Encryption deduplication method supporting file key continuous updating

Abstract

The invention discloses a random key encryption deduplication method supporting continuous updating, and in order to enable a client to safely outsourced private data to a server, the method comprises the following steps: after initializing system parameters, the client selects a random key to encrypt the data, and sends the encrypted data to the server; and the server side performs repeated check and duplicate removal on the data of the user. And the server verifies the ownership of each uploader to the file through a challenge response mechanism to realize effective ownership management control. According to the method and the device, the user is supported to replace the file key, all legal users can obtain the key updated for multiple times, and the risk of privacy data leakage after key leakage is reduced. Due to the randomness of key selection of the client, the method can resist violent attacks introduced by deterministic convergence encryption. Compared with an encryption deduplication method assisted by a third-party independent server, the method is simpler in deployment. The method is used in the field of encryption deduplication and can provide data privacy.

Description

Technical Field

[0001] The present invention relates to the field of encryption deduplication, and in particular to an encryption deduplication method supporting continuous updating of file keys. Background Art

[0002] The rapid development of Internet technology has made Internet access more and more popular, and the amount of data per capita has increased rapidly. According to Statista's forecast, the global data volume will reach 2142Zb in 2035, and data storage faces huge challenges. Individuals and small and medium-sized enterprises have limited storage and maintenance capabilities, and have chosen cloud storage. In order to reduce costs, cloud service providers use deduplication technology. This technology can detect and delete the same files in the outsourced data of different users, and only retain one ciphertext backup, thereby reducing storage space usage, improving storage resource utilization, and providing users with a more economical and efficient data storage solution. In order to prevent privacy data leakage, users will encrypt data before outsourcing. However, traditional encryption technology will cause different users to encrypt the same file into different ciphertexts, making deduplication more difficult. To this end, Douceur et al. [Douceur JR, Adya A, Bolosky WJ, et al. Reclaiming space from duplicate files in a serverless distributed file system [C]. Proceedings 22nd International conference on distributed computing systems. 2002. 617-624.] proposed the Convergent Encryption (CE) algorithm, which uses the file fingerprint as the encryption key. Different users can obtain the same ciphertext by encrypting the same file with CE. At that time, the deterministic encryption property of the CE method made it vulnerable to offline brute force attacks. Although cloud storage servers can detect duplicate data in the ciphertext state, there are security risks. This has prompted people to continuously explore safer and more efficient encryption deduplication methods to meet the security and resource utilization efficiency requirements of data storage.

[0003] In 2013, Bellare et al. [Keelveedhi S, Bellare M, Ristenpart T. DupLESS: server-aided encryption for deduplicated storage [C]. Proceedings of the 22nd USENIX conference on Security. 2013. 179-194.] proposed the DupLESS algorithm. The client obtains the key based on the plaintext message through the oblivious PRF protocol and interacts with the key server, thereby resisting the offline brute force attack that may exist in the CE scheme. At the same time, Dupless resists the online brute force attack launched by the attacker by limiting the user's access frequency. In this way, the client can use the existing service to store encrypted data, and the server performs the deduplication task, while achieving strong confidentiality protection. For deduplication storage, DupLESS can achieve almost the same performance and space saving effect as using plaintext data storage services.

[0004] In 2015, Liu Jian et al. [Liu J, Asokan N, Pinkas B. Secure deduplication of encrypted data without additional independent servers [C]. Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. 2015. 874-885.] proposed a cross-user encrypted data deduplication scheme that does not require additional independent servers. The data owner of the previously uploaded file needs to assist the later uploader to complete the data encryption. Therefore, there is no need to consider the single point failure problem of the key server.

[0005] In 2017, Jay Dave et al. [Dave J, Saharan S, Faruki P, et al. Secure random encryption for deduplicated storage [C] Information Systems Security: 13th International Conference. 2017. 164-176.] proposed that encryption mechanisms based on deterministic keys (such as CE and MLE) are vulnerable to brute force attacks and dictionary attacks against predictable files, and proposed a random key-based deduplication storage secure encryption method. In order to allow deduplication, the random key is encrypted by a set of hash values ​​calculated from the plaintext file. Therefore, subsequent uploaders of the file are also able to decrypt the random key. This method provides the confidentiality of the file and the security of the key without the need for any additional key server.

[0006] In 2020, Tian et al. [Tian G, Ma H, Xie Y, et al. Randomized deduplication with ownership management and data sharing in cloud storage [J]. Journal of Information Security and Applications, 2020, 51: 102432.] proposed a client-side deduplication protocol that provides more secure ownership authentication while resisting brute force attacks and repeated forgery attacks. In addition, they proposed a dynamic KEK tree to achieve more effective ownership management in deduplication systems and designed a new data sharing technology based on a dynamic KEK tree, which enriched cloud services and reduced the business pressure on cloud servers.

[0007] In 2024, Wu et al. [Wu X, Li J, Wang H, et al. A randomized encryption deduplication method against frequency attack [J]. Journal of Information Security and Applications, 2024, 83: 103774.] proposed a randomized encryption deduplication method against frequency attack (REFA), which provides high randomness of ciphertext. The core idea of ​​REFA is that after obtaining the convergence key generated by the key server, the user randomizes the convergence key with a random value of the same length. Then, REFA encrypts the plaintext block with the random key. REFA hides the random value in the ciphertext and encrypts the convergence key for user ownership verification. REFA perfectly masks the frequency of the plaintext block and has high storage efficiency and data security. After the subsequent user uploads the ciphertext, the CSP updates the ciphertext. REFA can effectively defend against frequency analysis attacks.

[0008] In addition, Chinese patent application CN108400970A discloses a method for detecting and deleting similar data messages in a cloud environment, which uses a similarity-preserving hash function, a key extraction method based on an error-correcting code, and a secure symmetric encryption algorithm based on a pseudo-random generator to further improve the efficiency of deduplication in existing solutions. In addition, the method uses the optimization method of Hamming distance reduction and label cutting to improve the efficiency of label query in cloud servers.

[0009] Chinese patent application CN118748589A discloses a multifunctional cloud-based collaborative data audit method. The method integrates cryptographic deduplication technology, remote data integrity audit and protocol RDC, heterogeneous ring signature and other cryptographic technologies to achieve efficient, secure, private and flexible device authentication and data integrity verification.

[0010] Chinese patent application CN115225409A discloses a cloud data security deduplication method based on multi-backup joint verification. The method generates a pair of public and private keys based on the user's identity and the selected backup number; hides the encryption key in the data label to obtain the ciphertext block label; and implements data integrity verification before decrypting the data. Summary of the invention

[0011] The purpose of the present invention is to provide an encryption deduplication method that supports continuous updating of file keys in view of the above-mentioned deficiencies, efficiently realize encryption deduplication of data, and provide users with data confidentiality and integrity outsourcing storage services. The present invention uses random keys to encrypt files, which can resist offline / online brute force attacks and improve the efficiency of key generation. Secondly, the present invention supports continuous updating of file keys / ciphertexts. Effective access control is achieved.

[0012] The present invention is achieved through the following scheme:

[0013] An encryption deduplication method supporting continuous update of file keys comprises the following steps:

[0014] Step 1: Set system parameters;

[0015] Step 2: The client encrypts file F;

[0016] Step 3: Deduplication of uploaded files;

[0017] Step 4: Ciphertext update;

[0018] When the key or ciphertext of file F is leaked, the client can choose to re-select the key to encrypt the file;

[0019] Step 5: The client downloads file F;

[0020] Step 501: The client sends T to the server;

[0021] Step 502: The server queries whether the client is in T's ownership list;

[0022] Step 503: After receiving the ciphertext, the client first calculates the file key key = H(e(g r ,y)), then decrypt the ciphertext F=D(C,key);

[0023] Step 504: After receiving the ciphertext, the client first calculates File Key Then decrypt the ciphertext F=D(C, key) to restore the file F; then calculate T * =H(F), compare T * =T is true, if so the file is complete, otherwise it is discarded.

[0024] In step 2, specifically, step 201: the client calculates the file tag T=H(F).

[0025] In step 1, specifically, is a bilinear map; H:{0,1} * →Z p; The output is a fixed-length hash function; H1: {0, 1} * →G1, mapping an arbitrarily long input to an element in group G1; H2: G1→Z p ; p is a large prime number, the public key of the server y = g x , the private key of the server x (1 < x < p - 1); the client i 's private key a i (1 < a i < p - 1, 1 < i < s), s is the number of clients, and the public key is public system parameters; G1: a multiplicative cyclic group of order p with the generator g; G2: also a multiplicative cyclic group of order p.

[0026] In step 3, it specifically includes:

[0027] Step 301: The client sends T to the server;

[0028] Step 302: The server checks whether it has stored T;

[0029] Step 303: After receiving the tag sent by the server, the client randomly selects r ∈ Z*, and calculates the file key Key = H1(e(g r , y)); The client encrypts the file F with the file key: C = E(Key, F);

[0030] Step 304: The client randomly selects an n-dimensional vector V = [r1, r2, r3,..., r n , divides the file F into n chunks {f1, f2, f3,..., f n}, and calculates h i = H(r i ||f i ); The client calculates the Merkle hash tree root h i with {h root}1≤i≤n as the leaf nodes, and calculates n is the number of data block shards; || represents string concatenation;

[0031] Step 305: The client sends the ciphertext C, the file tag T f , Passkey, and the vector V to the server, and retains g r and T locally;

[0032] Step 306: After receiving the Passkey and the vector V sent by the server, the client divides the file F into n chunks {f1, f2, f3,..., f n}, and calculates h i = H(r i ||fi ); the client uses {h i}1≤i≤n is used as a leaf node to calculate the Merkle hash tree root h, and then the calculation is obtained

[0033]

[0034] The client calculates C = E (F, key); finally, the ciphertext C is divided into n blocks of equal size {C i}1≤i≤n, calculate {hc i =H(C i ||u i )} as a leaf node, construct a Merkle hash tree to get the root hc root ; The client sends hc root to the server, save g r and T in local;

[0035] Step 307: The server receives hc root , construct a Merkle hash tree based on the ciphertext C and vector U saved by itself, and add the obtained tree root to hc root Make comparisons and judgements.

[0036] In step 302: if there is no storage, the server sends tag=0 to the client; then goes to step 303;

[0037] If it has been stored, the server randomly selects an n-dimensional vector U = [u1, u2, ..., u n ], send the Passkey vectors V and U containing part of the file key to the client; then go to step 306.

[0038] Step 307: (i) If they are the same, add the client to the owner list of file F; (ii) If they are not the same, reject the client's request.

[0039] In step 4, specifically, step 401: the client randomly selects r1 ′ ∈G1, calculate Then calculate r1=H2(r1 ′ ), new file key And use the new key new Encrypted Files

[0040] C new =E(key new ,F)

[0041] Then upload the new ciphertext and token to the server;

[0042] Step 402: After receiving the ciphertext and token, the server first saves the ciphertext Cnew , then calculate

[0043] r1=H2(r1 ′ ).

[0044] In step 503, if the client has not updated the ciphertext after joining the ownership list, the server sends the ciphertext C to the client and continues to execute step 503. If the client has updated the key k times after joining the ownership list, and the random value selected by the user each time is r i ′ , the server will update the ciphertext C and Send to the client; continue to step 504.

[0045] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0046] 1. The encryption deduplication method of the present invention can complete data encryption deduplication without the assistance of a third-party independent server, and can well resist offline / online brute force attacks and repeated forgery attacks. Secondly, when the user revokes the key leakage, the present invention supports the data owner to update the encryption key and re-encrypt the file. At the same time, the previous legitimate user can still download the decrypted ciphertext. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 It is an encryption flow chart of a specific implementation mode of the present invention;

[0048] Figure 2 This is the construction diagram of the Merkle hash tree. DETAILED DESCRIPTION

[0049] All features disclosed in this specification, or steps in all methods or processes disclosed, except mutually exclusive features and / or steps, can be combined in any manner.

[0050] Any feature disclosed in this specification (including any additional claims and abstract), unless otherwise stated, may be replaced by other equivalent or alternative features having similar purposes. That is, unless otherwise stated, each feature is only an example of a series of equivalent or similar features.

[0051] In the description of the present invention, it is necessary to understand that the directions or positional relationships indicated by the terms "up", "down", "left", "right", etc. are based on the directions or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as a limitation on the present invention.

[0052] In addition, terms such as "first", "second", etc. are only used for descriptive purposes and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first", "second", etc. may explicitly or implicitly include one or more such features.

[0053] Example 1

[0054] As Figure 1-2 shown, the present invention provides a technical solution:

[0055] An encryption deduplication method supporting continuous update of file keys, comprising the following steps:

[0056] Step 1: Set system parameters;

[0057] λ is a security parameter, n is the number of data block shards; || represents string concatenation hereinafter; G1: a multiplicative cyclic group of order p with generator g; G2: also a multiplicative cyclic group of order p;

[0058] is a bilinear map; H: {0, 1} * → Z p ; an output fixed-length hash function; H1: {0, 1} * → G1, mapping an arbitrarily long input to an element in group G1; H2: G1 → Z p ; p is a large prime number, the public key of the server y = g x , the private key of the server x (1 < x < p - 1); the private key a of the client Client i (1 < a i (p - 1, 1 < i < s), s is the number of clients, and the public key is i Disclose the system parameters;

[0059] Step 2: The client encrypts the file F;

[0060] Step 201: The client calculates the file tag T = H(F);

[0061] Step 3: File upload deduplication processing;

[0062] Step 301: The client transmits T to the server;

[0063] Step 302: The server checks whether T has been stored;

[0064] If not stored, the server sends tag = 0 to the client; then go to step 303;

[0065] If it has been stored, the server randomly selects an n-dimensional vector U = [u1, u2, ..., u n ], send the Passkey vectors V and U containing the partial file key to the client; then go to step 306;

[0066] Step 303: After receiving the tag sent by the server, the client randomly selects r∈Z* and calculates the file key Key=H1(e(g r ,y)); The client encrypts file F using the file key: C=E(Key,F);

[0067] Step 304: The client randomly selects an n-dimensional vector V = [r1, r2, r3, ..., r n ], divide the file F into n blocks {f1, f2, f3, ..., f n}, calculate h i =H(r i ||f i ); the client uses {h i}1≤i≤n is used as a leaf node to calculate the Merkle hash tree root h root , and calculate

[0068] Step 305: The client sends the ciphertext C and the file tag T f , Passkey, vector V are sent to the server together, retaining g r and T in local;

[0069] Step 306: After receiving the Passkey and vector V sent by the server, the client divides the file F into n blocks {f1, f2, f3, ..., f n}, calculate h i =H(r i ||f i ); the client uses {h i}1≤i≤n is used as a leaf node to calculate the Merkle hash tree root h, and then the calculation is obtained

[0070]

[0071] The client calculates C = E (F, key); finally, the ciphertext C is divided into n blocks of equal size {C i}1≤i≤n, calculate {hc i =H(C i ||u i )} as a leaf node, construct a Merkle hash tree to get the root hc root ; The client sends hc root to the server, save g r and T in local;

[0072] Step 307: The server receives hc root , construct a Merkle hash tree based on the ciphertext C and vector U saved by itself, and add the obtained tree root to hc root Compare. (i) If they are the same, add the client to the owner list of file F; (ii) If they are not the same, reject the client's request;

[0073] Step 4: Ciphertext update;

[0074] When the key or ciphertext of file F is leaked, the client can choose to re-select the key to encrypt the file;

[0075] Step 401: The client randomly selects r1 ′ ∈G1, calculate Then calculate r1=H2(r1 ′ ), the new file key And use the new key new Encrypted Files

[0076] C new =E(key new ,F)

[0077] Then upload the new ciphertext and token to the server;

[0078] Step 402: After receiving the ciphertext and token, the server first saves the ciphertext C new , then calculate

[0079] r1=H2(r1 ′ );

[0080] Step 5: The client downloads file F;

[0081] Step 501: The client sends T to the server;

[0082] Step 502: The server queries whether the client is in T's ownership list; if the client has not updated the ciphertext after joining the ownership list, the server sends the ciphertext C to the client; and continues to step 503; if the client has updated the key k times after joining the ownership list, and the random value selected by the user each time is r i ′ , the server will update the ciphertext C and Send to the client. Continue to step 504;

[0083] Step 503: After receiving the ciphertext, the client first calculates the file key key = H(e(g r ,y)), then decrypt the ciphertext F=D(C,key);

[0084] Step 504: After receiving the ciphertext, the client first calculates File Key Then decrypt the ciphertext F=D(C, key) to restore the file F; then calculate T * =H(F), compare T * =T is true, if so the file is complete, otherwise it is discarded.

[0085] The present solution discloses a random key encryption deduplication method that supports continuous updates. In order to enable the client to safely outsource private data to the server, the method of the present invention includes initializing the system parameters, and then the client selects a random key to encrypt the data and sends it to the server. The server performs duplicate checks and deduplication on the user's data. The server verifies the ownership of the file by each uploader through a challenge-response mechanism to achieve effective ownership management and control. The present invention supports users to replace file keys, and can ensure that all legitimate users obtain keys that have been updated multiple times, thereby reducing the risk of private data leakage after key leakage. Due to the randomness of the key selected by the client, the present invention can resist brute force attacks introduced by deterministic convergent encryption. Compared with the encryption deduplication method assisted by a third-party independent server, the present method is simpler in deployment. The present invention is used in the field of encryption deduplication to provide data privacy, integrity and key update services.

[0086] Example 2

[0087] like Figure 1 As shown, the present invention provides a technical solution:

[0088] An encryption deduplication method supporting continuous update of file keys comprises the following steps:

[0089] Set system parameters to generate client and server private keys S ID and public key PK ID , and system parameters required for client and server interaction;

[0090] File upload phase: The first client that uploads the file generates a tag, an encryption key, a vector V for key transmission, and a Passkey for the transmission key, and sends the file tag, ciphertext, vector V, and Passkey to the storage server, which saves them. Subsequent clients that upload files use the file tag to download vector V, Passkey, and the challenge vector U for user proof of file ownership from the storage server, and extract the encryption key from it to encrypt the file. Finally, a response to the ownership challenge is generated using the ciphertext and vector U. After the server passes the review, the user is granted ownership of file F.

[0091] During the key update phase, the client can update the key and ensure that the previous client can still correctly decrypt the plaintext.

[0092] During the file download phase, the client uses the file tag to download the ciphertext from the server and then encrypts it using the saved key.

[0093] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An encryption deduplication method supporting continuous update of file keys, characterized in that: The following steps are involved: Step 1: Set system parameters; Step 2: The client encrypts file F; Step 3: Deduplication of uploaded files; Step 4: Ciphertext update; When the key or ciphertext of file F is leaked, the client can choose to re-select the key to encrypt the file; Step 5: The client downloads file F; Step 501: The client sends T to the server; Step 502: The server queries whether the client is in T's ownership list; Step 503: After receiving the ciphertext, the client first calculates the file key key = H(e(g r ,y)), then decrypt the ciphertext F=D(C,key); Step 504: After receiving the ciphertext, the client first calculates File Key Then decrypt the ciphertext F=D(C, key) to restore the file F; then calculate T * =H(F), compare T * =T is true, if so the file is complete, otherwise it is discarded.

2. The encryption deduplication method supporting continuous update of file keys according to claim 1, characterized in that: In step 2, specifically, step 201: the client calculates the file tag T=H(F).

3. The encryption deduplication method supporting continuous update of file keys as claimed in claim 1, characterized in that: In step 1, specifically, is a bilinear mapping; H: {0, 1} * → Z p ; the output is a fixed-length hash function; H1: {0, 1} * → G1, mapping an arbitrarily long input to an element in the group G1; H2: G1 → Z p ; p is a large prime number, the public key of the server y = g x , the private key of the server x (1 < x < p - 1); the private key a of the client Client i i (1 < a i < p - 1, 1 < i < s), s is the number of clients, and the public key is public system parameters; G1: a multiplicative cyclic group of order p with the generator g; G2: also a multiplicative cyclic group of order p.​ 4. The encryption deduplication method supporting continuous update of file keys as claimed in claim 1, characterized in that: In step 3, it specifically includes: Step 301: The client transmits T to the server; Step 302: The server checks whether T has been stored; Step 303: After receiving the tag sent by the server, the client randomly selects r∈Z* and calculates the file key Key=H1(e(g r ,y)); The client encrypts file F using the file key: C=E(Key,F); Step 304: The client randomly selects an n-dimensional vector V = [r1, r2, r3, ..., r n ], divide the file F into n blocks {f1, f2, f3, ..., f n }, calculate h i =H(r i ||f i ); the client uses {h i }1≤i≤n is used as a leaf node to calculate the Merkle hash tree root h root , and calculate n is the number of data block fragments; || indicates string concatenation; Step 305: The client sends the ciphertext C and the file tag T f , Passkey, vector V are sent to the server together, retaining g r and T in local; Step 306: After receiving the Passkey and vector V sent by the server, the client divides the file F into n blocks {f1, f2, f3, ..., f n }, calculate h i =H(r i ||f i ); the client uses {h i }1≤i≤n is used as a leaf node to calculate the Merkle hash tree root h, and then the calculation is obtained The client calculates C = E (F, key); finally, the ciphertext C is divided into n blocks of equal size {C i }1≤i≤n, calculate {hc i =H(C i ||u i )} as a leaf node, construct a Merkle hash tree to get the root hc root ; The client sends hc root to the server, save g r and T in local; Step 307: The server receives hc root , construct a Merkle hash tree based on the ciphertext C and vector U saved by itself, and add the obtained tree root to hc root Make comparisons and judgements.

5. The encryption deduplication method supporting continuous update of file keys as claimed in claim 4, characterized in that: In step 302: if there is no storage, the server sends tag=0 to the client; then goes to step 303; If it has been stored, the server randomly selects an n-dimensional vector U = [u1, u2, ..., u n ], send the Passkey vectors V and U containing part of the file key to the client; then go to step 306.

6. The encryption deduplication method supporting continuous update of file keys as claimed in claim 4, characterized in that: Step 307: (i) If they are the same, add the client to the owner list of file F; (ii) If they are not the same, reject the client's request.

7. The encryption deduplication method supporting continuous update of file keys as claimed in claim 1, characterized in that: In step 4, specifically, step 401: the client randomly selects r1 ′ ∈G1, calculate Then calculate r1=H2(r1 ′ ), the new file key And use the new key new Encrypted Files C new =E(key new ,F) Then upload the new ciphertext and token to the server; Step 402: After receiving the ciphertext and token, the server first saves the ciphertext C new , then calculate 8. The encryption deduplication method supporting continuous update of file keys as claimed in claim 1, characterized in that: In step 503, if the client does not update the ciphertext after joining the ownership list, the server sends the ciphertext C to the client, and continues to execute step 503; If the client has updated the key k times after joining the ownership list, and the random value selected by the user each time is r i ′ , the server will update the ciphertext C and Send to the client; continue to step 504.

Images