Secure hierarchical repeating data processing method for edge-assisted cloud

Abstract

The invention discloses a secure hierarchical duplicated data deletion method for edge-assisted cloud. The method comprises the stages of system initialization, health data block security evaluation, health data encryption and uploading, health data deduplication and health data downloading. According to the method, different encryption strategies are adopted to implement hierarchical de-duplication according to the security level of health data, and the security level of a block is defined according to the correlation between the block and a user to measure the security demand of the user. According to the embodiment of the invention, the duplicate data deletion operation is issued to the edge node, the data transmission burden is reduced, and the search efficiency is improved by using the adaptive balanced binary tree to carry out duplicate removal label comparison. According to the method, the data items are encrypted by combining message locking encryption and convergence all-existence or all-absence transformation, so that the data security is enhanced. By providing ownership certificates, it is ensured that only authorized users can access specific data, and repeated forgery attacks are resisted.

Description

Technical Field

[0001] The present invention relates to the field of privacy data protection processing, and in particular to a secure layered duplicate data processing method for an edge-assisted cloud. Background Art

[0002] Digital health achieves the goals of disease prevention and medical cost reduction by combining the Internet of Things (IoT) and cloud technology. Modern medical devices can monitor the user's health status in real time and transmit the collected data to the cloud to ensure efficient storage and management of information. As a digital version of the user's health data, the storage, management and protection of the personal health record (PHR) are crucial to maintain user privacy and data security. Through in-depth analysis of these health data, medical staff can have a more comprehensive understanding of the user's health status and make more accurate medical decisions. Real-time monitoring enables medical professionals to detect potential health problems in a timely manner, implement personalized interventions, and provide high-quality care. At the same time, users can also obtain more intuitive health feedback through these data and actively participate in their own health management.

[0003] With the continuous development of digital health technology, this ecosystem not only optimizes the efficiency and quality of medical services, but also lays the foundation for personalized medicine in the future. Through effective health data management, we can achieve better disease prevention, health promotion and resource utilization, and promote the progress of the entire medical industry.

[0004] In the field of health data, since the same personal health records may be uploaded multiple times by different users or the same user, a large amount of redundant data will appear in cloud storage. Therefore, deduplication management can help cloud service providers (CSPs) greatly reduce storage costs and relieve storage pressure. Deduplication at the edge of the network significantly improves the communication efficiency of edge-assisted cloud storage systems. With the increasing concern about data privacy, secure deduplication has been proposed to provide data security while supporting deduplication. Summary of the invention

[0005] The purpose of the present invention is to overcome the shortcomings of the prior art and provide a secure layered deduplication method for edge-assisted cloud. In the field of health data, this solution aims to ensure efficient and secure deduplication, which is particularly suitable for edge nodes with limited resources. By transferring the duplicate work from the cloud to the edge server for execution, the traffic burden of the backbone network is significantly reduced. In addition, by encrypting the pre-deduplicated data from plaintext to ciphertext, we can improve storage efficiency and ensure data security.

[0006] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is: a secure hierarchical duplicate data processing method for edge-assisted cloud, the processing method includes implementing hierarchical deduplication according to the security level of health data, adopting different encryption strategies to implement hierarchical deduplication, defining the security level of blocks according to the correlation between blocks and users to measure the security needs of users, delegating the deduplication operation to edge nodes, and performing deduplication management by using AVL tree.

[0007] The method comprises an initialization step, the initialization step comprising:

[0008] Step 1-1: Initialize the system's public parameters PP = {q, P, G, G t ,e,H1,H2,f,π};

[0009] Step 1-2: The key server randomly selects x∈Z p * As the key, and calculate the public key V = αP, P is the generator of G;

[0010] Where q is a prime number, G and G t are two prime p-factorial cyclic groups, P is the generator of G, and e is a bilinear map: e(G,G)→G t , It is a group modulo q, with hash function H1: Used to generate long hashes, mapping binary strings of arbitrary length to Elements in; hash function H2: {0, 1} * →G t Used for convergent key generation, mapping binary strings of arbitrary length to G t Elements in; two pseudo-random functions f: and π: The definition of is to produce consistent challenge coefficients and block numbers.

[0011] The method includes a health data block security assessment step, and the health data block security assessment step includes:

[0012] Personal health records (PHR) are divided into text-based PHR and image-based PHR according to the file semantic information, using block-level deduplication and file-level deduplication respectively. The user inputs a health data file and outputs several blocks of variable length. The file is divided into multiple data blocks, and the security level of each data block is defined based on the sensitivity and importance of each data block. This is used to measure the protection needs of the data blocks and design corresponding encryption methods for different security levels.

[0013] The method also includes a data encryption and upload stage, in which the key manager is responsible for calculating the security level of each data block and assigning a corresponding encryption scheme to each data block, and completing the upload to the edge node after encryption is completed.

[0014] In the data encryption and upload stage, for files or file blocks with a lower security level, a double-layer encryption process is used to achieve efficient protection, and a hash function is used to calculate the hash value of the plaintext, ks i =H2(B i ),i=1,2,...,n, get the convergent key, use the convergent encryption to encrypt the data block to generate the data block ciphertext cc i =Enc(ks i ,B i ), (1<i<n), get the data block ciphertext set C i ={cc1,cc2,...,cc n}, ensuring data consistency and confidentiality, where ks i is the convergent key, Enc() is the convergent encryption function;

[0015] For each cc i Use it to encrypt, first generate the encryption key k i =H2(cc i ), and then generate a convergent all-or-nothing transform package (c i ,tr i ) where c i The ciphertext of the packet is called tr i It is called the tail of the packet; P means cc i The common blocks of the same size, E() represents a symmetric encryption scheme, represents XOR to prevent data leakage when the entire package is missing; the defined hash function generates the label t i =H1{c i}; The user retains a key set {k1, k2, ..., k i}, and change the label T a ={t1,t2,...,t n}Upload to the edge node.

[0016] The method also includes a health data deduplication stage:

[0017] Step 6-1: For each label t i Stored in the nodes of the AVL tree, the structure of the tree node is defined as: Node = (t i ,c i ,f i );

[0018] Step 6-2: Verify whether the label ti already exists in the AVL tree, and find the corresponding label position through the characteristics of the binary search tree;

[0019] Step 6-3: If the same label already exists in the AVL tree, the data item is considered to already exist, and the duplicate data is directly ignored, and only one copy is saved;

[0020] Step 6-4: If there is no matching label, the AVL tree inserts the new label into the tree and stores the corresponding unique copy;

[0021] Step 6-5: For scenarios with limited network bandwidth, edge nodes will periodically upload deduplicated data to the cloud. After receiving the uploaded data, the cloud will further deduplicate it to prevent multiple users or multiple edge nodes from uploading the same data block.

[0022] The method also includes a health data downloading phase, in which the downloading of health data by the user is controlled according to whether the user is the data owner.

[0023] For each data block ciphertext c in the health data F i ,i∈[1,n]

[0024] The edge server generates the authentication tag δ i =α(H1(i)+c i U) and store it; the user sends the tag set to the edge server. After receiving the request, the edge server verifies and confirms the ownership. The edge node checks whether the data tag uploaded by the area already exists in the index table to determine the data block set S of non-duplicate data blocks. f ,If the verification passes, the cloud server confirms that the user owns the data; otherwise it determines that the user is not the owner of the data.

[0025] When a user tries to download data, the edge node first checks whether the user is the owner of the data. If the user is not the owner of the data, the edge node will reject the request. If the user's identity is confirmed, the edge node will label the health data file T * After the user obtains the encrypted data from the cloud storage, the encrypted block is marked by the AONT variant (c i ,t) to decrypt and get the ciphertext cc of the block i ; Then, the user uses the known convergent key to ciphertext cc i Decrypt to obtain the original data block B i ; Since the original order of the data blocks has been recorded when the file is divided, the data block B is divided into i Reassemble into a complete file F and restore the original content of the file.

[0026] The system involved in the processing method includes four entities: user, edge server, cloud server, and key server;

[0027] The cloud service provider provides a centralized server for long-term data storage and retrieval services; manages all edge nodes within the system;

[0028] The edge server is an entity that provides storage services and lightweight computing tasks at the edge of the network. Each edge node is connected to the cloud and manages all users in a specific area.

[0029] The key server performs identity authentication for entities and manages the keys of each entity in the system;

[0030] The user is used to upload / download personal health data PHR to the cloud.

[0031] The advantages of the present invention are as follows: 1. The present invention implements layered deduplication according to the security level of health data, that is, the data is divided into different security levels, and different deduplication strategies are set for data at each security level. Different encryption methods are adopted for data with higher security levels and data with lower security levels to ensure that sensitive data is always fully protected during the deduplication process.

[0032] 2. According to different data characteristics, the text health data is processed at the block level, and the image data is processed at the file level, which ensures the flexibility and efficiency of the system and improves the transmission speed and system responsiveness. CDC automatically adjusts the block boundaries and flexibly handles local changes.

[0033] 3. Edge-based deduplication framework, where deduplication operations are performed directly by edge nodes, greatly reducing transmission pressure and reducing the burden on the cloud. Using AVL tree for deduplication can help manage metadata of data blocks to quickly detect and delete duplicate data, thereby improving storage efficiency.

[0034] 4. The key server receives the auxiliary information generated by the data block, uses the Count-Min Sketch technology to approximate the frequency estimate, calculates and determines the security level of the data block, and can also identify abnormal or sensitive data. This helps ensure that user privacy is protected during the deduplication process, so as to better balance security and personalized needs.

[0035] 5. Using AONT's variant scheme to perform convergent encryption and then encrypt the ciphertext can effectively improve data security because it protects data by introducing an additional encryption layer, while reducing dependence on the original data and enhancing the protection of data integrity. Proof of ownership is provided to ensure that only authorized users can access and use specific data and resist repeated forgery attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] The following is a brief description of the contents expressed in the drawings of the present invention and the symbols in the drawings:

[0037] Figure 1 Schematic diagram of the process of the present invention; System structure diagram

[0038] Figure 2 The figure is a structure diagram of the entity system involved in the method of the present invention. DETAILED DESCRIPTION

[0039] The specific implementation of the present invention will be further explained in detail below by describing the optimal embodiment with reference to the accompanying drawings.

[0040] The following is a further detailed description of the specific implementation of the present invention through the description of the optimal embodiment with reference to the accompanying drawings. In view of the data redundancy and privacy issues in health data sharing, a secure hierarchical deduplication method is proposed. Edge computing is used to assist cloud storage, which can reduce the burden on the cloud, respond in time, and reduce the delay of data transmission while ensuring data confidentiality. The Count-Min Sketch technology is introduced to estimate the frequency of elements by using a set of short hash values, thereby greatly reducing the required storage space and improving the processing speed. A self-balancing binary search tree is constructed to improve the deduplication efficiency. Data security is enhanced by combining the MLE scheme and the AONT variant scheme. Proposed proof of ownership suitable for this system to resist repeated forgery attacks. A secure hierarchical deduplication processing method for an edge-assisted cloud of this scheme includes implementing hierarchical deduplication according to the security level of health data using different encryption strategies, defining the security level of blocks according to the relevance of blocks to users to measure the security needs of users, delegating the deduplication operation to edge nodes, and performing deduplication management by using AVL trees.

[0041] The specific steps are as follows:

[0042] like Figure 1 As shown, a secure hierarchical data deduplication method for edge-assisted cloud includes four entities: a group of users, a group of edge servers, a cloud server, and a key server;

[0043] The cloud service provider provides a centralized server for long-term data storage and retrieval services; manages all edge nodes within the system;

[0044] The edge server is an entity that provides storage services and lightweight computing tasks at the edge of the network. Each edge node is connected to the cloud and manages all users in a specific area.

[0045] The key server performs identity authentication for entities and manages the keys of each entity in the system;

[0046] The user (patient) can upload / download personal health data (PHR) to the cloud; the user can be considered as an initial uploader or a subsequent uploader.

[0047] according to Figure 2 ,A secure hierarchical data deduplication method for edge assisted cloud includes system initialization, health data block security assessment, health data encryption and uploading, health data deduplication, and health data downloading stages.

[0048] Before explaining the system flow in detail, we first introduce the Count-Min Sketch solution. The specific steps are as follows:

[0049] (1) First, define the array dimensions: set the width w and depth d of CM-Sketch, and initialize a two-dimensional array counts with each element set to zero. This array will be used to store the frequency counts calculated by each hash function.

[0050] (2) Select hash function: Select d independent hash functions h j (mi), each hash function maps data block mi to a position in the counts array.

[0051] (3) Data Block Processing: When sending data blocks, the user sends each data block mi to the key manager. For each data block mi, d hash values ​​[h1(mi),h2(mi),...,h d (mi)].

[0052] (4) The key manager increases the value of the corresponding counter according to the hash value: j (mi), increment the count at the corresponding position of counts. At the same time, the key manager maintains a counter of the total number of blocks n, which increases by 1 each time a data block is received.

[0053] (5) Frequency estimation: To estimate the number of occurrences oi of a data block mi, the key manager takes the minimum value from the d corresponding counters: o i =min(counts[h1(m i )], counts[h2(m i )],...,counts[h d (m i )]).

[0054] The specific stages of this plan are:

[0055] 1. The system initialization phase includes:

[0056] Step 1-1: The key server uses the security parameter λ as input and generates a public parameter PP, PP = {q, P, G, G t ,e,H1,H2,f,π}. Where q is a prime number, G and G t are two q-order cyclic groups, P is the generator of G,

[0057] e is a bilinear mapping: e(G,G)→Gt. It is a group modulo q, with hash function H1: Used to generate long hashes, mapping binary strings of arbitrary length to Elements in, and hash function H2: {0, 1} * →G t Used for convergent key generation, mapping binary strings of arbitrary length to G t Elements in. Two pseudo-random functions f: and π: The purpose of the definition is to help users or servers generate consistent challenge coefficients and block numbers.

[0058] Step 1-2: Random server selection As the key, and calculate the public key V = αP, P is the generator of G, which will be used later to verify ownership.

[0059] 2. The health data block security assessment stage is specifically as follows:

[0060] Step 2-1: Personal health records (PHR) are divided into text-based PHR and image-based PHR according to file semantic information such as suffix name. The former uses data block-level deduplication, while the latter uses file-level deduplication. This paper focuses on a more fine-grained deduplication technology, namely data block-level deduplication, and this method is also applicable to file-level deduplication. For the user input health data file, several blocks of variable length are output (user's basic information, user's physical examination data, laboratory data, diagnosis records, etc.).

[0061] Health data content segmentation algorithm steps:

[0062] The sliding window size is set to w, and the length of the data block is between the preset minimum value d and the maximum value D. The sliding window slides byte by byte from the starting position of the health data file F. File F refers to a health data file containing patient information, diagnosis records, etc. The hash value f of each sliding window position is tested. Determine whether the block boundary condition is met. When the condition fmodD=d is met, it is identified as a block boundary and divided into a block, marked as B1. The window continues to slide and the above process is repeated until the entire file is divided into multiple data blocks B1...B n That is, F = {B1, B2, ..., Bn}

[0063] Step 2-2: In the security assessment of health data files, we divide the files into multiple data blocks and define the security level of each data block based on its sensitivity and importance to measure the protection needs of the data blocks. To implement the layered encryption strategy, we consider that the correlation between a data block and a user increases with its frequency of occurrence in a single user's data, but when the frequency of occurrence of a data block in the data of different users increases, its correlation decreases relatively. Therefore, designing corresponding encryption methods for different security levels can optimize storage efficiency while protecting data privacy and adapt to the sensitive data management needs in multi-user scenarios.

[0064] (1) For user u and block B i , user u has block B i We define the security level as:

[0065]

[0066] where f i u Indicates the user's internal frequency F i It is block B i The calculation of the frequency is relatively simple. For each data block Bi, the user can directly count the number of occurrences of a block in the uploaded file, that is, the frequency of occurrence of data block Bi in all the data of user u. The formula is as follows:

[0067]

[0068] N u Indicates the total number of data blocks owned by user u, n i，u Indicates the number of times a data block appears in user u.

[0069] (2) Inter-frequency refers to the frequency of occurrence of a data block among all users, that is, the cross-user frequency of the data block. The Count-Min Sketch (CM-Sketch) technique is used to estimate the frequency of each block B. i The frequency interval of the block is CM-Sketch instead of directly calculating the fingerprint of the block. This approximate counting not only protects the data block information from data leakage caused by the key manager, but also reduces the overhead of frequency counting. Since each short hash function has at most w values, which is much smaller than the value range of the fingerprint, multiple data blocks are mapped to the same short hash value, and the attacker cannot derive blocks from these short hashes. The key manager estimates the data block B through CM-Sketch iThe number of occurrences oi in the entire user set. CM-Sketch is a two-dimensional counting array with a size of w*d (w represents the number of hash functions and d represents the number of counting table columns). For each data block B i , using w independent hash functions h1,h2,…,h w The data block is mapped to d locations in CM-Sketch, and the key manager increments the counter corresponding to each mapping location in turn according to these hash values. The formula is as follows:

[0070] Count[j,h j (B i )]+1,j=1,2,...,w

[0071] Estimation data block B i The number of occurrences o i Use the minimum frequency and minimum count value of the corresponding position in the hash table in CMS:

[0072]

[0073] The frequency Fi between users of data block Bi is calculated by the following formula:

[0074]

[0075] Where n is the total number of data blocks, combined with intra-frequency and inter-frequency, using the formula Calculate the security level of the data block to determine the encryption and deduplication strategy. The security level of the data block is measured by the relevance of the data block to the user. The more times a data block appears in a single user, the stronger its relevance to the user; and the more times a data block appears in the entire user set, the weaker its relevance to the single user.

[0076] 3. Data encryption and upload stage

[0077] Step 3-1: The key manager is responsible for calculating the security level of each data block and assigning an appropriate encryption scheme to each data block. Specifically, the key manager first sets a security threshold. If the security level of a data block reaches or exceeds the threshold, it is classified as high-security level data and uses a standard symmetric encryption algorithm (such as AES) to ensure its confidentiality and integrity.

[0078] Step 3-2: If the data block belongs to a low security level, a two-layer encryption process is used to achieve efficient protection: In the first step, a hash function is used to calculate the hash value of the plaintext, ks i =H2(B i ),i=1,2,...,n, get the convergent key, use the convergent encryption to encrypt the data block to generate the data block ciphertext cci =Enc(ks i ,B i ), (1<i<n), get the data block ciphertext set C i ={cc1,cc2,...,cc n}, ensuring data consistency and confidentiality, where ks i is the convergent key, and Enc() is the convergent encryption function.

[0079] In the second step, the data block is converted into an indivisible encrypted packet by combining the convergent all-or-nothing conversion (AONT variant) algorithm. i Use it to encrypt, first generate the encryption key k i =H2(cc i ), and then generate a convergent all-or-nothing transform package (c i ,tr i ), where c i The ciphertext of the packet is called tr i It is called the tail of the packet. Specifically, P means cc i The common blocks of the same size, E() represents a symmetric encryption scheme, Indicates XOR. This prevents data leakage when the entire package is missing. This double-layer encryption method

[0080] The scheme can not only achieve deduplication of encrypted data blocks, but also provide effective privacy protection for deduplication data, optimize the utilization of storage resources, and achieve refined management of hierarchical encryption. The user generates a label t for the data block ciphertext using the previously defined hash function i =H1{c i}; The user retains a key set {k1, k2, ..., k i}, and change the label T a ={t1,t2,...,t n}Upload to edge node;

[0081] 4. Data deduplication stage

[0082] When a user is ready to upload a health data item to the cloud, the system will perform the following two processing steps: First, the user generates a unique label based on the encrypted data of the personal health record and uploads the label to the edge node in the corresponding area.

[0083] Step 4-1: If it is the initial uploader, that is, the edge node checks the label for duplication: if the label does not exist, the system will feedback to the user ηF=0 "upload complete data" instruction ηF represents the identifier of whether the data block ciphertext exists, prompting the user to upload the complete encrypted data item and execute step 3-1.

[0085] Step 4-2: If there is duplicate data for a subsequent uploader, the system returns an identifier ηF = 1 to the user, indicating that the user is a subsequent uploader. For edge nodes, storage record 1 stores user ownership and unique tags of files, and storage record 2 stores unique file tags and data block tags. After the edge server detects duplication, the edge node interacts with the user based on the results. The user only needs to add his or her ownership to the data owner list and does not need to upload data repeatedly. In order to prevent repeated forgery attacks, the user proves ownership of the data.

[0086] The specific steps to verify ownership are:

[0087] For each data block ciphertext c in the health data F i ,i∈[1,n], the algorithm generates the authentication tag δ according to the following equation. i =α(H1(i)+c i U) for storage. Randomly select U, is a coefficient, c i is the data block ciphertext, H1(i) is a hash function that provides a unique identifier for each data block, which is bound to the data block content and the random number. The user sends the tag set to the edge server. After receiving the request, the edge server verifies and confirms the ownership and randomly selects three random numbers l∈[1,n], Finite field, generate challenge set chal s ={l,a1,a2}, and send it to the user. The user is equivalent to the client and needs to generate the correct response information to prove its ownership of the data. By sending the challenge response, the challenge index and the corresponding coefficient are further calculated. f,π are two pseudo-random functions. Proof of user ciphertext block, calculation of verification value Send it to the edge server, the edge server receives the proof and parameters, and calculates the label Verify formula That is, to determine whether the two are equal, V = αP is the public key. If the verification is successful, it is confirmed that the client owns the file and is added to the owner list. The following is the correctness of the verification formula:

[0088]

[0089] This formula uses the properties of bilinear mapping to achieve secure and reliable verification of user file ownership, ensuring the security and integrity of data in the cloud storage system. Confirm that the client user owns the file, then the user uploads the corresponding non-repeated data block ciphertext, label, edge node updates the index table, edge node checks whether the data label uploaded by the region already exists in the index table to determine the data block set S of non-repeated data blocks.f The edge node will S f Sent to the cloud for further cloud-level duplicate detection. The cloud server updates the index table and stores the ciphertext of the data block.

[0090] Find the files or blocks that need to be deleted, so that the same files are only uploaded once, which greatly saves network bandwidth. Use balanced binary tree (AVL) to compare tags to ensure faster search speed and scalability, which helps to improve the overall index search efficiency of cloud service providers.

[0091] Tags are compared based on their hash values:

[0092] Each label is stored in a node of the AVL tree. The structure of the tree node can be defined as Node = (t i , c i , f i ), t i It is a data ciphertext label used to determine whether the data is repeated. i is the data ciphertext, f i It's the count.

[0093] The edge server receives the tag t sent by the user * After that, check whether the label already exists. First, find the root node label t1 of the AVL tree that stores the label. Then, check the equality of the received user label and the root node label. The result is represented by rs. The formula is as follows:

[0094]

[0095] If the label t * If it is equal to the current root node label t1, it means that the label already exists and the corresponding data block is repeated. Only one reference count f needs to be increased. i This means that each time the same data block is referenced, its reference count increases by f. i =f i +1, this will effectively identify duplicate data blocks;

[0096] For the label t * If the label t is not equal to the current label t1, there are two cases: the first case is that if the label t * If the label t1 is smaller than the current node, the search is performed along the left subtree of the current node. The second case is that if the label t *If the label t1 is greater than the label of the current node, then search along the right subtree of the current node. Based on this comparison rule, if the corresponding label exists, the relevant node can be efficiently located in the AVL tree. There is no need to actually store multiple copies, and it also avoids storing the ciphertext again. Continue this comparison and search process. If no equal label is found, a suitable leaf node position will eventually be found, and this position is the new label t * Where to insert.

[0097] Thanks to the characteristics of the AVL tree, our label storage structure is efficient in node insertion and deletion operations. In addition, neither the label comparison process nor the node update process requires the client to participate.

[0098] 5. Data downloading stage

[0099] When a user tries to download data, the edge node first checks whether the user is the owner of the data. If the user is not the owner of the data, the edge node will reject the request; if the user's identity is confirmed, the edge node will label the health data file T * After the user obtains the encrypted data from the cloud storage, the encrypted block is marked (c i ,t) to decrypt and get the ciphertext cc of the block i .

[0100] Next, the user uses the known convergent key to ciphertext cc i Decrypt to obtain the original data block B i Since the original order of the data blocks is recorded when the file is divided, the user can move the data blocks B i Reassemble into a complete file F and restore the original content of the file.

[0101] Description of the functions implemented by the present invention:

[0102] 1. The present invention implements layered deduplication according to the security level of health data, that is, the data is divided into different security levels, and different deduplication strategies are set for data at each security level. Different encryption methods are adopted for data with higher security levels and data with lower security levels to ensure that sensitive data is always fully protected during the deduplication process.

[0103] 2. According to different data characteristics, the text health data is processed at the block level, and the image data is processed at the file level, which ensures the flexibility and efficiency of the system and improves the transmission speed and system responsiveness. CDC automatically adjusts the block boundaries and flexibly handles local changes.

[0104] 3. Edge-based deduplication framework, where deduplication operations are performed directly by edge nodes, greatly reducing transmission pressure and reducing the burden on the cloud. Using AVL tree for deduplication can help manage metadata of data blocks to quickly detect and delete duplicate data, thereby improving storage efficiency.

[0105] 4. The key server receives the auxiliary information generated by the data block, uses the Count-Min Sketch technology to approximate the frequency estimate, calculates and determines the security level of the data block, and can also identify abnormal or sensitive data. This helps ensure that user privacy is protected during the deduplication process, so as to better balance security and personalized needs.

[0106] 5. Using AONT's variant scheme to perform convergent encryption and then encrypt the ciphertext can effectively improve data security because it protects data by introducing an additional encryption layer, while reducing dependence on the original data and enhancing the protection of data integrity. Proof of ownership is provided to ensure that only authorized users can access and use specific data and resist repeated forgery attacks.

[0107] Obviously, the specific implementation of the present invention is not limited to the above-mentioned methods. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, they are all within the protection scope of the present invention.

Claims

1. A secure layered duplicate data processing method for edge-assisted cloud, characterized by: The processing method includes implementing hierarchical deduplication by adopting different encryption strategies according to the security level of health data, defining the security level of blocks according to the relevance of blocks to users to measure the security needs of users, delegating the deduplication operation to edge nodes, and performing deduplication management by using AVL trees.

2. The secure layered duplicate data processing method of edge-assisted cloud according to claim 1, characterized in that: The method comprises an initialization step, the initialization step comprising: Step 1-1: Initialize the system's public parameters PP = {q, P, G, G t ,e,H1,H2,f,π}; Step 1-2: Key server random selection As the key, and calculate the public key V = αP, P is the generator of G; Where q is a prime number, G and G t are two prime p-factorial cyclic groups, P is the generator of G, and e is a bilinear map: e(G,G)→G t , is a group modulo q, the hash function Used to generate long hashes, mapping binary strings of arbitrary length to Elements in; hash function H2: {0, 1} * →G t Used for convergent key generation, mapping binary strings of arbitrary length to G t Elements in; two pseudo-random functions and The definition of is to produce consistent challenge coefficients and block numbers.

3. The secure layered duplicate data processing method of edge-assisted cloud according to claim 1, characterized in that: The method includes a health data block security assessment step, and the health data block security assessment step includes: Personal health records (PHR) are divided into text-based PHR and image-based PHR according to the file semantic information, using block-level deduplication and file-level deduplication respectively. The user inputs a health data file and outputs several blocks of variable length. The file is divided into multiple data blocks, and the security level of each data block is defined based on the sensitivity and importance of each data block. This is used to measure the protection needs of the data blocks and design corresponding encryption methods for different security levels.

4. The secure layered duplicate data processing method of edge-assisted cloud according to claim 3, characterized in that: The method also includes a data encryption and upload stage, in which the key manager is responsible for calculating the security level of each data block and assigning a corresponding encryption scheme to each data block, and completing the upload to the edge node after encryption is completed.

5. The secure layered duplicate data processing method of edge-assisted cloud according to claim 4, characterized in that: In the data encryption and upload stage, for files or file blocks with a lower security level, a double-layer encryption process is used to achieve efficient protection, and a hash function is used to calculate the hash value of the plaintext, ks i =H2(B i ),i=1,2,...,n, get the convergent key, use the convergent encryption to encrypt the data block to generate the data block ciphertext cc i =Enc(ks i ,B i ), (1<i<n), get the data block ciphertext set C i ={cc1,cc2,...,cc n }, ensuring data consistency and confidentiality, where ks i is the convergent key, Enc() is the convergent encryption function; For each cc i Use it to encrypt, first generate the encryption key k i =H2(cc i ), and then generate a convergent all-or-nothing transform package (c i ,tr i ), where c i The ciphertext of the packet is called tr i It is called the tail of the packet; P means cc i The common blocks of the same size, E() represents a symmetric encryption scheme, represents XOR to prevent data leakage when the entire package is missing; the defined hash function generates the label t i =H1{c i }; The user retains a key set {k1, k2, ..., k i }, and change the label T a ={t1,t2,...,t n }Upload to the edge node.

6. A secure layered duplicate data processing method for edge-assisted cloud according to claim 5, characterized in that: The method also includes a health data deduplication stage: Step 6-1: For each label t i Stored in the nodes of the AVL tree, the structure of the tree node is defined as: Node = (t i ,c i ,f i ); Step 6-2: Verify whether the label ti already exists in the AVL tree, and find the corresponding label position through the characteristics of the binary search tree; Step 6-3: If the same label already exists in the AVL tree, the data item is considered to already exist, and the duplicate data is directly ignored, and only one copy is saved; Step 6-4: If there is no matching label, the AVL tree inserts the new label into the tree and stores the corresponding unique copy; Step 6-5: For scenarios with limited network bandwidth, edge nodes will periodically upload deduplicated data to the cloud. After receiving the uploaded data, the cloud will further deduplicate it to prevent multiple users or multiple edge nodes from uploading the same data block.

7. A secure layered duplicate data processing method for edge-assisted cloud according to claim 6, characterized in that: The method also includes a health data downloading phase, in which the downloading of health data by the user is controlled according to whether the user is the data owner.

8. A secure layered duplicate data processing method for edge-assisted cloud according to claim 7, characterized in that: For each data block ciphertext c in the health data F i ,i∈[1,n] The edge server generates the authentication tag δ i =α(H1(i)+c i U) and store it; the user sends the tag set to the edge server. After receiving the request, the edge server verifies and confirms the ownership. The edge node checks whether the data tag uploaded by the area already exists in the index table to determine the data block set S of non-duplicate data blocks. f ,If the verification passes, the cloud server confirms that the user owns the data; otherwise it determines that the user is not the owner of the data.

9. A secure layered duplicate data processing method for edge-assisted cloud according to claim 8, characterized in that: When a user tries to download data, the edge node first checks whether the user is the owner of the data. If the user is not the owner of the data, the edge node will reject the request. If the user's identity is confirmed, the edge node will label the health data file T * After the user obtains the encrypted data from the cloud storage, the encrypted block is marked (c i , t) to decrypt and get the ciphertext cc of the block i ; Then, the user uses the known convergent key to ciphertext cc i Decrypt to obtain the original data block B i ; Since the original order of the data blocks has been recorded when the file is divided, the data block B is divided into i Reassemble into a complete file F and restore the original content of the file.

10. A secure hierarchical duplicate data processing method for edge-assisted cloud according to any one of claims 1 to 9, characterized in that: The system involved in the processing method includes four entities: user, edge server, cloud server, and key server; The cloud service provider is a centralized server that provides long-term data storage and retrieval services; Manage all edge nodes in the system; The edge server is an entity that provides storage services and lightweight computing tasks at the edge of the network. Each edge node is connected to the cloud and manages all users in a specific area. The key server performs identity authentication for entities and manages the keys of each entity in the system; The user is used to upload / download personal health data PHR to the cloud.

Images