Cloud data trusted deletion method based on secret sharing

Abstract

The invention discloses a cloud data trusted deletion method based on secret sharing, which comprises the following steps that: a data owner processes a data file needing to be uploaded locally by adopting a threshold secret sharing scheme, generates n share files through Shamir (n, n) threshold calculation, keeps one share file locally, and uploads the rest share files to a cloud storage server as encrypted files; the data user downloads the encrypted file from the cloud storage server, and decrypts the encrypted file after obtaining the authorization of the data owner; and when the data needs to be safely deleted, a data owner sends a deletion command to the cloud storage server, deletes the encrypted file in the cloud storage server, and destroys a share file reserved locally, so that trusted deletion of the data on the cloud is realized. According to the method, the capability of resisting ciphertext analysis and brute force cracking is greatly improved, the trust dependence on the third-party server is reduced, and the method is more efficient.

Description

Technical Field

[0001] The present invention relates to the technical field of applied cryptography, and in particular to a cloud data trusted deletion method based on secret sharing. Background Art

[0002] With the development and application of cloud computing technology, cloud storage services are very important as a necessary support for cloud computing. Users are no longer limited to storing data locally, but prefer to upload their data to cloud servers for storage. This can greatly save users' local storage costs and has more advantages than local storage in data sharing. Therefore, more and more individuals or companies use cloud servers to store data so that they can share with relevant personnel or groups, such as cloud platforms such as Dropbox, Google Drive and Alibaba Cloud. However, this form of cloud data storage has brought new challenges to data confidentiality and integrity protection. This form of storage separates data from the client, deprives users of direct physical control over data, disappears security boundaries, and traditional data security gradually loses its effect. If data stored in the cloud that has not been accessed for a long time or data that users want to delete cannot be deleted safely, efficiently and reliably, a large amount of privacy-sensitive data: such as medical data, financial data, trade secrets or privileged communications, will have problems such as information leakage, illegal data migration and space waste.

[0003] At present, traditional trusted deletion technologies mainly include two methods: those based on key management and those based on data erasure. The former has the problem of key leakage. For example, in a distributed system, there may be malicious nodes that fail to delete keys in a timely manner as required, tamper with or leak keys, resulting in shared data leakage. In addition, most of the existing key management-based technologies only destroy the decryption key to prevent users from decrypting ciphertexts within polynomial time to achieve the effect of data deletion. In fact, the encrypted data stored on the cloud server is not destroyed and still faces the risk of ciphertext analysis and brute force cracking. The latter is based on the method of data erasure. Since cloud storage often involves third-party servers that are uncontrollable, users cannot decide whether the third-party provider uses erasable devices, and therefore cannot determine whether the outsourced data has been safely deleted. Summary of the invention

[0004] The purpose of the present invention is to provide a cloud data trusted deletion method based on secret sharing, which greatly improves the ability to resist ciphertext analysis and brute force cracking, reduces the trust dependence on third-party servers and is more efficient. Its security is also provable, achieving semantic security.

[0005] The objective of the present invention is achieved through the following technical solutions:

[0006] A cloud data trusted deletion method based on secret sharing, the method comprising:

[0007] Step 1: The data owner processes the data file to be uploaded locally using a threshold secret sharing scheme, generates n share files through Shamir (n, n) threshold calculation, retains one share file locally, and uploads the remaining n-1 share files to the cloud storage server as encrypted files;

[0008] Step 2: The data user downloads the encrypted file from the cloud storage server and decrypts the encrypted file after obtaining authorization from the data owner;

[0009] Step 3: When data needs to be securely deleted, the data owner sends a deletion command to the cloud storage server to delete the encrypted file in the cloud storage server and destroy a share file retained locally, thereby achieving trusted deletion of data on the cloud.

[0010] It can be seen from the technical solution provided by the present invention that the above method greatly improves the ability to resist ciphertext analysis and brute force cracking, reduces the trust dependence on third-party servers and is more efficient. Its security is also provable, achieving semantic security. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0012] Figure 1 A schematic diagram of a flow chart of a cloud data trusted deletion method based on secret sharing provided in an embodiment of the present invention;

[0013] Figure 2 The figure is a schematic diagram of an implementation of the example of the present invention in a data outsourcing storage scenario. DETAILED DESCRIPTION

[0014] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments, which does not constitute a limitation of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0015] like Figure 1 The figure is a flow chart of a cloud data trusted deletion method based on secret sharing provided by an embodiment of the present invention, the method comprising:

[0016] Step 1: The data owner processes the data file to be uploaded locally using a threshold secret sharing scheme, generates n share files through Shamir (n, n) threshold calculation, retains one share file locally, and uploads the remaining n-1 share files to the cloud storage server as encrypted files;

[0017] In this step, the data owner first performs binary reading of all bytes of the data file to be uploaded to obtain a hexadecimal string representing the data file; since reading a large file into the memory at one time will consume a lot of time and resources, the file is stored in the form of a two-dimensional array in batch processing, and the number of share files derived by the Shamir threshold scheme each time is determined by setting different numbers of elements in the second dimension of the array;

[0018] In the ciphertext derivation process, a random large prime number p is first generated. The randomly generated large prime number p is tested for n rounds according to the Miller-Rabin prime number detection algorithm. If all n rounds of tests pass, the error probability, that is, the probability that p is a pseudo-prime number, is If one of the rounds fails, it is not a prime number and should be regenerated and checked;

[0019] According to the Shamir (t, n) threshold scheme, let t = n, and perform a Shamir (n, n) threshold calculation for the n numbers in each dimension of the binary data file:

[0020] The number of n in each dimension of the data file {a 0 , a 1 , ..., a n-1 As n coefficients of an n-1 order polynomial, it is expressed as:

[0021]

[0022] Where p is a random large prime number generated; mod(p) is a modulus operation on p; x is an independent variable parameter, and f(x) is the share function value;

[0023] Take x = 1, 2, ..., n, and generate n share files, that is: (k, f(k)), k = 1, 2, ..., n;

[0024] The data owner keeps a copy of the share file locally and uploads the remaining n-1 copies of the share file to the cloud storage server as encrypted files.

[0025] Specifically, it can be understood that the locally saved share file is a fragment of the ciphertext, and the other part of the ciphertext is in the cloud storage server. The two together form a complete encrypted file data. The local data or cloud data alone cannot reveal any information. Even if the cloud data is leaked or disclosed, the confidentiality of the data can still be guaranteed to achieve data security.

[0026] Step 2: The data user downloads the encrypted file from the cloud storage server and decrypts the encrypted file after obtaining authorization from the data owner;

[0027] In this step, the data user downloads the encrypted file from the cloud storage server and sends a request to the data owner; after the data owner agrees to the request, the data user is sent a backup of the shared file retained locally, i.e., file:

[0028] (x 0 ,f(x 0 )), x 0 ∈GF(p) / {1,2,...,n}

[0029] Where x0 is the backup value of the independent variable parameter of the local share file; GF(p) is the Galois field of p;

[0030] By combining the downloaded encrypted file with the backup file, the data user obtains the complete ciphertext;

[0031] The data user then decrypts the obtained ciphertext using the Lagrange interpolation formula:

[0032]

[0033] Where L(x) is the Lagrange interpolation polynomial; y j is the function value at position j, and j is the parameter to which the control variable is added; is the interpolation basis function, and all n-1 order polynomials before encryption are restored;

[0034] The coefficients of all restored n-1 order polynomials are stored in the two-dimensional array form of the original data file; the original data file is then restored in a binary writing manner to achieve decryption of the encrypted file.

[0035] Step 3: When data needs to be securely deleted, the data owner sends a deletion command to the cloud storage server to delete the encrypted file in the cloud storage server and destroy a share file retained locally, thereby achieving trusted deletion of data on the cloud.

[0036] In this step, when data needs to be securely deleted, the data owner should have control over the data and implement trusted deletion of data on the cloud through a secure method. In this embodiment, the share file retained locally by the data owner is both the key for decrypting the file and part of the ciphertext itself. Even if the cloud server fails to honestly delete the data on the cloud or data leakage occurs, the ciphertext data cannot be decrypted within polynomial time, thereby protecting data security.

[0037] It is worth noting that the contents not described in detail in the embodiments of the present invention belong to the prior art known to professional and technical personnel in the field.

[0038] The security of the method of the present invention is verified by a specific example below. Specifically:

[0039] 1. First, the difficulty proof of Shamir's scheme based on polynomials

[0040] Given two k-1 degree polynomials P over GF(p) 1 , P 2 , calculate P b k-1 points on {s 1 ,s 2 , ..., s k-1}, the attacker cannot 1 ,s 2 , ..., s k-1}Determine the value of b. That is, the security problem Y:

[0041] Share(P)→{y 1 ,y 2 , ..., y n}∈GF(p)

[0042] Recover({s 1 ,s 2 , ..., s k})→P

[0043] Proof: A k-1 degree polynomial can be written as There are k coefficient values ​​in total. The x and y values ​​of the known k-1 points are expressed as x(s i ) and y(s i ), then the equations can be solved as:

[0044] P(x(s 1 ))=y(s 1 )

[0045] P(x(s 2 ))=y(s 2 ) ...

[0047] P(x(s k-1 )) = y(s k-1 )

[0048] From the relationship between the matrix and the solutions of the linear equations, the rank of the coefficient matrix is k - 1 < k. So the system of equations has infinitely many solutions in GF(p), that is, the values of the k coefficients cannot be uniquely determined, and thus the polynomial P cannot be uniquely determined. b , that is, b cannot be determined from {s 1 , s 2 ,..., s k-1}. Therefore, it satisfies unconditional security, that is, its security does not depend on the computational complexity of difficult problems.

[0049] 2. Security Proof of the Encryption Scheme Based on Secret Sharing

[0050] The formal definition of the encryption scheme X based on secret sharing is as follows:

[0051] Initialization: Initialize various system parameters by inputting the parameters λ and the plaintext m, and generate a polynomial P, that is, the random numbers generated by m and λ are used as the coefficients of P.

[0052] Encryption Phase: Call the Shamir(n, n) algorithm (denoted as Share(P)) to encrypt the plaintext, and generate k shares using P. Among them, k - 1 shares are directly juxtaposed as the ciphertext c, and the other share is denoted as s k Saved locally.

[0053] Recovery Phase: Use the k shares to call the Recover algorithm to recover the polynomial P'.

[0054] Decryption Phase: Through the relationship between the plaintext m and the polynomial coefficients, obtain the decrypted plaintext m' from the coefficients of the polynomial P'.

[0055] Gen(1 λ , m) → P

[0056] Enc(P) → c, s k : c = s 1 |s 2 |...|s k-1 , s k ← Share(P)

[0057] Eval(c, s k ) → P′: P′ ← Recover({s 1 , s 2 ,..., s k})

[0058] Dec(P′)→m′

[0059] 3. Reduction Proof

[0060] The following will use the security premise of Shamir's scheme to prove that the probability of an attacker breaking the encryption algorithm based on secret sharing is negligible, that is, the proof goal is "Y security → X security".

[0061] Game1 and Game2 are constructed as attack strategies launched by the attacker against the challenger.

[0062] 1)Game1

[0063] Attacker B chooses a k-1 degree polynomial P on CF(p) 0 , P 1 Submit it to the challenger chal_B, who calculates P b k-1 points on {s 1 ,s 2 , ..., s k-1}∈GF(p) is returned to attacker B, who determines whether the value of b is 0 or 1. If the guess is random, the probability of guessing correctly is Otherwise, the probability of attacker B's challenge success is Pr[B(P b )=1]. Based on the security premise Y,

[0064] |Pr[B(P b )=1]-Pr[B(random)]|

[0065] 2)Game2

[0066] Attacker A chooses two m 0 、m 1 ∈GF(p) is handed over to the challenger chal_A, who calculates c←Enc{Gen{m b}} is returned to attacker A, who determines whether the value of b is 0 or 1. If the guess is random, the probability of guessing correctly is Otherwise, the probability of attacker A's challenge being successful is:

[0067] Pr[A(enc{Gen{1 λ , m b}}=1]

[0068] if Then solution X is safe.

[0069] Because challenger chal_A is constructed by challenger chal_B, when B receives A’s m 0 、m 1 ∈GF(p), then use m0 、m 1 Construct P 0 , P 1 , then P 0 , P 1 Send to challenger chal_B. Attacker B directly sends chal_B's reply {s 1 ,s 2 , ..., s k-1}∈GF(p) is returned to attacker A as c. Attacker A's guess about b is also attacker B's guess about b, so Pr[B(P b )=1]=Pr[A(Enc{Gen{1 λ , m b}}=1], so the advantage of PPT (probabilistic polynomial time) attacker A is no greater than negl(p), that is, the proposed scheme is IND-CPA secure (with indistinguishability under chosen-plaintext attacks).

[0070] like Figure 2 The figure shows an implementation diagram of the example of the present invention in a data outsourcing storage scenario. A certain enterprise is the data owner, and the storage space of its physical equipment is not very ample. It has the power to upload and delete data. A certain operator provides cloud storage servers, which have sufficient physical storage space and are far superior to other parties in terms of computing resources, and are mainly responsible for storing data. A certain user is a data user, who can download encrypted data from the cloud and decrypt the data after obtaining authorization from the data owner.

[0071] Specifically, the enterprise locally performs phase one: data processing and phase two: ciphertext derivation, retains a portion of the data locally, and then uploads the remaining encrypted portion to a certain operator’s cloud storage server;

[0072] User execution phase three: data decryption. After downloading the encrypted data from the cloud, a request is made to the enterprise. Only after authorization can the plaintext data be decrypted.

[0073] When the data expires or is no longer needed, the enterprise executes phase 4: trusted deletion. The enterprise destroys the locally retained share and issues a command to the operator to delete the cloud data, thus achieving trusted deletion of the cloud data.

[0074] In summary, compared with traditional trusted deletion technology, the method described in the embodiment of the present invention has greatly improved security compared with trusted deletion technology based on key management, because the ciphertext data stored on the cloud is incomplete and cannot be cracked by ciphertext analysis and brute force attack methods. Compared with the method based on data erasure, this solution reduces the trust dependence on third-party servers and is more efficient.

[0075] At the same time, the security of this scheme is provable, achieving IND-CPA security (with indistinguishability under chosen-plaintext attacks): based on the idea of ​​security proof by reduction, a formal security analysis is performed on the method described in the embodiment of the present invention using a standard model, and the security verification of the encryption algorithm of this scheme is reduced to the security proof of semantic security (IND-CPA), indicating that this scheme is provably secure.

[0076] In addition, a person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be implemented by instructing related hardware through a program, and the corresponding program can be stored in a computer-readable storage medium. The above-mentioned storage medium can be a read-only memory, a disk or an optical disk, etc.

[0077] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed in the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims. The information disclosed in the background technology section of this article is only intended to deepen the understanding of the overall background technology of the present invention, and should not be regarded as an admission or in any form that the information constitutes prior art known to those skilled in the art.

Claims

1. A cloud data trusted deletion method based on secret sharing, characterized in that: The method comprises: Step 1: The data owner processes the data file to be uploaded locally using a threshold secret sharing scheme, generates n share files through Shamir (n, n) threshold calculation, retains one share file locally, and uploads the remaining n-1 share files to the cloud storage server as encrypted files; Step 2: The data user downloads the encrypted file from the cloud storage server and decrypts the encrypted file after obtaining authorization from the data owner; Step 3: When data needs to be securely deleted, the data owner sends a deletion command to the cloud storage server to delete the encrypted file in the cloud storage server and destroy a share file retained locally, thereby achieving trusted deletion of data on the cloud.

2. The cloud data trusted deletion method based on secret sharing according to claim 1 is characterized in that: In step 1, the data owner first performs binary reading of all bytes of the data file to be uploaded to obtain a hexadecimal string representing the data file; the files are stored in a two-dimensional array in a batch processing manner, and the number of share files derived by the Shamir threshold scheme each time is determined by setting different numbers of elements in the second dimension of the array; In the ciphertext derivation process, a random large prime number p is first generated. The randomly generated large prime number p is tested for n rounds according to the Miller-Rabin prime number detection algorithm. If all n rounds of tests pass, the error probability, that is, the probability that p is a pseudo-prime number, is If one of the rounds fails, it is not a prime number and should be regenerated and tested; According to the Shamir (t, n) threshold scheme, let t = n, and perform a Shamir (n, n) threshold calculation for the n numbers in each dimension of the binary data file: The n numbers {a0, a1, ..., a n-1 } as the n coefficients of an n-1 order polynomial, expressed as: Where p is a random large prime number generated; mod(p) is a modulus operation on p; x is an independent variable parameter, and f(x) is the share function value; Take x = 1, 2, ..., n, and generate n share files, that is: (k, f(k)), k = 1, 2, ..., n; The data owner keeps a copy of the share file locally and uploads the remaining n-1 copies of the share file to the cloud storage server as encrypted files.

3. The cloud data trusted deletion method based on secret sharing according to claim 1 is characterized in that: In step 2, the data user downloads the encrypted file from the cloud storage server and sends a request to the data owner; after the data owner agrees to the request, the data owner sends a backup of the shared file retained locally to the data user, namely, file: (x0,f(x0)),x0∈GF(p) / [1,2,...,n} Where x0 is the backup value of the independent variable parameter of the local share file; GF(p) is the Galois field of p; By combining the downloaded encrypted file with the backup file, the data user obtains the complete ciphertext; The data user then decrypts the obtained ciphertext using the Lagrange interpolation formula: Where L(x) is the Lagrange interpolation polynomial; y j is the function value at position j, and j is the parameter to which the control variable is added; is the interpolation basis function, and all n-1 order polynomials before encryption are restored; The coefficients of all restored n-1 order polynomials are stored in the two-dimensional array form of the original data file; the original data file is then restored in a binary writing manner to achieve decryption of the encrypted file.

Images