A Privacy-Preserving Multi-Party Collaborative Public Auditing Method

Abstract

The present invention discloses a multi-party collaborative public auditing method for privacy protection, which relates to the field of collaborative verification of data integrity and includes three entities: Cloud Service Provider (CSP), Third Party Auditor (TPA), and Department Member Group (MG). The method includes: system initialization phase, distributed key generation phase, data outsourcing phase, and integrity auditing phase. The present invention allows members within a group to form a threshold group to jointly generate a tag for a piece of data, reducing the tag redundancy of the same piece of data; during the multi-party collaboration process, it protects the information privacy of collaborative members. If a certain member is attacked, it will not affect the security of the data tag. Based on secret sharing and MtA conversion technology, the present invention realizes the tag multi-party unorganized collaborative generation without additional communication overhead, resists the "key person attack", and solves the problem of responsibility and right division in the multi-user data outsourcing scenario.

Description

Technical Field

[0001] The present invention relates to the field of collaborative verification of data integrity in the scenario of multi-user data outsourcing, and specifically relates to a privacy-preserving multi-party collaborative public auditing method. Background Art

[0002] Cloud auditing provides integrity protection for outsourced data and is an important technology to ensure the quality of cloud storage services. Its auditing process can be roughly divided into three steps: preprocessing (generating ciphertext data and data tags), challenge-response (initiating an audit challenge and generating an audit proof to respond to the challenge), and verification (verifying the audit proof). In existing research, most schemes focus on the latter two steps, such as innovating the challenge mechanism, studying the freshness and randomness of challenge information, resisting dishonest verification, and how to achieve decentralized verification, etc. Few schemes pay attention to the generation process of data tags.

[0003] In fact, in specific application scenarios, data tags will have varying degrees of impact on the overall security and performance of the system. In a multi-user scenario, for example, there are issues regarding the division of responsibilities for data outsourcing among various departments in smart government affairs. Since the members of each department are multiple independent individuals, there are the following two situations in the process of data preprocessing (mainly data tag generation):

[0004] 1. Set a group administrator to complete the data preprocessing work. This method has the problem of over-centralized power. If there are mistakes in the preprocessing process by the administrator, the integrity of the outsourced data cannot be effectively audited. An attacker can launch a "key person attack" and focus on attacking the administrator. Even if the processed data has computational security, it cannot prevent social engineering attacks. Once the administrator is compromised, the data of all users in the group is at risk. For the administrator himself, processing the data of the entire group will also cause a large computational burden.

[0005] 2. Members process their own data respectively. In this way, even if there are mistakes or attacks, only individual data will be damaged, and there is no problem of responsibility division. However, independent processing of data by individual members will cause the problem of tag redundancy. The same data may have multiple different tags, resulting in unnecessary local / cloud storage overhead. Independent data processing also easily makes the members of the same department lack communication.

[0006] Therefore, there is an urgent need for a data tag generation method that can both ensure data security and save resources to adapt to the gradually distributed network environment. Summary of the Invention

[0007] The purpose of the present invention is to overcome the deficiencies of the prior art and provide a privacy-preserving multi-party collaborative public auditing method, which allows members within a group to form a threshold group to jointly generate a tag for a piece of data, so as to reduce the tag redundancy of the same piece of data.

[0008] The object of the present invention is achieved by the following technical solutions:

[0009] A multi-party collaborative public auditing method for privacy protection includes three entities: a cloud service provider CSP with rich storage space, a third-party auditor TPA with professional capabilities and sufficient computing resources, and a department member group MG including multiple independent individuals member; the method includes:

[0010] System initialization phase: The third-party auditor TPA generates the public parameters required by the system, including: multiplicative cyclic group, elliptic curve group, symmetric encryption algorithm, hash algorithm, threshold parameter;

[0011] Distributed key generation phase: Executed by the interaction of the members within the department member group. The members within the department member group each generate member public and private keys, and randomly select a polynomial function to hide the member private keys; calculate and distribute the verifiable distributed key shares to other members within the threshold group, and generate the distributed signature key required for public auditing based on the distributed key shares;

[0012] Data outsourcing phase: Executed by the interaction of the members within the threshold group. Respectively generate the parameters required for tag generation based on the distributed signature key and the distributed secret key shares, including signature temporary parameters, signature blinding factors, signature collaborative private keys;

[0013] Integrity auditing phase: Executed by the interaction of the cloud service provider CSP and the third-party auditor TPA. The TPA initiates an audit challenge, the CSP responds to the challenge to calculate the storage proof, and the TPA reconstructs the distributed signature and verifies the storage proof.

[0014] Furthermore, the system initialization phase includes:

[0015] Select a large prime number p to form a multiplicative cyclic group Select an elliptic curve group where G is the generator;

[0016] Select a symmetric encryption algorithm Enc(·, key), where key is the symmetric key; select a hash function

[0017] Select a threshold parameter

[0018] Generate system public parameters

[0019] Furthermore, the distributed key generation phase includes:

[0020] Randomly select as the private key, and calculate pk l = skl ·G as the public key;

[0021] Randomly select a t-term polynomial f l (x) = a l,0 + a l,1 x +... + a l,t-1 x t-1 , where a l,0 = sk l , for sk l Calculate n secret key shares And send them to other members;

[0022] Calculate the distributed key share Calculate its verification value PS l = ps l ·G;

[0023] Each member l Calculate the distributed verification key

[0024] Each member within the threshold group l Interactively generate the distributed signature key DSK = Λ1ps1 + Λ2ps2 +... + Λ l ps l , where Λ l is the Lagrange coefficient of f l (x)

[0025] Furthermore, when the threshold value t = 2, the threshold group includes member1 and member2, and the data outsourcing stage includes:

[0026] Encryption data generation: Divide the original file f i into k data blocks: f i = m i1 || m i2 ||... || m ik ; Encrypt each data block using the symmetric encryption algorithm: c ij = Enc(m ij , k), where κ is the symmetric encryption key;

[0027] Signature collaboration private key interaction generation: member1 and member2 randomly select as their respective signature temporary parameters, and calculate the public values R1 = k1·G and R2 = k2·G;

[0028] member1 randomly selects as the signature collaboration private key of member1, and calculates its collaboration public key pk′1 = ;1·G;

[0029] Member1 and member2 cooperate to run the multiplication-addition conversion function MtA(α,β)→(a,b). Specifically, member1 inputs ε1 and member2 inputs k2, and the outputs t1 and t2 are obtained respectively, that is, ε1k2 = t1 + t2;

[0030] Member1 randomly selects As the blinding factor, calculate the check value Γ of the signature private key Γ = t1 + ε1θ1 - Λ1ps1 mod p, and send (θ1,Γ) to member2;

[0031] Member2 verifies the check value of member1: (t2 + Γ)·G = (θ1 + k2)·pk′1 - Λ1PS1; if the verification passes, member2 calculates the signature cooperation private key ε2 of member2 = Λ2ps2 - (t2 + Γ);

[0032] Combine its label parameter sp l =(k l ,ε l ,θ l );

[0033] Distributed label generation: member1 calculates the distributed signature R = k1R2 + k1θ1·G; member2 calculates the distributed signature R = (θ1 + k2)R1 = (r x ,r y ), where r x ,r y are the x coordinate and y coordinate of R on the elliptic curve respectively;

[0034] Member2 calculates the partial label of the data block and sends it to member1;

[0035] Member1 calculates the data block label

[0036] Furthermore, the integrity audit phase includes:

[0037] Challenge number generation: TPA runs a random number generator to generate a set of random challenge block numbers Generate the challenge information Chal = J and send it to CSP;

[0038] Storage proof generation: CSP finds the challenged data block and its corresponding label according to the challenge information, calculates the proof information T = ∑ j∈J σ ij , μ = ∑ j∈J c ij , and generates the storage proof Ω = (T,μ);

[0039] Integrity verification: The TPA calculates the distributed verification public key, and calculates the distributed signature based on the proof of storage, the distributed verification public key, and the x - coordinate of the signature Verification If they are equal, the verification passes; otherwise, it is proved that the data integrity is damaged.

[0040] The beneficial effects of the present invention are as follows:

[0041] 1) Based on secret sharing and MtA conversion technology, the present invention realizes the collaborative generation of tags by multiple parties without organization without additional communication overhead, resists "key person attacks" and solves the problem of responsibility division in the scenario of multi - user data outsourcing.

[0042] 2) Designed based on elliptic curve groups, the data size under the same security level is reduced by multiples. The generation of tags and the generation of proof of storage only involve simple operations (scalar multiplication, addition, hashing). The introduction of the MtA conversion algorithm (which can be implemented based on algorithms such as BGN and OT) further simplifies complex operations (scalar multiplication is simplified to addition), improves the efficiency of distributed tag generation, and significantly reduces the storage overhead and computational overhead involved. Its lightweight feature endows the invention with scalability.

[0043] 3) The present invention constructs an integrity proof based on the ECDSA signature algorithm, avoiding the huge overhead of bilinear pairing operations on the premise of ensuring computational security, making it available in storage environments with limited computational resources; ECDSA signature is one of the underlying cryptographic primitives of the blockchain, so the implementation of the present invention on the blockchain has inherent advantages. The use of MtA conversion protects the privacy of members, and the blind factor introduced in its implementation process enables distributed tag generation to further resist linear attacks. Brief Description of the Drawings

[0044] Figure 1 Schematic diagram of the privacy - protected multi - party collaborative public audit system provided by the embodiment of the present invention;

[0045] Figure 2 Schematic diagram of the interaction of each algorithm of the privacy - protected multi - party collaborative public audit method provided by the embodiment of the present invention;

[0046] Figure 3 Schematic diagram of the distributed key generation process in the privacy - protected multi - party collaborative public audit method provided by the embodiment of the present invention;

[0047] Figure 4 Schematic diagram of the collaborative signature key generation process in the privacy - protected multi - party collaborative public audit method provided by the embodiment of the present invention. Detailed Embodiments

[0048] Next, the technical solutions of the present invention will be clearly and completely described in conjunction with the embodiments. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative efforts belong to the scope of protection of the present invention.

[0049] Referring to Figures 1 - 4 , the present invention provides a technical solution:

[0050] A multi-party collaborative public auditing method for privacy protection includes three entities: a cloud service provider CSP with abundant storage space, a third-party auditor TPA with professional capabilities and sufficient computing resources, and a department member group MG including multiple independent individuals member. The system schematic diagram composed of the three entities is as shown in Figure 1 shown; the method includes:

[0051] S1 System initialization stage: The third-party auditor TPA generates the public parameters required for the system, including: multiplicative cyclic group, elliptic curve group, symmetric encryption algorithm, hash algorithm, threshold parameter; the above S1 system initialization stage is run by the third-party auditor TPA using the Setup(λ)→pp algorithm, and the specific steps include:

[0052] Select a large prime number p to form a multiplicative cyclic group Select an elliptic curve group where G is the generator;

[0053] Select a symmetric encryption algorithm Enc(·, key), where key is the symmetric key; select a hash function

[0054] Select a threshold parameter

[0055] Generate system public parameters

[0056] S2 Distributed key generation stage: Executed by the members within the department member group interactively. The members within the department member group each generate member public and private keys, and randomly select a polynomial function to hide the member private keys; calculate and distribute the verifiable distributed key shares to other members within the threshold group, and generate the distributed signature key required for public auditing based on the distributed key shares; including:

[0057] S21. Randomly select as the private key, and calculate pk l = sk l ·G as the public key;

[0058] S22. Randomly select a t-term polynomial f l (x)=al,0 +a l,1 x +... + a l,t-1 x t-1 , where a l,0 = sk l , is sk l Calculate n secret key shares and send them to other members;

[0059] S23. Calculate the distributed key share Calculate its verification value PS l = ps l ·G;

[0060] The above steps S21 - S23 are run by the member l to generate the key public share and its verification value by running the KeyShaGen(n) → (psl, PSl) algorithm.

[0061] S24. Each member l Calculates the distributed verification key

[0062] S25. Each member within the threshold group l Interacts to generate the distributed signature key DSK = Λ1ps1 + Λ2ps2 +... + Λ l ps l , where Λ l is the Lagrange coefficient of f l (x)

[0063] The above steps S24 - S25 are run by t members l to generate the distributed signature key by running the DisKeyGen({ps l} l∈[1,t] ,{pk l} l∈[1,n] ) → (DSK, DVK) algorithm.

[0064] S3 Data outsourcing phase: Executed interactively by members within the threshold group, generating the required parameters for generating tags based on the distributed signature key and the distributed secret key share respectively, including signature temporary parameters, signature blinding factors, and signature cooperation private keys;

[0065] In this embodiment, when the threshold value t = 2, the threshold group includes member1 and member2, and the data outsourcing phase includes the following steps 1 to 3:

[0066] Step 1: Encrypted data generation. The member cuts the data to be outsourced into data blocks and encrypts the data in units of data blocks;

[0067] Step 2: Generation of signature collaboration private key interaction. First, member2 of the threshold group selects a random number as the signature temporary parameter of member2, calculates its verification value, and then generates its proof digest and sends it to member1. Then, member1 selects a random number as the signature collaboration private key of member1 and calculates its signature collaboration public key. Then, member1 and member2 respectively input the signature collaboration private key and the signature temporary parameter to run the MtA conversion function and obtain their own conversion parameters respectively. Then, member1 selects a random number as the blinding factor, and calculates the verification value of the signature collaboration private key based on the conversion parameter of member1, the signature collaboration private key, the blinding factor, and the public key share, and sends it to member2. Finally, member2 verifies the validity of the verification value, and calculates the signature collaboration private key of member2 according to the verification value, the conversion parameter of member2, and the public key share under the condition of validity.

[0068] Step 3: Distributed label generation. First, member1 selects a random number as the signature temporary parameter of member1, calculates its verification value, generates its proof digest and sends it to member2. Then, member1 and member2 respectively verify the signature temporary parameters of each other and calculate signatures based on the information they each hold. Then, member2 generates a partial data block label based on the x coordinate of the member2 signature, the signature temporary parameter, the signature collaboration private key, the blinding factor of member1, and the encrypted data block, and sends it to member1. Finally, member1 generates the final data label based on the partial data block label, the x coordinate of the member1 signature, the signature collaboration private key, and the signature temporary parameter.

[0069] After completing the above steps, the data can be outsourced to the cloud service provider CSP.

[0070] In a specific embodiment, the data outsourcing phase includes:

[0071] Generation of encrypted data: The original file f i is split into k data blocks: f i = m i1 ||m i2 ||...||m ik ; Each data block is encrypted using a symmetric encryption algorithm: c ij = Enc(m ij , κ), where κ is the symmetric encryption key; member1 runs DatEnc({f i} i∈[1,s] , κ) → {c ij} i∈[1,s],j∈[1,k] The algorithm generates encrypted data blocks based on the original file.

[0072] Signature collaboration private key interaction generation: member1 and member2 randomly select as their respective signature temporary parameters, and calculate the public values R1 = k1·G and R2 = k2·G;

[0073] member1 randomly selects as member1's signature collaboration private key, and calculates its collaboration public key pk′1 = ε1·G;

[0074] member1 and member2 cooperate to run the multiply-accumulate conversion function MtA(α,β)→(a,b). Specifically, member1 inputs ε1 and member2 inputs k2, and obtains the outputs t1 and t2 respectively, that is, ε1k2 = t1 + t2;

[0075] member1 randomly selects as the blinding factor, calculates the verification value Γ of the signature private key as Γ = t1 + ε1θ1 - Λ1ps1 mod p, and sends (θ1,Γ) to member2;

[0076] member2 verifies member1's verification value: (t2 + Γ)·G = (θ1 + k2)·pk′1 - Λ1PS1; if the verification passes, member2 calculates member2's signature collaboration private key ε2 = Λ2ps2 - (t2 + Γ);

[0077] Combines its label parameter sp l =(k l ,ε l ,θ l );

[0078] The above signature collaboration private key interaction generation process is run interactively by the members of the threshold group SigKeyGen(DSK,{(ps l ,PS l )} l∈[1,t] )→{sp l} l∈[1,t] algorithm to generate the parameters required for label generation.

[0079] Distributed label generation: member1 calculates the distributed signature R = k1R2 + k1θ1·G; member2 calculates the distributed signature R = (θ1 + k2)R1 = (r x ,r y ), where r x ,r y are the x-coordinate and y-coordinate of R on the elliptic curve respectively;

[0080] member2 calculates the partial label of the data block and send it to member1;

[0081] member1 calculates the data block tag

[0082] The above - mentioned distributed tag generation process is run interactively by the members of the threshold group through TagGen(c ij ,{sp l} l∈[1,t] )→(σ ij ,R) algorithm to generate the data block tag.

[0083] S4 Integrity Audit Phase: It is executed interactively by the Cloud Service Provider (CSP) and the Third - Party Auditor (TPA). The TPA initiates an audit challenge, the CSP responds to the challenge by calculating the storage proof, and the TPA reconstructs the distributed signature and verifies the storage proof, including:

[0084] Challenge Number Generation: The TPA runs a random number generator to generate a set of random challenge block numbers Generate the challenge information Chal = J and send it to the CSP; The challenge number generation process is run by the TPA through ChalGen(c)→Chal algorithm to generate random challenge information.

[0085] Storage Proof Generation: The CSP finds the challenged data blocks and their corresponding tags according to the challenge information, and calculates the proof information T = ∑ j∈J σ ij , μ = ∑ j∈J c ij , and generates the storage proof Ω=(T, μ); The storage proof generation process is run by the CSP through PrfGen(Chal,{c ij ,{σ ij})→Ω algorithm to generate the storage proof of the data corresponding to the challenge.

[0086] Integrity Verification: The TPA calculates the distributed verification public key, and calculates the distributed signature based on the storage proof, the distributed verification public key, and the x - coordinate of the signature Verify If they are equal, the verification passes, that is, the audit is considered to pass; otherwise, it is proved that the data integrity is damaged and the audit fails; The integrity verification process is run by the TPA through PrfVer(Chal,Ω,DVK,R)→0 / 1 algorithm to verify the data integrity based on the challenge information, the storage proof, and the distributed verification key.

[0087] Among them, the correctness derivation of each verification equation is as follows:

[0088] (1) Distributed Key Verification: DSK·G = DVK

[0089]

[0090] (2) Signature private key verification: (t2 + Γ)·G = (θ1 + k2)·pk′1 - Λ1PS1

[0091] (t2 + Γ)·G = (t2 + t1 + ε1θ1 - Λ1ps1)·G

[0092] = (ε1k2 + ε1θ1 - Λ1ps1)·G

[0093] = ε1(k2 + θ1)·G - Λ1ps1·G

[0094] = (k2 + θ1)·pk′1 - Λ1PS1

[0095] (3) Distributed signature consistency verification: k1R2 + k1θ1·G = (θ1 + k2)R1

[0096] k1R2 + k1θ1·G = k1k2·G + k1θ1·G

[0097] = kj1(k2·G + θ1·G)

[0098] = (k2 + θ1)k1·G

[0099] = (θ1 + k2)R1

[0100] (4) Storage proof verification: T -1 (μ·G + r x ∑ j∈J H(ID i ||j)·DVK) = R, denote h ij = H(ID i ||j)

[0101]

[0102] Figure 2 is the schematic diagram of the algorithm interaction process involved in the present invention. Among them, the algorithms KeyShaGen, DisKeyGen, and SigKeyGen involve the interaction of internal members of the user group. Therefore, in Figure 3 the interaction of the KeyShaGen and DisKeyGen algorithms is shown by taking memberA, memberB, memberC, and memberD as examples, and in Figure 4 the interaction of the SigKeyGen algorithm is shown by taking memberA and memberD as examples.

[0103] The above are only the preferred embodiments of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein, and should not be regarded as excluding other embodiments, but can be used in various other combinations, modifications, and environments, and can be changed within the scope of the concept described herein through the above teachings or the technology or knowledge in the relevant field. And any changes and modifications made by those skilled in the art without departing from the spirit and scope of the present invention shall fall within the protection scope of the appended claims of the present invention.

Claims

1. A privacy-preserving multi-party collaborative public audit method, characterized by: It includes three entities: CSP, a cloud service provider with abundant storage space, TPA, a third-party auditor with professional capabilities and sufficient computing resources, and MG, a department member group consisting of multiple independent individual members; The method comprises: System initialization phase: The third-party auditor TPA generates the public parameters required by the system, including: multiplication cycle group, elliptic curve group, symmetric encryption algorithm, hash algorithm, and threshold parameters; Distributed key generation phase: executed interactively by members of the department member group, each member of the department member group generates a member public and private key, randomly selects a polynomial function to hide the member private key; calculates and distributes a verifiable distributed key share to other members of the threshold group, and generates a distributed signature key required for public auditing based on the distributed key share; Data outsourcing stage: It is executed interactively by members within the threshold group, and the required parameters are generated based on the distributed signature key and the distributed secret key share generation label, including signature temporary parameters, signature blinding factor, and signature collaboration private key; Integrity audit phase: The cloud service provider CSP interacts with the third-party auditor TPA. TPA initiates an audit challenge, CSP responds to the challenge by calculating the storage proof, TPA reconstructs the distributed signature, and verifies the storage proof. The system initialization phase includes: Choose a large prime number p to form a multiplication cyclic group Selected elliptic curve group Where G is the generator; Select the symmetric encryption algorithm Enc(·, key), where key is the symmetric key; select the hash function Select threshold parameters Generate system public parameters The distributed key generation phase includes: Random Selection As the private key, calculate pk l =sk l G as the public key; Randomly select a t-term polynomial f l (x) = a l,0 +a l,1 x+...+a l,t-1 x t-1 , where a l,0 =sk l , for sk l Calculate n secret key shares And send it to other members; Calculate the distributed key shares Calculate its verification value PS l =ps l ·G; Each member l Compute distributed verification key Each member in the threshold group l Interactively generate distributed signature key DSK = Λ1ps1+Λ2ps2+...+Λ l ps l , where Λ l Yes l Lagrange coefficient of (x) When the threshold value t=2, the threshold group includes member1 and member2, and the data outsourcing stage includes: Encrypted data generation: The original file f i Split into k data blocks: f i =m i1 ||m i2 ||...||m ik ; Use symmetric encryption algorithm to encrypt each data block: c ij =Enc(m ij ,κ), where κ is the symmetric encryption key; Signature collaboration private key interactive generation: member1 and member2 randomly select k1, As their respective temporary signature parameters, and calculate the public values ​​R1 = k1·G and R2 = k2·G; member1 random selection As member1’s signature collaboration private key, calculate its collaboration public key pk′1=ε1·G; Member1 and member2 cooperate to run the multiplication-addition conversion function MtA(α,β)→(a,b). Specifically, member1 inputs ε1 and member2 inputs k2, and the outputs t1 and t2 are obtained respectively, that is, ε1k2=t1+t2; member1 random selection As a blinding factor, calculate the checksum of the signature private key Γ=t1+ε1θ1-Λ1ps1modp and send (θ1,Γ) to member2; Member2 verifies member1's checksum: (t2+Γ)·G=(θ1+k2)·pk′1-Λ1PS1; if the checksum passes, member2 calculates member2's signature collaboration private key ε2=Λ2ps2-(t2+Γ); Combine its label parameter sp l =(k l ,ε l ,θ l ); Distributed tag generation: member1 calculates the distributed signature R = k1R2 + k1θ1·G; member2 calculates the distributed signature R = (θ1+k2)R1 = (r x ,r y ), where r x ,r y They are the x-coordinate and y-coordinate of R on the elliptic curve; member2 calculates part of the data block label And send it to member1; member1 calculates the data block label 2. According to claim 1, a privacy-preserving multi-party collaborative public audit method is characterized by: The integrity audit phases include: Challenge number generation: TPA runs a random number generator to generate a set of random challenge block numbers Generate challenge information Chal=J and send it to CSP; Storage proof generation: CSP finds the challenged data block and its corresponding label based on the challenge information and calculates the proof information T = ∑ j∈J σ ij ,μ=∑ j∈J c ij , generate storage proof Ω = (T, μ); Integrity verification: TPA calculates the distributed verification public key, and calculates the distributed signature based on the storage proof, the distributed verification public key, and the x-coordinate of the signature verify If they are equal, the verification is successful; otherwise, the data integrity is compromised.

Images