Methods to defend against ownership spoofing attacks in multimedia data deduplication systems

Abstract

This invention discloses a method for defending against ownership spoofing attacks in a multimedia data deduplication system. The method includes: a client using a user password as a private key to generate a mask and hash value for file data blocks, constructing a Merkle tree, and sending a commitment value to a server; the server receiving the commitment value, generating challenge information, and sending it to the client; the client generating a random index based on the challenge information, extracting sibling paths from the Merkle tree as proof, and sending it to the server; the server recalculating the hash value based on the challenge information and the client's private key, reconstructing the Merkle tree using the sibling paths, and comparing it with the client's commitment value for verification. This invention not only considers more complex attack scenarios but also demonstrates excellent performance and effectiveness in practical applications. It provides strong protection for user data while ensuring efficient system operation.

Description

Technical Field

[0001] This invention relates to the field of information security protection technology, and in particular to a method for resisting ownership fraud attacks in a multimedia data deduplication system. Background Technology

[0002] With the rapid development of digital and multimedia technologies, the amount of multimedia data on the internet and various devices is exploding. This multimedia data exists in the form of audio, video, and images, not only occupying huge storage space but also often exhibiting high redundancy due to its inherent characteristics. This redundancy manifests as multiple copies of the same data or significant similarities between multiple data sets. This rapidly growing data volume places enormous storage pressure on cloud service providers; therefore, effectively improving storage efficiency has become an urgent problem to be solved.

[0003] Data deduplication technology, as an effective means to solve this problem, has received widespread attention and application. Through data deduplication, cloud servers can identify a large amount of redundant parts in multimedia data and retain only one copy, thus significantly saving storage space. This technology is of great significance for improving the storage efficiency of cloud services and reducing operating costs.

[0004] In multimedia data deduplication practices, depending on the entity performing the deduplication, two main approaches can be adopted: server-side deduplication and client-side deduplication. Server-side deduplication typically involves the client transmitting the complete file to the server. The server receives the file, divides it into smaller data blocks, and calculates a fingerprint for each block using a hash function. If the fingerprint of a data block matches a fingerprint in the already saved fingerprint set, the data block is considered a duplicate and does not need to be saved again; otherwise, the server saves the data block and adds its fingerprint to the fingerprint set. This approach effectively removes data redundancy but may increase the bandwidth requirements for data transmission.

[0005] To reduce bandwidth pressure, client-side deduplication solutions have emerged. In client-side deduplication, file segmentation and fingerprint calculation are both performed by the client. The client transmits the calculated fingerprint to the server, which then determines whether the corresponding data block is duplicated. If the data block is duplicated, the client does not need to transmit the entire file to the server, thereby reducing data transmission volume and saving bandwidth. However, client-side deduplication solutions also face some inherent security vulnerabilities, the most concerning of which is ownership spoofing attacks.

[0006] The core of ownership fraud attacks lies in the fact that attackers only need to obtain the fingerprint of a file to successfully upload it and download its contents, even if they initially do not know the full content. This type of attack can lead to the following serious consequences: First, attackers may access files belonging to other legitimate users, such as personal photos and videos, resulting in the leakage of user privacy data; second, there may be an accomplice actively assisting the attacker, such as by proactively leaking file fingerprints to utilize the high bandwidth provided by cloud servers for sharing large or infringing files.

[0007] To combat ownership fraud attacks, academia has proposed an ownership proof mechanism. When a client uploads a duplicate file, this mechanism helps the server verify whether the client truly owns the entire file content. This is typically an interactive protocol process where the server issues challenges to the client, and the client needs to calculate the corresponding response based on these challenges and the file content. However, existing ownership proof mechanisms are based on models that do not account for the existence of online colluders who may provide assistance in real time during the protocol's execution, making existing mechanisms vulnerable to attacks in certain scenarios.

[0008] Therefore, developing a novel defense method against ownership fraud attacks involving online collusion is particularly important. This method needs not only to effectively identify the attacker's fraudulent activities but also to counter collusion and ensure the security and privacy of user data. Summary of the Invention

[0009] In view of this, the present invention proposes a method to defend against ownership fraud attacks in a multimedia data deduplication system, in order to solve the problem of insufficient verification mechanism in existing data deduplication technologies.

[0010] The specific technical solution of this invention is as follows:

[0011] Methods to defend against ownership spoofing attacks in multimedia data deduplication systems include:

[0012] Step 1: The client uses the user's password as a private key to generate a mask and hash value for the file data blocks, constructs a Merkle tree, and sends the commitment value to the server;

[0013] Step 2: After receiving the commitment value, the server generates challenge information and sends it to the client;

[0014] Step 3: The client generates a random index based on the challenge information, extracts the sibling path in the Merkle tree as proof, and sends it to the server;

[0015] Step 4: The server recalculates the hash value based on the challenge information and the client's private key, reconstructs the Merkle tree using the sibling path, and compares it with the client's commitment value for verification.

[0016] Specifically, in step 1, the client uses the login password set by the user as a private key, which can be accessed by a trusted enclave on the server.

[0017] Specifically, in step 1, the client divides the file to be verified into multiple file data blocks; for each data block, the client uses a private key and a random value received from the server to encrypt an integer sequence using the symmetric encryption algorithm AES until the length of the resulting ciphertext is not less than the length of the data block, and then extracts the first part of the ciphertext as a bit string equal to the length of the data block as the mask of the file data block.

[0018] Specifically, in step 1, the client XORs each mask with the corresponding file data block content and applies the hash function SHA-256 to the XOR value to obtain the hash value of each file data block.

[0019] Specifically, in step 1, the client uses the obtained hash value sequence as the leaf node of the Merkle tree, builds the Merkle tree from bottom to top, and sends the root node value of the Merkle tree as the commitment value to the server.

[0020] Specifically, in step 2, the server determines the challenge information according to the algorithm. The challenge information includes a random number seed and the number of data blocks to be challenged. The number of data blocks to be challenged is determined based on security parameters and the number of file data blocks contained in the file to be verified.

[0021] Specifically, in step 3, the client uses a random number generation function, taking the random number seed in the challenge information as input, to generate one or more random indices ranging from 0 to the total number of file data blocks minus 1.

[0022] Specifically, in step 3, the client extracts the sibling paths of the leaf nodes corresponding to the random indices from the Merkle tree and sends these sibling paths as proof to the server.

[0023] Specifically, in step 4, the server uses the same random number generation function and the previously selected seed to generate random indices; the server reads the corresponding data blocks from the disk into the enclave based on the random indices and the client's private key, and generates a mask; the server XORs the mask with the data block content and applies a hash function to obtain the calculated hash value.

[0024] Specifically, in step 4, the server recalculates the root node value of the Merkle tree from bottom to top based on the received sibling path and the calculated hash value; the server compares the calculated root node value of the Merkle tree with the commitment value sent by the client, and if the two match, the verification is successful.

[0025] The beneficial effects of this invention are as follows:

[0026] (1) This invention considers a more robust threat model for ownership fraud attacks, namely, the existence of a conspirator capable of providing real-time assistance to the attacker. This assumption enables the invention to address more complex attack scenarios. Compared to existing solutions, this invention expands the scope of the threat model by introducing the concept of an online conspirator, thereby improving system security.

[0027] (2) This invention combines each user's private key and mask with a cryptographic commitment scheme to construct a secure solution. This scheme can effectively resist ownership fraud attacks while protecting user data. By using cryptographic techniques, this invention ensures the confidentiality and integrity of user data and improves the overall security of the system.

[0028] (3) This invention eliminates the need for the server to read the entire file when verifying user ownership. This design reduces the server's computational burden and improves the efficiency of the verification process. By verifying only a portion of the file's content, this invention achieves efficient user ownership verification and reduces system overhead.

[0029] (4) The proposed solution requires less additional communication bandwidth, which means that the system has lower network transmission overhead. The efficient data transmission and verification process enables the multimedia data deduplication system to ensure security in more scenarios while maintaining high efficiency. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a flowchart illustrating the method for resisting ownership deception attacks in the multimedia data deduplication system of the present invention. Detailed Implementation

[0032] To make the technical problems to be solved, the technical solutions, and the beneficial effects of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present invention and are not intended to limit the present invention.

[0033] Existing data deduplication technologies suffer from insufficient verification mechanisms. Particularly in client-side deduplication, a security vulnerability known as "ownership fraud attack" exists. An attacker only needs to obtain the fingerprint of a file to successfully upload it and may access files belonging to other legitimate users, leading to the leakage of user privacy data. Although academia has proposed an ownership proof mechanism to help the server verify that the client truly owns the entire file content when uploading duplicate files, the models based on existing mechanisms do not involve colluding parties that can provide assistance in real time during protocol execution. Therefore, these mechanisms cannot defend against attacks in certain specific scenarios.

[0034] This invention proposes a method to defend against ownership spoofing attacks in multimedia data deduplication systems. The core objective of this invention is to address the common ownership spoofing attack problem in multimedia data deduplication systems (e.g., clients store their data on untrusted servers (such as public clouds) but do not want their private data to be accessed by the server, while the server also needs to be able to deduplicate user data), and to propose an efficient and comprehensive solution. When constructing the threat model, the factor of online colluders is specifically considered; they may provide real-time assistance to attackers, thereby exacerbating the risk of attacks. Therefore, this invention proposes an attack defense method that achieves high efficiency in computation, communication, and I / O. The process is as follows:

[0035] 1. File Chunking and Fingerprint Generation: When a client requests to upload a file (such as an image or video), the entire file is first divided into chunks of a specific size. Then, a hash function is used to generate a unique fingerprint for each data chunk.

[0036] 2. Fingerprint Upload and Deduplication: The client then uploads the generated fingerprint to the server. The server quickly searches for these fingerprints in its stored fingerprint collection. If a matching fingerprint is found, it means a copy of the data block already exists on the server, so there's no need to transmit the data block again, thus saving bandwidth and storage resources.

[0037] 3. Proof of Ownership Protocol: After uploading the data block fingerprints and deduplicated data blocks of all files, all duplicate data blocks are treated as a single complete file. An proof of ownership protocol is then initiated between the server and client. This protocol, based on a mask and cryptographic commitment scheme, aims to ensure the client's ownership of the duplicated data. This protocol effectively defends against ownership spoofing attacks.

[0038] To achieve the above objectives, this embodiment performs the following:

[0039] TEE-based deployment:

[0040] 1. Environment Setup: To protect user data on an untrusted server, this embodiment employs a Trusted Execution Environment (TEE)-based solution. Specifically, Intel SGX technology is used, but this method is also applicable to other TEE implementations.

[0041] 2. Enclave Creation: On processors supporting Intel SGX, server programs can create a secure zone called an "enclave." Programs and code within the enclave are protected and cannot be accessed by any external programs (including operating systems and privileged software).

[0042] 3. Interaction between the client and the enclave:

[0043] Remote authentication: Clients can verify the identity of the enclave on the server and exchange keys with the enclave through remote authentication.

[0044] Secure communication: Using the exchanged keys, the client can communicate securely with the enclave, ensuring the security and privacy of data during transmission.

[0045] Data block processing:

[0046] 1. Encryption and Transmission: Before sending data blocks and fingerprints to the server, the client encrypts them using an encryption algorithm. This ensures that only enclaves within the server can access and process this data.

[0047] 2. Deduplication: Within the enclave, the server maintains a mapping between fingerprint information and data block storage addresses. When an encrypted data block and fingerprint are received, the enclave checks the mapping to determine if the data block already exists. If it does not exist, it stores the data block and updates the mapping.

[0048] 3. Non-duplicate data block management: To reduce enclave switching and I / O overhead, a fixed-size container is maintained within the enclave to temporarily store non-duplicate data blocks. When the container is full, the enclave writes the data to disk space and clears the container to prepare for receiving new data blocks.

[0049] Execution of the ownership proof agreement:

[0050] After all data block fingerprints and deduplicated data block transfers are complete, the client and the enclave will execute an ownership proof protocol. This protocol consists of the following four main steps:

[0051] Generate a commitment: The client sends a commitment to the enclave, indicating its ownership of a specific duplicated data block.

[0052] Generate a challenge: The enclave generates a challenge based on the commitment and sends the challenge to the client.

[0053] Proof generation: The client generates a proof based on the challenge and its own data block, and sends the proof to the enclave.

[0054] Verification Proof: The enclave verification client sends a proof to confirm its ownership of the duplicate data block. If the verification passes, the protocol execution is complete.

[0055] Specifically, this embodiment employs a block-level deduplication scheme. The client divides the complete file into 4KB blocks and calculates a fingerprint for each block using the SHA-256 algorithm, with each fingerprint being 32 bytes in size. To prevent untrusted servers from accessing the block content and fingerprint information, the client encrypts them using a session key before sending them to the server, ensuring that only enclaves within the server can access this data. Each enclave maintains a mapping between fingerprint information and block storage addresses, using this structure to deduplicate user data. Simultaneously, the enclave creates a data key, which is used to encrypt all non-duplicate data blocks received by the enclave. To reduce enclave switching and I / O overhead, a fixed-size 4MB container is maintained within the enclave to temporarily store non-duplicate data blocks; only when a container is full are the data blocks written to disk. After the client transmits the fingerprint information of all data blocks and all non-duplicate data blocks, all duplicate data blocks are treated as a complete file. The client needs to execute the interactive protocol proposed in this invention to resist ownership fraud attacks with the enclave for this duplicate data. It mainly includes four steps: generating commitment, generating challenge, generating proof, and verifying proof.

[0056] Step 1, Generate Commitments:

[0057] Step 1.1, Initialization and Key Generation:

[0058] Users set a login password. When a user uses the system for the first time, they will be required to set a complex login password. This password will serve as the user's private key. i This is used for subsequent ownership verification processes.

[0059] Private key s i The private key is stored in a Trusted Execution Environment (TEE) within the server, and can be accessed by trusted enclaves within the server. The TEE ensures the secure storage of the private key, preventing its leakage even if the server is attacked.

[0060] Step 1.2, Masking:

[0061] Random value generation: Before each protocol execution, the server generates a random value (nonce) and transmits it to the client through a secure communication channel (such as TLS / SSL).

[0062] Mask generation: The client generates a sequence of integers by incrementing a random value and then uses a symmetric encryption algorithm (using the user's private key). i The integer sequence (used as a key input) is encrypted to generate the mask used for the current protocol execution. To avoid reusing masks for different data blocks, the random value used to generate the mask for each data block is obtained by XORing the received nonce with the fingerprint of each data block.

[0063] Data mask: The client performs an XOR operation between the generated mask and the content of the original data block to generate a masked data block.

[0064] Hash value calculation: Apply a hash function (such as SHA-256) to the XORed value (i.e., the masked data block) to obtain a hash value. This hash value represents the content of the masked data block and serves as input for subsequent Merkle tree construction.

[0065] Algorithm 1 describes the mask generation process in detail:

[0066]

[0067] Where l is the bit length of the mask to be generated, E is the symmetric encryption algorithm, and this embodiment uses AES-256 with a key length of 256 bits and an encrypted block length of 128 bits. The private key s... i As the key for this encryption algorithm, if the user's login password exceeds 256 bits, the first 256 bits are truncated and used as the private key; if it is less than 256 bits, it is padded to 256 bits. The nonce value is a 128-bit random value, which is used to generate a mask sequence by encryption and incrementing this value.

[0068] Step 3, Merkle tree construction and commitment value generation:

[0069] Hash value sequence: A sequence of hash values ​​is formed by arranging the hash values ​​of all data blocks in a certain order (such as the position of the data blocks in the file).

[0070] Merkle tree construction: Each hash value in the hash value sequence is used as a leaf node of the Merkle tree. Starting from a leaf node, hash values ​​at the current level are paired up and a new hash value is calculated, which becomes the node of the next higher level. This process continues until only a root node remains.

[0071] Commitment Value: The root node value of the Merkle tree is the commitment value. This commitment value is a summary of the entire file content, containing information about the file's integrity and authenticity. The client sends the commitment value to the server through a secure communication channel. The server stores this commitment value and uses it in subsequent data verification processes.

[0072] Algorithm 2 describes the specific process of generating commitments:

[0073]

[0074] The file F′ to be verified has n data blocks, and for each data block m′ j First, the corresponding mask is generated using Algorithm 1. Then, the mask is XORed with the data block content, and the hash function H (SHA-256 is used in this embodiment) is applied to the XORed value to obtain a hash value l. j For the obtained hash value sequence P, each hash value is used as a leaf node, and a Merkle tree MT is built from bottom to top. H (P), and send the root node R of the tree as the commitment value to the server.

[0075] Private key security: Each client possesses a secret information that cannot be disclosed to other clients, known as its private key. This private key can be the login password set during user registration, or the key used by the client to establish a secure channel with the server. The security of the private key is paramount. If the private key is leaked, the client's private data will be at risk of being compromised. Therefore, protecting the security of the private key is a crucial step in the entire data verification process.

[0076] Step 2, Generate Challenge:

[0077] Step 2.1, Receive and save the commitment value:

[0078] The server first receives the commitment value R sent by the client and stores it in a secure location. This commitment value is generated by the client based on the hash value of the file to be verified and a specific algorithm (such as the Merkle hash tree algorithm), and is used for subsequent verification of the file's integrity and authenticity.

[0079] Step 2.2, retrieve file information based on file fingerprint:

[0080] The server retrieves the corresponding data block information from its storage system or database based on the fingerprint of the duplicate data blocks. Upon successful retrieval, the server can calculate the size of the file to be verified (usually in bytes) and the total number of blocks. This information is crucial for generating the subsequent challenge information.

[0081] Step 2.3, calculate the total number of challenged data blocks:

[0082] The server calculates the total number of data blocks to be challenged based on system security parameters (such as expected verification difficulty and acceptable error rate) and the retrieved file size and block count information. This process aims to ensure that the challenge is difficult enough that even if an attacker knows part of the data block content, they cannot successfully forge a response with a high probability.

[0083] Specifically, the server may use one or more algorithms to calculate the total number of data blocks to be challenged. These algorithms are typically based on principles of probability theory and cryptography. Through these algorithms, the server can find a suitable number of data blocks to be challenged, reducing the probability of an attacker succeeding to a negligible level.

[0084] Step 2.4, Generate a random number seed:

[0085] To ensure the randomness and unpredictability of the challenge process, the server generates a random number seed. This seed will be used in subsequent random number generation processes to ensure that the challenged data blocks are randomly selected, rather than fixed or predictable.

[0086] Servers typically use a cryptographically secure random number generator (CSPRNG) to generate this random number seed, ensuring that the generated random numbers are sufficiently random and unpredictable. This prevents attackers from predicting or manipulating the challenged data block by guessing or analyzing the random number generation process.

[0087] Step 2.5, compose the challenge information:

[0088] The server combines the generated random number seed with the calculated total number of challenged data blocks to form a challenge message. This challenge message will guide the client on how to generate a response (proof) and send it to the server for verification.

[0089] Step 2.6, Send the challenge message:

[0090] The server sends the challenge information to the client through a secure communication channel (such as TLS / SSL). This communication channel needs to ensure the integrity and authenticity of the challenge information to prevent it from being tampered with or forged during transmission.

[0091] Throughout the challenge generation and delivery process, the server needs to ensure its own security and reliability. This includes protecting file information and security parameters on the server from unauthorized access and tampering, and using secure random number generators and communication channels to ensure the integrity and authenticity of the challenge information.

[0092] Furthermore, the server needs to ensure that the generation process of the challenge information is sufficiently random and unpredictable to prevent attackers from predicting or manipulating the challenged data block through guessing or analysis. This can be achieved by using strong cryptographic algorithms and protocols.

[0093] Challenge information is generated based on Algorithm 3:

[0094]

[0095] The challenge information consists of a random number seed s and the number of data blocks to be challenged c, where c is determined by the security parameter κ and the number of data blocks n contained in the file F to be verified.

[0096] Step 3, generate proof:

[0097] Once the client receives the challenge message from the server, it will generate a proof according to the steps of Algorithm 4 so that the server can verify the integrity of the file. The detailed process is described below:

[0098] Step 3.1, Generating the random number seed and random index:

[0099] The client first obtains the random number seed from the challenge information; using this random number seed, the client calls the random number generation function to generate a series of random indices in the range of 0 to n-1, where n is the total number of leaf nodes in the Merkle tree, which is the total number of data blocks into which the file is divided; the total number of generated random indices should be the same as the total number of challenged data blocks to ensure that there are enough leaf nodes in the Merkle tree to be selected to build the verification proof.

[0100] Step 3.2, extract sibling paths:

[0101] For each generated random index, the client locates the corresponding leaf node in the Merkle tree previously generated for the file. Starting from this leaf node, the client traverses upwards along the structure of the Merkle tree, extracting the sibling nodes of all nodes on the path from the leaf node to the root node. These sibling nodes (except for the root node) together constitute the "sibling path" of the leaf node. The length of the sibling path is the height of the Merkle tree minus 1, because the path from the leaf node to the root node requires traversing all levels of the tree, excluding the root node itself.

[0102] Step 3.3, Generate and send the proof:

[0103] The client repeats the above process to extract the corresponding sibling path for each random index; all extracted sibling paths are packaged into a proof data packet; the client sends the proof data packet to the server through a secure communication channel (such as TLS / SSL).

[0104] Through the steps described above, the client can generate a certificate containing sufficient information to enable the server to verify the integrity of the file without directly accessing its contents. This ensures both the security and efficiency of the verification process.

[0105]

[0106]

[0107] PRF is a random number generation function that uses 's' from the challenge information as the random number seed to generate a random index in the range of 0 to n-1. The client then uses the Merkle tree MT built in step [Generate Commitment] to generate the random index. H Extract the sibling paths of the leaf nodes corresponding to the indexes in (P), that is, the sibling nodes of all nodes on the path from the leaf node to the root node, with a length equal to the height of the tree minus 1. Generate a total of c random indices. After the client extracts c paths, it sends them to the server as proof V.

[0108] Step 4, Verification and Proof:

[0109] After receiving the proof V from the client, the server will verify the user's ownership of the data based on the previously received commitment value R (the root hash of the Merkle tree). The following are the detailed verification steps:

[0110] Step 4.1, Random index generation:

[0111] The server uses the same random number generation function as the client, along with a previously selected seed, to generate a series of random indices. These indices are identical to those used by the client when generating the proof.

[0112] Step 4.2, Data block reading and decryption:

[0113] Based on the generated random index, the server reads the corresponding data block from the disk into a secure enclave (such as Intel SGX or other trusted execution environments). If the data block is encrypted, the server needs to decrypt it using the corresponding decryption key, datakey.

[0114] Step 4.3, regenerate the mask:

[0115] Similar to the generation of commitments, the server uses the previously generated random value nonce, the data block fingerprint, and the user's private key s. i Then, regenerate the corresponding mask.

[0116] Step 4.4, Hash value calculation:

[0117] The regenerated mask is XORed with the decrypted data block content. A hash function (such as SHA-256) is applied to the XOR result to obtain a hash value.

[0118] Step 4.5, Merkle tree reconstruction and verification:

[0119] For each calculated hash value, the server uses the corresponding sibling path returned by the client (i.e., the hash values ​​of all sibling nodes on the path from the leaf node corresponding to the hash value to the root node of the Merkle tree) to recalculate the root node value of the Merkle tree from bottom to top.

[0120] If the calculated root node value is inconsistent with the commitment value previously submitted by the client, the validation of the data block will fail.

[0121] The server will repeat the above steps to verify all challenged data blocks. The entire verification process is considered successful only when all challenged data blocks have been verified (i.e., all calculated root node values ​​match the promised values).

[0122] This verification method combines randomness, the collision resistance of hash functions, and the efficiency of Merkle trees, enabling effective verification of user ownership of data without accessing the complete file content, thus improving system security and privacy.

[0123]

[0124] The server uses the same random number generation function PRF and the previously selected seed s to generate a random index (consistent with the one generated by the client), and then reads the data block m corresponding to that index from the disk. j In the enclave (data key decryption required), the same steps as in "Generate Commitment" are performed, based on the nonce value and data block fingerprint f. idx and user private key s i Generate a mask, and then combine the mask with the data block content m. j After XORing, applying the SHA-256 function yields a hash value l. j .

[0125] For a hash value l jThe root node R′ of the Merkle tree is calculated from bottom to top using the corresponding sibling path returned by the client. If this value is inconsistent with the previously submitted commitment value R, the verification fails. Verification only succeeds when the root node values ​​calculated based on the received sibling paths for all c challenged data blocks are consistent with the commitment value.

[0126] The following will describe in detail the calculation process of the number c of challenged data blocks in the step of "Generate Challenge" in this embodiment.

[0127] An attacker cannot obtain the complete content of file F. Let ∈ be the proportion of file content it does not know. Then, for n data blocks, the attacker cannot obtain the content of ∈ n data blocks. During the proof generation process, the attacker needs to know the complete content of a data block to correctly calculate the sibling path of a challenged data block (based on the collision resistance of a hash function). Therefore, if there are unknown data blocks among the selected c data blocks, there is a certain probability that the attack will fail, i.e., the verification will fail. The probability of the attacker succeeding in the verification can be expressed as follows:

[0128]

[0129] in Let J be the probability that an attacker is unaware of J out of c data blocks but can still pass verification. This value can be considered negligible, therefore the above formula can be simplified as follows:

[0130]

[0131] For the security parameter κ, if the probability of an attacker passing the verification is required to be less than or equal to 2... -κ That is, Pr[A wins the game]≤2 -κ Then c can be derived as follows:

[0132]

[0133] This embodiment assumes that the attacker is unaware that the proportion of file content is determined by the communication overhead required by the protocol itself.

[0134]

[0135] The main communication overhead of the protocol is considered to be c sibling paths, each path consisting of log2n (let's assume n is an integer power of 2) hash values ​​of length h.

[0136] Substituting formula (4) into formula (3) yields

[0137]

[0138] The safety parameter requirements can be met by finding the minimum c that satisfies the above formula.

[0139] For a 2GB file with a data block size of 4KB, using the SHA-256 hash function and setting the security parameter to 66, the minimum acceptable value c is 12701.

[0140] The beneficial effects of this invention are as follows:

[0141] This invention proposes an innovative defense method against ownership spoofing attacks in multimedia data client deduplication systems. The core of this method lies in introducing the user's private key into the protocol design and employing masking and commitment mechanisms, thereby significantly enhancing the security of user multimedia data. The advantages of this method are mainly reflected in its security and efficiency.

[0142] First, from a security perspective, this invention considers a more robust threat model for ownership fraud attacks, namely, the existence of a conspirator capable of providing real-time assistance to the attacker. This assumption enables the invention to address specific scenarios that existing solutions cannot effectively defend against, such as situations where malicious users may act as online conspirators when the server is unwittingly acting as a CDN (Content Delivery Network). By introducing an online conspirator and combining each user's private key and mask with a cryptographic commitment scheme, this invention provides a secure solution that effectively enhances the security of users' multimedia data.

[0143] Secondly, from an efficiency perspective, the proposed solution does not require the server to read the entire file when verifying user ownership. This means that the challenge and response generation process is efficient, reducing the use of computing resources. Simultaneously, the solution requires less additional communication bandwidth, further improving the overall system's operating efficiency. This enables the multimedia data deduplication system to ensure security while maintaining high efficiency in more scenarios.

[0144] In summary, this invention, by introducing online colluders and combining them with a cryptographic commitment scheme, successfully provides a secure and efficient method for resisting ownership fraud attacks in multimedia data deduplication systems. This method not only considers more complex attack scenarios but also demonstrates excellent performance and effectiveness in practical applications.

[0145] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for defending against ownership spoofing attacks in a multimedia data deduplication system, characterized in that, include: Step 1: The client uses the user's password as a private key to generate a mask and hash value for the file data blocks, constructs a Merkle tree, and sends the commitment value to the server; Step 2: After receiving the commitment value, the server generates challenge information and sends it to the client; Step 3: The client generates a random index based on the challenge information, extracts the sibling path in the Merkle tree as proof, and sends it to the server; Step 4: The server recalculates the hash value based on the challenge information and the client's private key, reconstructs the Merkle tree using the sibling path, and compares it with the client's commitment value for verification. In step 1, the client uses the login password set by the user as a private key, which can be accessed by a trusted enclave on the server. In step 1, the client uses the obtained hash value sequence as the leaf node of the Merkle tree, builds the Merkle tree from bottom to top, and sends the root node value of the Merkle tree as the commitment value to the server. In step 4, the server uses the same random number generation function and the previously selected seed to generate random subscripts; The server reads the corresponding data block from the disk into the enclave based on the random index and the client's private key, and generates a mask. The server XORs the mask with the data block content and then applies a hash function to obtain the calculated hash value. In step 4, the server recalculates the root node value of the Merkle tree from bottom to top based on the received sibling path and the calculated hash value; the server compares the calculated root node value of the Merkle tree with the commitment value sent by the client, and if the two match, the verification is successful.

2. The method for resisting ownership fraud attacks in the multimedia data deduplication system as described in claim 1, characterized in that, In step 1, the client divides the file to be verified into multiple file data blocks. For each data block, the client uses its private key and a random value received from the server to encrypt an integer sequence using the AES symmetric encryption algorithm until the length of the ciphertext is not less than the length of the data block. Then, the client extracts a bit string from the beginning of the ciphertext that is equal to the length of the data block as a mask for the file data block.

3. The method for resisting ownership fraud attacks in the multimedia data deduplication system as described in claim 1, characterized in that, In step 1, the client XORs each mask with the corresponding file data block content and applies the hash function SHA-256 to the XOR value to obtain the hash value of each file data block.

4. The method for resisting ownership fraud attacks in the multimedia data deduplication system as described in claim 1, characterized in that, In step 2, the server determines the challenge information according to the algorithm. The challenge information includes a random number seed and the number of data blocks to be challenged. The number of data blocks to be challenged is determined based on security parameters and the number of file data blocks contained in the file to be verified.

5. The method for resisting ownership spoofing attacks in the multimedia data deduplication system as described in claim 4, characterized in that, In step 3, the client uses a random number generation function, taking the random number seed in the challenge information as input, to generate one or more random indices ranging from 0 to the total number of file data blocks minus 1.

6. The method for resisting ownership fraud attacks in the multimedia data deduplication system as described in claim 1, characterized in that, In step 3, the client extracts the sibling paths of the leaf nodes corresponding to the random indices from the Merkle tree and sends these sibling paths as proof to the server.

Images