Anonymous password authentication and encryption method for deduplication-oriented cloud storage system

Abstract

The application discloses an anonymous password authentication and encryption scheme for a deduplication cloud storage system, and is characterized in that, in the deduplication cloud storage system, under a three-party architecture of a key server, a cloud server and a user, the three parties jointly generate an MLE key, encryption data deduplication is realized, and the problems of brute force attack and single point failure are avoided; an anonymous authentication of the user to the cloud storage server is constructed based on a non-interactive zero-knowledge proof scheme, and the privacy protection of the user identity information is realized; a key protection mechanism based on a reinforced password is constructed by using an identity-based careless pseudo-random function, so that the user can safely store and maintain the key at the remote cloud server side without occupying local resources. The security analysis and simulation experiment results show that the scheme can guarantee the encryption and authentication security, and provide higher calculation and communication efficiency.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy protection, and particularly relates to an anonymous password authentication and encryption method for a deduplication-oriented cloud storage system. BACKGROUND

[0002] In the big data era, the amount of data is growing exponentially, and cloud storage platforms have become an important medium for data storage, processing and management. According to the latest IDC Global DataSphere 2023, the size of data in China will grow from 23.88 ZB in 2022 to 76.6 ZB in 2027, with an annual growth rate of 26.3%, ranking first in the world. The dramatic increase in data volume puts a huge pressure and test on cloud storage service providers. By deleting duplicate data on the cloud through deduplication, only one physical copy is retained, which can greatly save cloud storage resources and usage costs. However, with the increasing frequency of privacy breaches, users are increasingly storing encrypted data in the cloud, and it is difficult to perform duplicate checking on data encrypted by traditional encryption methods. Therefore, how to implement cross-user deduplication on encrypted data on the cloud while ensuring data integrity and confidentiality has become a research hotspot.

[0003] In order to realize encrypted data deduplication, Bellare et al. [Bellare M, Keelveedhi S, Ristenpart T. Message-Locked Encryption and Secure Deduplication [C]. Johansson T, Nguyen PQ, eds. Advances in Cryptology - EUROCRYPT 2013, 2013: 296-312.] proposed a message-locked encryption (MLE) method. MLE is a special symmetric encryption method that can output the same ciphertext for the same plaintext by extracting encryption and decryption keys from the plaintext, thereby realizing cross-user duplicate data deletion.

[0004] Zhang et al.[Reference A: Zhang Y, Xu C, Cheng N, et al. Secure Password-Protected Encryption Key for Deduplicated Cloud Storage Systems[J]. IEEE Transactions on Dependable and Secure Computing, 2022, 19(4): 2789-2806.] proposed a kind of MLE mechanism assisted by multiple servers in 2022, which uses a set of dynamic key servers to generate MLE keys with plaintext. Through threshold mechanism and periodic update mechanism, the security risk caused by the corruption of part of the key servers is effectively avoided, and password is used for identity authentication and key protection, so that users can manage keys through cloud servers without storing and maintaining any data on local devices. However, since the system requires the use of multiple key servers to meet the threshold scheme and periodic update requirements, it is inevitable to bring additional deployment and maintenance costs in practice. In addition, this scheme lacks privacy protection of user static identity information, and attackers may track the network behavior and login history of users according to the user identity information, and obtain user privacy by using big data analysis means. SUMMARY

[0005] In view of the security problems such as lack of privacy protection existing in the deduplicable cloud storage system, the present application provides an anonymous password authentication and deduplicable cloud data encryption scheme. The server-assisted MLE mechanism is used to encrypt and store the file, which meets the requirement of data deduplication; the MLE key is generated by the secret held by the key server and the cloud server respectively and the file, which avoids the complex system architecture and the additional deployment and maintenance cost, and also avoids the single point failure problem caused by the single server; the password-based identity authentication and encryption mechanism is used to provide key protection, and the user only needs to remember a low-entropy password to securely store and maintain the MLE key on the cloud server; the zero-knowledge proof scheme based on the algebraic message authentication code (MAC) is used to realize anonymous authentication, which provides privacy protection for the user identity information.

[0006] In order to achieve the above purpose, the technical scheme adopted by the present application is as follows:

[0007] An anonymous password authentication and encryption method for a deduplicable cloud storage system, comprising:

[0008] Step 1: User U registers to cloud server CS and obtains an authentication credential σ and a corresponding non-interactive zero-knowledge proof π; User U verifies the validity of σ using π and public parameters, and after verification, generates a reinforced password spw with the assistance of key server KS U Encrypt σ and store it in KS;

[0009] Step 2: Based on the encrypted σ, generate MLE key through U, CS and KS, and encrypt data file M using MLE key and upload, perform deduplication operation for encrypted data on cloud storage server side;

[0010] Step 3: User U completes authentication to cloud server CS with the assistance of key server KS and recovers data file M.

[0011] Further, the step 1 comprises:

[0012] Step 1.1: User U calls IBOPRF(ID U ,pw U ) to obtain reinforced password spw U ; Calculate message m = h(ID U ) and send to CS for registration; Where IBOPRF() represents an identity-based non-casual pseudo-random function, ID U represents user ID, pw U represents password, p is a prime number, and Z represents the set of integers;

[0013] Step 1.2: CS generates credential σ and non-interactive zero-knowledge proof π for U using Cert algorithm;

[0014] Step 1.3: After receiving (σ, π), user U verifies σ using CertVerify algorithm; After verification, encrypt σ using spw U to obtain encrypted credential Send to KS for storage;

[0015] Step 1.4: If user U is registered to KS for the first time, KS creates a user credential list for it to store the encrypted credential of user U, and initializes ρ U = 0 to count the number of times of requesting MLE key through ρ U , otherwise registration fails.

[0016] Further, in the step 2, the MLE key is generated in the following way:

[0017] Step 2.1: User U calls IBOPRF(ID Upw U ), get the strengthened password spw U , and meanwhile retrieve the user credential list stored in KS use spw U to decrypt, and restore the credential σ;

[0018] Step 2.2: the user U calculates m = h(ID U ), generates a proof υ for (m, σ) by using a Show algorithm, and sends υ to the CS for identity verification; meanwhile, the user U randomizes the file M to be encrypted: send M1 and M2 to the KS and the CS respectively; wherein the hash function is a p-th order permutation cycle group;

[0019] Step 2.3: after receiving the message, the CS first verifies υ by using a ShowVerify algorithm, and calculates if the verification is passed, and meanwhile the KS calculates by using α1, and counts the number of requests; the CS and the KS send KM1 and KM2 to the U respectively;

[0020] Step 2.4: the user U calculates KM, and the KM is the MLE key.

[0021] Further, in the step 2, the encrypting and uploading of the data file M by using the MLE key include:

[0022] Step 2.5: after generating the MLE key, the user U encrypts the file M by using the MLE key locally, and obtains a ciphertext C M : C M = E.enc(KM, M), and calculates a corresponding ciphertext tag wherein E is a symmetric encryption function with indistinguishability security under a chosen-plaintext attack, E.enc(KM, M) represents that the plaintext M is encrypted by using the MLE key, and H5 represents a hash function;

[0023] Step 2.6: the user U calculates two different keys κ U , U by using spw encrypt KM by using κ , and obtain a corresponding ciphertext C KM = E.enc(κ U , KM), wherein ID CS ​​represents the cloud server ID, ID KS represents the key server ID, represents a hash function;

[0024] Step 2.7: Send the ciphertext C to the KS and store it in Send the to the CS for storage.

[0025] Further, in step 2, the de-duplication operation performed on the encrypted data at the cloud storage server end includes:

[0026] Step 2.8: After data upload, the CS checks the tag whether it already exists, if it exists, performs data de-duplication, and continues to maintain a list; otherwise, create a list;

[0027] Step 2.9: For subsequent users uploading ciphertext C', the CS checks whether it is true, if it is true, performs data de-duplication, otherwise, creates a new list for C'.

[0028] Further, the step 3 includes:

[0029] Step 3.1: User U calls IBOPRF(ID U , pw U ), gets the strengthened password spw U , and retrieves from the list

[0030] Step 3.2: U uses spw U to decrypt , restores the credential σ; calculates m and generates proof υ using the Show algorithm on (m, σ); uses spw U to restore the key κ U and decrypts C KM , restores the tag and KM; sends to the CS for identity verification and file retrieval;

[0031] Step 3.3: After the CS receives , it verifies υ using the ShowVerify algorithm, and if the verification is passed, it uses the tag to retrieve the list C M and sends it to U;

[0032] Step 3.4: U uses KM to decrypt C​M Decryption, get file M.

[0033] Further, the step 1.2 comprises:

[0034] First, by algebraic Scheme to generate credentials: Indicates the input key sk and message Algorithm A = g 1 / γ+m , let σ <- A and output authentication label σ; wherein Wherein Indicates the algebraic Scheme;

[0035] Second, construct a non-interactive zero-knowledge proof scheme Select Calculate R1 = A r , R2 = g r , c = H6(g, w, m, A, R1, R2), s = r + cγmodp, let π <- (c, s), return (σ, π); wherein, π <- NIZK{} represents a non-interactive zero-knowledge proof; Indicates that for input sk = γ, m, σ = A, Algorithm to verify whether A γ+m = g is true, if the equation is true, output 1, indicating that the authentication is passed, otherwise output 0, indicating that the authentication fails; Indicates that the input security parameter λ, Algorithm first generates group elements Where p is a 2λ bit safe prime number, Is the p order law group, g is the generator of the group G; randomly select Calculate w = g γ , let sk <- γ, output key sk and public parameter H6 represents a hash function.

[0036] Further, in the step 1.3, the user U verifies σ using the CertVerify algorithm, comprising:

[0037] For input ((par mac , m, σ = A), π), construct verification algorithm Verify NIZK ((par mac , m, σ), π): calculate c' = H6(g, w, m, A, A s+cm g -c , g s w -c ), if c' = c, return 1; otherwise, return 0.

[0038] Further, in the step 2.2, the generating proof υ for (m, σ) by using the Show algorithm comprises:

[0039] First, a randomization algorithm Rerand is constructed to randomize the credential σ, (T, a) <- Rerand(σ): T <- A a ; then, an SE-NIZK proof scheme ∑ <- SPK{(m, a): f p (par mac , T, m, a) = V}: first, select Calculate c <- H7(g, T, R), s m <- r m + cm mod p, s a <- r a + ca mod p; let ∑ = (c, s m , s a ), return υ = (T, ∑); wherein ∑ <- SPK{} represents an SE-NIZK proof, H7 represents a hash function, and f p () represents that the parameters in the parentheses constitute a mapping relationship.

[0040] Further, in the step 2.3, the verifying υ by using the ShowVerify algorithm comprises:

[0041] Construct a verification algorithm Verify SPK (f v (par mac , T, sk) = V, ∑): first, calculate V <- T γ , c' <- H7(g, T, R'), if T ≠ 1 and c = c', return 1; otherwise, return 0; wherein f v () represents that the parameters in the parentheses constitute a mapping relationship.

[0042] Compared with the prior art, the present application has the beneficial effects:

[0043] (1) Facing the deduplication cloud storage system, an anonymous authentication and encryption scheme for the deduplication cloud storage system is constructed based on the MLE framework under the key server-cloud server-user three-party architecture. The MLE key is generated by the three parties, the resistance to offline dictionary attack is realized, and the single point failure problem is avoided.

[0044] (2) Based on the non-interactive zero-knowledge proof scheme, the anonymous authentication of the user to the cloud storage server is constructed, and the privacy protection of the user identity information is realized.

[0045] (3) Constructed a key protection mechanism based on reinforced password by using identity-based careless pseudo-random function, so that the user can store and maintain the key at the remote cloud server side safely without occupying local resources.

[0046] (4) The formal security proof was carried out under the random oracle model, and the feasibility and effectiveness of the scheme were verified in the experimental environment. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 An identity-based careless pseudo-random function in the embodiment of the application is shown in the schematic diagram;

[0048] Figure 2 A flowchart of the anonymous password authentication and encryption method for the deduplication-oriented cloud storage system in the embodiment of the application is shown in the flowchart;

[0049] Figure 3 A flowchart of the registration stage in the embodiment of the application is shown in the flowchart;

[0050] Figure 4 A flowchart of the MLE key generation and data uploading stage in the embodiment of the application is shown in the flowchart;

[0051] Figure 5 A flowchart of the data downloading stage in the embodiment of the application is shown in the flowchart. DETAILED DESCRIPTION

[0052] The application will be further explained in combination with the drawings and specific embodiments:

[0053] 1. Security assumption

[0054] Let p be a prime number, is a p-order permutation group, g is the generator of the group G. Lambda is a security parameter.

[0055] DDDH assumption. For any probabilistic polynomial time (Probabilistic Polynomial Time, PPT) attacker Given two distributions The advantage of distinguishing the above two distributions Will not exceed a negligible function negl(lambda).

[0056] q-SDH assumption. For any PPT attacker Given The advantage of successfully calculating (c, g 1 / (x+c) ) will not exceed a negligible function negl(lambda), wherein

[0057] 2. Identity-based careless pseudo-random function ​

[0058] Identity-Based Oblivious Pseudorandom Function (IBOPRF) makes a user holding a secret x obliviously generate a pseudorandom function value associated with the user ID by interacting with a server holding a secret K and satisfies that the user cannot learn the server's key K and the server cannot learn the user's secret x and the generated result As shown in Figure 1 .

[0059] Specifically, It is described as a challenge-response mechanism, including four statements The detailed description is as follows:

[0060] Input security parameter λ, The statement outputs a λ-length server key K and public parameters where p is a secure prime number, is a p-order multiplicative group, and H1, H2, H3 are three different hash functions.

[0061] The user initiates a challenge, calls the statement, generates the internal state and challenge according to the input (pp, ID, x). Save r on the user side and send ch to the server.

[0062] After receiving the challenge, the server calls the statement, calculates kid = H2(ID, k) and response value rp = a kid according to the input (pp, ch, K), and sends rp back to the user.

[0063] After receiving the response, the user reads the internal state r, calls the statement, calculates y = H3(x, rp 1 / r ) according to the input (pp, rp, r, x), which is the final output value.

[0064] IBOPRF scheme satisfies the following three securities:

[0065] (1) Uniqueness: It is said that the IBOPRF scheme satisfies uniqueness if the probability of output is negligible for any (ID', x') ≠ (ID, x).

[0066] (2) Pseudorandomness: an IBOPRF scheme is said to satisfy (d, B)-pseudorandomness if for any PPT adversary there exists a negligible function negl(λ) such that

[0067]

[0068] where denotes the distribution of x, d denotes the minimal entropy of the distribution S(·, ·) denotes a simulated server-side oracle Turing machine that, on input (pp, ch, K), computes while counting, limiting the number of queries to the same ID * to at most B times.

[0069] (3) Carelessness: an IBOPRF scheme is said to satisfy (d, k)-carelessness if for any PPT adversary

[0070] there exists a negligible function negl(λ) such that where denotes the distribution of x, d denotes the minimal entropy of the distribution k denotes the number of times the adversary queries y, and C(·) denotes a simulated user-side oracle Turing machine that, on each query, outputs

[0071] 3 Algebraic MAC

[0072] An algebraic MAC (Algebraic Message Authentication Codes) scheme is usually defined as a triple of algorithms whose general construction is as follows:

[0073] Initialization and key generation algorithm, input a security parameter λ, generate public parameters par and a secret key sk and pass par mac to the subsequent algorithms (explicitly or implicitly). mac

[0074] MAC algorithm, input secret key sk and message m, output a tag σ of m under sk.

[0075]

[0076] ​​​​​Verification algorithm, on input (sk, m, σ), verify whether σ is a valid tag for message m under key sk, if yes, return 1, otherwise return 0.

[0077] The present application instantiates the scheme based on the q-SDH assumption, and the specific description is as follows:

[0078] Input security parameter λ, The algorithm first generates a group element where p is a 2λ-bit secure prime number, is a p-order multiplicative group; randomly select Calculate w = g γ , let sk <- γ, output the key sk and public parameter

[0079] Input the key sk and the message The algorithm calculates A = g 1 / γ+m , let σ <- A and output the authentication tag σ.

[0080] For input (sk = γ, m, σ = A), The algorithm verifies whether A γ+m = g is established, if the equation is established, output 1, indicating that the authentication is passed; otherwise, output 0, indicating that the authentication fails.

[0081] Let denote the distribution of the message m, and Φ denote the distribution of the tag σ. The above The scheme satisfies the following properties:

[0082] (1) Key-parameter consistency (Key-Parameter Consistency): it is called that the key generation algorithm satisfies the key-parameter consistency, if for any sk ≠ sk', there is a negligible value ε, such that:

[0083]

[0084] (2)

[0085] suf-rmva security (Strongly Existentially Unforgeable under Random Message and Chosen Verification Queries Attack, suf-rmva): it is called that a scheme is suf-rmva secure if for any PPT adversary A, there is a negligible value ε, such that: ​A scheme is suf-rmva-secure if for any PPT adversary There exists a negligible function negl(λ) such that

[0086] where the oracle machine MAC(sk,*) chooses Computes and adds (m,σ) to the set Q, which is initialized to be empty at the beginning of the simulation. The oracle machine Verify(sk,*,*) outputs

[0087] (3) Weak Pseudorandomness: A scheme is said to have weak pseudorandomness if for any PPT adversary There exists a negligible function negl(λ) such that

[0088]

[0089] where the oracle machine MAC(sk,*) chooses and computes

[0090] 4 Non-Interactive Zero-Knowledge Proof

[0091] A non-interactive zero-knowledge (NIZK) proof scheme on a language L ∈ NP is usually composed of a pair of PPT algorithms The prover generates a proof via algorithm and sends it to the verifier, who verifies the proof via algorithm and outputs a Boolean value indicating acceptance or rejection, and satisfies the following properties:

[0092] (1) Completeness. For any x ∈ L (|x| = k) and its witness ω, it holds that

[0093]

[0094] (2) Soundness. For any PPT adversary There exists a negligible function negl(k) such that

[0095]

[0096] ​(3) Zero-knowledge. There exists a PPT simulator S, such that for any x∈L(|x|=k) and its witness σ, the following two distributions are computationally indistinguishable:

[0097]

[0098] {(r,π)←S(x):(r,x,π)}

[0099] where r represents a public random reference string.

[0100] If an NIZK proof scheme satisfies completeness and simulation-sound extractability (SE) simultaneously, it is called SE-NIZK proof scheme.

[0101] The present application is based on The present application instantiates an NIZK proof scheme and an SE-NIZK proof scheme based on the above-mentioned SPK and Cert schemes, respectively, for user registration (credential issuing) and identity authentication (credential submitting) at the cloud server side, and uses relevant notations, wherein ∑←SPK{(ω):statement} represents an SE-NIZK proof, Verify SPK (statement,∑) represents a verification algorithm for ∑; wherein π←NIZK{(ω):statement} represents an NIZK proof, Verify NIZK (statement,π) represents a verification algorithm for π. The specific description is as follows:

[0102] Credential issuing. Credential issuing refers to the process of issuing a credential σ authenticated by the private key sk to a registered user by the cloud server without leaking the private key sk. The process is implemented by an NIZK proof scheme, which consists of two algorithms (Cert,CertVerify):

[0103] (σ,π)←Cert(par mac ,sk,m): first, generate a credential by the SPK scheme: second, construct an NIZK proof Select Calculate R1=A r , R2=g r , c=H6(g,w,m,A,R1,R2) (H6 represents a hash function), s=r+cγmodp, and let π←(c,s). Return (σ,π).

[0104] {0,1}←CertVerify((par mac ​m, σ), π): on input ((par mac m, σ = A), π), construct the verification algorithm Verify NIZK ((par mac m, σ), π): compute c' = H6(g, w, m, A, A s+cm g -c , g s w -c ), if c' = c, return 1; otherwise, return 0.

[0105] Credential submission. Credential submission refers to the process in which a credential holder proves to the issuer that he holds the credential σ to verify the identity legitimacy without revealing the credential information. This process is implemented by the SE-NIZK proof scheme and consists of two algorithms (Show, ShowVerify):

[0106] υ <- Show(par mac m, σ): first construct the randomization algorithm Rerand to randomize the credential σ: (T, a) <- Rerand(σ): T <- A a . Then construct the SE-NIZK proof ∑ <- SPK{(m, a): f p (par mac T, m, a) = V}(f p () indicates that the parameters in the parentheses constitute a mapping relationship): first select Compute c <- H7(g, T, R) (H7 represents a hash function, and H1 to H7 represent different types of hash functions), s m <- r m + cm mod p, s a <- r a + ca mod p; let ∑ = (c, s m s a ), return υ = (T, ∑).

[0107] {0, 1} <- ShowVerify(par mac υ, sk): construct the verification algorithm Verify SPK (f v (par mac T, sk) = V, Σ)(f v () indicates that the parameters in the parentheses constitute a mapping relationship): first compute V <- T γ , c' <- H7(g, T, R'), if T ≠ 1 and c = c', return 1; otherwise, return 0.

[0108] We say that the above randomization algorithm Rerand is simulatable if there exists a simulator TVSim that, on input par mac , outputs (T, V). Where V' = f v (par mac , T', sk), and T' has the same distribution as T output by the randomization algorithm Rerand. Corresponding to the Rerand algorithm, there exists a Derand algorithm: σ ← Derand(T, a).

[0109] 5 Security Model

[0110] This section extends the security model of anonymous password authentication schemes, and defines a security model for analyzing the authentication security and anonymity of the anonymous password authentication and encryption (APADE) scheme for deduplication-oriented cloud storage systems.

[0111] 5.1 Authentication Security

[0112] Protocol participants. The participants of this scheme include three sets: user set Key server set Cloud server set For simplicity, it is usually assumed that the key server and cloud server sets each contain only one element, i.e.

[0113] Long-term key. Each user U in the user set holds a password pw U , the key server KS holds a private key K, and the cloud server CS holds a private key sk. Among them, the password pw U is uniformly taken from the dictionary space The private key K of KS is a high-entropy random number; the private key sk of CS is generated by The scheme, and its corresponding public parameters par mac are published to all protocol participants. In addition, KS stores a user credential list where cre C (U) is encrypted by the credential σ of user U using the strong password spw U and the private key K of KS. U

[0114] Protocol execution model. It is assumed that each participant can run multiple instances simultaneously, denoted as U i represents the i-th instance of user U, KS j represents the j-th instance of the key server KS, and CS k represents the k-th instance of the cloud server CS, and I represents any type of instance. The user and CS communicate through a TLS secure channel, so a PPT attacker​ While it's impossible to obtain honest communication information between the user and the client (CS) through eavesdropping, it's possible to launch proactive attacks, such as forging or deleting messages. Regarding communication between the user and the server (KS), attackers... Controlling the entire communication network allows for the eavesdropping, forging, deleting, and modifying arbitrary communication messages, as well as obtaining a user list. Specifically, the attacker's capabilities are formalized into the following queries:

[0115] Execute(U i KS j Simulated attacker Passive eavesdropping capability on protocol operation. Regarding this query, in user instance U... i Key server instance KS j Initiate an honest protocol execution and output all messages exchanged during the protocol process.

[0116] Send(I i ,m): This query simulates an attacker. Its proactive attack capabilities. Attacker To the agreement participants I i Send message m, output I i The response message to message m.

[0117] Corrupt(I): This query simulates an attacker. The ability to corrupt protocol participant I. For the query `Corrupt(U)`, output the password `pw` for user U. U i A query for Corrupt(KS) outputs the private key K of the key server instance KS and the stored list of users. Querying Corrupt(CS) will output the private key sk of the cloud server CS.

[0118] Definition 1 (Authentication Security). Given a scheme The incident Indicates attacker Successful counterfeit collection A user in the cloud server authenticates and establishes a session. Indicates PPT attacker sabotage plan Advantages of authentication security. (Referred to as the solution) This achieves secure authentication between the user and the cloud server, preventing attacks from any PPT attacker. There exists a negligible function negl(λ) such that:

[0119]

[0120] Where qs denotes an attacker the number of times Send queries are initiated, denotes the size of the dictionary space.

[0121] 5.2 Anonymity

[0122] Protocol participants. The participants of our scheme consist of three sets: the set of users the set of key servers the set of cloud servers

[0123] Long-term keys. Each user U in the set of users holds a password pw U , the key server KS holds a private key K and a list of user credentials (wherere U is used to count the number of times a MLE key is requested), and the cloud server CS holds a private key sk. The elements cre C (U) in the list of user credentials are initialized to C (U) by invoking the Reg query. The attacker is allowed to obtain the cloud server private key sk.

[0124] Protocol execution model. At the beginning of the execution of the protocol, a random bit b← $ {0, 1} is generated. The capabilities of a PPT attacker are formalized as the following queries:

[0125] Reg(U): This query models the ability of an attacker to invoke the registration algorithm. For and cre C (U) =, this query makes the user U invoke the registration algorithm, generate and output the encrypted credential cre C (U).

[0126] TestAnonymity(U i ,U j ): This query is used to characterize the anonymity of a user. For a user and cre C (U i ) =, cre C (U j ) =, according to the pre-generated random bit b, if b = 1, the oracle returns that U i ,U j are the same user, and if b = 0, it returns that they are not the same user. This query is only allowed to be sent once.

[0127] Definition 2 (Anonymity). Given a scheme Let event denote an attacker guesses the random bit b in TestAnonymity query correctly, denote a PPT attacker breaks the anonymity of the scheme . We say a scheme satisfies user-to-cloud server anonymity if for any PPT attacker there exists a negligible function negl(λ) such that

[0128]

[0129] 6 Scheme construction

[0130] This section constructs an anonymous password authentication and encryption method for deduplication cloud storage system according to security assumptions and components, including registration, MLE key generation and data upload, data download three stages, as shown in Figure 2 , specifically including:

[0131] Step S1: User U registers to cloud server CS and obtains an authentication credential σ and the corresponding non-interactive zero-knowledge proof π; User U verifies the validity of σ by using π and public parameters, and after verification, uses the strengthened password spw U generated by the key server KS to encrypt σ, and stores it in KS;

[0132] Step S2: Based on the encrypted σ, generate MLE key through U, CS and KS, and use MLE key to encrypt and upload data file M, and perform deduplication operation for encrypted data on the cloud storage server side;

[0133] Step S3: User U completes authentication to cloud server CS and recovers data file M with the assistance of key server KS.

[0134] Before step S1, it also includes:

[0135] Initialization phase. Set public parameters λ, H1, H2, H3, H4, H5, h, E, where λ is a security parameter, p is a secure prime number of λ bits, is a p-th order multiplicative group, and hash functions H5, H1, H2, H3, H4 denote different kinds of common hash functions. E is a symmetric encryption function which is IND-CPA (indistinguishability under chosen-plaintext attack) secure, c = E.enc(k, m) denotes the encryption of plaintext m using key k, and outputs ciphertext c; m = E.dec(k, c) denotes the decryption of ciphertext c using key k, and outputs plaintext m. The key server holds the private key (K, a1), and the cloud server holds the private key (sk, a2), where K is a high-entropy random number, and sk is generated by Algorithm generation, The server uses the same private key for different users.

[0136] Further, the registration phase includes:

[0137] The user U registers to the cloud server CS and obtains an authentication credential σ and a corresponding non-interactive zero-knowledge (NIZK) proof π; the user U verifies the validity of σ using π and public parameters, and after verification, uses the enhanced password spw U generated by the key server KS to encrypt σ and store it in the KS, as shown in Figure 3 , including:

[0138] S101: The user U calls the IBOPRF (ID U , pw U ) to obtain the enhanced password spw U ; calculates the message m = h(ID U ) and sends it to the CS for registration;

[0139] S102: The CS generates the credential σ and the proof π for the user U using the Cert algorithm;

[0140] S103: After receiving (σ, π), the user U verifies σ using the CertVerify algorithm; after verification, the user uses spw U to encrypt σ and obtains Send to the KS for storage;

[0141] S104: If the user U is registered to the KS for the first time, the KS creates a list for the user U to store the encrypted credential of the user U, and initializes p U = 0, and counts the number of requests for MLE keys through p U , otherwise the registration fails.

[0142] Further, the MLE key generation and data upload phase includes:

[0143] This stage is divided into two parts: MLE key generation and data upload. After the data is uploaded, deduplication can be performed on the encrypted data on the cloud storage server. Specific steps are as follows: Figure 4 As shown.

[0144] Furthermore, the MLE key generation section includes:

[0145] S201: User U calls IBOPRF(ID) U ,pw U ), obtained the enhanced password spw U At the same time, from the user list stored in KS retrieve Use spw U right Decrypt and recover credentials σ;

[0146] S202: User U calculates m = h(ID) U The Show algorithm is used to generate a proof υ for (m,σ), which is then sent to the CS for authentication. Simultaneously, the file M to be encrypted is randomized. Send M1 and M2 to KS and CS respectively;

[0147] S203: Upon receiving the message, CS first verifies υ using the ShowVerify algorithm. After successful verification, it calculates using the held secret α2. At the same time, KS uses α1 to calculate The number of requests is counted; CS and KS send KM1 and KM2 to U respectively;

[0148] S204: User U calculation This is the MLE key.

[0149] Furthermore, the data upload component includes:

[0150] S205: After generating the MLE key, user U encrypts file M locally using the MLE key: C M =E.enc(KM,M), and calculate the corresponding ciphertext tag.

[0151] S206: User U utilizes spw U Calculate two distinct keys κ U , For KM, Encryption: C KM =E.enc(κ) U (KM),

[0152] S207: Will Send to KS and save. Will Send to CS for storage, where These tags are used as storage labels for subsequent retrieval and deduplication.

[0153] Furthermore, the data deduplication process includes:

[0154] S208: After data upload, CS checks the tags. Check if the data already exists. If it does, perform data deduplication and continue maintaining a new one. List; otherwise, create List;

[0155] S209: For users who subsequently upload ciphertext C', CS check. Check if the condition is met. If it is, perform data deduplication; otherwise, create a new list for C'.

[0156] Furthermore, the data download phase includes:

[0157] During this stage, with the assistance of the key server KS, the user completes authentication with the cloud server CS and recovers the data file M. Specific steps are as follows: Figure 5 As shown, it includes:

[0158] S301: User U calls IBOPRF(ID) U ,pw U ), obtained the enhanced password spw U Meanwhile from the list retrieve

[0159] S302: U uses spw U right Decrypt and recover the credential σ; calculate m and use the Show algorithm to generate proof υ for (m,σ); use spw U recovery key κ U And on C KM Decrypt and restore tags With KM; will Send to CS for authentication and file retrieval;

[0160] S303: CS received Then, the ShowVerify algorithm is used to verify υ; if the verification passes, the label is used. Search Retrieve C from the list M And send it to U;

[0161] S304: U uses KM to C M Decrypt to obtain file M.

[0162] 7. Security Certificates

[0163] This section presents the proposed solution (hereinafter referred to as the solution). The security proof of the key server. It primarily considers two types of attackers: corrupted key servers. Malicious but rational cloud servers in The primary targets of these attacks are obtaining file information and guessing user passwords. Its security is mainly characterized by the confidentiality and authentication security of the MLE. The attack primarily targets user privacy violations, including obtaining outsourced file data and compromising user anonymity, but it does not disrupt the normal execution of the protocol or the integrity of the stored data. The security of MLE is mainly characterized by the confidentiality of the MLE and the anonymity of the authentication. Theorems 1, 2, and 3 provide proofs for confidentiality, authentication security, and anonymity, respectively.

[0164] Theorem 1 (Confidentiality). If the DDDH assumption is in a cyclic group... If the IBOPRF mechanism constructed in this invention satisfies both pseudo-randomness and unintentionality, then the scheme is valid. Meet the requirements of cloud servers and key server The confidentiality of the information. And it satisfies:

[0165]

[0166] in Indicates PPT attacker sabotage plan The advantage of confidentiality, q s express The number of times online attacks were launched. ε represents the distribution of file M, where ε is a negligible value.

[0167] Proof: First, we prove the scheme using a simulated game based on indistinguishability. Capable of accessing cloud servers Confidentiality.

[0168] The incident express Win the following indistinguishable games. Game participants include... The game execution process is as follows, using the ε environment and the Sim emulator:

[0169] 1) ε calling scheme and initialize, generate public parameters and a1, a2, send a2 to

[0170] 2) Randomly select a file Send M * to Sim, Sim sends M * to ε.

[0171] 3) ε randomly selects Calculate Send M2 * to Sim, Sim sends it to

[0172] 4) Calculate Send KM2 * to Sim, Sim sends it to ε.

[0173] 5) ε calculates Send KM * to Sim, Sim sends it to

[0174] 6) Repeat steps 2) to 5) at most polynomial times. Then Randomly select and send it to Sim, Sim sends it to ε.

[0175] 7) ε randomly selects b <- {0,1}, If b = 0, then ε calculates Otherwise, ε randomly selects where is a random bit string space of the same length as . Then send to Sim, Sim sends it to

[0176] 8) Select b' <- {0,1}, call win the above indistinguishability game if and only if b' = b.

[0177] Suppose win the above indistinguishability game with probability , then this means win the game with advantage , which violates the correctness of the DDDH assumption. Therefore, there exists a negligible value ε, such that Thus: Therefore, cloud servers Information about file M cannot be obtained through the MLE key generation process. Only online dictionary attacks can be launched against file M, with advantages at most... A negligible amount.

[0178] Similarly, key server It is also impossible to obtain information related to file M through the MLE key generation process. Furthermore, due to the unintentional nature of IBORF... Unable to use enhanced passwords spw U Make the correct guess, thus preventing it from being stored in C KM Obtain KM. Therefore, the solution is... It also has access to the key server. Confidentiality.

[0179] Q.E.D.

[0180] Theorem 2 (Authentication Security). If the IBOPRF mechanism satisfies pseudo-randomness and unintentionality, the mechanism constructed in this invention... The scheme satisfies SUFF-RMVA security and weak pseudo-randomness. The SPK proof constructed in this invention is an SE-NIZK proof, the E1 encryption algorithm is CPA-secure, h(·) is a random oracle machine, and PPT attackers... At most q s If we send a query twice, then the solution is... Ensures secure authentication between users and the cloud server. And satisfies:

[0181]

[0182] in Indicates attacker It compromises the security of user authentication to cloud servers.

[0183] Proof: The proof of Theorem 2 is given below through a series of simulated games G0, G1, ..., G6. Game G0 simulates attacks in a real-world environment, thus... In G0, the attacker Granted access to the list stored in the key server KS The ability.

[0184] Game G1: Modify the generation method of the credential υ by defining a simulator Sim and a extractor Ext. Since the SPK proof has complete, simulatable extractability (SE), a simulator Sim can be defined. Using the mentioned simulator TVSim, the input par... mac Output: (T',V')←TVSim(par mac), where T' has the same distribution as T output by the randomizer Rerand. From (T', V'), the simulator Sim generates a proof ∑' <- Sim(par mac , T', V') and outputs the credential υ = (T', ∑'). Then define the extractor Ext that first extracts the corresponding witness (m', a') from the credential υ and then computes σ' <- Derand(T', a') by the Derand algorithm and outputs (m', σ') <- Ext(par mac , υ). If T' does not satisfy the same distribution as T, then Ext returns invalid.

[0185] In G1, if one of the following happens, then the authentication is rejected and the game is terminated: or Ext returns invalid. Therefore, unless the extractability or the simulatability of the SPK proof scheme is broken, G1 is indistinguishable from G0. Thus we have: where denotes the advantage of an algorithm that breaks the zero-knowledge property of the SPK proof scheme, denotes the advantage of an algorithm that breaks the extractability of the SPK proof scheme.

[0186] Game G2: Based on G1, the following modifications are made:

[0187] (1) The hash function h(·) is simulated as a random oracles The rules are as follows: initialize a list For any hash query if there exists a record (id, m) in the list , return m; otherwise randomly select return m and add (id, m) to the list

[0188] (2) When the following happens, the authentication is rejected and the game is terminated: For the submitted credential υ, the extractor Ext(par mac , υ) outputs where the set Q is obtained as follows:

[0189] Let the algorithm simulate the execution of the attacker in G1, while making queries to the oracle MAC(sk, *) and Verify(sk, *, *) as follows:

[0190] (1) For i ∈ [N], query to get m iThen query the MAC(sk,*) machine for m. i For each query, MAC(sk,*) is calculated. and (m) i ,σ i Add to set Q.

[0191] (2) For the extractor Ext at input (par) mac Any (m',σ') pair output under υ) Initiate a query (m',σ') to the oracle machine Verify(sk,*,*). The query will proceed if and only if it returns a response. hour, Accept υ, otherwise reject.

[0192] Since h(·) can be considered a random oracle, modifying (1) will not change the attacker. Advantages; The scheme satisfies SUF-RMVA security, therefore G2 is no different from G1 unless SUF-RMVA security is violated, thus:

[0193] Game G3: Same as G2, except the game ends when the following collision occurs: for i,j∈[N], if i≠j, but m holds true. i =m j Therefore:

[0194] Game G4: Based on G3, for i∈[N], σ in i Change to a random value r i ← $ Φ. For (m,σ)←Ext(par) mac ,υ), if m=m i , i∈[N], if and only if σ=r i If the authentication is rejected, the game will be terminated.

[0195] according to The scheme exhibits weak pseudo-randomness: in Representation Algorithm destroy The advantage of the scheme's weak pseudo-randomness.

[0196] Game G5: Based on G4, the following modifications were made:

[0197] (1) Simulate the IBORPF mechanism as a random oracle machine The rules are as follows: Initialize a list For query If there exists (id, x, y) in the list, return y; otherwise randomly pick y← $ Γ, return y and add (id, x, y) to the list where Γ denotes the distribution of spw U .

[0198] (2) For i ∈ [N], the attacker can query and get y i . In the following case, reject the authentication and terminate the game: for i, j ∈ [N], if i≠j, but y i = y j .

[0199] The occurrence of the above case means that the pseudo-randomness and the carelessness of the IBOPRF mechanism are broken. Thus we have

[0200] where denote the advantage of the algorithm that breaks the pseudo-randomness and the carelessness of the IBOPRF mechanism, respectively.

[0201] Game G6: On the basis of G5, for i ∈ [N], change to a random value where denotes the ciphertext space, and reject the authentication request initiated by the attacker who impersonates any legitimate user. Since the encryption algorithm E satisfies the CPA security, G5 and G6 have the same distribution, unless the CPA security of the encryption algorithm E is broken. Thus we have:

[0202] where denotes the advantage of the algorithm that breaks the CPA security of the encryption algorithm E1.

[0203] So far, the information related to the credential υ has been completely replaced by random values, and the user cannot obtain any useful information through passive attacks, but can only initiate an online dictionary attack on the password through Send queries. Therefore

[0204] In summary,

[0205]

[0206] Q.E.D.

[0207] ​Theorem 3 (Anonymity). If the NIZK proof scheme constructed by the present application satisfies soundness, the SPK proof scheme satisfies zero-knowledge, the label randomization algorithm Rerand satisfies simulatability, and the key generation algorithm satisfies consistency, then the scheme satisfies user-to-key server anonymity, and satisfies:

[0208]

[0209] where denotes a PPT attacker that breaks the advantage of the scheme in user-to-cloud server authentication anonymity.

[0210] Proof: The proof of Theorem 3 is given below by a series of game simulations G0,..., G3. Let event denote a PPT attacker that succeeds in guessing the random bit b in the TestAnonymity query in game G i . Game G0 simulates the attack in the real environment, so that

[0211] Game G1 : The same as G0, except that the game is terminated when the following occurs: in the credential issuing process, if a user accepts a label σ on a message m and the corresponding credential π * , i.e., Verify NIZK ((par mac , m, σ), π * ) = 1, but At this time, unless the soundness of the NIZK proof scheme is broken, G1 is not different from G0. Thus where denotes an algorithm that breaks the soundness of the NIZK proof scheme.

[0212] Game G2 : Based on G1, the following modification is made: using a PPT simulator S, for any input, output ∑', and replace ∑ in the protocol process with ∑'. Unless the zero-knowledge of the SPK proof scheme is broken, the distribution of ∑' and ∑ is computationally indistinguishable. Thus where denotes an algorithm that breaks the zero-knowledge of the SPK proof scheme.

[0213] Game G3 : Based on G2, the following modification is made: using a simulator TVSim, for input par mac, output (T', V'), replace (T, V) in the protocol process with (T', V'). Since the SPK proof scheme is simulatable, T' has the same distribution as T. Thus, there exists a negligible function negl(λ) such that

[0214] At this point, all user-related information in the credential υ computation process has been replaced with random values, and the cloud server cannot distinguish whether it comes from different users, i.e., there is a negligible function negl(λ) such that where λ is a security parameter.

[0215] In summary:

[0216]

[0217] Q.E.D.

[0218] 8 Experimental simulation and efficiency analysis

[0219] This section verifies the effectiveness of the proposed scheme under the simulation environment, and further compares and analyzes the proposed scheme and the SPADE scheme [document 2] from the aspects of computational efficiency, communication efficiency, security, etc. The simulation environment is VMware, Core TM i7-9700 CPU @ 3.00 GHz, 15.6 GiB memory, Ubuntu 18.04.6 LTS 64-bit operating system, the experimental code is written in Python language and is designed based on Charm, Crypto, etc.

[0220] 8.1 Comparison of computational and communication efficiency

[0221] Table 1 shows the comparison of computational complexity between the APADE scheme and the SPADE scheme, where the number represents the number of times of using the corresponding operation or algorithm, and “-” represents not using this operation or algorithm, and n represents the number of key servers. Table 2 shows the comparison of computational delay, communication overhead, storage overhead, etc. in the simulation experiment, where R represents the registration stage, KG&DU represents the MLE key generation and data upload stage, and DA represents the data download stage. The communication overhead of each stage is shown. The security parameter is set to 1024, the file size is set to 10M, the user ID is set to a random string of 10 bytes, and the length of the encryption key (including the MLE key) is set to 256 bits. In order to more intuitively show the comparison of communication and storage overhead, the communication and storage overhead of the encrypted file are not included. In addition, according to document A, the number of key servers in the SPADE scheme is usually set to n = 30.

[0222] According to the comparison results in Table 1 and Table 2, the calculation delay of the APADE scheme is lower than that of the SPADE scheme, because the APADE scheme avoids multiple signing / verification, symmetric encryption / decryption operations and secret sharing algorithms caused by the threshold scheme, although the modular exponentiation and NIZK proof are used, the calculation efficiency is still improved to a certain extent.

[0223] In terms of communication efficiency, according to Table 2, when n≥2, the communication round and communication overhead of the SPADE scheme are always greater than those of the APADE scheme. Therefore, in terms of communication efficiency, the APADE scheme has obvious advantages.

[0224] In terms of storage overhead, according to Table 2, the storage overhead of the APADE scheme on the cloud server is lower and the overhead on the key server is higher, because the APADE scheme stores the login credentials and MLE keys on the key server, while in the SPADE scheme, the MLE keys are stored on the cloud server, so the storage overhead of the APADE scheme on the cloud server is lower. Overall, in terms of storage overhead of a single key server and cloud server, the two schemes are basically equivalent.

[0225] Table 1 Comparison of calculation complexity with SPADE scheme

[0226]

[0227] Table 2 Comparison of calculation delay, communication overhead and storage overhead with SPADE scheme

[0228]

[0229] 8.2 Security comparison

[0230] Table 3 compares the MLE scheme, the DupLESS scheme [Keelveedhi S, Bellare M, Ristenpart T. DupLESS: Server-Aided Encryption for Deduplicated Storage [C]. 22nd USENIX Security Symposium (USENIX Security 13), 2013: 179-194.], the SPADE scheme and the APADE scheme proposed in the present application in terms of security. Five aspects are mainly considered: whether the scheme is resistant to brute force attack, whether it solves the single point failure problem, whether it has key management problem, whether it provides anonymous authentication, and whether it has provable security. “-” indicates that there is no such security problem.

[0231] According to Table 3, the APDADE scheme provides security against brute force attacks, single point failures, etc., like the SPADE scheme, and avoids the problem of local key management of users. At the same time, compared with the SPADE scheme, the APDADE scheme increases anonymous authentication and proves its security in the random oracle model. Therefore, compared with the SPADE scheme and other similar schemes, the APDADE scheme has higher security.

[0232] Table 3 Comparison of security of similar schemes

[0233]

[0234] In summary, in view of the security problems such as vulnerability to brute force attacks, single point failures, lack of privacy protection, etc. in the deduplication cloud storage system, the application provides an anonymous password authentication and deduplication cloud data encryption scheme. The double-server assisted message lock encryption is used to resist brute force attacks and single point failures, and the complex system architecture and deployment cost are not required. The anonymous authentication based on the non-interactive zero-knowledge proof scheme is used to protect the privacy of the user identity information. The confidentiality, authentication security and anonymity of the scheme are proved in the random oracle model. The effectiveness of the scheme is proved in the simulation experiment environment. The experimental and comparative analysis results show that, compared with similar schemes, the scheme has higher security with higher calculation and communication efficiency, and reduces the deployment and maintenance cost.

[0235] The above only shows the preferred embodiments of the application, and it should be noted that for ordinary skilled persons in the art, some improvements and refinements can be made without departing from the principles of the application, and these improvements and refinements should also be considered as the protection scope of the application.

Claims

1. An anonymous password authentication and encryption method for a deduplication-oriented cloud storage system, characterized in that, The application relates to a method for realizing a user's data file encryption and storage in a cloud storage system. Step 1: a user U registers to a cloud server CS and obtains an authentication credential sigma and a corresponding non-interactive zero-knowledge proof pi; The user U verifies the validity of σ with π and the public parameter, and after the verification, uses the strengthened password spw generated with the assistance of the key server KS U σ is encrypted and stored in KS; Step 2: based on the encrypted sigma, an MLE key is generated by the three parties of U, CS and KS, and the data file M is encrypted and uploaded by using the MLE key, and a deduplication operation is performed on the encrypted data at the cloud storage server end; Step 3: the user U completes authentication to the cloud server CS and recovers the data file M with the aid of the key server KS; The step 1 comprises: Step 1.1: User U invokes IBOPRF(ID U , pw U ) and gets a strong password spw U ; Compute message m = h(ID U ), send to CS for registration; wherein IBOPRF() represents an identity-based oblivious pseudo-random function, ID U represents a user ID, pw U represents a password, p is a prime number, and Z represents an integer set; Step 1.2: the CS generates a credential sigma and a non-interactive zero-knowledge proof pi for the U by using a Cert algorithm; Step 1.3: Upon receiving (σ, π), the user U verifies σ using the CertVerify algorithm; upon successful verification, the user uses spw U Encrypts σ to obtain the encrypted credential Encrypts Send to KS store; Step 1.4: If the user U is registering to the KS for the first time, the KS creates a list of user credentials for him Store the encrypted credentials of the user U, while initializing p U = 0, by p U Count the number of requests for MLE keys, else registration fails; In the step 2, the MLE key is generated in the following manner: Step 2.1: User U invokes IBOPRF(ID U , pw U ) and gets a strong password spw U , while retrieving from the list of user credentials stored in KS Decrypted using spw U , the credential σ is recovered;​ Step 2.2: User U computes m = h(ID U ), generates proof υ for (m, σ) using Show algorithm, and sends υ to CS for identity verification; meanwhile, randomizes the file M to be encrypted: Sends M1 and M2 to KS and CS respectively; wherein the hash function is a p-th power cyclic group; Step 2.3: After receiving the message, the CS first verifies υ by using the ShowVerify algorithm, and after verification, uses the held secret α2 to calculate Meanwhile, the KS uses α1 to calculate and counts the number of requests; the CS and the KS send KM1 and KM2 to the U, respectively; Step 2.4: User U computes KM is the MLE key.

2. The anonymous password authentication and encryption method for deduplication-oriented cloud storage system according to claim 1, characterized in that, In the step 2, the encrypted data file M is uploaded by using the MLE key, which comprises: Step 2.5: After the MLE key is generated, the user U encrypts the file M locally using the MLE key to obtain the ciphertext C M : C M = E.enc(KM, M), and calculates the corresponding ciphertext tag where E is a symmetric encryption function that is indistinguishable under chosen-plaintext attack, E.enc(KM, M) represents encryption of plaintext M using the MLE key, and H5 represents a hash function; Step 2.6: User U utilizes spw U Compute two different keys For KM, Encrypt, get corresponding ciphertext: C KM = E.enc(κ U , KM), Where ID CS represents the cloud server ID, ID KS represents the key server ID, represents the hash function; Step 2.7: The cipher text is sent to KS and stored in The is sent to CS for storage.​ 3.The anonymous password authentication and encryption method for deduplication-oriented cloud storage system according to claim 2, characterized in that, In the step 2, the deduplication operation is performed on the encrypted data at the cloud storage server end, which comprises: Step 2.8: After data upload, CS checks the tags If already exists, if exists, perform data deduplication, continue to maintain a list; otherwise, create list; Step 2.9: For the user uploading the ciphertext C' subsequently, CS checks whether it is true, if true, then performs data deduplication, otherwise, creates a new list for C'.

4. The anonymous password authentication and encryption method for deduplication-oriented cloud storage system according to claim 2, characterized in that, The step 3 comprises: Step 3.1: User U invokes IBOPRF(ID U , pw U ) and gets a strong password spw U , while retrieving from the list Step 3.2: U uses spw U To Decrypt, recover credential σ; compute m and generate proof υ using Show algorithm on (m, σ); use spw U Recover key κ U And to C KM Decrypt, recover label With KM; send To CS for authentication and file retrieval; Step 3.3: CS receives After, the ShowVerify algorithm is used to verify u, and if it is verified, the label Retrieval List retrieval C M and sends to U; Step 3.4: U uses KM on C M Decrypt to get file M.

5. The anonymous password authentication and encryption method for deduplication-oriented cloud storage system according to claim 1, characterized in that, The step 1.2 comprises: First, by algebra The scheme generates a credential: denote an input key sk and a message The algorithm computes A = g 1 / γ+m , let σ <- A and output the authentication tag σ; where where denote an algebraic scheme; Secondly, construct a non-interactive zero-knowledge proof scheme Select Calculate R1 = A r , R2 = g r , c = H6(g, w, m, A, R1, R2), s = r + c gamma mod p, let pi <- (c, s), return (sigma, pi); wherein, pi <- NIZK{} represents a non-interactive zero-knowledge proof; Indicates that for the input sk = gamma, m, sigma = A, Algorithm verifies whether A γ+m = g is correct, if the equation is correct, the output is 1, indicating that the authentication is passed, otherwise the output is 0, indicating that the authentication fails; Indicates that the input security parameter lambda, Algorithm first generates group elements Where p is a 2 lambda bit safe prime number, G is a group of p order, g is the generator of group G; randomly select Calculate w = g γ , let sk <- gamma, output the key sk and public parameter H6 represents a hash function.

6. The anonymous password authentication and encryption method for deduplication-oriented cloud storage system according to claim 5, characterized in that, In the step 1.3, the user U verifies the sigma by using a CertVerify algorithm, which comprises: On input ((par mac ,m,σ),π), the verification algorithm Verify NIZK ((par mac ,m,σ),π) computes c' = H6(g,w,m,A,A s+cm g -c ,g s w -c ) and returns 1 if c' = c, and 0 otherwise.

7. The anonymous password authentication and encryption method for deduplication-oriented cloud storage system according to claim 6, characterized in that, In the step 2.2, the proof u is generated for (m, sigma) by using a Show algorithm, which comprises: First, construct a randomization algorithm Rerand to randomize the credential σ, (T, a) <- Rerand(σ): T <- A a ; then construct an SE-NIZK proof scheme ∑ <- SPK{(m, a): f p (par mac , T, m, a) = V}: first select Calculate c <- H7(g, T, R), s m <- r m + cmmodp, s a <- r a + camodp; let ∑ = (c, s m , s a ), return υ = (T, ∑); where ∑ <- SPK{} represents an SE-NIZK proof, H7 represents a hash function, f p () represents that the parameters in the parentheses constitute a mapping relationship.

8. The anonymous password authentication and encryption method for deduplication-oriented cloud storage system according to claim 7, characterized in that, In the step 2.3, the verification of the proof u is performed by using a ShowVerify algorithm, which comprises: Construction of the verification algorithm Verify SPK (f v (par mac , T, sk) = V,∑): first compute V <- T γ , c' <- H7(g, T, R'), if T≠1 and c = c', return 1; otherwise return 0; where f v () represents that the parameters in the parentheses constitute a mapping relationship.

Images