Efficient and extensible inter-group data ownership transfer method

Abstract

The invention relates to an efficient and extensible inter-group data ownership transfer method. Comprising the following steps: 1) generating a group user key; 2) generating a data integrity auditing label; 3) auditing data integrity; 4) dynamically joining or quitting the group users; and 5) data ownership transfer. According to the method, a random mask is added to a private key indexed in an integrity auditing label, and meanwhile public parameters corresponding to the random mask are calculated. Compared with the problem that the existing scheme is difficult to adapt to the dynamic characteristics of the group, the method has the advantages that 1) the structure of the BLS aggregation signature is adaptively optimized, the rogue key attack can be effectively resisted, and the ownership of the group to the data can be transferred only under the condition that the public key and the private key are consistent; the generated data integrity auditing label can effectively resist collusion attacks, safety of sensitive information such as private keys of two transaction parties is guaranteed, participation of any trusted third party is not needed, and the method is more suitable for actual production.

Description

Technical Field

[0001] The present invention relates to the technical field of cloud storage data security attributes, and in particular to an efficient and scalable method for transferring data ownership between groups. Background Art

[0002] The rapid development of information technology has brought great changes to people's lives. Traditional local storage methods can no longer cope with the growing amount of data. Therefore, more and more individuals and organizations choose to use inexpensive cloud storage services to store and manage data online. According to the world-renowned consulting firm IDC, by 2025, nearly half of the world's data, that is, more than 175 zettabytes, will be stored in the cloud. The continuous growth and benign management of data have laid a solid foundation for data to release economic vitality. In addition, with the continuous breakthroughs and development of technologies such as big data and artificial intelligence in recent years, data has been circulated in the data factor market as a new means of production. In actual transactions, in order to ensure the fairness of transactions, data ownership is generally abstracted as the audit capability of cloud data integrity, which is essentially transferred in the form of user keys with data transactions. In response to this, researchers such as Wang integrated cryptographic technologies such as proxy re-encryption, random masking, and aggregate signatures into classic data integrity audit schemes to achieve reversible, trusted third-party-free, and lightweight data ownership transfer. However, most of these schemes focus on single-entity transaction scenarios. The first research work on the transfer of data ownership in inter-group transactions was too rough in its technical abstraction of multi-user groups. It assumed that the group structure was fixed, and then used aggregate signature technology to simply aggregate the transaction group into a logical single entity, and continued the idea of ​​transactions between single entities to complete the transfer of data ownership between groups.

[0003] However, the assumption that the internal structure of a group is always stable is difficult to hold in practice, especially for data collection companies, artificial intelligence startups, research institutions and universities that are relatively active in the data factor market. They often form transaction groups with different user compositions around transaction data and change the group composition from time to time during the project advancement. The BLS digital signature scheme has a good homomorphic structural foundation and integrates a publicly verifiable tightening PoR scheme. It can realize the rapid embedding, aggregation and update of multi-user private keys of the group in the data integrity label without a trusted third party, thereby completing the dynamic confirmation and transfer of ownership of the multi-user group to its data. The BLS digital signature method is briefly described as follows:

[0004] (1) Key Generation

[0005] (1-1) Choose a large prime number p and a prime number q, where q is a factor of p-1.

[0006] (1-2) Choose a generator g, which is the group Z* P The generator of gq ≡1 mod p.

[0007] (1-3) Generate a private key sk for each signer i , 1 <sk i <q。

[0008] (1-4) Calculate the public key

[0009] (1-5) For n public keys pk 1 ,……,pk n , calculate the aggregate public key

[0010] (2) Signature generation

[0011] (2-1) For message (m), calculate its hash value H(m) and map it to point Q=H(m) on the elliptic curve.

[0012] (2-2) The signer uses the private key sk i Calculate the signature with message m

[0013] (3) Aggregate Signature

[0014] (3-1) For n signatures S 1 , S 2 ,…,S n , calculate the aggregate signature

[0015] (3-2) Verify the aggregate signature: Calculate If the equality holds, then all signatures are valid.

[0016] Based on this, Shen et al. proposed an integrity audit scheme for the transfer of ownership between multi-user groups. However, this scheme based on BLS digital signature still has the following problems: (1) Insufficient support for dynamics: In the face of the strong dynamics within the group, existing research work is either limited by the rigid design and difficult to transform, or will cause obvious performance degradation after the transformation; (2) It is difficult to resist rogue key attacks: Under the existing scheme, the attacker can use the public key sub-shares of other honest users to generate a valid BLS aggregate signature for a given information without the actual participation status of other honest users. This will cause the user to be maliciously added or removed from the ownership of the specified data by other users in the group without knowing it, affecting the fairness of the transaction; (3) It is easy to cause collusion attacks: In existing research, the index factor in the data integrity audit label is decoupled from the data, and the private key of the signature index factor is directly transferred when the data is transferred. At this time, it may be subject to collusion attacks between the conspirators and the cloud storage service provider, resulting in the failure of the integrity audit of files that have not been traded. Summary of the invention

[0017] In view of this, the purpose of the present invention is to provide an efficient and scalable method for transferring data ownership between groups, which solves the problems of insufficient dynamic support, difficulty in resisting rogue key attacks, and easy to cause collusion attacks in the above-mentioned continuous proof of cloud data integrity technology.

[0018] To achieve the above object, the present invention adopts the following technical solution: an efficient and scalable method for transferring data ownership between groups, comprising the following steps:

[0019] Step 1: Group A users generate system parameters, public-private key pairs, and aggregated public keys;

[0020] Step 2: Group A users generate integrity audit labels for the data;

[0021] Step 3: After outsourcing the file blocks and integrity audit labels to the cloud storage service provider, any user in group A can initiate a random data integrity audit challenge to the cloud storage service provider;

[0022] Step 4: When the user members of group A change, the data ownership is changed dynamically;

[0023] Step 5: Group A chooses to transfer the data and data audit rights to Group B.

[0024] In a preferred embodiment, the step 1 specifically includes the following steps:

[0025] Step 11: Users in group A select a cyclic multiplication group G of prime order q 1 and G T , and through G 1 and GT Choose an efficient non-degenerate bilinear pairing e:G 1 ×G 1 →G T , and define a binary string of arbitrary length that can be mapped to the cyclic multiplicative group G 1 The cryptographic hash function H in 1 , H 1 :{0,1} * →G 1 And can map binary strings of arbitrary length to the integer ring Z P The cryptographic hash function H in 2 , H 2 :{0,1} * →ZP, where “×” represents the pairing operation between two groups, “→” represents the mapping symbol, and “*” represents any number of iterations;

[0026] Step 12: Group A users disclose system parameters pp, pp←{p,G 1 ,G T ,e,g,u,H 1 ,H 2}, where “←” represents the assignment symbol, p is a large prime number, and g,u are the components of the group G 1 Two independent generators selected at random;

[0027] Step 13: Group A users randomly select a private key sk i ,sk i ∈ R Z p , and calculate the corresponding public key pk through the generator g i , At the same time, through the cryptographic hash function H 1 Calculate the hash power of the corresponding public key apk i , Then for all users' apk i Perform product operation to obtain the aggregate public key APK, Public APK.

[0028] In a preferred embodiment, the step 2 specifically includes the following steps:

[0029] Step 21: Group A users select a random number a i , a i ∈ R Z p , and combined with the generator g, the cryptographic hash function H 2 And its own private key sk i Calculate the parameter h' i , and r'i , where ‖ represents the concatenation operation;

[0030] Step 21: The users in Group A divide the encoded file F into n file blocks of the same size F = {m 1 ,..., m n}, where m j ∈Z p , (1 < j < n). Calculate the corresponding integrity audit tag σ ij for each file block. At the same time, add a random mask a ij to sk i during the calculation of the integrity audit tag σ i , that is where ‖ represents the concatenation operation;

[0031] Step 23: Any user in Group A aggregates the integrity tags calculated by all users for the data block m j to calculate the integrity audit tag set σ j . where ‖ represents the concatenation operation. At the same time, also aggregate the parameters h' i and r' i respectively to obtain H, and R, and send {m j , σ j} j∈n to the cloud storage service provider and disclose R and H.

[0032] In a preferred embodiment, step 3 specifically includes the following steps:

[0033] Step 31: After receiving the integrity audit challenge chal, the cloud storage service provider calculates the data storage proof DP, and the integrity audit tag storage proof TP, The cloud storage service provider then sends the audit proof P, P = {DP, TP}, to the integrity audit initiator;

[0034] Step 32: After receiving the storage proof P, the integrity audit initiator uses the equation to verify the storage proof P; if the verification shows that the storage proof P is correct and outputs True, it means that the data stored on the cloud server is complete; otherwise, it outputs False, indicating that the integrity of the stored data is damaged.

[0035] In a preferred embodiment, step 4 specifically includes the following steps:

[0036] Step 41: When a user initiates a request to join group A, the user to be added (marked ) Generate a public-private key pair through steps (1-3) Afterwards Select random number and Calculation parameters as well as At the same time, calculate the remaining auxiliary information as well as

[0037]

[0038] Then any user among the users to be added aggregates the auxiliary information and calculates as well as After the calculation is completed, the auxiliary information is sent to the cloud storage service provider. After receiving the auxiliary information, the cloud storage service provider calculates and updates the integrity audit label σ' j :

[0039]

[0040] Step 42: When a user in group A initiates a logout request, the user to be logged out (marked )Select a random number And calculate the auxiliary information as well as

[0041]

[0042] Then the user who left the group Any user aggregates the auxiliary information and calculates as well as After calculation, the auxiliary information is sent to the cloud storage service provider. After receiving the auxiliary information, the cloud storage service provider calculates and updates the integrity audit label σ' j :

[0043]

[0044] In a preferred embodiment, the step 5 specifically includes the following steps:

[0045] Step 51: Group A users select a random number x i , x i ∈ R Z p, and calculate the auxiliary information h i ,aux i and v i ;

[0046]

[0047] Step 52: Then any user in group A aggregates the auxiliary information and calculates h CA =∑ i∈S h i ,aux CA =∑ i∈S aux i and v CA =Π i∈S v i , and send the aggregated information to group B;

[0048] Step 53: After receiving the auxiliary information sent by the users in group A, the users in group B select a random number a i and x' i , a i ,x' i ∈ R Z p , and calculate the parameter h' i , and r' i , And other auxiliary information h i ,aux i and v i ;

[0049]

[0050] Step 54: At the same time, any user in group B aggregates the auxiliary information and calculates H = h CA +∑ i∈S' h i ,AUX=aux CA +∑ i∈S' aux i ,V=v CA ∏ i∈S' v i And R = R·Π i∈S r' i , and send the auxiliary information to the cloud storage service provider after the calculation is completed;

[0051] Step 55: After receiving the auxiliary information from group B users, the cloud storage service provider calculates and updates the integrity audit label σ' j :

[0052]

[0053] After the calculation is completed, the data audit rights are transferred from Group A to Group B.

[0054] In a preferred embodiment, the integrity audit challenge ch al described in step 3 is compatible with other challenge generation methods, and specifically includes the following steps:

[0055] (1) Randomly select a subset of t elements from the data block set [1,n] I = {s 1 ,……,s t}where s 1 ≤…≤s t , 1≤t≤n;

[0056] (2) For each s in the challenge set i , select a random element v i ∈Z p , generate a random challenge ch al={(s i' ,v i' )} 1<i'<t .

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] 1) Adaptive optimization of the structure of BLS aggregate signature can effectively resist rogue key attacks and ensure that the ownership of the group's data can only be transferred when the public and private keys are consistent;

[0059] 2) Generating data integrity audit tags can effectively resist collusion attacks and ensure the security of sensitive information such as private keys of both parties to the transaction;

[0060] 3) The present invention does not require any trusted third party to participate, and is more suitable for actual production. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 This is a workflow diagram of the generation of keys and integrity audit tags by users in group A in a preferred embodiment of the present invention.

[0062] Figure 2 It is a workflow diagram of the data integrity audit phase of a preferred embodiment of the present invention.

[0063] Figure 3 This is a workflow diagram of the group user dynamic change stage in a preferred embodiment of the present invention.

[0064] Figure 4 It is a workflow diagram of the ownership transfer stage of a preferred embodiment of the present invention. DETAILED DESCRIPTION

[0065] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0066] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0067] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application; as used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or their combinations.

[0068] The efficient and scalable method for transferring data ownership between groups proposed in this invention is referred to as Figure 1-4 , including the following steps:

[0069] Step 1: Group A users generate system parameters, public-private key pairs, and aggregated public keys. The process is as follows: Figure 1 As shown, the specific steps include:

[0070] Step 11: Users in group A select a cyclic multiplication group G of prime order q 1 and G T , and through G 1 and G T Choose an efficient non-degenerate bilinear pairing e:G 1 ×G 1 →G T , and define a binary string of arbitrary length that can be mapped to the cyclic multiplicative group G 1 The cryptographic hash function H in 1 , H 1 :{0,1} * →G 1 And can map binary strings of arbitrary length to the integer ring Z P The cryptographic hash function H in 2 , H 2 :{0,1} * →Z P , where “×” represents the pairing operation between two groups, “→” represents the mapping symbol, and “*” represents any number of iterations.

[0071] Step 12: Group A users disclose system parameters pp, pp←{p,G 1 ,G T ,e,g,u,H 1 ,H 2}, where “←” represents the assignment symbol, p is a large prime number, and g,u are the components of the group G1 Two randomly selected independent generators.

[0072] Step 13: A group of users randomly select a private key sk i , sk i ∈ R Z p , and calculate the corresponding public key pk i , At the same time, calculate the hash power apk of the corresponding public key through the cryptographic hash function H 1 , i , Then perform a product operation on the apk of all users i to obtain the aggregated public key APK, Publish the APK.

[0073] Step 2: A group of users generate integrity audit tags for the data, which specifically include the following steps:

[0074] Step 21: A group of users select a random number a i , a i ∈ R Z p , and combine the generator g, the cryptographic hash function H 2 and their own private key sk i to calculate the parameter h' i , and r' i , where ‖ represents the concatenation operation.

[0075] Step 22: The group A users divide the encoded file F into n file blocks of the same size F = {m 1 ,..., m n}, where m j ∈Z p , (1 < j < n), calculate the corresponding integrity audit tag σ ij for each file block, and at the same time add the random mask a ij to sk i in the calculation of the integrity audit tag σ i , that is where ‖ represents the concatenation operation.

[0076] Step 23: Any user in the group A users aggregates the integrity tags calculated by all users for the data block m j to calculate the integrity audit tag set σ j , where ‖ represents the concatenation operation, and at the same time also for the parameter h'i and r' i They are polymerized to obtain H, and R, After the calculation is completed, send {m j ,σ j} j∈n Go to the cloud storage service provider and disclose R and H.

[0077] Step 3: After outsourcing the file blocks and integrity audit labels to the cloud storage service provider, any user in group A can randomly select a subset I = {s 1 ,……,s t}where s 1 ≤…≤s t , 1≤t≤n, and for each s in the challenge set i , select a random element v i ∈Z p , generate a random challenge ch al={(s i' ,v i' )} 1<i'<t ,The user then initiates a random data integrity audit challenge to the cloud storage service provider.

[0078] Step 31: After receiving the integrity audit challenge, the cloud storage service provider calculates the data storage proof DP. and integrity audit tag storage proof TP, The cloud storage service provider then sends the audit proof P, P = {DP, TP}, to the integrity audit initiator.

[0079] Step 32: After receiving the storage proof P, the integrity audit initiator uses equation Verify the storage proof P. If the storage proof P is verified to be correct, True is output, indicating that the data stored on the cloud server is complete; otherwise, False is output, indicating that the integrity of the stored data is destroyed.

[0080] Step 4: When the user membership of group A changes, the data ownership is changed dynamically, such as Figure 3 As shown, the specific steps include:

[0081] Step 41: When a user initiates a request to join group A, the user to be added (marked ) Generate a public-private key pair through steps (1-3) Afterwards Select random number and Calculation parameters as well as At the same time, calculate the remaining auxiliary information as well as

[0082]

[0083] Then any user among the users to be added aggregates the auxiliary information and calculates as well as After the calculation is completed, the auxiliary information is sent to the cloud storage service provider. After receiving the auxiliary information, the cloud storage service provider calculates and updates the integrity audit label σ' j :

[0084]

[0085] Step 42: When a user in group A initiates a logout request, the user to be logged out (marked )Select a random number And calculate the auxiliary information as well as

[0086]

[0087] Then the user who left the group Any user aggregates the auxiliary information and calculates as well as After calculation, the auxiliary information is sent to the cloud storage service provider. After receiving the auxiliary information, the cloud storage service provider calculates and updates the integrity audit label σ' j :

[0088]

[0089] Step 5: Group A chooses to transfer data and data audit rights to Group B, e.g. Figure 4 As shown, the specific steps include:

[0090] Step 51: Group A users select a random number x i , x i ∈ R Z p , and calculate the auxiliary information h i ,aux i and v i .

[0091]

[0092] Step 52: Then any user in group A aggregates the auxiliary information and calculates hCA =∑ i∈S h i ,aux CA =∑ i∈S aux i and v CA =∏ i∈S v i , and send the aggregated information to group B.

[0093] Step 53: After receiving the auxiliary information sent by the users in group A, the users in group B select a random number a i and x' i , a i ,x' i ∈ R Z p , and calculate the parameter h' i , and r' i , And other auxiliary information h i ,aux i and v i .

[0094]

[0095] Step 54: At the same time, any user in group B aggregates the auxiliary information and calculates H = h CA +∑ i∈S' h i ,AUX=aux CA +∑ i∈S' aux i ,V=v CA ∏ i∈S' v i And R = R·∏ i∈S r' i , and send the auxiliary information to the cloud storage service provider after the calculation is completed.

[0096] Step 55: After receiving the auxiliary information from group B users, the cloud storage service provider calculates and updates the integrity audit label σ' j :

[0097]

[0098] After the calculation is completed, the data audit rights are transferred from Group A to Group B.

[0099] The above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. A person skilled in the art may modify or make equivalent substitutions for the technical solutions of the present invention without departing from the spirit and scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. An efficient and scalable method for transferring data ownership between groups, characterized in that: The following steps are involved: Step 1: Group A users generate system parameters, public-private key pairs, and aggregated public keys; Step 2: Group A users generate integrity audit labels for the data; Step 3: After outsourcing the file blocks and integrity audit labels to the cloud storage service provider, any user in group A can initiate a random data integrity audit challenge to the cloud storage service provider; Step 4: When the user members of group A change, the data ownership is changed dynamically; Step 5: Group A chooses to transfer the data and data audit rights to Group B.

2. According to claim 1, an efficient and scalable method for transferring data ownership between groups, characterized in that: The step 1 specifically comprises the following steps: Step 11: Users in group A select cyclic multiplication groups G1 and G with prime order q. T , and through G1 and G T Choose an effective non-degenerate bilinear pairing e:G1×G1→G T , and define a cryptographic hash function H1 that can map a binary string of any length to the cyclic multiplication group G1, H1: {0,1} * →G1 and can map binary strings of arbitrary length to the integer ring Z P The cryptographic hash function H2 in H2:{0,1} * →Z P , where "×" represents the pairing operation between two groups, "→" represents the mapping symbol, and "*" represents any number of iterations; Step 12: Group A users disclose system parameters pp, pp←{p,G1,G T ,e,g,u,H1,H2}, where "←" represents the assignment symbol, p is a large prime number, and g,u are two independent generators randomly selected from group G1; Step 13: Group A users randomly select a private key sk i ,sk i ∈ R Z p , and calculate the corresponding public key pk through the generator g i , At the same time, the cryptographic hash function H1 is used to calculate the hash power of the corresponding public key apk i , Then for all users' apk i Perform product operation to obtain the aggregate public key APK, Public APK.

3. The efficient and scalable method for transferring data ownership between groups according to claim 1, characterized in that: The step 2 specifically includes the following steps: Step 21: Group A users select a random number a i , a i ∈ R Z p , and combines the generator g, the cryptographic hash function H2 and its own private key sk i Calculate the parameter h' i , and r' i , Where ‖ represents the connection operation; Step 21: The group A users divide the encoded file F into n file blocks of the same size F = {m1,..., m n}, where m j ∈Z p , (1 < j < n). Calculate the corresponding integrity audit tag σ ij for each file block. Meanwhile, add a random mask a i to sk i during the calculation of the integrity audit tag σ ij , that is where ‖ represents the concatenation operation; Step 23: Any user in group A sends all users' data block m j The calculated integrity labels are aggregated to calculate the integrity audit label set σ j , Where ‖ represents the connection operation, and also the parameter h' i and r' i They are polymerized to obtain H, and R, After the calculation is completed, send {m j ,σ j } j∈n Go to the cloud storage service provider and disclose R and H.

4. The efficient and scalable method for transferring data ownership between groups according to claim 1, characterized in that: The step 3 specifically comprises the following steps: Step 31: After receiving the integrity audit challenge, the cloud storage service provider calculates the data storage proof DP. and integrity audit tag storage proof TP, The cloud storage service provider then sends the audit proof P, P = {DP, TP}, to the integrity audit initiator; Step 32: After receiving the storage proof P, the integrity audit initiator uses equation Verify the storage proof P; if the storage proof P is verified to be correct, output True, which means that the data stored on the cloud server is complete; otherwise, output False, indicating that the integrity of the stored data is destroyed.

5. The efficient and scalable method for transferring data ownership between groups according to claim 1, characterized in that: The step 4 specifically comprises the following steps: Step 41: When a user initiates a request to join group A, the user to be added (marked ) Generate a public-private key pair through steps (1-3) Afterwards Select random number and Calculation parameters as well as At the same time, calculate the remaining auxiliary information as well as Then any user among the users to be added aggregates the auxiliary information and calculates as well as After the calculation is completed, the auxiliary information is sent to the cloud storage service provider. After receiving the auxiliary information, the cloud storage service provider calculates and updates the integrity audit label σ' j : Step 42: When a user in group A initiates a logout request, the user to be logged out (marked )Select a random number And calculate the auxiliary information as well as Then the user who left the group Any user aggregates the auxiliary information and calculates as well as After calculation, the auxiliary information is sent to the cloud storage service provider. After receiving the auxiliary information, the cloud storage service provider calculates and updates the integrity audit label σ' j :

6. The efficient and scalable method for transferring data ownership between groups according to claim 1, characterized in that: The step 5 specifically comprises the following steps: Step 51: Group A users select a random number x i , x i ∈ R Z p , and calculate the auxiliary information h i ,aux i and v i ; Step 52: Then any user in group A aggregates the auxiliary information and calculates h CA =∑ i∈S h i ,aux CA =∑ i∈ S aux i and v CA =Π i∈S v i , and send the aggregated information to group B; Step 53: After receiving the auxiliary information sent by the users in group A, the users in group B select a random number a i and x' i , a i ,x' i ∈ R Z p , and calculate the parameter h' i , and r' i , And other auxiliary information h i ,aux i and v i ; Step 54: At the same time, any user in group B aggregates the auxiliary information and calculates H = h CA +∑ i∈S' h i ,AUX=aux CA +∑ i∈S' aux i ,V=v CA Π i∈S' v i And R = R·Π i∈S r' i , and send the auxiliary information to the cloud storage service provider after the calculation is completed; Step 55: After receiving the auxiliary information from group B users, the cloud storage service provider calculates and updates the integrity audit label σ j ': After the calculation is completed, the data audit rights are transferred from Group A to Group B.

7. The efficient and scalable method for transferring data ownership between groups according to claim 1, characterized in that: The integrity audit challenge ch al described in step 3 is compatible with other challenge generation methods and specifically includes the following steps: (1) Randomly select a subset of t elements from the data block set [1,n] I = {s1, ..., s t }where s1≤…≤s t , 1≤t≤n; (2) For each s in the challenge set i , select a random element v i ∈Z p , generate random challenge ch al={s i' ,v i' )} 1<i'<t .

Images