Internet-of-things-oriented edge duplicate removal and privacy protection entrusted audit management method and system

Abstract

The invention relates to an edge duplicate removal and privacy protection entrusted audit management method and system for the Internet of Things. The method comprises the following steps: an Internet of Things device issues an audit task announcement, and a target fog node obtains a delegation key by negotiating with the device; the equipment performs block and partition processing on original data, encrypts the original data by using an AES (Advanced Encryption Standard) by using an MLE key and sends the encrypted data to a target fog The fog node uses the delegation key to generate a block label, and the block label is compared with a storage block label to remove repeated blocks; in the auditing stage, the fog node generates a random challenge and sends the random challenge to the cloud server, the cloud server generates a corresponding integrity proof and sends the integrity proof to the target fog node for validity verification, and the target fog node creates an auditing log and uploads the auditing log to the block chain for the Internet of Things device to view. The original data is encrypted by using the MLE key, so that the data privacy is protected; by entrusting label calculation, deduplication operation and auditing to the fog node, offline auditing of the equipment can be realized, and the calculation burden of the equipment can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for entrusted audit management for edge deduplication and privacy protection for the Internet of Things. Background Art

[0002] With the development of information technology, the Internet of Things (IoT), as a core component of information technology, has attracted widespread attention from various industries. In a typical IoT system, a large amount of data is generated by terminal devices, including RFID tags, sensors, laser scanners, etc. However, for IoT devices with limited resources, processing and analyzing this huge amount of data poses a huge challenge. These devices continuously generate and upload data to support decision-making, optimize business processes, and improve user experience. However, with the increase in the number of connected devices, the amount of data is growing exponentially, containing a large amount of duplicate information, which not only increases storage costs, but also reduces the efficiency of data processing and affects the accuracy of analysis results. To this end, cloud computing provides new possibilities for meeting the challenges of data processing. IoT devices can upload massive amounts of data to the cloud for analysis, thereby effectively alleviating the burden of local computing and maintenance. In this process, data needs to be pre-processed at the edge node, including filtering and deduplication, to save storage resources. In existing deduplication solutions, deduplication operations are often performed in the cloud. However, transmitting a large amount of data that may contain duplicates to the cloud will put additional pressure on the already tight edge-to-cloud bandwidth. Even if the cloud processes the deduplicated data, transmitting data that should not be uploaded to the cloud over long distances will waste bandwidth. Therefore, it is necessary to perform deduplication processing on the data uploaded by IoT devices at the edge node to identify and exclude duplicate information, retain only unique data for subsequent analysis, and then transmit the deduplicated data to the cloud storage server (CSS) for final storage and analysis. Of course, the cloud storage server needs to ensure the integrity of the stored data, because outsourcing data to the cloud means that the data management rights are transferred to the cloud storage server. Although cloud storage servers usually claim that the infrastructure they provide is more robust and reliable than local facilities, data loss or corruption still occurs from time to time. Since the original data copy is removed from the local storage, any damage to the cloud data may cause the uploaded data to become unusable or even permanently lost. Therefore, ensuring the integrity of cloud storage data has become one of the hot issues. In the IoT scenario, achieving data edge deduplication and ensuring the integrity of uploaded data are the core requirements of audit solutions applied to the IoT environment.

[0003] At present, most auditing solutions cannot be directly applied to IoT data because the deduplication requirements have not been met. At the same time, some auditing solutions that support deduplication are not applicable to the IoT environment. One of the reasons is that data should be deduplicated at the edge rather than in the cloud to save bandwidth. Another key reason is that most IoT devices are designed for data collection and cannot afford to generate authenticatable tags for the continuously generated data and initiate integrity audit challenges to cloud servers.

[0004] Therefore, traditional audit solutions for the Internet of Things will cause great bandwidth pressure due to the deduplication operations performed in the cloud; and there may be problems of illegal interception and privacy leakage during data transmission. Summary of the invention

[0005] Based on this, in order to solve the above technical problems, a delegated audit management method and system for edge deduplication and privacy protection for the Internet of Things is provided, which can effectively reduce the computing burden of the device, reduce the local overhead of the device, and protect the identity security and data security of the device and edge nodes.

[0006] A delegated audit management method for edge deduplication and privacy protection for the Internet of Things, the method comprising:

[0007] The IoT device publishes an audit task announcement to each fog node, determines a target fog node from each fog node, and the target fog node obtains a delegation key by negotiating with the IoT device;

[0008] The IoT device determines the original data to be uploaded, performs block and partition processing on the original data to obtain various data areas, generates an MLE key using the MLE technology, and uses the MLE key to encrypt each of the data areas using the AES algorithm to obtain an encrypted data area set, and generates a ciphertext hash value based on the encrypted overall file, and sends it together with the data area set to the target fog node;

[0009] The target fog node checks the consistency between the ciphertext and the ciphertext hash value, and after the check is passed, compares the ciphertext hash value with the stored hash value to remove duplicate files. If there is no duplication, the delegate key is used to generate a block label based on the encrypted data block, and the block label is compared with the stored block label to remove the duplicate data block. The target fog node uses the private key to generate a file identifier based on the ciphertext hash value;

[0010] The target fog node uploads the data area set, file identifier, and block tag to the cloud server for storage, and stores the corresponding relationship between the target fog node and the IoT device in the blockchain;

[0011] The target fog node generates a random challenge based on the audit task announcement and sends it to the cloud server. The cloud server generates integrity proof data based on the random challenge and sends it to the target fog node for validity verification. If the verification passes, the target fog node believes that the cloud server has correctly stored the uploaded data, and creates an audit log and uploads it to the blockchain for the IoT device to view.

[0012] In one embodiment, the method further comprises:

[0013] The key generation center selects a system private key, calculates a system public key based on the system private key and makes it public;

[0014] The Internet of Things device sends a first identity identifier to the key generation center, and the key generation center calculates a first anonymous identity and a first corresponding private key according to the first identity identifier and sends them to the Internet of Things device;

[0015] The IoT device performs consistency verification on the first anonymous identity and the first corresponding private key. If the verification is successful, the IoT device accepts the first anonymous identity and the first corresponding private key;

[0016] The fog node sends a second identity identifier to the key generation center, and the key generation center calculates a second anonymous identity and a second corresponding private key according to the second identity identifier and sends them to the fog node;

[0017] The fog node performs consistency verification on the second anonymous identity and the second corresponding private key. If the verification passes, the fog node accepts the second anonymous identity and the second corresponding private key;

[0018] The blockchain administrator initializes the blockchain system, and the cloud server, IoT device, and fog node respectively register blockchain accounts and perform pre-storage operations.

[0019] In one embodiment, the Internet of Things device publishes an audit task announcement to each fog node, determines a target fog node from each fog node, and the target fog node obtains a delegation key by negotiating with the Internet of Things device, including:

[0020] The IoT device creates and publishes an audit task announcement corresponding to the first anonymous identity, and uses an idle node in each of the fog nodes as a target fog node based on the audit task announcement;

[0021] The IoT device sends the delegation information to the target fog node, and the target fog node verifies the validity of the delegation information. After the verification is passed, the target fog node accepts the delegation information and obtains the delegation key.

[0022] The target fog node sends the second anonymous identity to the IoT device, and the IoT device uploads the audit task announcement, the first anonymous identity, and the second anonymous identity to the blockchain.

[0023] In one embodiment, the method further comprises:

[0024] After receiving the audit log, the IoT device randomly extracts a target audit result from the blockchain for inspection to obtain an inspection result.

[0025] In one embodiment, the method further comprises:

[0026] When all the audit results of the random checks are true, the target fog node provides the second corresponding private key to the blockchain administrator;

[0027] The blockchain administrator retrieves and extracts the second anonymous identity corresponding to the audit task announcement based on the second corresponding private key, performs a consistency check on the second corresponding private key and the second anonymous identity, and if the check is qualified, pays the remuneration stored in the blockchain account of the IoT device to the blockchain account of the target fog node.

[0028] In one embodiment, the IoT device determines the original data to be uploaded, performs block and partition processing on the original data to obtain each data area, generates an MLE key using MLE technology, and uses the MLE key to encrypt each data area using the AES algorithm to obtain the encrypted data area, and generates a ciphertext hash value based on the encrypted overall file, and sends it to the target fog node together with the data area set, including:

[0029] The IoT device processes the original data in blocks to obtain the original data after blocks;

[0030] Partition processing is performed on each of the divided original data to obtain each data area;

[0031] The IoT device generates an MLE key based on each of the data areas, and uses the MLE key to encrypt each of the data areas into a ciphertext data area using the AES algorithm;

[0032] The IoT device calculates the ciphertext hash value of the ciphertext data file, and sends the ciphertext hash value and the encrypted ciphertext data area set to the target fog node.

[0033] In one embodiment, the target fog node checks the consistency between the ciphertext and the ciphertext hash value, compares the ciphertext hash value with the stored hash value to remove duplicate files after the check, and if there is no duplication, generates a block label based on the encrypted data block using the delegate key, compares the block label with the stored block label, removes the duplicate data block, and the target fog node generates a file identifier based on the ciphertext hash value using a private key, including:

[0034] The target fog node checks the consistency between the ciphertext and the ciphertext hash value to obtain a check result;

[0035] If the check result is consistent, the file hash value is compared with the locally stored file hash value to remove duplicate files;

[0036] If there is no duplication, generating a block tag based on the encrypted data block using the entrusted key, comparing the block tag with the stored block tag, and removing the duplicate data block;

[0037] The target fog node generates a file identifier based on the ciphertext hash value using a private key.

[0038] In one embodiment, after the target fog node uploads the data area, file identifier, and block tag to the cloud server for storage, and stores the corresponding relationship between the target fog node and the IoT device in the blockchain, the method further includes:

[0039] The cloud server checks the consistency between the data area and the file identifier, and if they are consistent, the cloud server stores the data area, the file identifier, and the block tag;

[0040] The cloud server compares the file identifier with a pre-stored file identifier and deletes duplicates of the same data file uploaded by the same target fog node.

[0041] A delegated audit management system for edge deduplication and privacy protection for the Internet of Things, the system comprising: an Internet of Things device, a fog node, and a cloud server; the Internet of Things device is connected to and communicated with the fog node and the cloud server respectively, and the fog node is connected to and communicated with the cloud server; wherein:

[0042] The IoT device is used to publish an audit task announcement to each fog node, determine a target fog node from each fog node, and the target fog node obtains a delegation key by negotiating with the IoT device;

[0043] The IoT device is also used to determine the original data to be uploaded, perform block and partition processing on the original data to obtain various data areas, generate an MLE key using the MLE technology, and use the MLE key to encrypt each of the data areas using the AES algorithm to obtain an encrypted data area set, and generate a ciphertext hash value based on the encrypted overall file, and send it together with the data area set to the target fog node;

[0044] The target fog node checks the consistency between the ciphertext and the ciphertext hash value, compares the ciphertext hash value with the stored hash value to remove duplicate files after the check, and if there is no duplication, generates a block label based on the encrypted data block using the delegate key, compares the block label with the stored block label, removes duplicate data blocks, and the target fog node generates a file identifier based on the ciphertext hash value using a private key;

[0045] The target fog node is further used to upload the data area set, file identifier, and block tag to the cloud server for storage, and store the corresponding relationship between the target fog node and the IoT device in the blockchain;

[0046] The target fog node is also used to generate a random challenge according to the audit task announcement and send it to the cloud server. The cloud server generates proof data based on the random challenge and sends it to the target fog node for validity verification. If the verification passes, the target fog node believes that the cloud server has correctly stored the uploaded data, and creates an audit log and uploads it to the blockchain for the IoT device to view.

[0047] In one embodiment, the system further comprises: a key generation center and a blockchain manager; wherein:

[0048] The key generation center is used to select a system private key, calculate a system public key based on the system private key and make it public;

[0049] The Internet of Things device is further used to send a first identity identifier to the key generation center, and the key generation center calculates a first anonymous identity and a first corresponding private key according to the first identity identifier and sends them to the Internet of Things device;

[0050] The IoT device is further configured to perform consistency verification on the first anonymous identity and the first corresponding private key. If the verification is successful, the IoT device accepts the first anonymous identity and the first corresponding private key.

[0051] The fog node is further configured to send a second identity identifier to the key generation center, and the key generation center calculates a second anonymous identity and a second corresponding private key according to the second identity identifier and sends them to the fog node;

[0052] The fog node is further used to perform consistency verification on the second anonymous identity and the second corresponding private key. If the verification is successful, the fog node accepts the second anonymous identity and the second corresponding private key;

[0053] The blockchain manager is used to initialize the blockchain system, and the key generation center, IoT device, and fog node respectively register blockchain accounts and perform pre-storage operations.

[0054] The above-mentioned delegated audit management method and system for edge deduplication and privacy protection for the Internet of Things protects data privacy by using MLE keys to encrypt the original data using the AES algorithm after block and partition processing on the IoT device; fog nodes are set to perform deduplication operations, and block labels are calculated using delegated keys combined with homomorphic hash functions to ensure the integrity of data blocks; in addition, fog nodes upload the tasks issued by the device and the corresponding relationship between the device and the fog node to the blockchain to achieve subsequent incentives. By delegating label calculation, deduplication operations and audits to fog nodes, the computing burden of the device can be effectively reduced, the local overhead of the device can be reduced, and the identity security and data security of the device and edge nodes can be protected. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 An application environment diagram of a delegated audit management method for edge deduplication and privacy protection for the Internet of Things in one embodiment;

[0056] Figure 2 A flowchart of a delegated audit management method for edge deduplication and privacy protection for the Internet of Things in one embodiment;

[0057] Figure 3 The present invention is a structural block diagram of a delegated audit management system for edge deduplication and privacy protection for the Internet of Things in one embodiment. DETAILED DESCRIPTION

[0058] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0059] It is understood that the terms "first", "second", etc. used in this application may be used herein to describe anonymous identities, corresponding private keys, but these anonymous identities, corresponding private keys are not limited by these terms. These terms are only used to distinguish the first anonymous identity, corresponding private key from another anonymous identity, corresponding private key. For example, without departing from the scope of this application, the first anonymous identity can be referred to as the second anonymous identity, and similarly, the second anonymous identity can be referred to as the first anonymous identity. Both the first anonymous identity and the second anonymous identity are anonymous identities, but they are not the same anonymous identity.

[0060] The entrusted audit management method for edge deduplication and privacy protection for the Internet of Things provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1 As shown, the application environment includes an IoT device 110, a fog node 120, and a cloud server 130; the IoT device 110 is connected to and communicates with the fog node 120 and the cloud server 130, respectively, and the fog node 120 is connected to and communicates with the cloud server 130. In one embodiment, Figure 2 As shown, a delegated audit management method for edge deduplication and privacy protection for the Internet of Things is provided, including the following steps:

[0061] In step 202, the IoT device publishes an audit task announcement to each fog node, determines a target fog node from each fog node, and the target fog node obtains a delegation key by negotiating with the IoT device.

[0062] The IoT device can publish an audit task announcement based on the files it already has. The audit task announcement can contain basic information about the file, such as file size, task deadline, task reward after completing the task, etc. The audit task announcement published by the IoT device is for each fog node. Idle or interested fog nodes, i.e., target fog nodes, can connect and communicate with the IoT device based on the audit task announcement. The target fog node obtains the delegation key required to process the task in the audit task announcement through negotiation with the IoT device. In this embodiment, only authorized fog nodes can process specific data tasks.

[0063] In step 204, the IoT device determines the original data to be uploaded, divides the original data into blocks and partitions to obtain each data area, generates an MLE key using MLE technology, and uses the MLE key to encrypt each data area using the AES algorithm to obtain the encrypted data area. At the same time, a ciphertext hash value is generated based on the encrypted overall file and sent to the target fog node together with the data area set.

[0064] Among them, the IoT device needs to upload the data to the designated fog node for preliminary processing. In the initial data upload stage, the IoT device can first divide the original data to be uploaded into blocks and partitions, and then use the plaintext content of the partition area to generate the MLE key, and then use the AES algorithm to encrypt the plaintext, and send the encrypted data block to the fog node for subsequent deduplication processing and block label generation. In this embodiment, during the entire audit phase, the main task of the IoT device is to use the AES-256 algorithm to encrypt the original data using the generated MLE key, while the subsequent computationally heavy label calculation, deduplication and audit interaction do not need to participate. In other words, during the audit process, the local overhead of the IoT device is very low, and the subsequent IoT device can also remain offline.

[0065] Specifically, the IoT device can divide the original data it has into blocks and further partition each block to generate an MLE encryption key, and then use the MLE encryption key to encrypt each zone using the AES algorithm, and then transmit the encrypted zone set to the target fog node.

[0066] In one embodiment, a delegated audit management method for edge deduplication and privacy protection for the Internet of Things is provided, which may also include a data processing process, and the specific process includes: the Internet of Things device performs block processing on the original data to obtain the block-based original data; partitions the original data after each block to obtain each data area; the Internet of Things device generates an MLE key based on each data area, and uses the MLE key to use the AES algorithm to encrypt each data area into a ciphertext data area; the Internet of Things device calculates the ciphertext hash value of the ciphertext data file, and sends the ciphertext hash value and the encrypted ciphertext data area set to the target fog node.

[0067] In this embodiment, the IoT device Ds generates an MLE key to perform preliminary processing on the data, which is then transmitted to the fog node Fz for subsequent processing, including deduplication and generation of block labels, and then the processed data set is uploaded to the cloud server for storage.

[0068] For example, suppose the IoT device Ds holds the original data file M, and the IoT device Ds processes the data into blocks {m i} 1≤i≤n , and then partition each block into m i =(m i1 ,m i2 ,...,m ij ,...m iη ), where m ij ∈Z q *That is, each block has η areas and has the same size η|q|=|M| / n. If the length of the last block is shorter than that of other blocks, 0 is added to the end. To protect data privacy, the IoT device Ds generates the MLE key k based on the plaintext. ij =H3(m ij ), and use the generated MLE key k ij Encrypt the plaintext into ciphertext C = {c ij} 1≤i≤,1≤j≤η =AES.Enc(k ij ,m ij ), where AES.Enc(k ij ,m ij ) refers to the AES-256 algorithm using the key k ij Encrypt each area to get the ciphertext c ij ; H3:{0,1} * →{0,1} 256 Used for the generation of MLE keys. The purpose of this process is that no one except the IoT device that has the original plaintext can generate the corresponding encryption key, so it is impossible to infer the plaintext from the ciphertext, ensuring that data privacy will not be leaked. At the same time, the IoT device Ds calculates the hash H(C) of the entire ciphertext file, and the IoT device Ds transmits the ciphertext set C and H(C) to the target fog node Fz.

[0069] In step 206, the target fog node checks the consistency between the ciphertext and the ciphertext hash value. After the check is passed, the ciphertext hash value is compared with the stored hash value to remove duplicate files. If there is no duplication, the delegate key is used to generate a block label based on the encrypted data block, and the block label is compared with the stored block label to remove duplicate data blocks. The target fog node uses the private key to generate a file identifier based on the ciphertext hash value.

[0070] In one embodiment, a provided delegated audit management method for edge deduplication and privacy protection for the Internet of Things may also include a process of inspection and verification by a target fog node, the specific process including: the target fog node checks the consistency between the ciphertext and the ciphertext hash value to obtain an inspection result; if the inspection result is consistent, the file hash value is compared with the locally stored file hash value to remove duplicate files; if there is no duplication, a block label is generated based on the encrypted data block using a delegated key, the block label is compared with the stored block label, and the duplicate data block is removed; the target fog node generates a file identifier based on the ciphertext hash value using a private key.

[0071] The target fog node Fz checks the consistency between the ciphertext file and the ciphertext hash value. If they are inconsistent, it will refuse to process and notify the IoT device Ds. Otherwise, it will perform further processing and compare H(C) with the hash value of the file stored locally. If they are repeated, it will ignore this processing request and notify the IoT device that the file is repeated; otherwise, it will select two random coefficients. A random variable and n random variables And calculate n values: Then further calculate the block label for the data block Among them, sk s,z represents the entrusted key, c ij is the encrypted data area, H is a homomorphic hash function H:{0,1} * →G1. Although each data block is further partitioned in the previous stage, a block label is still calculated for each block based on the data block, which can reduce the number of block labels to 1 / η of the number of block labels in the non-blocking scheme to save storage space. At the same time, the target fog node Fz uses its own private key sk z Generate a file identifier Finally, the target fog node Fz will take the data set {C,Ω={σ i} 1≤i≤n ,Τ} is uploaded to the cloud server, and H(C) and the block label collection Ω are saved locally for edge duplication check. If the IoT device Ds uploads data later, the target fog node Fz will remove duplicate data based on the stored ciphertext hash value and block label to ensure that redundant data will not be forwarded to the cloud server for storage, which can prevent bandwidth occupation on the one hand and save cloud storage space costs on the other.

[0072] In step 208, the target fog node uploads the data area set, file identifier, and block tag to the cloud server for storage, and stores the corresponding relationship between the target fog node and the IoT device in the blockchain.

[0073] Among them, the cloud server (CSS) as a resource center has powerful computing and storage capabilities. Its main responsibility is to store and manage uploaded data, respond to random challenges initiated by target fog nodes, and ensure the integrity of cloud storage data.

[0074] The target fog node acts as an intermediary node between the IoT device and the cloud server. The target fog node is responsible for receiving data from the IoT device, processing it and transmitting it to the cloud server for final storage. In the data upload stage, it is mainly responsible for deduplication and block label calculation of the data uploaded by the IoT device.

[0075] In this embodiment, the target fog node receives the ciphertext hash value and compares it with the previously stored ciphertext hash value to remove duplicate files. If there is no duplication, the delegate key is used to generate a block label based on the encrypted data block, and the block label is compared with the stored block label to obtain the comparison result; the purpose is to remove duplicate data blocks and use its own private key to generate a file identifier based on the ciphertext hash value. After the processing is completed, the target fog node uploads the data set (including the data area set, file representation and block label) to the cloud storage, and stores the auxiliary information, that is, the corresponding relationship between the IoT device and the target fog node on the blockchain, and saves the hash value of the ciphertext file and the block label locally for subsequent upload of file-level and block-level data deduplication. After receiving the data set, the cloud server can perform a consistency check on the file label and the ciphertext data. If it fails, the cloud server refuses to store and notifies the target fog node to upload the correct data set; if it passes, the cloud server can perform a duplicate file check based on the file label, and if it fails, notify the target fog node that the file is duplicated; if it passes, the ciphertext, the corresponding block label and the file identifier are stored.

[0076] In one embodiment, a delegated audit management method for edge deduplication and privacy protection for the Internet of Things is provided, which may also include a process in which a cloud server performs a deduplication operation. The specific process includes: the cloud server checks the consistency between the data area and the file identifier. If they are consistent, the cloud server stores the data area, file identifier, and block label; the cloud server compares the file identifier with a pre-stored file identifier, and deletes duplicates of the same data files uploaded by the same target fog node.

[0077] The cloud server CSS passes the judgment Verify the consistency of the uploaded data block and the corresponding file identifier, where T is the previously generated file identifier, g is the generator of the multiplication cyclic group G1 of order q selected by PKG at the initial stage of the system, C represents the ciphertext file, and AID z Represents the anonymous identity of the device, X is the system public key X = g x ,in is the system private key selected during the system initialization phase, e is a computable bilinear pairing e:G1×G1→G2, G1 and G2 are two multiplication cyclic groups of order large prime number q, and H2 is a cryptographic hash function If the verification is successful, the cloud server will store the data information; otherwise, the cloud server refuses to store it. The purpose of this check is to prevent other non-trusted entities from posing as trustee fog nodes to upload data to occupy cloud resources. The cloud server can choose to compare the file identifier Τ with the stored file identifiers, and can delete the same files uploaded by the same fog node to achieve file-level deduplication. At the same time, it can further perform block-level deduplication based on the uploaded block tags.

[0078] In step 210, the target fog node generates a random challenge based on the audit task announcement and sends it to the cloud server. The cloud server generates proof data based on the random challenge and sends it to the target fog node for validity verification. If the verification passes, the target fog node believes that the cloud server has correctly stored the uploaded data, and creates an audit log and uploads it to the blockchain for the IoT device to view.

[0079] During the audit interaction between the target fog node and the IoT device, the target fog node Fz generates a random challenge Q and sends it to the cloud server. The cloud server generates evidence P based on Q and sends it back to the target fog node Fz for verification. If the verification passes, the audit log corresponding to "success" will be stored on the blockchain, otherwise it will immediately notify the IoT device. Once the data is damaged, the device as the data owner needs to know immediately for subsequent processing.

[0080] For each round of periodic integrity audit, the target fog node Fz generates a random challenge I c is a set of c integers randomly selected from the set of integers [1,n], and is a randomly selected value; the target fog node Fz sends the random challenge Q to the cloud server.

[0081] When receiving the challenge Q, the cloud server generates data evidence μ according to the formula j =∑ i∈Q v i c ij With label evidence To form a completeness proof P = {μ, ρ}, where μ = {μ j} 1≤j≤η Finally, the cloud server returns the proof P to the target fog node Fz. The target fog node Fz verifies the formula To verify the validity of P, in Randomly select a value for Ds, H2 is a cryptographic hash function AID S is the anonymous identity of the device, ω∈{0,1} *is the audit task announcement. In order to speed up the calculation process, the target fog node Fz can pre-calculate the values ​​of Λ, Ε, Γ; if the above equation is true, the target fog node Fz believes that the cloud server has correctly stored the uploaded data; otherwise, the target fog node Fz believes that the cloud server has not honestly stored the uploaded file. Subsequently, the target fog node Fz creates an audit log {Τ, {Q, μ, ρ}} and uploads the log to the blockchain for storage. Assuming that at the end of a task cycle, the target fog node Fz has completed κ audits, then the target fog node Fz will record the log as {Τ, {Q k ,{μ k ,ρ k},b k} 1≤k≤κ}, where {Q k ,{μ k ,ρ k},b k} respectively represent the random challenge, related proof and audit result of the k-th audit.

[0082] In the audit phase, the target fog node undertakes the audit task entrusted by the device and interacts with the cloud server during the data audit process. After the audit task is completed, the target fog node can receive corresponding rewards for the audit task performed.

[0083] When auditing cloud data, the target fog node generates a random challenge and sends it to the cloud server. After receiving the challenge, the cloud server generates the corresponding evidence and returns it to the target fog node. The target fog node then determines the integrity of the cloud data by verifying the validity of the evidence. If the verification is successful, the target fog node stores the audit log corresponding to "success" on the blockchain, otherwise it will immediately notify the IoT device.

[0084] When the IoT device receives the audit result, it retrieves the corresponding auxiliary information from the blockchain to determine the correctness of the received result. If the audit result is confirmed to be correct and the identity information provided by the target fog node is verified, the blockchain will issue the reward related to the specified task to the target fog node.

[0085] In one embodiment, a delegated audit management method for edge deduplication and privacy protection for the Internet of Things may also include a process for checking the audit results. The specific process includes: after the Internet of Things device receives the audit log, it randomly extracts the target audit result from the blockchain for inspection to obtain the inspection result.

[0086] Specifically, in one embodiment, when all the audit results of random checks are true, the target fog node provides the second corresponding private key to the blockchain administrator; the blockchain administrator retrieves and extracts the second anonymous identity corresponding to the audit task announcement based on the second corresponding private key, and performs a consistency check on the second corresponding private key and the second anonymous identity. After the check is passed, the remuneration stored in the blockchain account of the IoT device is paid to the blockchain account of the target fog node.

[0087] When the IoT device receives the audit result, it retrieves the corresponding auxiliary information from the blockchain to determine the correctness of the received result. If the audit result is confirmed to be correct and the identity information provided by the target fog node is verified, the blockchain will issue the reward related to the specified task to the target fog node.

[0088] When receiving the information that the audit is completed, the IoT device Ds can check the results of any audit during the task. Assuming that it wants to check the k-th audit, the IoT device Ds will extract {Q k ,{μ k ,ρ k},b k} Conduct inspection and public announcement If the audit result is consistent with the expectation, the IoT device Ds considers the audit result returned by the target fog node Fz to be true. Only when all audit results are verified to be true will the IoT device Ds pay the corresponding reward to the designated target fog node Fz. Of course, the device does not need to check all logs, and can use random sampling to conduct spot checks.

[0089] After the audit is verified to be true, the target fog node Fz provides its private key sk to the blockchain administrator z As proof of identity, the blockchain administrator retrieves the corresponding {ω, AIDs, AIDz} and takes out AIDz to check Among them sk z is the device private key, X is the system public key, and H2 is the cryptographic hash function AID z is the anonymous identity of the device. If the equation holds, the money in the blockchain account of the IoT device Ds is transferred to the account of the target fog node Fz. According to the private key generation mechanism described previously, it can be clearly seen that except for the trusted PKG (private key generator) in the model, no other entity can forge the identity of the target fog node Fz to receive the reward. This is because the attacker cannot generate the corresponding fog node private key, thus realizing the function of preventing entities from impersonating and receiving rewards.

[0090] In one embodiment, a provided delegated audit management method for edge deduplication and privacy protection for the Internet of Things may also include a process of generating a key, and the specific process includes: a key generation center selects a system private key, calculates a system public key based on the system private key and makes it public; an Internet of Things device sends a first identity identifier to the key generation center, and the key generation center calculates a first anonymous identity and a first corresponding private key based on the first identity identifier and sends them to the Internet of Things device; the Internet of Things device performs consistency verification on the first anonymous identity and the first corresponding private key, and if the verification passes, the Internet of Things device accepts the first anonymous identity and the first corresponding private key; the fog node sends a second identity identifier to the key generation center, and the key generation center calculates a second anonymous identity and a second corresponding private key based on the second identity identifier and sends them to the fog node; the fog node performs consistency verification on the second anonymous identity and the second corresponding private key, and if the verification passes, the fog node accepts the second anonymous identity and the second corresponding private key; the blockchain manager initializes the blockchain system, and the cloud server, the Internet of Things device, and the fog node respectively register blockchain accounts and perform pre-storage operations.

[0091] Among them, the Private Key Generator (PKG) acts as a trusted third party to generate keys for relevant parties based on the specified identity information, and is responsible for generating system public parameters during the system initialization phase. Specifically, the trusted key generation center generates necessary parameters for the entire system, including the private keys, anonymous identities, and system public parameters of the participating entities. The key generation center distributes the private keys and corresponding anonymous identities to each participating entity through a secure communication channel to ensure the confidentiality and security of the private keys. At the same time, the blockchain manager BM is responsible for initializing the blockchain system, and the IoT devices, CSS, and fog nodes register blockchain accounts and pre-deposit amounts to support subsequent transactions. Among them, the blockchain manager BM is responsible for the initialization of the blockchain system, which consists of a series of network nodes, including IoT devices, cloud servers, and fog nodes.

[0092] In this embodiment, a delegated audit management method for edge deduplication and privacy protection for the Internet of Things is provided, which can be implemented between multiple IoT devices (a total of S devices), multiple fog nodes (a total of L fog nodes), a key generation center, and a cloud server. For ease of description, in this embodiment, only the interaction between a certain IoT device Ds and a certain fog node Fz participating in the audit model is discussed.

[0093] In one embodiment, during the system initialization process, PKG generates necessary parameters, the IoT device and the target fog node interact with the key generation center to obtain their first anonymous identity and the first corresponding private key, and at the same time, the blockchain administrator initializes the blockchain system, and the IoT device, the cloud server and the target fog node register the blockchain account and pre-deposit the amount to support subsequent transactions.

[0094] The key generation center selects two multiplicative cyclic groups G1 and G2 of order q and a computable bilinear pairing e:G1×G1→G2, where q is a large prime number; selects four cryptographic hash functions H3:{0,1} * →{0,1} 256 ,H:{0,1} * →G1; where H is a homomorphic hash function, H3 is used to generate the MLE key; the key generation center selects As the system private key, and calculate the system public key X = g x ; Finally, the key generation center announces the system public parameters params = {G1, G2, q, e, H1, H2, H3, H, X}, and the private key x is secretly kept by PKG.

[0095] The IoT device Ds sends the first identity ID to the key generation center s When receiving the first identity IDs, the key generation center randomly selects a value And calculate Then the key generation center calculates the first anonymous identity AID s =r s +xH1(ID s ,R s )modq and the first corresponding private key sk s = xH2(AID s )modq; Finally, the key generation center sends {AID s ,sk s}Sent to IoT device Ds; IoT device Ds passes verification To check AIDs and sk s If the verification is successful, the IoT device Ds accepts {AID s ,sk s} is the first anonymous identity and the first corresponding private key; otherwise, the IoT device Ds initiates a request to the key generation center again.

[0096] Similarly, the target fog node Fz sends the second identity ID to the key generation center z , the key generation center randomly selects a value And calculate And calculate the second anonymous identity AID for the target fog node Fz z =r z +xH1(ID z ,R z )modq and the second corresponding private key sk z = xH2(AIDz )modq, the second anonymous identity and the second corresponding private key consistency received by the target fog node Fz are verified: If the verification is successful, the target fog node Fz receives {AID z ,sk z} is the second anonymous identity and the second corresponding private key. Otherwise, the target fog node Fz initiates a request to the key generation center again.

[0097] The blockchain administrator can initialize the blockchain system, and the IoT device Ds, cloud server CSS and target fog node Fz register their respective blockchain accounts and pre-deposit amounts to support subsequent transactions.

[0098] In one embodiment, a delegated audit management method for edge deduplication and privacy protection for the Internet of Things is provided, which may also include a process for generating a delegation key, and the specific process includes: the Internet of Things device creates and publishes an audit task announcement corresponding to a first anonymous identity, and based on the audit task announcement, uses an idle node in each fog node as a target fog node; the Internet of Things device sends delegation information to the target fog node, and the target fog node verifies the validity of the delegation information, and after the verification is passed, accepts the delegation information and obtains the delegation key; the target fog node sends the second anonymous identity to the Internet of Things device, and the Internet of Things device uploads the audit task announcement, the first anonymous identity, and the second anonymous identity to the blockchain.

[0099] After the IoT device Ds publishes the audit task announcement, the target fog node Fz with idle resources negotiates with the IoT device Ds for the later audit-ready delegated key, thereby determining the generated delegated key sk s,z .

[0100] Specifically, in this embodiment, the IoT device Ds creates and publishes its first anonymous identity AID s and the audit task announcement ω∈{0,1} related to the original file M it owns * , the announcement can contain file size, task deadline, task reward amount, etc. If a target fog node Fz has idle resources and expects to accept the task, the target fog node Fz interacts with the IoT device Ds to negotiate the delegation key sk s,z .

[0101] IoT device Ds randomly selects a value And calculate and sk s,z =v s,z +sk s H1(ω,V s,z )modq. Then the IoT device Ds will delegate the information DI = {ω,V s,z ,sk s,z} is sent to the target fog node Fz.

[0102] The target fog node Fz passes the inspection The validity of the delegation information DI is verified by checking whether the verification fails. If the verification fails, the target fog node Fz rejects the information and notifies the IoT device Ds. Otherwise, the target fog node Fz accepts the information DI and saves the delegation key sk s,z , and inform the AID z Sent to IoT device Ds. IoT device Ds sends {ω,AID s ,AID z}Upload to blockchain for storage.

[0103] In a delegated audit management method for edge deduplication and privacy protection for the Internet of Things in the present application, the Internet of Things device can specify a fog node to interact with the cloud server for data auditing without personal participation, which effectively reduces the computing burden of the device. In addition, the Internet of Things device does not need to generate block labels for data blocks, which effectively reduces the overhead of the local device. Efficient deduplication of data at the edge level is achieved. The fog node ensures that duplicate files and duplicate data blocks are not processed repeatedly through file identification and block label comparison, saving bandwidth from the edge to the cloud and saving storage space required for the cloud. The Internet of Things device uses an MLE key to encrypt the plaintext, and the generated MLE key depends on the hash of the plaintext, that is, except for the Internet of Things device itself, other entities cannot generate the correct MLE key to decrypt the plaintext. Even if the data is illegally intercepted, the plain text cannot be restored; in terms of identity privacy protection, IoT devices use anonymous technology to ensure that data blocks do not expose the true identity of devices and fog nodes during transmission and auditing. In this way, attackers cannot directly associate audit data with specific IoT devices and corresponding fog nodes, thereby protecting the identity security of devices and fog nodes; a blockchain-based incentive mechanism is designed to automatically release rewards based on the work performance of fog nodes. After each fog node completes the data audit task and its identity is verified, the blockchain will distribute the reward to the fog node's account, ensuring the fairness of the incentive; an identity authentication mechanism is embedded in the log review stage. The reward can only be released when the fog node's identity is verified to be authentic and the task is completed. If there is any fraud, the blockchain will lock the reward to protect the interests of IoT devices from infringement.

[0104] It should be understood that, although the various steps in the above-mentioned flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flow chart may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0105] In one embodiment, Figure 1 , Figure 3 As shown, a delegated audit management system for edge deduplication and privacy protection for the Internet of Things is provided, including: an Internet of Things device 110, a fog node 120, and a cloud server 130; the Internet of Things device 110 is connected to communicate with the fog node 120 and the cloud server 130 respectively, and the fog node 120 is connected to communicate with the cloud server 130; wherein:

[0106] The IoT device 110 is used to publish an audit task announcement to each fog node 120, determine a target fog node 120 from each fog node 120, and the target fog node 120 obtains a delegation key by negotiating with the IoT device 110;

[0107] The IoT device 110 is also used to determine the original data to be uploaded, perform block and partition processing on the original data to obtain each data area, generate an MLE key using the MLE technology, and use the MLE key to encrypt each data area using the AES algorithm to obtain an encrypted data area set, and generate a ciphertext hash value based on the encrypted overall file, and send it together with the data area set to the target fog node 120;

[0108] The target fog node 120 checks the consistency between the ciphertext and the ciphertext hash value. After the check is passed, the ciphertext hash value is compared with the stored hash value to remove duplicate files. If there is no duplication, the delegate key is used to generate a block label based on the encrypted data block, and the block label is compared with the stored block label to remove duplicate data blocks. The target fog node uses the private key to generate a file identifier based on the ciphertext hash value.

[0109] The target fog node 120 is also used to upload the data area set, file identification, and block label to the cloud server 130 for storage, and store the corresponding relationship between the target fog node 120 and the IoT device 110 in the blockchain;

[0110] The target fog node 120 is also used to generate a random challenge based on the audit task announcement and send it to the cloud server 130. The cloud server 130 generates proof data based on the random challenge and sends it to the target fog node 120 for validity verification. If the verification passes, the target fog node 120 believes that the cloud server 130 has correctly stored the uploaded data, and creates an audit log and uploads it to the blockchain for the IoT device 110 to view.

[0111] In one embodiment, a delegated audit management system for edge deduplication and privacy protection for the Internet of Things may also include a key generation center and a blockchain manager; wherein:

[0112] The key generation center is used to select the system private key, calculate the system public key based on the system private key and make it public;

[0113] The Internet of Things device 110 is further used to send the first identity identifier to the key generation center, and the key generation center calculates the first anonymous identity and the first corresponding private key according to the first identity identifier and sends them to the Internet of Things device 110;

[0114] The IoT device 110 is further used to perform consistency verification on the first anonymous identity and the first corresponding private key. If the verification is successful, the IoT device 110 accepts the first anonymous identity and the first corresponding private key;

[0115] The fog node 120 is further configured to send a second identity identifier to the key generation center, and the key generation center calculates a second anonymous identity and a second corresponding private key according to the second identity identifier and sends them to the fog node 120;

[0116] The fog node 120 is further used to perform consistency verification on the second anonymous identity and the second corresponding private key. If the verification is successful, the fog node 120 accepts the second anonymous identity and the second corresponding private key;

[0117] The blockchain administrator is used to initialize the blockchain system, and the key generation center, the IoT device 110, and the fog node 120 respectively register blockchain accounts and perform pre-storage operations.

[0118] In one embodiment, Figure 3 As shown, a delegated audit management system for edge deduplication and privacy protection for the Internet of Things may include an Internet of Things device 110, a fog node 120, a cloud server 130, a key generation center 140, and a blockchain manager 150. Among them:

[0119] IoT device 110 (Device, D): IoT device 110 needs to upload data to fog node 120 for preliminary processing. In the initial data upload stage, IoT device 110 first divides the data into blocks and partitions, and then needs to use the plaintext content of the partitioned area to generate MLE keys, and then encrypt the plaintext using the AES algorithm, and send the encrypted data to fog node 120 for subsequent deduplication processing and block label generation. During the entire audit phase, the main task of IoT device 110 is to encrypt the initial data using the AES-256 algorithm, while subsequent computationally heavy label calculations, deduplication, and audit interactions do not need to be involved. In other words, during the audit process, the local overhead of IoT device 110 is very low, and subsequent devices can also remain offline.

[0120] Cloud Server 130 (CSS): As a resource center, the cloud server 130 has powerful computing and storage capabilities. Its main responsibilities are to store and manage uploaded data, respond to random challenges initiated by fog nodes 120, and ensure the integrity of cloud storage data.

[0121] Fog node 120 (Fog node, F): As an intermediary node between the IoT device 110 and the cloud server 130, the fog node 120 is responsible for receiving data from the IoT device 110, and transmitting the data to the cloud server 130 after processing for final storage. In the data upload stage, it is mainly responsible for deduplication and block label calculation of the data uploaded by the IoT device 110. In the audit stage, the fog node 120 undertakes the audit task entrusted by the device and interacts with the CSS during the data audit process. After the audit task is completed, the fog node 120 can obtain corresponding rewards for the audit task performed.

[0122] Key Generation Center 140 (Private Key Generator, PKG): As a trusted third party, the Key Generation Center 140 generates keys for relevant parties according to the specified identity information and is responsible for generating system public parameters during the system initialization phase.

[0123] Blockchain manager 150 (BM): responsible for the initialization of the blockchain system, which is composed of a series of network nodes, including IoT devices 110, cloud servers 130, and fog nodes 120. In this embodiment, the blockchain manager 150BM can represent the entire blockchain system.

[0124] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0125] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0126] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A delegated audit management method for edge deduplication and privacy protection for the Internet of Things, characterized in that: The method comprises: The IoT device publishes an audit task announcement to each fog node, determines a target fog node from each fog node, and the target fog node obtains a delegation key by negotiating with the IoT device; The IoT device determines the original data to be uploaded, performs block and partition processing on the original data to obtain various data areas, generates an MLE key using the MLE technology, and uses the MLE key to encrypt each of the data areas using the AES algorithm to obtain an encrypted data area set, and generates a ciphertext hash value based on the encrypted overall file, and sends it together with the data area set to the target fog node; The target fog node checks the consistency between the ciphertext and the ciphertext hash value, and after the check is passed, compares the ciphertext hash value with the stored hash value to remove duplicate files. If there is no duplication, the delegate key is used to generate a block label based on the encrypted data block, and the block label is compared with the stored block label to remove the duplicate data block. The target fog node uses the private key to generate a file identifier based on the ciphertext hash value; The target fog node uploads the data area set, file identifier, and block tag to the cloud server for storage, and stores the corresponding relationship between the target fog node and the IoT device in the blockchain; The target fog node generates a random challenge based on the audit task announcement and sends it to the cloud server. The cloud server generates integrity proof data based on the random challenge and sends it to the target fog node for validity verification. If the verification passes, the target fog node believes that the cloud server has correctly stored the uploaded data, and creates an audit log and uploads it to the blockchain for the IoT device to view.

2. The method for entrusted audit management for edge deduplication and privacy protection for the Internet of Things according to claim 1 is characterized in that: The method further comprises: The key generation center selects a system private key, calculates a system public key based on the system private key and makes it public; The Internet of Things device sends a first identity identifier to the key generation center, and the key generation center calculates a first anonymous identity and a first corresponding private key according to the first identity identifier and sends them to the Internet of Things device; The IoT device performs consistency verification on the first anonymous identity and the first corresponding private key. If the verification is successful, the IoT device accepts the first anonymous identity and the first corresponding private key; The fog node sends a second identity identifier to the key generation center, and the key generation center calculates a second anonymous identity and a second corresponding private key according to the second identity identifier and sends them to the fog node; The fog node performs consistency verification on the second anonymous identity and the second corresponding private key. If the verification passes, the fog node accepts the second anonymous identity and the second corresponding private key; The blockchain administrator initializes the blockchain system, and the cloud server, IoT device, and fog node respectively register blockchain accounts and perform pre-storage operations.

3. The method for entrusted audit management for edge deduplication and privacy protection for the Internet of Things according to claim 2 is characterized in that: The IoT device publishes an audit task announcement to each fog node, determines a target fog node from each fog node, and the target fog node obtains a delegation key by negotiating with the IoT device, including: The IoT device creates and publishes an audit task announcement corresponding to the first anonymous identity, and uses an idle node in each of the fog nodes as a target fog node based on the audit task announcement; The IoT device sends the delegation information to the target fog node, and the target fog node verifies the validity of the delegation information. After the verification is passed, the target fog node accepts the delegation information and obtains the delegation key. The target fog node sends the second anonymous identity to the IoT device, and the IoT device uploads the audit task announcement, the first anonymous identity, and the second anonymous identity to the blockchain.

4. The method for entrusted audit management for edge deduplication and privacy protection for the Internet of Things according to claim 2 is characterized in that: The method further comprises: After receiving the audit log, the IoT device randomly extracts a target audit result from the blockchain for inspection to obtain an inspection result.

5. The method for entrusted audit management for edge deduplication and privacy protection for the Internet of Things according to claim 4 is characterized in that: The method further comprises: When all the audit results of the random checks are true, the target fog node provides the second corresponding private key to the blockchain administrator; The blockchain administrator retrieves and extracts the second anonymous identity corresponding to the audit task announcement based on the second corresponding private key, performs a consistency check on the second corresponding private key and the second anonymous identity, and if the check is qualified, pays the remuneration stored in the blockchain account of the IoT device to the blockchain account of the target fog node.

6. The method for entrusted audit management for edge deduplication and privacy protection for the Internet of Things according to claim 1 is characterized in that: The IoT device determines the original data to be uploaded, performs block and partition processing on the original data to obtain each data area, generates an MLE key using the MLE technology, and uses the MLE key to encrypt each data area using the AES algorithm to obtain the encrypted data area, and generates a ciphertext hash value based on the encrypted overall file, and sends it together with the data area set to the target fog node, including: The IoT device processes the original data in blocks to obtain the original data after blocks; Partition processing is performed on each of the divided original data to obtain each data area; The IoT device generates an MLE key based on each of the data areas, and uses the MLE key to encrypt each of the data areas into a ciphertext data area using the AES algorithm; The IoT device calculates the ciphertext hash value of the ciphertext data file, and sends the ciphertext hash value and the encrypted ciphertext data area set to the target fog node.

7. The method for entrusted audit management for edge deduplication and privacy protection for the Internet of Things according to claim 6 is characterized in that: The target fog node checks the consistency between the ciphertext and the ciphertext hash value, compares the ciphertext hash value with the stored hash value to remove duplicate files after the check, and if there is no duplication, generates a block label based on the encrypted data block using the delegate key, compares the block label with the stored block label, removes the duplicate data block, and the target fog node generates a file identifier based on the ciphertext hash value using the private key, including: The target fog node checks the consistency between the ciphertext and the ciphertext hash value to obtain a check result; If the check result is consistent, the file hash value is compared with the locally stored file hash value to remove duplicate files; If there is no duplication, generating a block tag based on the encrypted data block using the entrusted key, comparing the block tag with the stored block tag, and removing the duplicate data block; The target fog node generates a file identifier based on the ciphertext hash value using a private key.

8. The method for entrusted audit management for edge deduplication and privacy protection for the Internet of Things according to claim 1 is characterized in that: After the target fog node uploads the data area, file identifier, and block tag to the cloud server for storage, and stores the corresponding relationship between the target fog node and the IoT device in the blockchain, the method further includes: The cloud server checks the consistency between the data area and the file identifier, and if they are consistent, the cloud server stores the data area, the file identifier, and the block tag; The cloud server compares the file identifier with a pre-stored file identifier and deletes duplicates of the same data file uploaded by the same target fog node.

9. A delegated audit management system for edge deduplication and privacy protection for the Internet of Things, characterized in that: The system comprises: an Internet of Things device, a fog node, and a cloud server; the Internet of Things device is connected and communicated with the fog node and the cloud server respectively, and the fog node is connected and communicated with the cloud server; wherein: The IoT device is used to publish an audit task announcement to each fog node, determine a target fog node from each fog node, and the target fog node obtains a delegation key by negotiating with the IoT device; The IoT device is also used to determine the original data to be uploaded, perform block and partition processing on the original data to obtain various data areas, generate an MLE key using the MLE technology, and use the MLE key to encrypt each of the data areas using the AES algorithm to obtain an encrypted data area set, and generate a ciphertext hash value based on the encrypted overall file, and send it together with the data area set to the target fog node; The target fog node checks the consistency between the ciphertext and the ciphertext hash value, compares the ciphertext hash value with the stored hash value to remove duplicate files after the check, and if there is no duplication, generates a block label based on the encrypted data block using the delegate key, compares the block label with the stored block label, removes duplicate data blocks, and the target fog node generates a file identifier based on the ciphertext hash value using a private key; The target fog node is further used to upload the data area set, file identifier, and block tag to the cloud server for storage, and store the corresponding relationship between the target fog node and the IoT device in the blockchain; The target fog node is also used to generate a random challenge according to the audit task announcement and send it to the cloud server. The cloud server generates proof data based on the random challenge and sends it to the target fog node for validity verification. If the verification passes, the target fog node believes that the cloud server has correctly stored the uploaded data, and creates an audit log and uploads it to the blockchain for the IoT device to view.

10. The edge deduplication and privacy protection entrusted audit management system for the Internet of Things according to claim 9, characterized in that: The system also includes: a key generation center and a blockchain manager; wherein: The key generation center is used to select a system private key, calculate a system public key based on the system private key and make it public; The Internet of Things device is further used to send a first identity identifier to the key generation center, and the key generation center calculates a first anonymous identity and a first corresponding private key according to the first identity identifier and sends them to the Internet of Things device; The IoT device is further used to perform consistency verification on the first anonymous identity and the first corresponding private key. If the verification is successful, the IoT device accepts the first anonymous identity and the first corresponding private key; The fog node is further configured to send a second identity identifier to the key generation center, and the key generation center calculates a second anonymous identity and a second corresponding private key according to the second identity identifier and sends them to the fog node; The fog node is further used to perform consistency verification on the second anonymous identity and the second corresponding private key. If the verification is successful, the fog node accepts the second anonymous identity and the second corresponding private key; The blockchain manager is used to initialize the blockchain system, and the key generation center, IoT device, and fog node respectively register blockchain accounts and perform pre-storage operations.

Images