A cloud auditing method and system for anonymous data
By introducing equivalence class substitution signature and flexible public key signature technologies in the cloud storage environment, the compatibility issues of anonymity and traceability in cloud storage auditing are resolved, enabling efficient user revocation and scheduled auditing, reducing computational overhead, and ensuring audit continuity.
Patent Information
- Application Number
- CN202211105904.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2022-09-09
- Publication Date
- 2025-12-12
- Estimated Expiration
- 2042-09-09
AI Technical Summary
Existing cloud storage auditing solutions struggle to achieve traceability while ensuring anonymity and efficiency. Furthermore, frequent user cancellation operations lead to massive data re-signing, resulting in significant computational overhead and impacting the normal execution of scheduled audits.
It employs equivalence class-based structured signature preservation and flexible public key signature technology. By performing equivalence class replacement on group elements, it achieves efficient auditing with anonymity and traceability. It uses file tags to record the current group state to avoid the computational overhead of re-signing. It replaces the private key with a re-signing to ensure the normal operation of scheduled audits.
It implements the anonymity attribute for user-shared files, supports frequent user revocation with low computational cost, ensures uninterrupted execution of scheduled audits, and avoids the huge overhead caused by re-signing massive amounts of data.
Smart Images
Figure CN116366239B_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the field of communication, in particular to a cloud auditing method and system for anonymous data. BACKGROUND
[0002] Cloud computing and extended cloud storage services have become mainstream in today's IT industry, the number of people working remotely is increasing rapidly, and more and more people are accessing and enjoying the convenience brought by cloud storage services. However, while enjoying the convenience, users have lost direct control over shared data, and the uncontrollability and complexity of the cloud environment have brought many security challenges to shared data. On the one hand, cloud storage service providers may be malicious and discard less frequently used parts to generate more revenue, resulting in data integrity being destroyed. On the other hand, administrator errors, disk damage, backup and recovery failures, and malicious attacks can all cause data loss.
[0003] In order to ensure data integrity, the current auditing scheme is that the data owner calculates the signature and uploads the file blocks to the cloud together with the identity verifier, and then these identity verifiers are verified by the data owner himself or any third-party auditor (TPA) to prove that the cloud completely owns these file blocks.
[0004] At present, in most auditing schemes, anonymity and efficiency, anonymity and traceability are often incompatible. One technique is to apply blind signature technology to protect user anonymity and identity privacy. This scheme requires the addition of a secure intermediary to help users generate verifiers, but the introduction of entities inevitably increases a lot of communication overhead. Another method is to implement an anonymous auditing scheme through ring signature, in which the overhead of generating signatures will increase sharply as the number of users grows. The above two techniques cannot realize the traceability function. Therefore, how to build an efficient auditing strategy that can provide both anonymity and traceability function is still a problem to be solved. SUMMARY
[0005] In order to overcome the problems in the related art, the present application provides a novel auditing strategy that can efficiently realize anonymous sharing of files by users while supporting efficient user revocation. At the same time, we can also maintain the traceability of revoked anonymous users and ensure the effective implementation of periodic audits.
[0006] According to a first aspect of an embodiment of the present application, a cloud auditing method for anonymous data is provided, which is used for verifying group data, the group including a plurality of group users and at least one group administrator, and characterized by comprising:
[0007] 1) Initialization phase
[0008] The group administrator sets an initial group state, a key generation center PKG generates a master key, a partial key and public parameters;
[0009] 2) Request to join phase
[0010] The group administrator assigns a unique identifier to each of the group users;
[0011] 3) Key generation phase
[0012] The group administrator generates a first key pair according to the identifier of each of the group users, and distributes the first key pair to the corresponding group user;
[0013] 4) Verifier generation phase
[0014] The group user generates a file label, and for each block of the file, calculates a corresponding verifier, and the cloud server verifies the correctness of the file label and the verifier;
[0015] 5) Proof generation phase
[0016] The third-party auditor TPA generates an audit challenge;
[0017] The cloud server creates a corresponding proof based on the audit challenge to verify that the cloud server has complete shared data;
[0018] 6) Proof verification phase
[0019] The TPA verifies the correctness of the proof.
[0020] According to a second aspect of the embodiment of the application, there is provided a cloud audit system for anonymous data, for verifying group data, characterized by comprising a group composed of a plurality of group users and at least one group administrator, a key generation center, a cloud server and a third-party auditor;
[0021] The group administrator is configured to set an initial group state, and the key generation center PKG is configured to generate a master key, a partial key and public parameters;
[0022] The group administrator is further configured to assign a unique identifier to each of the group users;
[0023] The group administrator is further configured to generate a first key pair according to the identifier of each of the group users, and distribute the first key pair to the corresponding group user;
[0024] The group user is configured to generate a file label, and for each block of the file, calculate a corresponding verifier, and the cloud server is configured to verify the correctness of the file label and the verifier;
[0025] a third party auditor (TPA) configured to generate an audit challenge;
[0026] the cloud server is further configured to create a corresponding proof based on the audit challenge to verify that the cloud server has the complete shared data;
[0027] the TPA is further configured to verify the correctness of the proof.
[0028] The present application can achieve the following beneficial effects:
[0029] 1. By using the two technologies of equivalence class-based structure-preserving signature and flexible public key signature, the anonymous property of user-shared files is realized, and the user only needs to replace the public and private keys with another equivalence class in the group before uploading the file, which will result in the public key not being pointed to the user, and the certificate can be replaced with the equivalent equivalence class according to the structure-preserving signature. At this point, only the group administrator who has the trapdoor can know who uploaded the file. The anonymous strategy and the traceability function of the group administrator only need constant time to implement, and are non-intrusive.
[0030] 2. The scheme also supports frequent user revocation. After the user leaves the group, the traditional scheme mainly ensures the continuous implementation of the audit by re-signing the file. The present application uses the latest technology to avoid the large amount of computing overhead caused by re-signing massive data. Specifically, we record the current group state through the file tag, and use the replacement public key instead of re-signing the file. Compared with the computing overhead caused by re-signing massive files, the computing cost brought by such a strategy is negligible.
[0031] 3. In addition, the use of this revocation technology can also ensure the normal implementation of the periodic audit. Compared with the traditional scheme, when a user is revoked, the files uploaded by the revoked user will be re-signed by the non-revoked users in the group or the cloud. If the auditor happens to draw some blocks in the re-signed file at this time, the audit work will be suspended, which will make it difficult to ensure the periodic audit negotiated by the user and the auditor. By replacing the private key instead of re-signing, the uninterrupted execution of the audit can be ensured while avoiding the huge overhead caused by re-signing.
[0032] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present application. BRIEF DESCRIPTION OF DRAWINGS
[0033] The above and other objects, features and advantages of the present application will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings, in which like reference characters refer to like parts throughout the figures, and in which:
[0034] Figure 1is a system model diagram of the method of the present application. DETAILED DESCRIPTION
[0035] Preferred embodiments of the present application will be described in greater detail below, with reference to the accompanying drawings. While the preferred embodiments of the present application are shown in the drawings, it is understood that the present application can be embodied in various forms without being limited by the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and fully convey the scope of the application to those skilled in the art.
[0036] The terminology used in the present application is for the purpose of describing particular embodiments only and is not intended to be limiting of the present application. As used in the present application and the appended claims, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.
[0037] It is to be understood that, although the terms "first," "second," "third," etc. can be used herein to describe various information, the information should not be limited by these terms. These terms are only used to distinguish one piece of information from another. For example, a first information can also be termed a second information, and, similarly, a second information can also be termed a first information, without departing from the scope of the present application. Therefore, the term "comprising" or "consisting of should not be interpreted as being limited to the features recited. In the description of the present application, the meaning of "a plurality" is two or more, unless otherwise explicitly specifically defined.
[0038] In the present application, a shared file F is divided into n blocks (m1...m n ), where m j represents the j th th block of the shared file F, To more clearly describe the present application, an ID-based digital signature SSig is used to ensure the integrity of the file tag. This is a secure signature scheme. When a shared group is created, a unique ID is assigned to the group. In the present embodiment, ssk is used to represent the key corresponding to SSig, and it is assumed that each group user holds the key ssk. Initially, it is assumed that there are d users U i(0≤i≤d). SPS-EQ (Structure-Preserving Signatures on Equivalence) is a technique that replaces a signature with another representative of its equivalence class. Similarly, SFPK (Signatures with Flexible Public Key) is a technique that replaces a key with another representative of its equivalence class. The implementation of these two techniques is referenced below. The technical solution of the present application is described as follows:
[0039] 1) Initialization algorithm: This algorithm is executed by the PKG (Key Generation Center) and the group administrator. The group administrator sets the initial group state. The PKG is mainly responsible for generating the master key, the partial key and the system public parameters.
[0040] a) The PKG randomly selects a bilinear mapping e: G1xG2→G T , where G1, G2 and G T are three multiplicative cyclic groups of prime order p. The PKG randomly selects two generators g1 and u1 from G1, a generator g2 from G2, and two different cryptographic hash functions: and H2: {0, 1} * →G1.
[0041] b) The PKG randomly selects a system master key This value is then used to generate system public parameters. The PKG keeps the master key by itself.
[0042] c) The group administrator sets the initial group initial revocation number RN=0 and sends the value R RN =H1(RN) to the PKG, the cloud and the group users. In addition, the PKG calculates two public values and
[0043] d) The PKG randomly selects a partial key and sends it to the group administrator, which is used to generate the public key and the private key of the user. It then publishes params=(G1, G2, e, p, g1, u1, g2, Y1, Y2, H1, H2) as the public parameters of the system.
[0044] 2) Request to join algorithm: In this algorithm, the group administrator assigns a unique identifier i to the newly joined user U i , where
[0045] 3) Key generation algorithm: In this algorithm, the group administrator generates a private key for each user U iGenerate a key pair. Then distribute the corresponding key pair to them.
[0046] a) The group administrator generates a public key based on the unique identity of each group user. and private key When a key is generated, a corresponding trapdoor is also created. This trapdoor τ i It will be saved by the group administrator and will not be sent to anyone.
[0047] b) The group administrator uses the algorithm SPS.KGen(2) to generate a key pair (pk SPS ,sk SPS ).
[0048] c) The group administrator uses the private key sk SPS Generate user U i signature (The SPS signature generation scheme will be explained in detail in the key points of the invention.) Signature and key (pk) i ,sk i ) was sent to the corresponding group user U i Then, it will set mpk=pk SPS As its public key, and set msk=(sk SPS ,∑(i,τ i )) as its private key.
[0049] d) After receiving the message, users in the group can use the public key to perform a PK (player kill) attack. i Use the private key mpk to verify the signature. The correctness of the signature (the specific signature verification is a detail of the SPS scheme, which is described in detail later).
[0050] 4) Validator generation algorithm: In this algorithm, group users generate file tags, ensuring the filename is 'name' and the user's public key is 'pk'. i value R RN And the integrity of the common value Y2. Then for each block m of file F j Calculate the corresponding validator Sig ij The group of users will use file F and set σ. i And the file tags are uploaded to the cloud. The cloud verifies the correctness of the file tags and the verifier. The specific verification steps are as follows:
[0051] a) An anonymous user randomly selects a scalar To randomize their keys (pk′) i ,sk′ i )←{SFPK.ChgKeys}(sk i , pk ir) and signature Then, it generates a file tag = name || pk' i || R RN || Y2|| Ssig ssk (name || pk' i || R RN || Y2). For each file block m j , a random scalar is chosen and a verifier consisting of three parts is computed: and
[0052] b) Group users upload F, together with the file tag to the cloud. Then, the group users delete the file F and σ i from the local storage.
[0053] c) The cloud verifies the correctness of the file tag and the set σ.
[0054] i) The cloud checks whether R RN in the file tag is the latest R RN . If yes, the cloud performs the following three steps; otherwise, the cloud server considers the user as a revoked user or an illegal user and rejects the user's request.
[0055] ii) The cloud verifies the validity of the file tag by checking whether SSig ssk is a valid signature with the group ID. If yes, the cloud performs the following steps. Otherwise, the cloud considers the file tag invalid and rejects the user's upload sharing request.
[0056] iii) The cloud checks whether pk in σ pk is a valid certificate with mpk and then compares pk in the file tag with pk in the file set σ. If they are not the same, the request will be rejected. iiii) Finally, the cloud checks whether the following equations hold:
[0057]
[0058] where Y2 comes from the file tag and pk' = (pk'1, pk'2). If these equations do not hold, the cloud considers these identity verifiers from a revoked user or an illegal user and rejects the upload request.
[0059] 5) Proof generation algorithm: In this algorithm, the third-party auditor TPA generates an audit challenge chal. The cloud server creates a corresponding proof ptf for the TPA to verify that it has the complete shared data.
[0060] a) TPA generates an audit challenge by the following steps:
[0061] i) Randomly select a set I with c elements, where
[0062] ii) For each j e I, generate a random value v
[0063] iii) Send the audit challenge chal = {j, v j} to the cloud server. j∈I
[0064] b) The cloud server receives the audit challenge chal sent by TPA, and then creates the proof of data possession ptf, the specific steps are as follows:
[0065] i) For each j e I, compute
[0066] ii) Compute
[0067] iii) Send prf = (T, P1, P2,..., P c ) to TPA as proof along with the file tag.
[0068] 6) Proof verification algorithm: In this algorithm, TPA verifies the correctness of the proof ptf from the cloud. TPA first verifies the validity of the file tag by checking whether SSig ssk is a valid signature. If the verification fails, TPA will return false. Otherwise, TPA checks whether the following equation is correct:
[0069]
[0070] where Y2 is from the file tag and pk' = (pk'1, pk'2). If yes, return true; otherwise, false.
[0071] 7) Key update algorithm when users are revoked: When a group user leaves the shared group, the group administrator updates the current group state, and TPA reissues the public parameters params. Then, the group administrator generates a new private key for each unrevoked user.
[0072] a) The group administrator resets the revoked number RN = RN + 1 and computes R RN = H1(RN) and sends it to TPA, the cloud server and unrevoked users.
[0073] b) TPA re-computes two public values and according to the latest R RN A new system public parameter params = (G1, G2, e, p, g1, u1, g2, Y1, Y2, H1, H2) is released.
[0074] c) Based on the updated value Y1, the group administrator re-generates the private key Then it is sent to the unrevoked users U in the group i .
[0075] 8) Trace algorithm: For a shared file, users in the group can query the group administrator whether there is a corresponding user. The group administrator uses msk to determine whether the shared data is uploaded by the group user who joins the group.
[0076] a) The group administrator first checks the validity of the certificate. If invalid, the request will be rejected.
[0077] b) The group administrator uses ∑(i, τ i ) in msk to find out whether there is an anonymous user that satisfies e(pk'1, τ i ) = e(pk'2, g2), where pk' = (pk'1, pk'2).
[0078] The technical key points of the present application are:
[0079] 1. A new anonymous strategy is introduced in the audit model. The anonymous strategy based on group element equivalence class replacement realizes anonymity and traceability with only constant level consumption.
[0080] 2. A new audit framework is proposed, which can support anonymous, user revocation and traceability functions at the same time. In order to realize the audit scheme that can support anonymous and traceable functions at the same time, we introduce the idea of equivalence class replacement on group elements into the model. SPS-EQ and SFPK technology are examples of this idea. SPS-EQ is a technology that replaces the signature with another representative on its equivalence class. Similarly, SFPK is a technology that replaces the key with another representative of its equivalence class. The anonymous authentication generator can be realized by combining the two technologies at the same time.
[0081] Both of these technologies are based on group elements. Therefore, the keys of the group users designed in the present application are all based on group elements. This will help to realize the SFPK technology. The SPS-EQ technology is mainly used to generate certificates. In the SPS-EQ technology, the number of group elements in the public key and the private key changes with the number of group elements in the plaintext (the public key of the user). Because the plaintext in the present application scheme only contains two elements, the group administrator sets l = 2 and generates the key: (pk SPS , sk SPS ) <- SPS.KGen(2).
[0082] Here's an example from an application. Suppose the user has... and Before generating the validator, a random number r needs to be selected, and the SFPK.ChgKeys(sk, pk, r) algorithm needs to be used to... Convert to and Convert to Using the same random number r, the algorithm SPS.ChgRep(pk, σ) is used. pk ,r,pk SPS ) For the original certificate σ pk Transform into σ pk For traceability, use SFPK.TKGen(1). λ The trapdoor τ in the r) algorithm is used to find the actual signer.
[0083] In dynamic groups, user revocation is a crucial consideration. The solution presented in this invention is an improvement upon the latest user revocation solutions. When a user is revoked, the group administrator sets RN = RN + 1. The value RN is then hashed to R before being sent to others. RN This will prevent group activity information from being leaked. TPA is based on the latest R... RN The group administrator then generates public parameters `params`. Finally, the group administrator uses the new public parameters `params` to generate a new private key for each user whose account has not been revoked. Conversely, once a user's public key is assigned, it will not be changed. It is important to emphasize that the group administrator assigns a unique key to each user.
[0084] When a group user generates a validator, it will set the current group state R. RN The public parameter Y2 is integrated into the file tag. The cloud and TPA operate based on the parameters in the file tag. This avoids the need for re-signing data when a user revokes sharing. Since the user's public key is stored in both the authenticator and the file tag, it also facilitates subsequent traceability.
[0085] 3. The anonymization scheme proposed in this invention incorporates the latest revocation technology and makes adaptive improvements under anonymity conditions. This ensures traceability of anonymous users, avoids the huge overhead caused by re-signing massive amounts of data, and also ensures the effective implementation of periodic audits.
[0086] The efficient, anonymous, and traceable cloud auditing solution constructed in this invention has excellent anonymity, user revocation, and traceability effects. Specifically, this invention can achieve the following beneficial effects:
[0087] 1. By using the structure-preserving signature based on equivalence classes and flexible public key signature, the anonymous property of user sharing files is realized, and the user only needs to replace the public and private keys with another equivalence class in the group before uploading the file, which will lead to the public key not being pointed to the user, and the certificate can be replaced with the equivalent equivalence class according to the structure-preserving signature, so that only the group administrator who has the trapdoor can know who uploaded the file. The anonymous strategy and the tracing function of the group administrator only need constant time to realize, and are non-intrusive.
[0088] 2. The scheme also supports frequent user revocation. After the user leaves the group, the traditional scheme mainly ensures the continuous implementation of the audit by re-signing the file. Our scheme uses the latest technology to avoid the large amount of computing overhead caused by re-signing massive data. Specifically, we record the current group state through the file tag, and use the replacement public key instead of re-signing the file. Compared with the computing overhead caused by re-signing massive files, the computing cost brought by such a strategy is negligible.
[0089] 3. In addition, the use of this revocation technology can also ensure the normal implementation of the timing audit. Compared with the traditional scheme, when a user is revoked, the files uploaded by the revoked user will be re-signed by the non-revoked users in the group or the cloud. If the auditor happens to draw some blocks in the re-signed file at this time, the audit work will be suspended, which will make it difficult to ensure the regular audit negotiated by the user and the auditor. By replacing the private key instead of re-signing, we can avoid the huge overhead caused by re-signing while ensuring uninterrupted execution of the audit.
[0090] The scheme of the present application has been described in detail above with reference to the drawings. In the above embodiments, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments. Those skilled in the art should also know that the actions and modules involved in the specification are not necessarily required by the present application. In addition, it can be understood that the steps in the method of the embodiments of the present application can be adjusted, combined and reduced in sequence according to actual needs, and the modules in the device of the embodiments of the present application can be combined, divided and reduced according to actual needs.
[0091] Those skilled in the art will also appreciate that the various example logical blocks, modules, circuits, and algorithm steps described in connection with the disclosure herein can be implemented as electronic hardware, computer software, or a combination of the two.
[0092] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.
[0093] Embodiments of the application have been described above with the understanding that such embodiments are exemplary, but are not exhaustive, and are not limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms herein is intended to best explain the principles of the embodiments, practical application, or improvement over the technology in the art, or to enable other of ordinary skill in the art to understand the embodiments disclosed herein.
Claims
1. A cloud auditing method of anonymous data for verification of group data, the group comprising a plurality of group users and at least one group administrator, characterized in that, Comprise: The group administrator sets the initial group state, the key generation center PKG generates the master key, the partial key and the public parameter; The key generation center PKG generates a master key, a partial key and public parameters, specifically comprising: the key generation center Randomly select a bilinear mapping , , and are three prime order multiplicative cyclic groups, Randomly select two generators and from , select a generator from , and two different cryptographic hash functions: and ; Randomly select and save the system master key ; the group administrator sets the initial group initial revocation number and sends the value to , the cloud and the group user , in addition, Calculate the public values and ; Randomly select a partial key , send to the group administrator, and publish the public parameters of the system ; said group administrator assigns a unique identifier to each of said group users ; The group administrator generates a first key pair according to the identifier of each group user and distributes the first key pair to the corresponding group user; the group administrator generates a first key pair according to the identifier of each group user, specifically comprising: the group administrator generates a second key pair , the second public key , the second private key , and the corresponding trapdoor ; the group administrator uses an algorithm to generate a third key pair , wherein is a third public key, is a third private key, and further obtains a first key pair of the group user , wherein the first public key , the first private key ; the group administrator uses the third private key to generate a signature of the group user , and the signature and the second key pair are sent to the corresponding group user ; Group users generate file tags. For each block of the file, a corresponding validator is calculated, and the cloud server verifies the correctness of the file tags and validators. Specifically, this process includes: anonymous users randomly selecting a scalar... ,based on Second key pair To randomize the user's key ,based on To randomize user signatures Then, file tags are generated. , To ensure filename accuracy, for files... Each block Randomly select a scalar And calculate the validator consisting of three parts: , and Group users will send files , The files, along with their tags, are uploaded to the cloud. Then, group users delete the files from their local storage. and Cloud server verification file tags and sets The correctness; The third party auditor TPA generates an audit challenge; The cloud server creates a corresponding proof based on the audit challenge to verify that the cloud server has complete shared data; The TPA verifies the correctness of the proof.
2. The method of claim 1, wherein, The cloud server verifies the file and the correctness of the set , specifically including: The cloud server checks whether the file tag is the latest in the file tag list If yes, the cloud server performs the following three steps; otherwise, the cloud server regards the user as a revoked user or an illegal user, and rejects the user's request; The cloud server verifies the file by group checking whether it is a valid signature to verify the validity of the file , if yes, the cloud server performs the following steps, otherwise, the cloud server considers the file tag invalid, and rejects the user's upload sharing request; Cloud server uses Checking in to determine if it is a valid certificate, then comparing in the file tag with in the file collection if not the same, reject the request; The cloud server checks whether the following equation is established: wherein from the file tag and If the equation is not true, the cloud server considers these authenticators to be from a revoked user or an illegal user and denies the upload request.
3. The method of claim 2, wherein, The third party auditor TPA generates an audit challenge, specifically comprising: A set of elements is randomly selected having wherein wherein ; for each generating a random value ; audit challenges to the cloud server; The cloud server creates a corresponding proof based on the audit challenge to verify that the cloud server has complete shared data, specifically comprising: for each calculating ; Computing ; Will Along with the documents Send it to TPA as proof.
4. The method of claim 3, wherein, The TPA verifies the correctness of the proof, specifically comprising: The TPA first verifies the validity of the file tag by checking whether it is a valid signature, and if the verification is successful, the TPA checks whether the following equation is correct: wherein from the file and .
5. The method according to any one of claims 1 to 4, characterized in that, Also include: When the group user leaves the shared group, the group administrator updates the current group state, the TPA reissues the public parameter, and the group administrator generates a new private key for each unrevoked user.
6. The method according to any one of claims 1 to 4, characterized in that, Also include: The group user queries the group administrator whether the shared file in the group exists corresponding group user.
7. A cloud auditing system for anonymous data, for implementing the method of any one of claims 1-6, characterized in that, Comprise a group consisting of a plurality of group users and at least one group administrator, a key generation center, a cloud server and a third party auditor; The group administrator is configured to set the initial group state, and the key generation center PKG is configured to generate the master key, the partial key and the public parameter; The group administrator is also configured to assign each group user a unique identifier; The group administrator is also configured to generate a first key pair according to the identifier of each group user, and distribute the first key pair to the corresponding group user; The group user is configured to generate a file label, and for each block of the file, calculate a corresponding verifier, and the cloud server is configured to verify the correctness of the file label and the verifier; The third party auditor TPA is configured to generate an audit challenge; The cloud server is also configured to create a corresponding proof based on the audit challenge to verify that the cloud server has complete shared data; The TPA is also configured to verify the correctness of the proof.