A method for supporting secure transmission and verification of large data files in a cloud environment

Abstract

The present application relates to a kind of methods for supporting large data file secure transmission and verification in cloud environment, belong to file transmission technical field.The method includes preparation stage, file fragment encryption, confusion processing, file upload download, file decryption and merging etc.Characteristics are: the file is divided into several file segments, and symmetric encryption is carried out to each segment to generate file fragment metadata, then confusion fragment and encrypted file fragment are uploaded to cloud server simultaneously, since the encrypted file fragment loses sequential information, so sequential information is stored after encryption, and is accessed by user to read;Sequential information of file fragment is hidden in graph, and sequential information is obtained using algorithm, finally file is merged, and thus the safe transmission of file is completed.The method can improve transmission efficiency and file transmission security in the case of distributed deployment, and realize the safe transmission of file data.

Description

Technical Field

[0001] The present invention relates to the fields of data transmission and data security protection, and more particularly to a method for supporting secure transmission and verification of large data files in a cloud environment. Background Art

[0002] As digital transformation deepens, industries across the globe are increasingly dependent on data, and the size of files processed on the internet is rapidly increasing. For example, the widespread adoption of high-definition video, the need to back up large databases, and the sharing of complex design files have all generated massive amounts of data. Transmitting these large files poses significant challenges to network bandwidth, transmission speed, and reliability. To address this issue, fragmented transmission technology has emerged as an effective solution. By splitting large files into multiple smaller data segments, fragmented transmission allows for parallel transmission of each segment, significantly improving transmission efficiency. Furthermore, fragmentation effectively reduces the risk of data loss or corruption during transmission. Even if a segment fails to transmit, the system only needs to retransmit the corresponding segment, rather than resending the entire file. This approach not only improves transmission success rates but also reduces network resource consumption. Consequently, fragmented transmission has become an indispensable tool for handling large file transfers, playing a crucial role in cloud storage, content delivery networks (CDNs), and video streaming.

[0003] Large file segmentation is a technology that breaks a large file into multiple smaller segments, transferring the entire file through parallel upload or download. This method offers significant advantages in terms of increased transfer speed, improved stability, reduced interruptions, and reduced time consumption. Particularly in scenarios like cloud services, segmentation offers numerous benefits for file management and data transfer. First, by breaking a large file into smaller segments, these segments can be transferred in parallel. This parallel processing significantly reduces latency associated with individual file transfers, allowing different segments to be transferred simultaneously over the network, thus more efficiently utilizing network bandwidth and improving transfer efficiency. Traditional file transfers are often limited by bandwidth, but segmentation technology fully exploits the potential of network resources, significantly accelerating overall transfer speeds even for extremely large files. Secondly, network fluctuations or outages are common challenges in large file transfers. Traditional single-file transfers often require retransmitting the entire file when network issues arise, which wastes time and consumes significant bandwidth resources. Segmentation significantly alleviates this problem. Even if a fragment fails during transmission, the system only needs to retransmit that fragment, without having to resend the entire file. This reduces wasted time and resources and improves transmission stability and fault tolerance. Furthermore, fragmented transmission technology offers significant advantages in ensuring file security and integrity. When transmitting large files, traditional single-file transmission methods are more vulnerable to cyberattacks or data tampering. However, with fragmented transmission technology, the system can independently verify and encrypt each fragment. This means that data integrity is fully protected during transmission; even if individual fragments are compromised, the overall file remains secure. This not only improves file transmission reliability but also enhances data confidentiality. Especially in enterprises with strict data protection requirements, fragmented technology can effectively prevent file leaks or malicious tampering.

[0004] In summary, the application of fragmented transmission technology on the Internet not only significantly improves the speed and efficiency of large file transfers, reduces the risk of network interruptions, but also provides a stronger guarantee for file security. In today's data-intensive digital age, fragmented transmission technology has become an important tool for the efficient and secure management and transmission of large files. Summary of the Invention

[0005] The present invention is based on file fragment transmission technology and is designed under the inspiration of topological sorting in directed graphs. Its purpose is to solve the following key technical problems: ensuring the security of fragments during fragment transmission, and the fragment verification problem after being attacked. The fragment encryption of the present invention uses symmetric encryption, which has a better encryption speed than public key encryption. Public key encryption only encrypts the most critical symmetric keys and obfuscation information to balance transmission efficiency. The file verification of this scheme does not involve frequent access to the server. The user uses local resources for verification and can know the verification result after obtaining the hash table from the server. The public key encryption of the present invention adopts attribute-based encryption ABE. Users with the same attribute can decrypt the file at the same time using their own private keys. According to the choice of public key encryption, the present invention can also expand multiple attributes and has good scalability.

[0006] The purpose of the present invention is achieved through the following technical solutions:

[0007] A method for supporting the secure transmission and verification of large data files in a cloud environment. The system model includes four roles: cloud server (platform operator), file sender (user), file receiver (user), and central organization (trusted center). The following is a detailed description of the characteristics and responsibilities of each role:

[0008] 1) File sender

[0009] This entity is the party that provides the file. Users or businesses can upload files to the cloud server through a client and set user permissions for viewing the video, effectively establishing an access control policy for the sender. The file sender possesses a pair of randomly generated keys used to encrypt the file. Once the video provider uploads the video to the cloud server and database, it goes offline.

[0010] 2) File recipient

[0011] This entity refers to the party that receives the file. Users can download and access the corresponding file fragments and meta-files from the cloud server and database based on their identity attributes, decrypt the key and obfuscated data with the private key, execute the corresponding algorithm to verify the fragmented files, and decrypt them into the original video file after combining and sorting.

[0012] 3) Cloud Server

[0013] The cloud server stores the video segments uploaded by the file sender, controls access to video viewers, and manages uploaded video segments. The server ensures that viewers can retrieve the required file segments through a search mechanism. To ensure security, attribute-based encryption is used for user access control.

[0014] 4) Central institutions

[0015] A central authority uses a public key infrastructure (PKI) to issue digital certificates to participants in the framework for system initialization and the generation of public parameters. These certificates represent the identities of entities participating in the framework. This allows recipients of transactions to verify the identity of the provider. Furthermore, the CA is responsible for managing and transmitting keys and obfuscating data, ensuring the confidentiality of digital communications and data.

[0016] The present invention specifically comprises the following steps:

[0017] Step 1: System Initialization

[0018] System parameter initialization: Using the security parameter λ as input, the central agency generates the system public parameter pp;

[0019] Key initialization: Call the key generation algorithm based on the public parameter pp to generate the master key mk and the public and private key pairs sk and pk;

[0020] Step 2: Preprocessing

[0021] The number of file shards n and the number of obfuscated shards m are selected based on the size of the data file, with n:m = 2:1. A directed acyclic graph Graph is randomly generated based on the shard order 1 to n, so that the topological sorting order of the graph is the shard order. The shard scrambling algorithm is called to add the obfuscated nodes to Graph to generate Graph′, thereby obfuscating the topological sorting.

[0022] Step 3: File fragmentation and encryption

[0023] According to the selected n, the data file is divided into FS = (FS1, FS2...FS n ), according to the selected m, select m obfuscated fragment files of similar size CS=(CS1,CS2…CS m ); the encryption key for each shard is t is a random number, i∈n; at this time, the obfuscated information msg=(FC i , SC j , t), i, j∈m and u+j=m; where FC i and SC j Represent the first type of confusion nodes and the second type of confusion nodes respectively; ek i As the symmetric encryption key, after encryption using the symmetric encryption algorithm AES-256, the file segment metadata file is generated;

[0024] Step 4: File Processing

[0025] Use the hash algorithm Hash to generate a hash value H for all encrypted fragments i =Hash(FSi ), H j = Hash(CS j ); select a value x, combine the hash values H of every x fragments to perform a second hash, Hash(Hash(FS i )), repeat the same process until the total number of remaining hashes is only 1; generate an x-way tree and a hash table;

[0026] Step 5: File upload

[0027] The file fragment metadata file is directly uploaded to the database, the file fragments FS, the obfuscated fragments CS and the hash table are uploaded to the cloud server, the key mk and the obfuscated information msgg are encrypted using attribute-based encryption (ABE), the encryption key is pk, the encrypted key mk' and the encrypted obfuscated information msg' are generated;

[0028] Step 6: File download

[0029] The user accesses the database according to the permission, obtains the file unique identifier V ind , accesses the cloud server for download according to the file fragment identifier F ind , confirms the fragment version information according to the file sender, and constructs a directed graph Graph' according to the node order information;

[0030] Step 7: File verification

[0031] The user locally processes the downloaded file by hash, compares and verifies the integrity of the file fragments according to the hash table in the cloud server, and requests to resend the file fragment if the file fragment is incomplete;

[0032] Step 8: File decryption and merging

[0033] The user accesses the central organization to obtain mk' and msg', and uses his own private key sk to obtain mk and msg; runs the fragment sorting algorithm to obtain the file order information, and obtains the decryption key for each fragment after obtaining the order information; decrypts the file fragments, and merges the decrypted files according to the order.

[0034] Further, the fragment scrambling algorithm in step 2 specifically includes:

[0035] For the directed acyclic graph Graph, add the same number of obfuscated nodes as the number of irrelevant data files m, and add the corresponding outgoing edges and incoming edges, the obfuscated nodes are divided into two categories, the first category and the second category, the difference between the two is as follows:

[0036] 1) Add edges to nodes with low out-degree, and the added edges point to the confusion nodes, thus generating the first type of confusion nodes FC;

[0037] 2) Obfuscate the existing edges and treat the obfuscated node as a bridge, completely changing the original graph structure. Specifically, (A→B) is obfuscated into (A→obfuscated node→B), generating a second type of obfuscated node SC. At this time, the direction of the obfuscated node must be checked. If the node it points to is not B, but the out-degree of the node is 0, an out-edge must be added to the node.

[0038] Furthermore, the fragment metadata file described in step 3 is a file generated when the file is fragmented and used for identification and recording, specifically including:

[0039] 1) Unique identifier V ind : A randomly generated number used to specify which file the shard belongs to. The unique identifier generated for the same file is the same, and users can search for all file shards based on the unique identifier. The unique identifiers for different files are different.

[0040] 2) Shard identifier F ind : A randomly generated number used to find the identifier of the shard. The shard identifiers of the same file are also different;

[0041] 3) Version information v : This value is used to verify whether the file is within the validity period; when the file fragment is dynamically updated, the value must be replaced;

[0042] 4) Node sequence information D n : This information is stored in the node shard identifier pointed to by the current shard node in the graph Graph′.

[0043] Furthermore, the fragment sorting algorithm described in step 8 aims to delete the obfuscated nodes and edges in Graph′ according to the obfuscation information msgg until the original graph Graph is restored, and finally generates a topological sequence to obtain the order information of the file fragments. The specific steps are as follows:

[0044] 1) Directly remove the first type of confusing nodes and all connected edges;

[0045] 2) Modify the node according to the direction of the second type of confusion node. If it points to an original node and the outgoing edge of the original node is zero or only points to the first type of confusion node, modify the confusion node to the original node and delete the original node it points to. If it points to a confusion node, continue to search for the original node according to the outgoing edge and use depth search to restore the node one level at a time.

[0046] Beneficial effects of the present invention:

[0047] 1) The use of a shard scrambling algorithm and shard sorting ensures the secure transmission of important file sequence information generated after sharding large data files. The inclusion of obfuscated information makes it impossible for attackers to decipher this sequence information within limited computing power (in polynomial time), thus ensuring transmission security.

[0048] 2) This method is consistent with mainstream transmission methods: it uses distributed upload and download to improve the overall transmission speed and performance of the solution, solving the problem of storage servers becoming performance bottlenecks in traditional storage systems, and facilitating the actual implementation of the system solution.

[0049] 3) This method uses hash values ​​to generate a MerkelTree and saves it as a hash table. This avoids the traditional sequential verification of shards, reduces the number of user interactions with the server, and allows users to generate verification information locally, improving verification efficiency for large file transfers.

[0050] 4) Symmetric encryption based on AES is fast and does not consume system performance. Public key encryption only targets a small portion of data, balancing encryption time and security, achieving both high performance and high security. The introduction of ABE also enables this method to perform user access control on cloud servers, making it suitable for specific scenarios such as companies and schools.

[0051] 5) There are two key pieces of information to ensure secure file transmission, including the encrypted key mk′ and the encrypted obfuscated message msg′. If an attacker obtains only one of the two pieces of information, it is not enough to decrypt the file sequence information. The two pieces of information can be used to distribute and manage the keys based on different encryption strategies. They can be flexibly selected according to specific circumstances, and have strong applicability and scalability. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 The overall framework diagram of the system for implementing the present invention;

[0053] Figure 2 is a flow chart of the present invention;

[0054] Figure 3 Schematic diagram of adding the first type of confusion nodes to the fragment scrambling algorithm of the present invention;

[0055] Figure 4 Schematic diagram of adding a second type of obfuscation node to the fragment scrambling algorithm of the present invention;

[0056] Figure 5 Schematic diagram of constructing an x-ary tree and a hash table according to the present invention. DETAILED DESCRIPTION

[0057] The present invention will be further described in detail below with reference to the accompanying drawings.

[0058] A method for supporting secure transmission and verification of large data files in a cloud environment of the present invention comprises the following steps:

[0059] Step 1: System Initialization

[0060] System parameter initialization: select the security parameter λ as input and generate a prime order group Its order is p, the group The generator is g; then, select a hash function Then randomly select represents the integer group of order p; and calculate h = g a. Finally output the system common parameters

[0061] Key initialization: Call the key generation algorithm based on the public parameter pp to generate the master key mk and the public and private key pairs sk and pk;

[0062] Step 2: Preprocessing

[0063] According to the size of the data file, the appropriate number of file shards n and the number of obfuscated shards m (n:m = 2:1) are selected. Based on the shard order 1 to n, a directed acyclic graph Graph is randomly generated, so that the topological sorting order of the graph is the shard order. The shard scrambling algorithm is called to add the obfuscated nodes to Graph to generate Graph′, thereby obfuscating the topological sorting.

[0064] 2.1 Shard Scrambling Algorithm

[0065] The purpose of this algorithm is to add the same number of obfuscated nodes as the number of irrelevant data files to the directed acyclic graph, as well as to add corresponding outgoing and incoming edges. The obfuscated nodes are divided into two types: the first type and the second type. The differences between the two are as follows:

[0066] 1) Add edges to nodes with low out-degree, and the added edges point to the confusion nodes, thus generating the first type of confusion nodes FC;

[0067] 2) Obfuscate the existing edges and treat the obfuscated nodes as bridges, completely changing the original graph structure. Specifically, (A→B) is obfuscated into (A→obfuscated node→B), generating a second type of obfuscated node SC. At this time, the direction of the obfuscated node is checked. If the node it points to is not B, but the node has an out-degree of 0, an out-edge is added to the node.

[0068] Step 3: File fragmentation and encryption

[0069] According to the selected n, the data file is divided into FS = (FS1, FS2...FS n), select m unrelated data files of similar size CS=(CS1,CS2…CS m ); the encryption key for each shard is t is a random number, i∈n; at this time, the obfuscated information msg=(FC i , SC j , t), i, j∈m and i+j=m. Among them FC i and SC j Represent the first type of confusion nodes and the second type of confusion nodes respectively; ek i As the symmetric encryption key, after encryption using the symmetric encryption algorithm AES-256, the file segment metadata file is generated;

[0070] 3.1 Shard metadata file

[0071] This file is generated during file fragmentation for identification and recording purposes. It consists of the following four parts:

[0072] 1) Unique identifier V ind : A randomly generated number used to specify which file the shard belongs to. The unique identifier generated for the same file is the same, and users can search for all file shards based on the unique identifier. Different files have different unique identifiers.

[0073] 2) Shard identifier F ind : A randomly generated number used to find the identifier of the shard. The shard identifiers of the same file are also different;

[0074] 3) Version information v : This value is used to verify whether the file is within the validity period; when the file fragment is dynamically updated, the value must be replaced;

[0075] 4) Node sequence information D n : This information is stored in the node shard identifier pointed to by the current shard node in the graph Graph′;

[0076] Step 4: File Processing

[0077] Use the hash algorithm Hash to generate a hash value H for all encrypted fragments i =Hash(FS i ), H j =Hash(CS j ); Select a value x, and perform a secondary hash on the hash value H of each x shards, namely Hash(Hash(FS i )), repeat the same process until the total number of remaining hashes becomes only 1; generate an x-ary tree and a hash table;

[0078] Step 5: File Upload

[0079] The shard metadata file is directly uploaded and stored in the database. The file shard FS, obfuscated shard CS and hash table are uploaded to the cloud server. The key mk and obfuscated message msg are encrypted using attribute-based encryption (ABE). The encryption key is pk, and the encrypted key mk′ and encrypted obfuscated message msg′ are generated.

[0080] Step 6: File Download

[0081] The user first accesses the database according to the authority, and then uses the unique identifier V ind Get the file fragment identifier F ind , access the cloud server to download; confirm the shard version information according to the file sender's instructions, and build a directed graph Graph' according to the node sequence information;

[0082] Step 7: Document Verification

[0083] The user hashes the downloaded file locally and compares it with the hash table in the cloud server to verify the integrity of the file segment. If the file segment is incomplete, the user requests that the file segment be resent.

[0084] Step 8: File decryption and merging

[0085] The user accesses the central agency to obtain mk' and msg', and uses his own private key sk to decrypt to obtain mk and msg; runs the fragment sorting algorithm to obtain the file sequence information, and after obtaining the sequence information, the decryption key of each fragment Decrypt the file in pieces and merge the decrypted files in order;

[0086] 8.1 Shard Merging Algorithm

[0087] The purpose of this algorithm is to delete the obfuscated nodes and edges in Graph′ according to the obfuscated information msg until the original graph Graph is restored, and finally generate a topological sequence to obtain the file sequence information. The specific steps are as follows:

[0088] 1) Directly remove the first type of confusing nodes and all connected edges;

[0089] 2) Modify the node based on the direction of the second type of confusion node. If it points to an original node and the outgoing edge of the original node is zero or only points to the first type of confusion node, modify the confusion node to the original node and delete the original node it points to. If it points to a confusion node, continue to search for the original node based on the outgoing edge, and use depth search to restore the node one level at a time.

[0090] Example

[0091] See Figure 1 The overall framework entity for implementing the present application comprises four parts. The central organization first distributes the key according to the public parameters ① and 1), the file sender can upload the encrypted file fragments and hash table 3) that need to be transmitted after identity authentication 2), and upload the generated fragment metadata to the database 4). Then the file sender sends the encryption key and the confusion information to the file receiver 5) after using the public key to encrypt. The file receiver can search and query the metadata file of the file required by the user according to the unique identifier in the database ②, send a download request to the cloud server ③, and the receiver can download the file data ④ after the server performs identity authentication on the file receiver.

[0092] Referring to Figure 2 The specific process of the present application mainly includes two stages, including the file sender sending stage and the file receiver receiving stage. Both of them need to pass through the central organization for identity authentication before operation, otherwise they have no right to operate. The central organization distributes the key pair, which is saved by the user. The sender performs operations such as fragmentation, encryption, hashing, file uploading, key transmission and confusion information transmission to complete the transmission of necessary files and information. After receiving the message, the receiver performs operations such as database access, query, cloud server request, file download, verification and decryption to obtain the original file. Thus, a complete file transmission is completed.

[0093] Referring to Figure 3 In the preprocessing stage, the present application uses the fragmentation scrambling algorithm to add two types of confusion nodes. The first type of confusion node is added as shown in the figure. Assuming that Graph is a five-node directed graph with topological order A→B→C→D→E. According to the fragmentation scrambling algorithm, the first type of confusion node adds confusion nodes F, G, H without changing the original graph structure, and selects nodes A, B, C, D with low in-degree to add confusion nodes to their out-edges. At this time, Graph(First) is generated. At this time, the topological sequence of the graph is not unique, because the in-edges of E and G are both zero, and can be used as the first order. However, the topological sequence generated at this time, such as F→A→G→B→H→C→D→E, or G→F→A→B→H→C→D→E, does not change the inherent sorting logic of A→B→C→D→E, so the second type of confusion node needs to be added.

[0094] Referring to Figure 4In the preprocessing stage, the present invention uses a sharding scrambling algorithm to add two types of obfuscated nodes. The addition of the second type of obfuscated nodes is shown in the figure. In the Graph (First) where the first type of obfuscated nodes are added, the second type of obfuscated nodes J and I are added. At this time, J occupies the position of the original B node, and I occupies the position of the C node. For this reason, these two nodes must point to the original nodes, that is, add outgoing edges of J→B and I→C. In order to further increase the degree of obfuscation, the original nodes B and C can also add incoming and outgoing edges, but if outgoing edges are added, they must point to the first type of obfuscated nodes. The graph Graph′ generated at this time may not have a topological sorting because the graph contains a loop, but if the edge H→E is removed, the topological sorting at this time is G→F→A→H→J→D→B→I→E→C. At this time, the internal sorting logic is disrupted, and the adversary needs exponential time to crack it by brute force, which ensures security.

[0095] See Figure 5 , set x to 3, and continue hashing after concatenating the hashes generated by each of the three shard files. For example, concatenate H(1), H(2), and H(3) and then hash to generate H(10). Repeat the above steps until H(root) is generated. The entire tree structure is the structure that the hash table needs to save. When the user downloads the file shards, perform the hash locally to generate a tree with the same structure, and then compare it with the node information one by one to complete the file verification.

Claims

1. A method for supporting secure transmission and verification of large data files in a cloud environment, the method being executed in a system comprising a cloud server, a file sender, a file receiver, and a central organization, characterized in that: The method comprises the following specific steps: Step 1: System Initialization System parameter initialization: Using the security parameter λ as input, the central agency generates the system public parameter pp; Key initialization: Call the key generation algorithm based on the public parameter pp to generate the master key mk and the public and private key pairs sk and pk; Step 2: Preprocessing Select the number of file shards n and the number of obfuscated shards m based on the size of the data file, with n:m = 2:

1. Randomly generate a directed acyclic graph Graph based on the shard order 1 to n, so that the topological sorting order of the graph is the shard order. Call the shard scrambling algorithm and add the obfuscated nodes to Graph to generate Graph′, thereby obfuscating the topological sorting. Step 3: File fragmentation and encryption According to the selected n, the data file is divided into FS = (FS1, FS2...FS n ), according to the selected m, select m obfuscated fragment files of similar size CS=(CS1,CS2…CS m ); the encryption key for each shard is t is a random number, i∈n; at this time, the obfuscated information msg=(FC i ,SC j ,t),i,j∈m and i+j=m; where FC i and SC j Represent the first type of confusion nodes and the second type of confusion nodes respectively; ek i As the symmetric encryption key, after encryption using the symmetric encryption algorithm AES-256, the file segment metadata file is generated; Step 4: File Processing Use the hash algorithm Hash to generate a hash value H for all encrypted fragments i =Hash(FS i ), H j =Hash(CS j ); Select a value x and perform a secondary hash on the hash value H of each x shards, that is, Hash(Hash(FS i )), repeat the same process until the total number of remaining hashes becomes only 1; generate an x-ary tree and a hash table; Step 5: File Upload The file shard metadata file is directly uploaded and stored in the database. The file shard FS, obfuscated shard CS and hash table are uploaded to the cloud server. The key mk and obfuscated message msg are encrypted using attribute-based encryption with the encryption key pk to generate the encrypted key mk′ and the encrypted obfuscated message msg′. Step 6: File Download The user first accesses the database according to the authority, and then uses the unique identifier V ind Get the file fragment identifier F ind , access the cloud server to download; confirm the shard version information according to the file sender's instructions, and build a directed graph Graph′ according to the node sequence information; Step 7: Document Verification The user hashes the downloaded file locally and compares it with the hash table in the cloud server to verify the integrity of the file segment. If the file segment is incomplete, the user requests that the file segment be resent. Step 8: File decryption and merging The user accesses the central agency to obtain mk' and msg', and uses his own private key sk to decrypt to obtain mk and msg; runs the fragment sorting algorithm to obtain the file sequence information, and after obtaining the sequence information, the decryption key of each fragment Decrypt the file in pieces and merge the decrypted files in order.

2. The method for supporting secure transmission and verification of large data files in a cloud environment according to claim 1, characterized in that: The shard scrambling algorithm described in step 2 specifically includes: For the directed acyclic graph Graph, add the same number of obfuscation nodes as the number of irrelevant data files m, and add corresponding outgoing and incoming edges. The obfuscated nodes are divided into two categories, the first category and the second category. The differences between the two are as follows: 1) Add edges to nodes with low out-degree, and the added edges point to the confusion nodes, thus generating the first type of confusion nodes FC; 2) Obfuscate the existing edges and treat the obfuscated node as a bridge, completely changing the original graph structure. Specifically, (A→B) is obfuscated into (A→obfuscated node→B), generating a second type of obfuscated node SC. At this time, the direction of the obfuscated node must be checked. If the node it points to is not B, but the out-degree of the node is 0, an out-edge must be added to the node.

3. The method for supporting secure transmission and verification of large data files in a cloud environment according to claim 1, characterized in that: The sharding metadata file in step 3 is a file generated when the file is sharded for identification and recording, specifically including: 1) Unique identifier V ind : A randomly generated number used to specify which file the shard belongs to. The unique identifier generated for the same file is the same, and users can search for all file shards based on the unique identifier. The unique identifiers for different files are different. 2) Shard identifier F ind : A randomly generated number used to find the identifier of the shard. The shard identifiers of the same file are also different; 3) Version information v : This value is used to verify whether the file is within the validity period; when the file fragment is dynamically updated, the value must be replaced; 4) Node sequence information D n : This information is stored in the node shard identifier pointed to by the current shard node in the graph Graph′.

4. The method for supporting secure transmission and verification of large data files in a cloud environment according to claim 1, wherein: The fragment sorting algorithm described in step 8 aims to delete the obfuscated nodes and edges in Graph′ according to the obfuscated information msg until the original graph Graph is restored, and finally generates a topological sequence to obtain the order information of the file fragments; The specific steps are as follows: 1) Directly remove the first type of confusing nodes and all connected edges; 2) Modify the node according to the direction of the second type of confusion node. If it points to an original node and the outgoing edge of the original node is zero or only points to the first type of confusion node, modify the confusion node to the original node and delete the original node it points to. If it points to a confusion node, continue to search for the original node according to the outgoing edge and use depth search to restore the node one level at a time.

Images