converted into unpopular data. To be consistent with the cloud server, the index server also needs to delete ID from the holder set O w and then the cloud server decrypts the re-encrypted ciphertext C3 with its own private key sk w to obtain the convergent ciphertext C1 = Dec(sk ID , C3). The cloud server selects a new random number R' and then calculates a new proof V' = H(C1 || R'). In this way, the proof V stored locally by the revoked user becomes obsolete, so the revoked user cannot pass the proof of ownership. The process of the user revocation algorithm is shown in Algorithm 2. w from the holder set O CSP . Then, the cloud server decrypts the re-encrypted ciphertext C3 with its own private key sk CSP to obtain the convergent ciphertext C1 = Dec(sk

[0074]

[0075] Plaintext data download process:

[0076] When a legitimate user U w wants to download the data M. The following steps are executed:

[0077] If the data was popular when U w uploaded the data, then the data must also be popular when U w downloads it. U w uploads the data tag T and its own identity information ID w to the cloud server through a secure channel. The cloud server first checks whether ID w is in the holder set O ID .

[0078] If not, the cloud server returns error to U w and stops executing the subsequent operations.

[0079] Otherwise, the CSP calculates the proxy re-encryption key rk = RG(pk CSP , sk CSP , pk w ), where RG is the re-encryption key generation algorithm and R represents the re-encryption algorithm; then calculates the proxy re-encrypted ciphertext and returns to U w . U w first uses its own private key skw Computing convergent ciphertext Then, the plaintext M = D(K, C1) is decrypted using the locally stored convergence key K.

[0080] It should be noted that the principle of proxy re-encryption in this embodiment is as follows: the proxy encrypts the ciphertext C3 with the re-encryption key rk and the user uses U... w PK with your own public key W The result obtained by encrypting data C1 is the same. The agent computed by the cloud server re-encrypts the ciphertext. Therefore, user U w You can directly use your own private key sk w Deciphering:

[0081] If U w When uploading data, if the data is not popular, then U w When downloading data, the data may be either unpopular or popular. w Upload the random tag RT to the cloud server.

[0082] If M is non-current data, the cloud server returns the symmetric ciphertext C2 corresponding to RT to U via CSP. w U w The plaintext data M = D(L, C2) is decrypted using the locally stored symmetric key L.

[0083] If M is popular data, then CSP cannot find the random label RT because the cloud server has already deleted all random labels corresponding to data label T during the popularity conversion. Therefore, CSP will return an error to U. w After receiving the error, U w I knew that data M had now become a popular data type. U w Then combine the data tag T and the identity ID w The data is uploaded to the cloud server via a secure channel. In subsequent steps, the cloud server performs the download and decryption operations, which are exactly the same as the operations described above for processing popular data.

[0084] A second aspect of the present invention also discloses an apparatus comprising: a memory and a processor; wherein the memory is used to store a computer program, and the processor is used to execute the computer program to implement the dynamic ownership management method based on data popularity of the first aspect.

[0085] The above provides a detailed description of the dynamic ownership management method and related equipment based on data popularity provided by the present invention. Specific examples are used in this embodiment to illustrate the principle and implementation of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation and application scope based on the idea of ​​the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

[0086] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined in these embodiments may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A dynamic ownership management method based on data popularity, characterized in that, The method is based on a system model including a user terminal, a cloud server, and an index server. The method includes: a popularity check algorithm, an encryption / decryption algorithm, a proof generation algorithm, an ownership proof algorithm, and a proof update algorithm; wherein... The encryption and decryption algorithm performs a convergent encryption on the data before the popularity check algorithm is executed on the index server to obtain ciphertext C1 and data tag T. After the popularity check algorithm is executed, a second convergent encryption or proxy re-encryption is performed. In the popularity check algorithm, the index server receives the data tag T after the data has been encrypted using the key K through an encryption and decryption algorithm. The index server checks whether the data is non-popular data, popularity-transformed data, or popular data based on the number of times the data tag T has been uploaded to the index server. If the data is popularity conversion data, the encryption and decryption algorithm performs proxy re-encryption on the ciphertext C1 to obtain ciphertext C3. Both ciphertext C3 and data tag T are uploaded to the cloud server. The cloud server executes the proof generation algorithm. In the proof generation algorithm, the encryption and decryption algorithm performs the decryption algorithm on the ciphertext C3 to verify the correspondence between ciphertext C1 and data tag T. If the verification is correct, the cloud server selects a random number R and performs encryption calculation with the ciphertext C1 to obtain proof V and stores it. The current data is also stored in the cloud server as popularity data. If the data is popular, the ownership proof algorithm is executed. In the ownership proof algorithm, the cloud server returns a random number R corresponding to the data tag T to the user terminal. The user terminal uses the random number R to encrypt and calculate the ciphertext C1 to obtain the proof V. W And upload it to the cloud server, where the cloud server verifies and proves V. W The system verifies whether V matches the data. If they do, it grants the user download permission. The cloud server receives the data tag T uploaded by the user and determines whether the user has data download permission. If so, it uses an encryption / decryption algorithm to perform proxy re-encryption on the ciphertext C3 to obtain the ciphertext. The data is sent to the user's device, where the user uses encryption and decryption algorithms to decrypt it and obtain the data. In the proof update algorithm, when a user logs out, the cloud server deletes the user's data download permission. For popular data, the cloud server deletes the random number R and the proof V, and uses the cloud server's private key sk. CSP The ciphertext C3 is decrypted by performing a proxy re-encryption algorithm to obtain ciphertext C1. The ciphertext C1 is then encrypted using a new random number R' to obtain a new proof V', which is then stored and updated.

2. The dynamic ownership management method based on data popularity according to claim 1, characterized in that, The convergence encryption process in the encryption / decryption algorithm employs a symmetric encryption algorithm.

3. The dynamic ownership management method based on data popularity according to claim 1, characterized in that, The index server receives user U W Data tag T and personal identity ID uploaded via secure channel W If the data tag T is uploaded for the first time, the index server generates a record to record the number of duplicate data tags and the ID of the authorized user. W The tuple; if the data tag T is not uploaded for the first time, the index server will increment the count corresponding to the data tag T by 1 and add the user's identity information ID. W Add it to the authorized user client collection.

4. The dynamic ownership management method based on data popularity according to claim 1, characterized in that, The popularity check algorithm checks the number of times the data tag T is uploaded to the index server. When the data is not popular, the encryption and decryption algorithm uses the key L to perform a second convergence encryption on the data to obtain ciphertext C2 and random tag RT, and then uploads them to the cloud server. The cloud server grants data download permissions to the user's device; When converting popularity data, the encryption and decryption algorithm performs proxy re-encryption on ciphertext C1 to obtain ciphertext C3. Ciphertext C3 and data tag T are both uploaded to the cloud server. The cloud server executes the proof generation algorithm and deletes ciphertext C2 and random tag RT.

5. The dynamic ownership management method based on data popularity according to claim 1, characterized in that, The popularity check algorithm checks whether the data is popularity-transformed data based on the number of times the data tag T is uploaded to the index server. The user end executes the encryption and decryption algorithm, using the cloud server's public key to perform a PK. CSP Encrypting ciphertext C1 using a proxy yields ciphertext C3, which is then processed using the cloud server's private key sk. CSP The ciphertext C3 is decrypted by performing a proxy re-encryption algorithm to obtain ciphertext C1.

6. The dynamic ownership management method based on data popularity according to claim 1, characterized in that, In the proof generation algorithm, the cloud server selects a random number R and ciphertext C1 to perform encryption calculations to obtain the proof V, including: Where H(*) is a collision-resistant hash function. .

7. The dynamic ownership management method based on data popularity according to claim 1, characterized in that, The cloud server verification certificate V W And prove whether V is consistent. If they are consistent, grant the user the data download permission, including: The cloud server will connect the user's U W Identity information ID W It is added to the set of authorized client terminals stored in the cloud server. This set of authorized client terminals is built by the cloud server when the data corresponding to the current data tag is popularity conversion data.

8. The dynamic ownership management method based on data popularity according to claim 4, characterized in that, If the user terminal U W If the data being uploaded and downloaded is non-traditional, then the cloud server receives the user's data via U. W The cloud server returns the symmetric ciphertext C2 corresponding to the uploaded random tag RT to the user's U. W User-side U W The data is decrypted using the key L.

9. The dynamic ownership management method based on data popularity according to claim 1, characterized in that, If the user terminal U W If the downloaded data is popular data, then the cloud server will send it to the user's U... W Return error information and receive user terminal U W The uploaded data is tagged T, and its download permission is checked. If permission is granted, the ciphertext C3 is re-encrypted using an encryption / decryption algorithm to obtain the ciphertext. The data is sent to the user's end, where it is decrypted using encryption and decryption algorithms to obtain the data, including: The cloud server receives the data tag T uploaded by the user and determines whether the user has data download permission. If so, it uses an encryption / decryption algorithm based on the user's public key to perform a PK (peer-key) operation. W Cloud server public key PK CSP Cloud server private key sk CSP The proxy re-encrypts the ciphertext C3. Send to the user's client, the user's client uses the user's private key sk W Decrypt to obtain ciphertext C1, then use key K to decrypt again to obtain the data.

10. A device, characterized in that, include: A memory and a processor; wherein the memory is used to store a computer program, and the processor is used to execute the computer program to implement the dynamic ownership management method based on data popularity as described in any one of claims 1-9.

Images