Cloud encrypted data deduplication method, device and storage medium based on secret sharing

Abstract

A cloud encrypted data deduplication method, device and storage medium based on secret sharing, involving the fields of cryptography technology and privacy protection technology, using a convergent encryption algorithm, mainly used to generate labels for data when stored in the cloud, so that the cloud can judge whether the data is repeated for the first time, using a secret sharing algorithm, after the data is grouped, calling the secret sharing algorithm to generate the key for each block, and hiding the hash value of the data as a secret in the selected polynomial. When the cloud stores the data for the first time, it stores the encrypted data block from the client, which has the characteristics of privacy protection. When deduplication is securely performed between the client and the cloud, there is no need to decrypt the cloud data, and deduplication judgment and ownership proof are performed on the encrypted data, ensuring the security of the cloud data. The client and the cloud server do not require a trusted third party or a key distribution server, which reduces the system load and simplifies the system.

Description

Technical Field

[0001] The present invention relates to the fields of cryptography technology and privacy protection technology, and in particular to a cloud-based encrypted data deduplication method, device and storage medium based on secret sharing. Background Art

[0002] In today's Internet and information age, with the rapid development of mobile Internet and the popularization of big data, cloud storage technology has been widely used. Cloud storage technology is an Internet technology service with scalable and elastic storage functions. It has become the mainstream platform for current data storage, effectively solving the shortage of local storage resources for individual users and enterprises.

[0003] Although cloud storage technology brings convenience to users, it also brings problems of cloud storage security and data privacy protection. In order to protect data privacy, prevent data leakage, and save local storage space, users usually encrypt data before uploading it to the cloud server.

[0004] However, with the increase in the number of users and the expansion of the scale of uploaded data, the same plaintext data is stored in different ciphertext forms on the cloud server, which not only wastes cloud storage resources but also increases the difficulty of data management. Summary of the invention

[0005] In order to overcome the deficiencies of the above technologies, the present invention provides a cloud-based encrypted data deduplication method, device and storage medium based on secret sharing, which can reduce the system load and simplify the system.

[0006] The technical solution adopted by the present invention to overcome the technical problems is:

[0007] A cloud encrypted data deduplication method based on secret sharing, comprising:

[0008] S1. Own data for the client Perform convergent encryption to obtain ciphertext ;

[0009] S2. According to the ciphertext Get the client's data Tags , label Send to the cloud;

[0010] S3. The client owns the data According to the fixed data block length Grouping, get Group Data , For the Group data, ;

[0011] S4. The client performs the first secret sharing algorithm and obtains the set ;

[0012] S5. Utilize the collection right Group Data Encrypt to obtain the ciphertext set of data group , ;

[0013] S6. Cloud verification step S2 tag sent by the client , if the tag If it exists, execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10;

[0014] S7. The cloud sends a proof of ownership request response to the client;

[0015] S8. After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set ;

[0016] S9. The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud, if they are not the same, return to step S2;

[0017] S10. The cloud sends a request response to the client to resend the data to the cloud;

[0018] S11. After the client receives the request response, the ciphertext set Send to the cloud;

[0019] S12. The cloud receives the ciphertext set Then label it Stored in the server.

[0020] Further, step S1 includes the following steps:

[0021] S1-1. The client owns the data As the input of the key generation function in the convergent encryption algorithm, the key is calculated ;

[0022] S1-2. Using the key Owning data to the client Perform convergent encryption to obtain ciphertext .

[0023] Step S2 includes the following steps:

[0024] S2-1. The ciphertext As the input of the label generation function in the convergent encryption algorithm, the client has data Tags ;

[0025] S2-2. Label Send to the cloud.

[0026] Further, step S4 includes the following steps:

[0027] S4-1. By formula

[0028] Calculate the value of the first polynomial , where , Owning data for the client The hash value of

[0029] S4-2. of The values ​​of the first polynomial are combined into the set .

[0030] Further, step S5 includes the following steps:

[0031] S5-1. Utilization of collection The The value of the first polynomial is used as the key for the Group Data Perform symmetric encryption to obtain Group Data The ciphertext ;

[0032] S5-2. All The ciphertext of the group data constitutes the ciphertext set of the data group , .

[0033] Further, step S8 includes the following steps:

[0034] S8-1. By formula

[0035] Calculate the value of the first polynomial , where , The ciphertext set The hash value of

[0036] S8-2. of The values ​​of the second polynomial are combined into the set .

[0037] Further, step S9 includes the following steps:

[0038] S9-1. The client will collect After being sent to the cloud, the cloud uses the formula

[0039] Calculate the value of the polynomial , where , To encrypt data The hash value of

[0040] S9-2. of The values ​​of the polynomials are combined into a set ;

[0041] S9-3. Judgment set With Collection Are they the same? If they are the same, they are determined to be the client's ciphertext set. Encrypted data with the cloud Same, ciphertext set Do not upload to the cloud. If they are not the same, return to step S2.

[0042] On the other hand, the present invention also relates to a cloud encrypted data deduplication device based on secret sharing, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; wherein:

[0043] The memory is used to store computer programs;

[0044] The processor is configured to execute, by running a program stored in the memory:

[0045] Owning data to the client Perform convergent encryption to obtain ciphertext ;

[0046] According to the ciphertext Get the client's data Tags , label Send to the cloud;

[0047] The client will own the data According to the fixed data block length Grouping, get Group Data , For the Group data, ;

[0048] The client performs the first secret sharing algorithm and obtains the set ;

[0049] Using Collections right Group Data Encrypt to obtain the ciphertext set of data group , ;

[0050] Cloud verification step S2: Tags sent by the client , if the tag If it exists, execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10;

[0051] The cloud sends a proof-of-ownership request response to the client;

[0052] After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set ;

[0053] The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud, if they are not the same, return to step S2;

[0054] The cloud sends a request response to the client to resend the data to the cloud;

[0055] After receiving the request response, the client sends the ciphertext set Send to the cloud;

[0056] The cloud receives the ciphertext collection Then label it Stored in the server.

[0057] On the other hand, the present invention also relates to a storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program implements:

[0058] Owning data to the client Perform convergent encryption to obtain ciphertext ;

[0059] According to the ciphertext Get the client's data Tags , label Send to the cloud;

[0060] The client will own the data According to the fixed data block length Grouping, get Group Data , For the Group data, ;

[0061] The client performs the first secret sharing algorithm and obtains the set ;

[0062] Using Collections right Group Data Encrypt to obtain the ciphertext set of data group , ;

[0063] Cloud verification step S2: Tags sent by the client , if the tag If it exists, execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10;

[0064] The cloud sends a proof-of-ownership request response to the client;

[0065] After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set ;

[0066] The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud, if they are not the same, return to step S2;

[0067] The cloud sends a request response to the client to resend the data to the cloud;

[0068] After receiving the request response, the client sends the ciphertext set Send to the cloud;

[0069] The cloud receives the ciphertext collection Then label it Stored in the server.

[0070] The beneficial effects of the present invention are: convergent encryption is adopted, the key is generated by the data, no key distribution server is required, and a secret sharing algorithm is adopted to ensure the privacy protection characteristics of cloud-based encrypted data during deduplication judgment and ownership proof. The data stored in the cloud is encrypted data and can resist the risk of data leakage. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 The present invention is a flow chart of the method. DETAILED DESCRIPTION

[0072] The following is combined with Figure 1 The preferred embodiments of the present invention are described in detail so that the advantages and features of the present invention can be more easily understood by those skilled in the art, thereby making a clearer and more definite definition of the protection scope of the present invention.

[0073] In the description of the present invention, it should be noted that the embodiments described in the present invention are only part of the embodiments of the present invention, rather than all of the embodiments; based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present invention.

[0074] The terms "first", "second", etc. in the specification of this article and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this article described here can be implemented in an order other than those illustrated or described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0075] Example 1

[0076] A cloud encrypted data deduplication method based on secret sharing, comprising:

[0077] S1. Own data for the client Perform convergent encryption to obtain ciphertext .

[0078] S2. According to the ciphertext Get the client's data Tags , label Send to the cloud.

[0079] S3. The client owns the data According to the fixed data block length Grouping, get Group Data , For the Group data, .

[0080] S4. The client performs the first secret sharing algorithm and obtains the set .

[0081] S5. Utilize the collection right Group Data Encrypt to obtain the ciphertext set of data group , .

[0082] S6. Cloud verification step S2 tag sent by the client , if the tag If it exists, execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10.

[0083] S7. The cloud sends a proof of ownership request response to the client.

[0084] S8. After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set .

[0085] S9. The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud. If they are not the same, return to step S2.

[0086] S10. If the label If it does not exist, it means that the cloud does not have the data yet and the client needs to upload the data, so the cloud sends a request response to the client to resend the data to the cloud.

[0087] S11. After the client receives the request response, the ciphertext set Send to the cloud.

[0088] S12. The cloud receives the ciphertext set Then label it Stored in the server.

[0089] The convergent encryption algorithm is used, which is mainly used to generate labels for data when it is stored in the cloud, so that the cloud can determine whether the data is repeated for the first time. The secret sharing algorithm is used. After the data is grouped, the secret sharing algorithm is called to generate the key for each block, and the hash value of the data is hidden as a secret in the selected polynomial. The secret sharing algorithm is used twice. The first time is for the original data, the algorithm polynomial is selected, the coefficient of each term is the data block, and the constant term is the hash value of the original data, so as to generate the algorithm key value corresponding to each data block; the second time the secret sharing algorithm is used is for the encrypted data block, the algorithm polynomial is selected, the coefficient of each term is the encrypted data block, and the constant term is the hash value of the entire encrypted data, and finally the algorithm key value corresponding to each encrypted data block is generated. The first time the secret sharing algorithm is used is mainly used to generate the algorithm key corresponding to the data block, and the corresponding data block is encrypted with the algorithm key to obtain the encrypted data block. The second time the secret sharing algorithm is used is mainly used to generate the corresponding algorithm key for the encrypted data block, which is mainly used to send to the cloud to prove the ownership of the data. These algorithm keys can be regarded as a challenge to prove ownership. When the cloud stores data for the first time, it stores the encrypted data block from the client, which has the characteristics of privacy protection. When deduplication is performed securely between the client and the cloud, there is no need to decrypt the cloud data, and deduplication judgment and ownership proof are performed on the encrypted data, ensuring the security of cloud data. The client and cloud server do not require a trusted third party or key distribution server, which reduces the system load and simplifies the system.

[0090] In this embodiment, step S1 includes the following steps:

[0091] S1-1. The client owns the data As the input of the key generation function in the convergent encryption algorithm, the key is calculated .

[0092] S1-2. Using the key Owning data to the client Perform convergent encryption to obtain ciphertext .

[0093] Step S2 includes the following steps.

[0094] S2-1. The ciphertext As the input of the label generation function in the convergent encryption algorithm, the client has data Tags .

[0095] S2-2. Label Send to the cloud.

[0096] In this embodiment, step S4 includes the following steps:

[0097] S4-1. By formula

[0098] Calculate the value of the first polynomial , where , Owning data for the client The hash value of is a constant term.

[0099] S4-2. of The values ​​of the first polynomial are combined into the set .

[0100] In this embodiment, step S5 includes the following steps:

[0101] S5-1. Utilization of collection The The value of the first polynomial is used as the key for the Group Data Perform symmetric encryption to obtain Group Data The ciphertext .

[0102] S5-2. All The ciphertext of the group data constitutes the ciphertext set of the data group , .

[0103] In this embodiment, step S8 includes the following steps:

[0104] S8-1. By formula

[0105] Calculate the value of the first polynomial , where , The ciphertext set The hash value of is a constant term.

[0106] S8-2. of The values ​​of the second polynomial are combined into the set .

[0107] In this embodiment, step S9 includes the following steps:

[0108] S9-1. The client will collect After being sent to the cloud, the cloud uses the formula

[0109] Calculate the value of the polynomial , where , To encrypt data The hash value of is a constant term.

[0110] S9-2. of The values ​​of the polynomials are combined into a set .

[0111] S9-3. Judgment set With Collection Are they the same? If they are the same, please explain the polynomial and If they are identical, i.e., the coefficients and constants are the same, then they are determined to be the client's ciphertext set. Encrypted data with the cloud Same, duplicate data, ciphertext set Without uploading to the cloud, the cloud sends a deduplication reply response to the client. If they are not the same, it returns to step S2.

[0112] Example 2

[0113] A cloud encrypted data deduplication device based on secret sharing, comprising: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; wherein:

[0114] The memory is used to store computer programs;

[0115] The processor is configured to execute, by running a program stored in the memory:

[0116] Owning data to the client Perform convergent encryption to obtain ciphertext .

[0117] According to the ciphertext Get the client's data Tags , label Send to the cloud.

[0118] The client will own the data According to the fixed data block length Grouping, get Group Data , For the Group data, .

[0119] The client performs the first secret sharing algorithm and obtains the set .

[0120] Using Collections right Group Data Encrypt to obtain the ciphertext set of data group , .

[0121] Cloud verification step S2: Tags sent by the client , if the tag If it exists, execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10.

[0122] The cloud sends a proof-of-ownership request response to the client.

[0123] After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set .

[0124] The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud. If they are not the same, return to step S2.

[0125] The cloud sends a request response to the client to resend the data to the cloud.

[0126] After receiving the request response, the client sends the ciphertext set Send to the cloud.

[0127] The cloud receives the ciphertext collection Then label it Stored in the server.

[0128] Example 3

[0129] A storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the computer program realizes:

[0130] Owning data to the client Perform convergent encryption to obtain ciphertext .

[0131] According to the ciphertext Get the client's data Tags , label Send to the cloud.

[0132] The client will own the data According to the fixed data block length Grouping, get Group Data , For the Group data, .

[0133] The client performs the first secret sharing algorithm and obtains the set .

[0134] Using Collections right Group Data Encrypt to obtain the ciphertext set of data group , .

[0135] Cloud verification step S2: Tags sent by the client , if the tag If it exists, execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10.

[0136] The cloud sends a proof-of-ownership request response to the client.

[0137] After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set .

[0138] The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud. If they are not the same, return to step S2.

[0139] The cloud sends a request response to the client to resend the data to the cloud.

[0140] After receiving the request response, the client sends the ciphertext set Send to the cloud.

[0141] The cloud receives the ciphertext collection Then label it Stored in the server.

[0142] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A cloud encrypted data deduplication method based on secret sharing, characterized in that: include: S1. Own data for the client Perform convergent encryption to obtain ciphertext ; S2. According to the ciphertext Get the client's data Tags , label Send to the cloud; S3. The client owns the data According to the fixed data block length Grouping, get Group Data , For the Group data, ; S4. The client performs the first secret sharing algorithm and obtains the set ; S5. Utilize the collection right Group Data Encrypt to obtain the ciphertext set of data group , ; S6. Cloud verification step S2 tag sent by the client , if the tag If it exists, then execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10; S7. The cloud sends a proof of ownership request response to the client; S8. After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set ; S9. The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud, if they are not the same, return to step S2; S10. The cloud sends a request response to the client to resend the data to the cloud; S11. After the client receives the request response, the ciphertext set Send to the cloud; S12. The cloud receives the ciphertext set Then label it Stored in the server.

2. The cloud encrypted data deduplication method based on secret sharing according to claim 1 is characterized in that: Step S1 includes the following steps: S1-1. The client owns the data As the input of the key generation function in the convergent encryption algorithm, the key is calculated ; S1-2. Using the key Owning data to the client Perform convergent encryption to obtain ciphertext .

3. The cloud encrypted data deduplication method based on secret sharing according to claim 1 is characterized in that: Step S2 includes the following steps: S2-1. The ciphertext As the input of the label generation function in the convergent encryption algorithm, the client has data Tags ; S2-2. Label Send to the cloud.

4. The cloud encrypted data deduplication method based on secret sharing according to claim 1 is characterized in that: Step S4 includes the following steps: S4-1. By formula Calculate the value of the first polynomial , where , Owning data for the client The hash value of S4-2. of The values ​​of the first polynomial are combined into the set .

5. The cloud encrypted data deduplication method based on secret sharing according to claim 4 is characterized in that: Step S5 includes the following steps: S5-1. Utilization of collection The The value of the first polynomial is used as the key for the Group Data Perform symmetric encryption to obtain Group Data The ciphertext ; S5-2. All The ciphertext of the group data constitutes the ciphertext set of the data group , .

6. The cloud encrypted data deduplication method based on secret sharing according to claim 1, characterized in that: Step S8 includes the following steps: S8-1. By formula Calculate the value of the first polynomial , where , The ciphertext set The hash value of S8-2. of The values ​​of the second polynomial are combined into the set .

7. The cloud encrypted data deduplication method based on secret sharing according to claim 1, characterized in that: Step S9 includes the following steps: S9-1. The client will collect After being sent to the cloud, the cloud uses the formula Calculate the value of the polynomial , where , To encrypt data The hash value of S9-2. of The values ​​of the polynomials are combined into a set ; S9-3. Judgment set With Collection Are they the same? If they are the same, they are determined to be the client's ciphertext set. Encrypted data with the cloud Same, ciphertext set Do not upload to the cloud. If they are not the same, return to step S2.

8. A cloud encrypted data deduplication device based on secret sharing, characterized in that: include: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; wherein: The memory is used to store computer programs; The processor is configured to execute, by running a program stored in the memory: Owning data to the client Perform convergent encryption to obtain ciphertext ; According to the ciphertext Get the client's data Tags , label Send to the cloud; The client will own the data According to the fixed data block length Grouping, get Group Data , For the Group data, ; The client performs the first secret sharing algorithm and obtains the set ; Using Collections right Group Data Encrypt to obtain the ciphertext set of data group , ; Cloud verification step S2: Tags sent by the client , if the tag If it exists, then execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10; The cloud sends a proof-of-ownership request response to the client; After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set ; The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud, if they are not the same, return to step S2; The cloud sends a request response to the client to resend the data to the cloud; After receiving the request response, the client sends the ciphertext set Send to the cloud; The cloud receives the ciphertext collection Then label it Stored in the server.

9. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements: Owning data to the client Perform convergent encryption to obtain ciphertext ; According to the ciphertext Get the client's data Tags , label Send to the cloud; The client will own the data According to the fixed data block length Grouping, get Group Data , For the Group data, ; The client performs the first secret sharing algorithm and obtains the set ; Using Collections right Group Data Encrypt to obtain the ciphertext set of data group , ; Cloud verification step S2: Tags sent by the client , if the tag If it exists, execute step S7 and store the tag in the cloud. The corresponding encrypted data is , , For the cloud The encrypted data of the group, , if the tag If it does not exist, execute step S10; The cloud sends a proof-of-ownership request response to the client; After receiving the ownership proof request response, the client performs a second secret sharing algorithm to obtain the set ; The client will collect Send to the cloud for ownership proof challenge, the cloud determines the ciphertext set With encrypted data Are they the same? If they are the same, then the ciphertext set Do not upload to the cloud, if they are not the same, return to step S2; The cloud sends a request response to the client to resend the data to the cloud; After receiving the request response, the client sends the ciphertext set Send to the cloud; The cloud receives the ciphertext collection Then label it Stored in the server.

Images