Method for supporting secure transmission and verification of large data file in cloud environment

Abstract

The invention relates to a method for supporting secure transmission and verification of large data files in a cloud environment, and belongs to the technical field of file transmission. The method comprises the steps of a preparation stage, file fragmentation encryption, confusion processing, file uploading and downloading, file decryption and combination and the like. The method is characterized in that a file is divided into a plurality of file fragments, each fragment is symmetrically encrypted to generate file fragment metadata, then confusion fragments and encrypted file fragments are uploaded to a cloud server at the same time, and due to the fact that the encrypted file fragments lose sequence information, the sequence information is encrypted and then stored, and the file fragments are stored in the cloud server. The user needs to access and read; and hiding the sequence information of the file fragments in the graph, obtaining the sequence information by using an algorithm, and finally carrying out file merging, so that the secure transmission of the file is completed. According to the method, under the condition of distributed deployment, the transmission efficiency can be improved, the file transmission safety can be improved, and safe transmission of file data is achieved.

Description

Technical Field

[0001] The present invention relates to the field of data transmission and data security protection, and in particular to a method for supporting secure transmission and verification of large data files in a cloud environment. Background Art

[0002] As digital transformation continues to advance, industries are increasingly dependent on data, and the size of files that the Internet needs to process is also growing rapidly. For example, the popularity of high-definition video, the need to back up large databases, and the sharing of complex design files have all generated massive amounts of data. The transmission of these large files poses huge challenges to network bandwidth, transmission speed, and reliability. In order to address this problem, fragmented transmission technology has become an effective solution. By dividing large files into multiple smaller data fragments, fragmented transmission technology can transmit different fragments in parallel, greatly improving transmission efficiency. In addition, fragmentation technology can also effectively reduce the risk of data loss or damage during transmission, because even if individual fragments fail to be transmitted, the system only needs to retransmit the corresponding fragments without resending the entire file. This approach not only improves the success rate of transmission, but also reduces the consumption of network resources. Therefore, fragmented transmission technology has gradually become an indispensable and important tool for processing large file transmission, especially in cloud storage, content distribution networks (CDNs), video streaming and other fields, playing a vital role.

[0003] Large file fragmentation transmission is a technology that splits a large file into multiple smaller fragments and completes the entire file transmission by uploading or downloading them in parallel. This method shows significant advantages in improving transmission speed, improving stability, reducing interruptions and reducing time consumption. Especially in application scenarios such as cloud services, fragmentation transmission technology brings many benefits to file management and data transmission. First, after splitting a large file into several small fragments, these fragments can be transmitted in parallel. This parallel processing greatly reduces the waiting time when a single file is transmitted, allowing different fragments to be transmitted through the network at the same time, thereby more effectively utilizing network bandwidth and improving transmission efficiency. Traditional file transmission is often limited by bandwidth, while fragmentation technology can fully tap the potential of network resources and significantly speed up the overall transmission speed even when facing extremely large files. Secondly, network fluctuations or interruptions are common problems in the process of large file transmission. If the traditional single file transmission mode is adopted, when there is a problem with the network, the entire file often needs to be retransmitted, which not only wastes time but also consumes a lot of bandwidth resources. The fragmentation transmission technology greatly alleviates this problem. Even if a fragment fails during transmission, the system only needs to retransmit the fragment without resending the entire file, thus reducing the waste of time and resources and improving the stability and fault tolerance of transmission. In addition, fragmented transmission technology also has significant advantages in ensuring file security and integrity. When transmitting large files, the traditional single file transmission method is more vulnerable to network attacks or data tampering. With fragmented transmission technology, the system can perform independent verification and encryption on each fragment. This means that during the transmission process, the integrity of the data can be fully guaranteed, and even if individual fragments are affected, the overall file can remain safe. This not only improves the reliability of file transmission, but also enhances the confidentiality of data. Especially in the case of strict enterprise data protection requirements, fragmentation technology can effectively prevent file leakage or malicious tampering.

[0004] In summary, the application of fragment transmission technology in the Internet not only significantly improves the speed and efficiency of large file transmission, reduces the risk of network interruption, but also provides a more solid guarantee for the security of files. In today's data-intensive digital age, fragment transmission technology has become an important tool for efficient and secure management and transmission of large files. Summary of the invention

[0005] The present invention is based on file fragmentation transmission technology and is designed under the inspiration of topological sorting in directed graphs. The purpose is to solve the following key technical problems: ensuring the security of fragments during fragmentation transmission, and the fragmentation verification problem after being attacked. The fragmentation encryption of the present invention uses symmetric encryption, which has a better encryption speed than public key encryption. Public key encryption only encrypts the most critical symmetric keys and obfuscated information to balance the transmission efficiency. The file verification of this scheme does not involve frequent access to the server. The user uses local resources for verification, and the verification result can be obtained after obtaining the hash table from the server. The public key encryption of the present invention adopts attribute-based encryption ABE, and users with the same attribute can decrypt the file at the same time using their own private keys. According to the selection of public key encryption, the present invention can also expand multiple attributes and has good scalability.

[0006] The purpose of the present invention is achieved through the following technical solutions:

[0007] A method for supporting secure transmission and verification of large data files in a cloud environment. Its system model includes four roles: cloud server (platform operator), file sender (user), file receiver (user), and central agency (trusted center). The following is a detailed description of the characteristics and functions of each role:

[0008] 1) File sender

[0009] The entity is the party that provides the file. Users or enterprises can upload files to the cloud server through the client and set the user permissions for viewing the video, that is, formulate the access control policy of the sender. The file sender has a pair of keys for encrypting the file, which are randomly generated. When the video provider uploads the video to the cloud server and database, it goes offline.

[0010] 2) Document recipient

[0011] This entity refers to the party that receives the file. Users can download and access the corresponding file segments and meta-files from the cloud server and database based on their identity attributes, decrypt the key and obfuscated data using the private key, execute the corresponding algorithm to verify the segment files, and decrypt them into the original video files after combining and sorting.

[0012] 3) Cloud Server

[0013] The cloud server is used to store the video segments uploaded by the file sender, and to control the access of video visitors and manage the uploaded video segments. The server ensures that visitors can obtain the file segments they need through a retrieval mechanism. In order to ensure a certain degree of security, attribute-based encryption is used to control user access.

[0014] 4) Central institutions

[0015] The central authority uses a public key infrastructure (PKI) to issue digital certificates to participants on the framework for system initialization and generation of public parameters. These certificates represent the identities of entities participating in the framework. This allows the recipient of the transaction to verify the identity of the provider. In addition, the CA is responsible for managing and transmitting keys and obfuscating data to ensure the confidentiality of digital communications and data.

[0016] The present invention specifically comprises the following steps:

[0017] Step 1: System Initialization

[0018] System parameter initialization: Using the security parameter λ as input, the central agency generates the system public parameter pp;

[0019] Key initialization: Call the key generation algorithm based on the public parameter pp to generate the master key mk and the public and private key pairs sk and pk;

[0020] Step 2: Preprocessing

[0021] Select the number of file shards n and the number of obfuscated shards m according to the size of the data file, n:m=2:1; randomly generate a directed acyclic graph Graph according to the shard order 1 to n, so that the topological sorting order of the graph is the shard order; call the shard scrambling algorithm, add the obfuscated nodes to Graph to generate Graph′, so as to obfuscate the topological sorting;

[0022] Step 3: File segmentation and encryption

[0023] According to the selected n, the data file is divided into FS = (FS 1 , FS 2 …FS n ), according to the selected m, select m obfuscated fragment files of similar size CS=(CS 1 , C.S. 2 …CS m ); the encryption key for each shard is t is a random number, i∈n; at this time, the obfuscated information msg=(FC i , S.C. j , t), i, j∈m and u+j=m; where FC i and SC j Represent the first type of confusion nodes and the second type of confusion nodes respectively; ek i As the symmetric encryption key, after encryption using the symmetric encryption algorithm AES-256, the file segment metadata file is generated;

[0024] Step 4: File Processing

[0025] Use the hash algorithm Hash to generate a hash value H for all encrypted fragments i =Hash(FS i ), H j =Hash(CS j ); Select a value x, and perform a secondary hash on the hash value H of each x shards, that is, Hash(Hash(FS i )) Repeat the same process until the total number of remaining hashes becomes only 1; generate an x-ary tree and a hash table;

[0026] Step 5: File Upload

[0027] The file shard metadata file is directly uploaded and stored in the database. The file shard FS, obfuscated shard CS and hash table are uploaded to the cloud server. The key mk and obfuscated information msgg are encrypted using attribute-based encryption (ABE). The encryption key is pk, and the encrypted key mk′ and encrypted obfuscated information msg′ are generated.

[0028] Step 6: Download the file

[0029] The user first accesses the database according to the permission, and then uses the unique identifier V ind Get the file fragment identifier F ind , access the cloud server to download; confirm the shard version information according to the file sender's instructions, and build a directed graph Graph' according to the node sequence information;

[0030] Step 7: Document Verification

[0031] The user performs hash processing on the downloaded file locally and compares it with the hash table in the cloud server to verify the integrity of the file segment. If the file segment is incomplete, the user requests to resend the file segment.

[0032] Step 8: File decryption and merging

[0033] The user accesses the central agency to obtain mk' and msg', and uses his own private key sk to decrypt to obtain mk and msg; runs the shard sorting algorithm to obtain the file sequence information. After obtaining the sequence information, the decryption key of each shard Decrypt the file in pieces and merge the decrypted files in order.

[0034] Furthermore, the sharding algorithm described in step 2 specifically includes:

[0035] For the directed acyclic graph Graph, add the same number of obfuscated nodes as the number of irrelevant data files m, and add corresponding outgoing and incoming edges. The obfuscated nodes are divided into two categories, the first category and the second category. The differences between the two are as follows:

[0036] 1) Add edges to nodes with low out-degree, and the added edges point to the confusion nodes, thus generating the first type of confusion nodes FC;

[0037] 2) Confuse the existing edges and treat the confused nodes as a bridge to completely change the original graph structure. Specifically, confuse (A→B) into (A→confusing node→B) to generate the second type of confused node SC. At this time, check the direction of the confused node. If the node it points to is not B, but the out-degree of the node is 0, then add an out-edge to the node.

[0038] Furthermore, the sharding metadata file described in step 3 is a file generated when the file is sharded for identification and recording, and specifically includes:

[0039] 1) Unique identifier V ind : A randomly generated number used to specify which file the shard belongs to. The unique identifiers generated for the same file are the same, and users can search for all file shards based on the unique identifiers. The unique identifiers for different files are different.

[0040] 2) Shard identifier F ind : A randomly generated number used to find the identifier of the shard. The shard identifiers of the same file are also different;

[0041] 3) Version information v : This value is used to verify whether the file is within the validity period; when the file fragment is dynamically updated, the value must be replaced;

[0042] 4) Node order information D n :This information is stored in the node shard identifier pointed to by the current shard node in the graph Graph′.

[0043] Furthermore, the fragment sorting algorithm described in step 8 aims to delete the obfuscated nodes and edges in Graph′ according to the obfuscated information msgg until the original graph Graph is restored, and finally a topological sequence is generated to obtain the order information of the file fragments; the specific steps are as follows:

[0044] 1) Directly remove the first type of confusing nodes and all connected edges;

[0045] 2) Modify the node according to the direction of the second type of confusion node. If it points to an original node and the outgoing edge of the original node is zero or only points to the first type of confusion node, modify the confusion node to the original node and delete the original node it points to. If it points to a confusion node, continue to search for the original node according to the outgoing edge, and use depth search to restore the node level by level.

[0046] Beneficial effects of the present invention:

[0047] 1) The use of sharding algorithm and sharding sorting ensures that the important file sequence information generated after sharding large data files can be transmitted securely. The addition of obfuscated information makes it impossible for attackers to decipher the sequence information under limited computing power (within polynomial time), thus ensuring the security of transmission.

[0048] 2) This method is in line with the mainstream transmission mode: using distributed upload and download to improve the overall transmission speed and performance of the solution, solving the problem of storage servers becoming performance bottlenecks in traditional storage systems, and facilitating the actual implementation of system solutions.

[0049] 3) This method uses hash values ​​to generate MerkelTree and saves it as a hash table. This avoids the sequential verification of traditional shards, reduces the number of user interactions with the server, allows users to generate verification information locally, and improves verification efficiency for large file transmission.

[0050] 4) The symmetric encryption method based on AES is fast and does not occupy system performance. Public key encryption only targets a small part of the data, balancing encryption time and security, making it high-performance and highly secure. At the same time, the introduction of ABE enables this method to perform user access control on cloud servers, which is suitable for specific scenarios such as companies and schools.

[0051] 5) There are two key information to ensure the secure transmission of files, including the encrypted key mk′ and the encrypted obfuscated information msg′. If an attacker only obtains one of the information, it is not enough to decrypt the file sequence information. The two information can be used to distribute and manage the keys according to different encryption strategies. They can be flexibly selected according to specific circumstances, with strong applicability and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 The overall framework diagram of the system for executing the present invention;

[0053] Figure 2 is a flow chart of the present invention;

[0054] Figure 3 A schematic diagram of adding the first type of confusion node to the slice scrambling algorithm of the present invention;

[0055] Figure 4 A schematic diagram of adding a second type of obfuscation node to the slice scrambling algorithm of the present invention;

[0056] Figure 5 A schematic diagram of constructing an x-ary tree and a hash table according to the present invention. DETAILED DESCRIPTION

[0057] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0058] A method for supporting secure transmission and verification of large data files in a cloud environment of the present invention comprises the following steps:

[0059] Step 1: System Initialization

[0060] System parameter initialization: select the security parameter λ as input and generate a prime order group Its order is p, the group The generator is g; then, select a hash function Randomly select represents the integer group of order p; and calculate h = g a. Finally output the system common parameters

[0061] Key initialization: Call the key generation algorithm based on the public parameter pp to generate the master key mk and the public and private key pairs sk and pk;

[0062] Step 2: Preprocessing

[0063] According to the size of the data file, select the appropriate number of file shards n and the number of obfuscated shards m (n:m=2:1); randomly generate a directed acyclic graph Graph according to the shard order 1 to n, so that the topological sorting order of the graph is the shard order; call the shard scrambling algorithm, add the obfuscated nodes to Graph to generate Graph′, so as to obfuscate the topological sorting;

[0064] 2.1 Shard Scrambling Algorithm

[0065] The purpose of this algorithm is to add the same number of obfuscated nodes as the number of irrelevant data files to the directed acyclic graph Graph, as well as to add corresponding outgoing and incoming edges. The obfuscated nodes are divided into two types, the first type and the second type. The differences between the two are as follows:

[0066] 1) Add edges to nodes with low out-degree, and the added edges point to the confusion nodes, thus generating the first type of confusion nodes FC;

[0067] 2) Confuse the existing edges and treat the confusion node as a bridge to completely change the original graph structure. Specifically, confuse (A→B) into (A→confusing node→B) to generate the second type of confusing node SC. At this time, check the direction of the confusing node. If the node it points to is not B, but the out-degree of the node is 0, then add an out-edge to the node.

[0068] Step 3: File segmentation and encryption

[0069] According to the selected n, the data file is divided into FS = (FS 1 , FS 2 …FSn ), select m unrelated data files of similar size CS=(CS 1 , C.S. 2 …CS m ); the encryption key for each shard is t is a random number, i∈n; at this time, the obfuscated information msg=(FC i , S.C. j , t), i, j∈m and i+j=m. Among them FC i and SC j Represent the first type of confusion nodes and the second type of confusion nodes respectively; ek i As the symmetric encryption key, after encryption using the symmetric encryption algorithm AES-256, the file segment metadata file is generated;

[0070] 3.1 Shard metadata file

[0071] This file is generated when the file is fragmented and is used for identification and recording. It specifically includes the following four parts:

[0072] 1) Unique identifier V ind : A randomly generated number used to specify which file the shard belongs to. The unique identifiers generated for the same file are the same, and users can search for all file shards based on the unique identifiers. Different files have different unique identifiers.

[0073] 2) Shard identifier F ind : A randomly generated number used to find the identifier of the shard. The shard identifiers of the same file are also different;

[0074] 3) Version information v : This value is used to verify whether the file is within the validity period; when the file fragment is dynamically updated, the value must be replaced;

[0075] 4) Node order information D n :This information is stored in the node shard identifier pointed to by the current shard node in the graph Graph′;

[0076] Step 4: File Processing

[0077] Use the hash algorithm Hash to generate a hash value H for all encrypted fragments i =Hash(FS i ), H j =Hash(CS j ); Select a value x, and perform a secondary hash on the hash value H of each x shards, that is, Hash(Hash(FS i )) Repeat the same process until the total number of remaining hashes becomes only 1; generate an x-ary tree and a hash table;

[0078] Step 5: File Upload

[0079] The shard metadata file is directly uploaded and stored in the database. The file shard FS, obfuscated shard CS and hash table are uploaded to the cloud server. The key mk and obfuscated information msg are encrypted using attribute-based encryption (ABE). The encryption key is pk, and the encrypted key mk′ and encrypted obfuscated information msg′ are generated.

[0080] Step 6: Download the file

[0081] The user first accesses the database according to the permission, and then uses the unique identifier V ind Get the file fragment identifier F ind , access the cloud server to download; confirm the shard version information according to the file sender's instructions, and build a directed graph Graph' according to the node sequence information;

[0082] Step 7: Document Verification

[0083] The user performs hash processing on the downloaded file locally and compares it with the hash table in the cloud server to verify the integrity of the file segment. If the file segment is incomplete, the user requests to resend the file segment.

[0084] Step 8: File decryption and merging

[0085] The user accesses the central agency to obtain mk' and msg', and uses his own private key sk to decrypt to obtain mk and msg; runs the shard sorting algorithm to obtain the file sequence information. After obtaining the sequence information, the decryption key of each shard Decrypt the file in pieces, and merge the decrypted files in order;

[0086] 8.1 Shard Merging Algorithm

[0087] The purpose of this algorithm is to delete the obfuscated nodes and edges in Graph′ according to the obfuscated information msg until the original graph Graph is restored, and finally a topological sequence is generated to obtain the file sequence information; the specific steps are as follows:

[0088] 1) Directly remove the first type of confusing nodes and all connected edges;

[0089] 2) Modify the node according to the direction of the second type of confusion node. If it points to an original node and the outgoing edge of the original node is zero or only points to the first type of confusion node, modify the confusion node to the original node and delete the original node it points to. If it points to a confusion node, continue to search for the original node according to the outgoing edge, and use depth search to restore the node level by level.

[0090] Example

[0091] See also Figure 1 , the overall framework entity for executing the present invention includes four parts. The central agency first distributes keys ① and 1) according to public parameters. After the file sender is authenticated, 2) he can upload the encrypted file segments and hash tables that need to be transmitted 3), and upload the generated segment metadata to the database 4). After that, the file sender encrypts the encryption key and obfuscation information with the public key and sends them to the file receiver 5). The file receiver can search and query the file required by the user in the database according to the unique identifier to obtain the metadata file ②, and send a download request to the cloud server ③. When the server authenticates the file receiver, the receiver can download the file data ④.

[0092] See also Figure 2 The specific process of the present invention is mainly divided into two stages, including the file sender sending stage and the file receiver receiving stage. Both need to pass the identity authentication through the central agency before the operation, otherwise they are not authorized to operate. After the central agency distributes the key pair, it is saved by the user. The sender performs operations such as fragmentation, encryption, hashing, uploading files, transmitting keys and obfuscating information in sequence to complete the transmission of necessary files and information. After receiving the message, the receiver performs database access, query, cloud server request, file download, verification, decryption and other operations to obtain the original file. At this point, a complete file transfer is completed.

[0093] See also Figure 3 In the preprocessing stage, the present invention uses a sharding scrambling algorithm to add two types of confusing nodes. The addition of the first type of confusing nodes is shown in the figure. Assume that Graph is a randomly generated directed graph with five nodes in the topological order of A→B→C→D→E. According to the sharding scrambling algorithm, the first type of confusing nodes adds confusing nodes F, G, and H without changing the structure of the original graph, and selects nodes A, B, C, and D with low in-degree to add outgoing edges of the confusing nodes. At this time, Graph (First) is generated. At this time, the topological sequence of the graph is not unique, because the incoming edges of E and G are both zero, which can be used as the first order. However, the topological sequence generated at this time, such as F→A→G→B→H→C→D→E, or G→F→A→B→H→C→D→E, etc., does not change the intrinsic sorting logic of A→B→C→D→E, so it is necessary to add the second type of confusing nodes.

[0094] See also Figure 4In the preprocessing stage, the present invention uses a sharding scrambling algorithm to add two types of obfuscated nodes, and the addition of the second type of obfuscated nodes is shown in the figure. In the Graph (First) where the first type of obfuscated nodes are added, the second type of obfuscated nodes J and I are continued to be added. At this time, J occupies the position of the original B node, and I occupies the position of the C node. For this reason, these two nodes must point to the original nodes, that is, add outgoing edges of J→B and I→C. In order to further increase the degree of confusion, the original nodes B and C can also add ingoing and outgoing edges, but if outgoing edges are added, they must point to the first type of obfuscated nodes. The graph Graph′ generated at this time may not have a topological sorting because the graph contains a loop, but if the edge H→E is removed, the topological sorting at this time is G→F→A→H→J→D→B→I→E→C. At this time, the internal sorting logic is disrupted, and the adversary needs exponential time to crack it by brute force, which ensures security.

[0095] See also Figure 5 , set x to 3, and continue to hash after the hashes generated by every three shard files are concatenated. For example, H(1), H(2), and H(3) are concatenated and then hashed to generate H(10). Repeat the above steps until H(root) is generated. The structure of the entire tree is the structure that the hash table needs to save. When the user downloads the file shard, perform the hash locally to generate a tree with the same structure, and then compare it with the node information one by one to complete the file verification.

Claims

1. A method for supporting secure transmission and verification of large data files in a cloud environment, the method being executed in a system including a cloud server, a file sender, a file receiver, and a central agency, characterized in that: The method comprises the following specific steps: Step 1: System Initialization System parameter initialization: Using the security parameter λ as input, the central agency generates the system public parameter pp; Key initialization: Call the key generation algorithm based on the public parameter pp to generate the master key mk and the public and private key pairs sk and pk; Step 2: Preprocessing Select the number of file shards n and the number of obfuscated shards m according to the size of the data file, n:m=2:1; randomly generate a directed acyclic graph Graph according to the shard order 1 to n, so that the topological sorting order of the graph is the shard order; call the shard scrambling algorithm, add the obfuscated nodes to Graph to generate Graph′, so as to obfuscate the topological sorting; Step 3: File segmentation and encryption According to the selected n, the data file is divided into FS = (FS1, FS2...FS n ), according to the selected m, select m obfuscated fragment files of similar size CS = (CS1, CS2...CS m ); the encryption key for each shard is t is a random number, i∈n; at this time, the obfuscated information msg=(FC i ,SC j ,t),i,j∈m and i+j=m; where FC i and SC j Represent the first type of confusion nodes and the second type of confusion nodes respectively; ek i As the symmetric encryption key, after encryption using the symmetric encryption algorithm AES-256, the file segment metadata file is generated; Step 4: File Processing Use the hash algorithm Hash to generate a hash value H for all encrypted fragments i =Hash(FS i ), H j =Hash(CS j ); Select a value x, and perform a secondary hash on the hash value H of each x shards, that is, Hash(Hash(FS i )) Repeat the same process until the total number of remaining hashes becomes only 1; generate an x-ary tree and a hash table; Step 5: File Upload The file shard metadata file is directly uploaded and stored in the database. The file shard FS, obfuscated shard CS and hash table are uploaded to the cloud server. The key mk and obfuscated information msg are encrypted using attribute-based encryption. The encryption key is pk, and the encrypted key mk′ and encrypted obfuscated information msg′ are generated. Step 6: Download the file The user first accesses the database according to the permission, and then uses the unique identifier V ind Get the file fragment identifier F ind , access the cloud server to download; confirm the shard version information according to the file sender's instructions, and build a directed graph Graph′ according to the node sequence information; Step 7: Document Verification The user performs hash processing on the downloaded file locally and compares it with the hash table in the cloud server to verify the integrity of the file segment. If the file segment is incomplete, the user requests to resend the file segment. Step 8: File decryption and merging The user accesses the central agency to obtain mk' and msg', and uses his own private key sk to decrypt to obtain mk and msg; runs the shard sorting algorithm to obtain the file sequence information. After obtaining the sequence information, the decryption key of each shard Decrypt the file in pieces and merge the decrypted files in order.

2. The method for supporting secure transmission and verification of large data files in a cloud environment according to claim 1, characterized in that: The sharding algorithm described in step 2 specifically includes: For the directed acyclic graph Graph, add the same number of obfuscated nodes as the number of irrelevant data files m, and add corresponding outgoing and incoming edges. The obfuscated nodes are divided into two categories, the first category and the second category. The differences between the two are as follows: 1) Add edges to nodes with low out-degree, and the added edges point to the confusion nodes, thus generating the first type of confusion nodes FC; 2) Confuse the existing edges and treat the confused nodes as a bridge to completely change the original graph structure. Specifically, confuse (A→B) into (A→confusing node→B) to generate the second type of confused node SC. At this time, check the direction of the confused node. If the node it points to is not B, but the out-degree of the node is 0, then add an out-edge to the node.

3. The method for supporting secure transmission and verification of large data files in a cloud environment according to claim 1, characterized in that: The sharding metadata file in step 3 is a file generated when the file is sharded for identification and recording, and specifically includes: 1) Unique identifier V ind : A randomly generated number used to specify which file the shard belongs to. The unique identifiers generated for the same file are the same, and users can search for all file shards based on the unique identifiers. The unique identifiers for different files are different. 2) Shard identifier F ind : A randomly generated number used to find the identifier of the shard. The shard identifiers of the same file are also different; 3) Version information v : This value is used to verify whether the file is within the validity period; when the file fragment is dynamically updated, the value must be replaced; 4) Node order information D n :This information is stored in the node shard identifier pointed to by the current shard node in the graph Graph′.

4. The method for supporting secure transmission and verification of large data files in a cloud environment according to claim 1, characterized in that: The fragment sorting algorithm described in step 8 aims to delete the obfuscated nodes and edges in Graph′ according to the obfuscated information msg until the original graph Graph is restored, and finally a topological sequence is generated to obtain the order information of the file fragments; The specific steps are as follows: 1) Directly remove the first type of confusing nodes and all connected edges; 2) Modify the node according to the direction of the second type of confusion node. If it points to an original node and the outgoing edge of the original node is zero or only points to the first type of confusion node, modify the confusion node to the original node and delete the original node it points to. If it points to a confusion node, continue to search for the original node according to the outgoing edge, and use depth search to restore the node level by level.

Images