An encryption deduplication method to resist convergence key leakage

Abstract

The present invention proposes an encryption deduplication method for resisting convergence key leakage, the method comprising the following steps: S1 : Set security parameters, the number of data block fragments and n × n The matrix is ​​constructed by generating a matrix of the same order, and the element values ​​therein are set, a fixed-length hash function and a multi-set hash function based on an XOR operation are output, and the master key of the storage server is set; S2 : The client first calculates the file F The file key of the file F Split into fixed-size chunks F :{ f1 , f2 , f3 ..., fn}. Calculate the hash value of each file block to obtain the convergence key; the present invention supports two-level deduplication at the file level and the block level. The client and the storage server first perform file-level deduplication, and then perform block-level deduplication when there is no duplication, saving storage space to the greatest extent. Secondly, the present invention supports client-side deduplication, reducing the communication cost between the client and the storage server.

Description

Technical Field

[0001] The invention belongs to the field of encryption deduplication, and in particular relates to an encryption deduplication method for resisting convergence key leakage. Background Art

[0002] At present, with the development of Internet technology, more and more people are surfing the Internet, and the amount of data per capita has increased dramatically. Statista analysis and forecasting, to 2035 In 2018, the amount of global data is expected to reach 2142Zb The ever-increasing amount of data and the storage space required to store it have become a major issue. Due to the limited storage and data maintenance capabilities of individual users or small and medium-sized enterprises, more and more people choose to outsource their data to cloud storage providers with low storage costs. In order to save storage costs, cloud service providers have adopted deduplication technology. Deduplication technology can detect and delete the same files in the data outsourced by different users, leaving only one encrypted backup. In order to detect duplicate data in the encrypted state, Douceur et al. Douceur J R , Adya A , Bolosky W J , et al . Reclaiming space from duplicate files in a serverless distributed file system [ C ]. Proceedings 22nd International conference on distributed computing systems . 2002 . 617 - 624 .] proposed a convergent encryption algorithm that uses the file's fingerprint as the encryption key ( CE ). Different users use CE Encrypting the same file will produce the same ciphertext. CE This method is vulnerable to offline brute force attacks. Bellare et al. Keelveedhi S , Bellare M , Ristenpart T . DupLESS : server - aided encryption for deduplicated storage [ C ]. Proceedings of the 22nd USENIX conference on Security . 2013 . 179 - 194 .] proposed DupLESS The algorithm introduces a trusted third-party key server to assist users in generating convergent keys to resist offline brute force attacks, and to resist online brute force attacks by limiting the user's access frequency. DupLESS The encryption deduplication scheme of the scheme may still be subject to various attacks from both inside and outside, such as single point failure problems, key retention attacks, frequency analysis attacks, side channel attacks, etc. Many related works have also been proposed.

[0003] 2015 Year, Liu et al. Liu J , Asokan N , Pinkas B . Secure deduplication of encrypted data without additional independent servers [ C ]. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . 2015 . 874 - 885 .] proposed the first deduplication scheme that does not require additional servers to resist brute force attacks, thus solving the single point of failure problem. Their scheme exploits the high collision rate of short hashes to resist offline brute force attacks.

[0004] 2016 Year, Li et al. Li J , Qin C , Lee P P C , et al . Rekeying for encrypted deduplication storage [ C ]. 2016 46th Annual IEEE / IFIP International Conference on Dependable Systems and Networks ( DSN ). 2016 . 618 - 629 .]based on the convergent all - or - nothing transform ( CAONT ) and attribute encryption ( ABE ) proposed a partial re-encryption solution to the ownership control problem. REED algorithm.

[0005] 2019 Year, Yuan et al. Yuan H , Chen X , Li J , et al . Secure cloud data deduplication with efficient re - encryption [ J ]. IEEE Transactions on Services Computing .2019 . 442 - 456 .]Discover REED Vulnerable to stub retention attacks and using Bloom filters ( Bloom Filter ) Randomly sample some bits and re-encrypt them to solve the stub retention attack.

[0006] 2020 Year, Li et al. Li J , Yang Z , Ren Y , et al . Balancing storage efficiency and data confidentiality with tunable encrypted deduplication [ C ]. Proceedings of the Fifteenth European Conference on Computer Systems . 2020 . 1 - 15 .] proposed a traditional encryption deduplication method that retains the ability to deduplicate encrypted duplicate data blocks by always obtaining encryption / decryption keys from the data block content, but this determinism leads to information leakage due to frequency analysis. They proposed an encryption deduplication scheme that resists frequency attacks TED ,A tunable cryptographic deduplication primitive that provides a tunable mechanism to balance the trade-off between storage efficiency and data confidentiality.

[0007] 2023 Year, Ha et al. Ha G , Jia C , Chen Y , et al . A secure client - side deduplication scheme based on updatable server - aided encryption [ J ]. IEEE Transactions on Cloud Computing , 2023 . 3672 - 3684 ] believe that in the encryption deduplication scheme based on key server assistance, once the master key of the key server is leaked, all users' private data may be attacked in offline packets. In addition, they proposed a method based on renewable encryption ( UE ) that implements efficient encryption and user-transparent key updates of system-level master keys.

[0008] The above encryption deduplication schemes all ignore the fact that the user who revokes ownership retains the convergent encryption key, and then obtains part of the ciphertext or all of the ciphertext by monitoring or attacking the storage server, and then decrypts the plaintext to save data outsourcing costs. We assume that the user who revokes ownership cannot obtain the master key of the storage server.

[0009] Publication No. CN110278087A Using asymmetric encryption and zero-knowledge proof technology, a file-level encryption deduplication method is designed. This method uses zero-knowledge verification method and secondary hashing to achieve functions such as key and file separation and complete ownership authentication. It alleviates the convergence encryption ( CE ) The encryption operation on the same file causes the computational overhead to increase as the deduplication rate of the data load increases. HSN The same files between different users are deduplicated on the network. Only one encrypted copy of the content needs to be saved on the network, which effectively protects the user's data content and privacy and improves HSN Storage efficiency in networks.

[0010] The authorization number is CN112637153 Disclosed is an encryption deduplication method, which first divides a file into variable-length file blocks; then calculates a hash feature value of each plaintext file block; finally compares each hash feature value with feature data on a deduplication storage server; if a file block is not stored on the deduplication storage server, M The hash feature value of the file block M The data is encrypted and sent to the deduplication storage server. The invention uses the data characteristics of the plain text to generate an encryption key, which ensures the security of the data while achieving encryption deduplication and realizes effective access control. Summary of the invention

[0011] The present invention proposes a method for resisting convergence key leakage, so that even if an attacker obtains the convergence key, the plaintext information cannot be decrypted. Multi-set hashing is used to implement local block updates of files, so as to achieve safe and efficient deduplication of duplicate data between multiple users.

[0012] The technical solution of the present invention is implemented as follows: an encryption deduplication method for resisting convergence key leakage, the method comprising the following steps:

[0013] S1 : Set security parameters, the number of data block fragments and n × n The matrix is ​​constructed by generating a matrix of the same order, and the element values ​​therein are set, a fixed-length hash function and a multi-set hash function based on an XOR operation are output, and the master key of the storage server is set;

[0014] S2 : The client first calculates the file F The file key of the file F Split into fixed-size chunks F :{ f1 , f2 , f3 ..., fn }. Calculate the hash value of each file block and obtain the convergence key;

[0015] S3 : After passing the legal identity authentication, the client uploads the file tag to the storage server. The storage server verifies the uploaded file tag. If it has been stored and the client's identity is in the ownership list, Pid , then the confirmation information is returned to the client; if it has been stored, but the client's identity does not exist in the ownership list Pid , the storage server randomly generates a n Dimensional vector U =[ u1 , u2 , u3 ,... un ] is sent to the client, and the client generates the ownership certificate through the vector and the file ciphertext; if it is not stored, the unstored information is fed back to the client, and after receiving the unstored information, the client calculates the file F The tags of each file block in the file are uploaded to the storage server, and block-level duplicate data detection and ownership verification are performed with the storage server;

[0016] S4 :The client sends a file download request to the storage server and sends the file tag to the storage server, and the storage server queries the file F The corresponding file owner list, if the user's identity Pid In the file owner list, all ciphertext blocks are found through the file recipe, and the file blocks encrypted by the server are decrypted and sent to the client, and the file blocks and the remaining ciphertext blocks are sent to the client at the same time; if the user's identity Pid If it is not in the owner's list, it will be rejected;

[0017] S5 :After the client receives the set of ciphertext blocks sent in sequence by the server, it calculates the transformation matrix A Inverse A - 1 , and then use the convergent key to decrypt the file block ciphertext for each block until all the file blocks are decrypted and the file is restored to the original file F ;

[0018] S6 :When the client accesses the file F When ownership expires, the storage server will Pid From File F The storage server removes the file from the user owner list and then decrypts the file block. The storage server recalculates a new file encryption key based on the remaining file owner set and randomly selects two file blocks from the non-repeated ciphertext blocks and re-encrypts them to obtain a new file block.

[0019] S7 : When a client updates a file F When the client first calculates the updated new file tag from the old file tag, the client sends an update request, and sends the file tag, the updated file tag, the file block number, the new file ciphertext block, and the key ciphertext to the storage server. After receiving the update request, the storage server calculates the updated file tag and compares it with the tag uploaded by the client to check whether they are the same. If they are the same, check whether the new file ciphertext block has been stored. If not, store the file block and add the storage address and file block tag to the storage server. F In the file recipe, if it has been stored, the storage information will be fed back.

[0020] As a preferred embodiment, the S1 The security parameter in is set to l, and the number of data block fragments is set to n , n The matrix is ​​expressed as A n×n , when outputting a fixed-length hash function, it is represented as H1 :{ 0 , 1}*→ G , the arbitrarily long input mapping group G In the element, the master key of the storage server is represented as Kcsp , which means string concatenation.

[0021] As a preferred embodiment, the steps S2 The file key in is represented as Kf = H ( F ), the hash value of each file block is expressed as ki = H ( fi ) ( 1 ≤ i ≤ n ), for each file block f i The file blocks are encrypted using the fingerprint as the convergence key, and the client encrypts the convergence key by using the file key.

[0022] As a preferred implementation, the client divides the encrypted file blocks into slices of the same size, where the slice size is | ki |, import the shards n The addition and multiplication in the operation are respectively used XOR and AND Operation execution.

[0023] As a preferred embodiment, the steps S3 The client receives n Dimensional vector U After that, the ownership certificate is calculated and sent to the storage server. After receiving the ownership certificate, the storage server verifies the ownership certificate. If they are consistent, the client feedbacks confirmation and sends the client identity. Pid Add to the file owner list. If they are inconsistent, user service will be denied.

[0024] The steps S3 When the storage server receives the file block tag set uploaded by the client, it queries each file block one by one to see if it has been stored and generates a n Dimensional vector V =[ v1 , v2 ,..., vn ], where the corresponding element value of the file block that has not been stored in the vector is 0, and V is sent to the client. The user will only judge which ones have been stored by whether the value is 0. For those that have been stored, there is no need to upload the ciphertext, and only a proof of ownership for these blocks needs to be calculated, while those that have not been stored need to upload the ciphertext.

[0025] As a preferred implementation, the client receives the vector V Then check the vectorV Each element value in , and all the values ​​that are not 0 The client calculates the file block ownership proof based on the non-zero elements in V and the corresponding file block ciphertext, and uploads the ownership proof and the file block ciphertext and key ciphertext corresponding to the remaining vector elements with values ​​of 0 to the server and saves the file label locally.

[0026] As a preferred implementation, after receiving the user's ownership certificate and ciphertext block set, the storage server first verifies the validity of the user's ownership certificate by comparing and verifying the file blocks uploaded by the user with the stored file block fragments.

[0027] After adopting the above technical scheme, the beneficial effects of the present invention are as follows: the present invention supports two-level deduplication, file level and block level. The client and the storage server first perform file level deduplication, and then perform block level deduplication when there is no duplication, saving storage space to the greatest extent. Secondly, the present invention supports client-side deduplication, reducing the communication cost between the client and the storage server. The present invention supports block-level updates of files (deletion, addition, and update of file blocks), and the client can update files without downloading the complete file ciphertext. The client constructs an update request with the updated file block and the updated file tag, and the block-level tag for the storage server to update the file. The client and the server can perform batch deduplication, and the number of interaction rounds between the two parties is independent of the number of file blocks, reducing the communication cost of both parties. In addition, when a malicious client revokes ownership, it retains the convergence key, and obtains the ciphertext stored by the storage server by some means (here refers to the ciphertext that has not been decrypted). package The client still cannot successfully decrypt the plaintext related information. Access control is effectively implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0029] picture 1 The present invention is a flow chart of the method. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] Example:

[0032] As shown 1 As shown, an encryption deduplication method for resisting convergence key leakage is characterized by comprising the following steps:

[0033] step 1 : Set system parameters. is a safety parameter. n Is the number of data block fragments. A n×n :yes n A vector of order, where the element value is

[0034] The output is a fixed-length hash function. , the arbitrarily long input mapping group G Medium element. H2 : Salted hash. Multi-set hash function based on XOR operation. Master key of storage server: . || represents string concatenation in the following text.

[0035] step 2 :Client to file F Encryption processing is performed.

[0036] step 201 : The client first calculates the file F The file key: , the file F Split into fixed-size chunks F :{ f 1 , f 2 , f 3 ..., f n}. Calculate the hash value of each file block: .

[0037] For each file block f i Perform the following operations.

[0038] step 202: The client uses the above file block fingerprint to encrypt the file block: .

[0039] step 203 : The client uses the file key to encrypt the convergence key: .

[0040] step 204 : The client will Divide into equal-sized shards , the shard size is .

[0041] Client Computing The addition and multiplication operations are respectively XOR and AND Operation execution.

[0042] The client gets the file ciphertext After that, calculate the file label .

[0043] step 3 : File upload deduplication processing

[0044] step 301 : After passing the legal identity authentication, the client will T f Upload to the storage server.

[0045] step 302 : The storage server checks whether the T f，

[0046] If it is already stored and the ownership list has the client's identity Pid . This means that the user has uploaded a file F The storage server returns to the user " YES ”.

[0047] If already stored T f , but the client's identity is not in the ownership list Pid . Indicates that the client is the subsequent uploader. The storage server randomly generates a n Dimensional vector U =[ u1 , u2 , u3 ,... un ] is sent to the client. The storage server and the client continue to execute steps 303 Perform file-level challenge and response. If there is no storage, it means that the client is the first uploader. The storage server returns " No " to the client. The storage server and client execute steps 305 Perform block-level challenge response.

[0048] step 303 : The client receives the vector U After that, calculate the proof of ownership The client will proof Sent to the storage server.

[0049] step 304 : The storage server receives proof of ownership proof After that, execute And compare , if they are equal then return the user" Yes ", and the client identity Pid Add to the list of file owners. Otherwise, deny service to the user.

[0050] step 305 : The client receives " No "After that, the client calculates the file F The labels of each file block in , and change the file block tag { T1 , T2 , T3 ,..., Tn }Upload to the storage server.

[0051] step 306 :After receiving the file block tag set uploaded by the client, the storage server queries one by one whether the file blocks have been stored and generates a n Dimensional vector V =[ v1 , v2 ,..., vn ]. Assumption Ti is not stored, then the first i Elements vi Then 0 ,if Tj has been stored, then j Elements vj is a randomly generated number. Then the vector V Send to the server.

[0052] step 307 : The client receives V Then, check the elements and find all the values ​​that are not 0 Elements .by calculate Client sends Proof and the remaining values ​​are0 The file block ciphertext and key ciphertext corresponding to the vector element of the file are uploaded to the server. The client sends the file tag Tf Save locally.

[0053] step 308 :The storage server receives the user's proof After the ciphertext block is collected, the validity of the user's proof of ownership is verified. The server first calculates the The corresponding file block calculate Storage Server Comparison If they are the same, the storage server will check the uploaded file blocks and the already stored Restructure file tags .

[0054] And compare (This not only guarantees the user's ownership of some file blocks, but also proves the ciphertext and file tags uploaded by the user. The corresponding relationship between them.

[0055] step 309 : The storage server builds a file F The file recipe (mainly including: file name, file block label, block storage address, and file owner list) and the client's identity Pidnum Add to the file owner list, assuming the file F have num The storage server uses the file owner's identity set and the master key to generate a file encryption key. , , and select any two blocks from the ciphertext blocks uploaded by the user for encryption. For example: the ciphertext block set uploaded by the user contains file blocks C2 , C3 , then use encryption C2 , C3 get

[0056] .

[0057] File download.

[0058] step 401 :The client sends a file download request to the server and tags the file Tf Sent to the storage server.

[0059] step 402 : Storage server query file F The corresponding file owner list. If the user Pid In the file owner list, all ciphertext blocks are found through the file recipe, and the file blocks are package Decryption

[0060] Then package It is sent to the client together with the remaining ciphertext blocks.

[0061] step 5 : File decryption processing.

[0062] step 501 :After the client receives the ciphertext block set sent in sequence by the server. Calculate the conversion vector A The inverse A - 1 Then for each block . Perform the subsequent processing as described above.

[0063] step 502 : Client Computing . Then use the file Kf Then, the client uses the converged key to decrypt the file block ciphertext .

[0064] step 503 : Client Computing If it passes, continue to step 502 Until all the file blocks are decrypted. Then the file is restored to the original file F .

[0065] step 6 : User ownership revoked.

[0066] step 601 :When the client accesses the file F When ownership of the client expires, the storage server will Pidk From File F Then remove the user from the owner list. package Decryption The storage server recalculates the new file encryption key based on the remaining set of file owners. Then randomly select two file blocks from the non-repeated ciphertext blocks and re-encrypt them to obtain the new .

[0067] step 7 : File block update.

[0068] step 701 :When a client wants to update the file F When the partial file blocks (we use blocks CiFor example). The client first calculates the file tag after the block is updated:

[0069] The client sends an update request (file tag, updated file tag, file block number, new file ciphertext block, key ciphertext) to the storage server.

[0070] step 702 :After receiving the update request, the storage server executes 701 The new file tag calculated in is compared with the tag uploaded by the client If they are the same, check And check whether it has been stored. If not, store the file block and add the storage address and file block tag to F in the file recipe.

[0071] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An encryption deduplication method for resisting convergence key leakage, characterized in that: The method comprises the following steps: S1 : Set security parameters, the number of data block fragments and n × n The matrix is ​​constructed by generating a matrix of the same order, and the element values ​​therein are set, a fixed-length hash function and a multi-set hash function based on an XOR operation are output, and the master key of the storage server is set; S2 : The client first calculates the file F The file key of the file F Split into fixed-size chunks F :{ f1 , f2 , f3 ..., fn }. Calculate the hash value of each file block and obtain the convergence key; S3 : After passing the legal identity authentication, the client uploads the file tag to the storage server. The storage server verifies the uploaded file tag. If it has been stored and the client's identity is in the ownership list, Pid , then return confirmation information to the client; If it has been stored, but the client's identity is not in the ownership list Pid , the storage server randomly generates a n Dimensional vector U =[ u1 , u2 , u3 ,... un ] is sent to the client, and the client generates a proof of ownership through the vector and the file ciphertext; If it is not stored, the unstored information will be fed back to the client. After receiving the unstored information, the client will calculate the file F The tags of each file block in the file are uploaded to the storage server, and block-level duplicate data detection and ownership verification are performed with the storage server; S4 :The client sends a file download request to the storage server and sends the file tag to the storage server, and the storage server queries the file F The corresponding file owner list, if the user's identity Pid In the file owner list, all ciphertext blocks are found through the file recipe, and the two encrypted file blocks are decrypted and sent to the client, and the file blocks and the remaining ciphertext blocks are sent to the client at the same time; if the user's identity Pid If it is not in the owner's list, the delivery will be refused; S5 :After the client receives the set of ciphertext blocks sent in sequence by the server, it calculates the transformation matrix A Inverse A - 1 , and then use the convergent key to decrypt the file block ciphertext for each block until all the file blocks are decrypted and the file is restored to the original file F ; S6 :When the client accesses the file F When ownership expires, the storage server will Pid From File F The storage server removes the two file blocks encrypted by the server from the user owner list, and then decrypts the two file blocks encrypted by the server again. The storage server recalculates the new file encryption key based on the remaining file owner set and randomly selects two file blocks from the non-repeated ciphertext blocks to re-encrypt the new file block. S7 : When a client updates a file F When the client first calculates the updated new file tag from the old file tag, the client sends an update request, and sends the file tag, the updated file tag, the file block number, the new file ciphertext block, and the key ciphertext to the storage server. After receiving the update request, the storage server calculates the updated file tag and compares it with the tag uploaded by the client to check whether they are the same. If they are the same, check whether the new file ciphertext block has been stored. If not, store the file block and add the storage address and file block tag to the storage server. F In the file recipe, if it has been stored, the storage information will be fed back.

2. As claimed in claim 1 The encryption deduplication method for resisting convergence key leakage is characterized by: Said S1 The security parameter in is set to 1, and the number of data block fragments is set to n , n*n The matrix is ​​represented as A n×n , when outputting a fixed-length hash function, it is represented as H1 :{ 0 , 1 }*→ G , the arbitrarily long input mapping group G In the element, the master key of the storage server is represented as K csp .

3. As claimed in claim 1 The encryption deduplication method for resisting convergence key leakage is characterized by: The steps S2 The file key in is represented as K = H ( F ), the hash value of each file block is expressed as ki = H ( fi ) ( 1 ≤ i ≤ n ), for each file block f i The file blocks are encrypted using the fingerprint as the convergence key, and the client encrypts the convergence key by using the file key.

4. As claimed in claim 3 The encryption deduplication method for resisting convergence key leakage is characterized by: The client divides the encrypted file blocks into pieces of equal size, and the piece size is | ki |, the slices are formed into an n-order vector and A n×n Perform multiplication operations, where addition and multiplication are performed using XOR and AND Operation execution.

5. As claimed in claim 1 The encryption deduplication method for resisting convergence key leakage is characterized by: The steps S3 The client receives n Dimensional vector U After that, the ownership certificate is calculated and sent to the storage server. After receiving the ownership certificate, the storage server verifies the ownership certificate. If they are consistent, the client feedbacks confirmation and sends the client identity. Pid Add to the file owner list. If they are inconsistent, user service will be denied.

6. As claimed in claim 1 The encryption deduplication method for resisting convergence key leakage is characterized by: The steps S3 When the storage server receives the file block tag set uploaded by the client, it queries each file block one by one to see if it has been stored and generates a n Dimensional vector V =[ v1 , v2 ,..., v ], where the element value corresponding to the file block that is not stored in the vector is 0, and V is sent to the client.

7. As claimed in claim 6 The encryption deduplication method for resisting convergence key leakage is characterized by: The client receives the vector V Then check the vector V Each element value in , and all the values ​​that are not 0 The client calculates the file block ownership proof based on the non-zero elements in V and the corresponding file block ciphertext, and uploads the ownership proof and the file block ciphertext and key ciphertext corresponding to the remaining vector elements with values ​​of 0 to the server and saves the file label locally.

8. As claimed in claim 7 The encryption deduplication method for resisting convergence key leakage is characterized by: After receiving the user's ownership certificate and the ciphertext block set, the storage server first verifies the validity of the user's ownership certificate by comparing and verifying the file blocks uploaded by the user with the already stored file block fragments.

Images