A security layered deduplication processing method of edge auxiliary cloud

Abstract

The application discloses a kind of edge auxiliary cloud's security layered deduplication method, the method includes system initialization, health data block security assessment, health data encryption and upload, health data deduplication, and health data download stage;The method is implemented by different encryption strategies according to the security level of health data to implement layered deduplication, and the security level of block is defined according to the correlation of block and user to measure the security demand of user.The deduplication operation is decentralized to edge node, reduces the data transmission burden, and improves the search efficiency by using adaptive balanced binary tree for deduplication label comparison.Proposed the message lock encryption and convergence all-or-nothing transform are combined to encrypt data item, to enhance data security.Provide ownership proof, ensure that only authorized users can access specific data, resist repeated forgery attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of privacy data protection processing, in particular to a security layered deduplication processing method of edge-assisted cloud. BACKGROUND

[0002] Digital health, through the combination of Internet of Things (IoT) and cloud technology, has achieved the goal of disease prevention and medical cost reduction. Modern medical devices can monitor users' health status in real time, and transmit the collected data to the cloud to ensure efficient storage and management of information. Personal health records (PHR) as the digital version of users' health data, its storage, management and protection are crucial to maintain user privacy and data security. Through in-depth analysis of these health data, medical personnel can have a more comprehensive understanding of users' health status, so as to make more accurate medical decisions. Real-time monitoring enables medical professionals to discover potential health problems in a timely manner and implement personalized intervention measures to provide high-quality care. At the same time, users can also obtain more intuitive health feedback through these data and actively participate in their own health management.

[0003] With the continuous development of digital health technology, this ecosystem not only optimizes the efficiency and quality of medical services, but also lays the foundation for future personalized medicine. Through effective health data management, we can achieve better disease prevention, health promotion and resource utilization, and promote the progress of the entire medical industry.

[0004] In the field of health data, due to the same personal health records may be uploaded by different users or the same user multiple times, resulting in a large amount of redundant data stored in the cloud. Therefore, deduplication management can help cloud service providers (CSPs) significantly reduce storage costs and alleviate storage pressure. Network edge deduplication significantly improves the communication efficiency of edge-assisted cloud storage systems. With increasing concerns about data privacy, secure deduplication is proposed to support deduplication while providing data security. SUMMARY

[0005] The purpose of the present application is to overcome the shortcomings of the prior art, and to provide a security layered deduplication method of edge-assisted cloud. In the field of health data, this scheme aims to ensure efficient and secure deduplication, especially suitable for resource-limited edge nodes. By transferring repetitive work from the cloud to the edge server for execution, the traffic burden of the backbone network is significantly reduced. In addition, we encrypt the pre-de-duplicated data from plaintext to ciphertext, which not only improves storage efficiency, but also ensures data security.

[0006] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is: a secure hierarchical duplicate data processing method for edge-assisted cloud, which includes implementing hierarchical deduplication according to the security level of health data using different encryption strategies, defining the security level of blocks according to the correlation between blocks and users to measure the security needs of users, delegating the duplicate data deletion operation to the edge node, and performing deduplication management by using AVL tree.

[0007] The method comprises an initialization step, wherein the initialization step comprises:

[0008] Step 1-1: Initialize the system's public parameters PP = {q, P, G, G t ,e,H1,H2,f,π};

[0009] Step 1-2: The key server randomly selects x∈Z p * As the key, and calculate the public key V = αP, P is the generator of G;

[0010] Where q is a prime number, G and G t are two prime numbers p-factorial cyclic groups, P is the generator of G, and e is a bilinear map: e(G,G)→G t , It is a group modulo q, hash function H1: Used to generate long hashes, mapping binary strings of arbitrary length to Elements in; hash function H2: {0, 1} * →G t Used for convergent key generation, mapping binary strings of arbitrary length to G t Elements in; two pseudo-random functions f: and π: The definition of is to produce consistent challenge coefficients and block numbers.

[0011] The method includes a health data block security assessment step, and the health data block security assessment step includes:

[0012] Personal health records (PHRs) are divided into text-based PHRs and image-based PHRs based on file semantic information, using block-level deduplication and file-level deduplication respectively. Users input health data files and output several blocks of variable length. The files are divided into multiple data blocks, and the security level of each data block is defined based on its sensitivity and importance. This is used to measure the protection needs of the data blocks, and corresponding encryption methods are designed for different security levels.

[0013] The method also includes a data encryption and upload stage. During the data encryption and upload stage, the key manager is responsible for calculating the security level of each data block and assigning a corresponding encryption scheme to each data block, and completing the upload to the edge node after encryption is completed.

[0014] In the data encryption and upload phase, for files or file blocks with lower security levels, a double-layer encryption process is used to achieve efficient protection, and a hash function is used to calculate the hash value of the plaintext, ks i =H2(B i ), i = 1, 2, ..., n, get the convergent key, use the convergent encryption to encrypt the data block to generate the data block ciphertext cc i =Enc(ks i ,B i ), (1<i<n), get the data block ciphertext set C i ={cc1,cc2,...,cc n}, ensuring data consistency and confidentiality, where ks i is the convergent key, Enc() is the convergent encryption function;

[0015] For each cc i Use it to encrypt, first generate the encryption key k i =H2(cc i ), and then generate a convergent all-or-nothing transform package (c i ,tr i ) where c i The ciphertext of the packet is called tr i It is called the tail of the packet; P means cc i The common blocks are of the same size, E() represents a symmetric encryption scheme, Represents XOR to prevent data leakage when the entire package is missing; the defined hash function generates the label t i =H1{c i}; The user retains the key set {k1,k2,...,k i}, and label T a ={t1,t2,...,t n}Upload to the edge node.

[0016] The method also includes a health data deduplication stage:

[0017] Step 6-1: Each label t i Stored in the node of the AVL tree, the structure of the tree node is defined as: Node = (t i ,c i ,f i );

[0018] Step 6-2: Verify whether the label ti exists in the AVL tree, find the corresponding label position through the characteristics of the binary search tree;

[0019] Step 6-3: If the same label exists in the AVL tree, it is considered that the data item already exists, and the duplicate data is directly ignored, and only one copy is saved;

[0020] Step 6-4: If there is no matching label, the AVL tree will insert the new label into the tree, while storing the corresponding unique copy;

[0021] Step 6-5: For the scenario of limited network bandwidth, the edge node will periodically upload the deduplicated data to the cloud, and the cloud will further deduplicate the uploaded data to avoid uploading the same data block by multiple users or multiple edge nodes.

[0022] The method further includes a health data download phase, which controls the download of health data by users according to whether the user is the data owner.

[0023] For each data block ciphertext c i i∈[1,n]

[0024] The edge server generates an authentication label δ i =α(H1(i)+c i U) and stores it; the user sends the label set to the edge server, and the edge server verifies and confirms the ownership after receiving the request, and the edge node checks whether the data label uploaded by the region exists in the index table to determine the data block set S f of the non-duplicate data block; if the verification is passed, the cloud server confirms that the user owns the data; otherwise, it is judged that the user is not the owner of the data.

[0025] When the user attempts to download the data, the edge node first checks whether the user is the owner of the data, and if the user is not the owner of the data, the edge node will reject the request; if the identity of the user is confirmed, the edge node will send the health data file label T * to the cloud storage and obtain the corresponding encrypted data block; after the user obtains the encrypted data from the cloud storage, the user first decrypts the encrypted block label (c i , t) through the deformation scheme of AONT to obtain the ciphertext cc i of the block; then, the user decrypts the ciphertext cc i using the known convergent key to obtain the original data block B i ; since the original order of the data blocks has been recorded when the file is blocked, the data blocks B i are reorganized into a complete file F according to this order, and the original content of the file is recovered.

[0026] The processing method involves four entities of a user, an edge server, a cloud server and a key server;

[0027] The cloud service provider provides a centralized server for long-term data storage and retrieval service; manage all edge nodes in the system;

[0028] The edge server is an entity that provides storage services and lightweight computing tasks at the network edge, and each edge node is connected to the cloud to manage all users in a specific area;

[0029] The key server authenticates entities and manages the keys of entities in the system;

[0030] The user is used to upload / download personal health data PHR to the cloud.

[0031] The advantages of the present application are: 1. The present application realizes hierarchical deduplication according to the security level of health data, that is, the data is divided into different security levels, and different deduplication strategies are set for data of different security levels. For data with high security level and low security level, different encryption methods are adopted to ensure that sensitive data is always fully protected during the deduplication process.

[0032] 2. For different data characteristics, the health data of text is processed by block-level blocking, and the image data is processed by file-level blocking, which ensures the flexibility and efficiency of the system and improves the transmission speed and system response ability. CDC automatically adjusts the block boundary and flexibly processes local changes.

[0033] 3. The edge-based deduplication framework, in which the deduplication operation is directly performed by the edge node, greatly reduces the transmission pressure and reduces the burden of the cloud. Using AVL tree for deduplication can help manage the metadata of data blocks to quickly detect and delete duplicate data, thereby improving storage efficiency.

[0034] 4. The key server receives auxiliary information generated by the data block, uses the Count-Min Sketch technology to approximate the frequency estimation value, calculates and judges the security level of the data block, and can also identify abnormal or sensitive data. This helps to ensure the protection of user privacy during the deduplication process, so as to better balance security and individual needs.

[0035] 5. Using the deformation scheme of AONT for convergent encryption and then encrypting the ciphertext can effectively improve the security of the data, because it protects the data by introducing an additional encryption layer, while reducing the dependence on the original data and enhancing the protection of data integrity. Provide proof of ownership to ensure that only authorized users can access and use specific data, resist duplicate forgery attacks. BRIEF DESCRIPTION OF DRAWINGS

[0036] Brief description of the drawings and the symbols in the drawings expressed in the specification of the present application:

[0037] Figure 1 Flowchart of the method of the present application; system structure diagram

[0038] Figure 2 System structure diagram corresponding to the entity involved in the method of the present application. DETAILED DESCRIPTION

[0039] The specific embodiments of the present application will be further described in detail below with reference to the drawings, by describing the optimal embodiments.

[0040] The specific embodiments of the present application will be further described in detail below with reference to the drawings, by describing the optimal embodiments, and a secure hierarchical deduplication method is designed to solve the problems of data redundancy and privacy in health data sharing. Edge computing assisted cloud storage is used to ensure data confidentiality while reducing the burden on the cloud, responding in a timely manner, and reducing data transmission delay. The Count-Min Sketch technology is introduced, which estimates the frequency of elements by using a set of short hash values, thereby greatly reducing the required storage space and improving the processing speed. A self-balancing binary search tree is constructed to improve deduplication efficiency. The MLE scheme and the deformation scheme of AONT are combined to enhance data security. A proof-of-ownership resistant to duplicate forgery attacks is proposed for the system. The secure hierarchical deduplication method of the edge-assisted cloud includes implementing hierarchical deduplication using different encryption strategies according to the security level of health data, defining the security level of blocks to measure the security needs of users according to the relevance of blocks and users, and performing deduplication operations on edge nodes and using AVL trees for deduplication management.

[0041] The specific steps are as follows:

[0042] As shown in Figure 1 , a secure hierarchical deduplication method of edge-assisted cloud includes a group of users, a group of edge servers, a cloud server, and a key server as four entities.

[0043] The cloud service provider provides a centralized server for long-term data storage and retrieval services; manages all edge nodes in the system;

[0044] The edge server provides storage services and lightweight computing tasks at the network edge; each edge node is connected to the cloud and manages all users in a specific area;

[0045] The key server performs identity authentication for entities and manages the keys of each entity in the system.

[0046] The user (patient) can upload / download personal health data (PHR) to the cloud; the user can be considered an initial uploader or a subsequent uploader.

[0047] According to Figure 2 , a security layered deduplication method for edge-assisted cloud, the method comprises system initialization, health data block security evaluation, health data encryption and uploading, health data deduplication, and health data downloading stage.

[0048] Before explaining the system flow in detail, we first introduce the Count-Min Sketch scheme, which has the following specific steps:

[0049] (1) First, define the array dimension: set the width w and depth d of the CM-Sketch, and initialize a two-dimensional array counts, each element is set to zero. This array will be used to store the frequency count calculated by each hash function.

[0050] (2) Select a hash function: select d independent hash functions h j (mi), each hash function maps the data block mi to a certain position in the counts array.

[0051] (3) Data block processing sends the data block, the user sends each data block mi to the key manager. For each data block mi, calculate d hash values [h1(mi), h2(mi),..., h d (mi)].

[0052] (4) The key manager increases the value of the corresponding counter according to the hash value: for each hash value h j (mi), the corresponding position in counts is incremented. At the same time, the key manager maintains a counter for the total number of blocks n, which is increased by 1 for each received data block.

[0053] (5) Frequency estimation: to estimate the number of occurrences oi of data block mi, the key manager takes the minimum value from the d corresponding counters: o i i = min(counts[h1(mi)], counts[h2(mi)],..., counts[h i (mi)]). i d i

[0054] The specific phase of the scheme is:

[0055] 1. The system initialization stage includes:

[0056] ​​​Step 1-1: The key server uses the security parameter λ as input and generates a public parameter PP, PP = {q, P, G, G t ,e,H1,H2,f,π}. Where q is a prime number, G and G t are two q-order cyclic groups, P is the generator of G,

[0057] e is a bilinear mapping: e(G,G)→Gt. It is a group modulo q, hash function H1: Used to generate long hashes, mapping binary strings of arbitrary length to Elements in, and hash function H2: {0, 1} * →G t Used for convergent key generation, mapping binary strings of arbitrary length to G t Elements in . Two pseudo-random functions f: and π: The purpose of this definition is to help users or servers generate consistent challenge coefficients and block numbers.

[0058] Step 1-2: Random server selection As the key, and calculate the public key V = αP, P is the generator of G, which will be used later when verifying ownership.

[0059] 2. The health data block security assessment stage is specifically as follows:

[0060] Step 2-1: Personal health records (PHRs) are categorized into text-based and image-based PHRs based on file semantics, such as file extensions. The former utilizes block-level deduplication, while the latter uses file-level deduplication. This paper focuses on a more fine-grained deduplication technique, namely block-level deduplication, although this method is also applicable to file-level deduplication. For a user's input health data file, the output is a number of variable-length blocks (such as the user's basic information, physical examination data, laboratory data, and diagnostic records).

[0061] Health data content segmentation algorithm steps:

[0062] The sliding window size is set to w, and the length of the data block is between the preset minimum value d and the maximum value D. The sliding window slides byte by byte from the starting position of the health data file F. File F refers to the health data file containing patient information, diagnostic records, etc. The hash value f of each sliding window position is tested to determine whether the block boundary condition is met. When the condition fmodD=d is met, it is identified as a block boundary and divided into a block, marked as B1. The window continues to slide and the above process is repeated until the entire file is divided into multiple data blocks B1...B n That is, F={B1,B2,...,Bn}

[0063] Step 2-2: In the security assessment of health data files, we divide the files into multiple data blocks and define the security level of each data block based on its sensitivity and importance, thereby measuring the protection requirements of the data blocks. To implement a layered encryption strategy, we consider that the correlation between a data block and a user increases with its frequency of occurrence in a single user's data, but when the frequency of a data block in the data of different users increases, its correlation decreases relatively. Therefore, designing corresponding encryption methods for different security levels can optimize storage efficiency while protecting data privacy and adapt to the sensitive data management needs in multi-user scenarios.

[0064] (1) For user u and block B i , user u for block B i We define the security level as:

[0065]

[0066] where f i u Indicates the user's internal frequency F i It's block B i The calculation of the frequency is relatively simple. For each data block Bi, the user can directly count the number of times a block appears in the uploaded file, that is, the frequency of the data block Bi in all the data of user u. The formula is as follows:

[0067]

[0068] N u Indicates the total number of data blocks owned by user u, n i，u Indicates the number of times a data block appears in user u.

[0069] (2) Inter-frequency refers to the frequency of occurrence of a data block among all users, that is, the cross-user frequency of the data block. The Count-Min Sketch (CM-Sketch) technique is used to estimate the frequency of each block B. i The frequency interval. CM-Sketch is used instead of directly calculating the fingerprint of the block. This approximate counting not only protects the data block information from data leakage caused by the key manager, but also reduces the overhead of frequency counting. Since each short hash function has at most w values, which is much smaller than the value range of the fingerprint, multiple data blocks are mapped to the same short hash value, and the attacker cannot derive blocks from these short hashes. The Key Manager estimates the data block B through CM-Sketch. iThe number of occurrences oi in the entire user set. CM-Sketch is a two-dimensional counting array with a size of w*d (w represents the number of hash functions, d represents the number of counting table columns). For each data block B i , using w independent hash functions h1,h2,…,h w The data block is mapped to d locations in CM-Sketch, and the key manager increments the counter corresponding to each mapping location according to these hash values. The formula is as follows:

[0070] Count[j,h j (B i )]+1,j=1,2,...,w

[0071] Estimated data block B i The number of occurrences o i Use the minimum frequency and minimum count value of the corresponding position in the hash table in CMS:

[0072]

[0073] The frequency Fi between users of a data block Bi is calculated using the following formula:

[0074]

[0075] Where n is the total number of data blocks, combined with intra-frequency and inter-frequency, using the formula Calculate the security level of a data block to determine encryption and deduplication strategies. A user's security level for a data block is measured based on its relevance to the user. The more times a data block appears for a single user, the stronger its relevance to that user; the more times a data block appears across the entire user set, the weaker its relevance to the individual user.

[0076] 3. Data encryption and upload stage

[0077] Step 3-1: The key manager is responsible for calculating the security level of each data block and assigning an appropriate encryption scheme to each data block. Specifically, the key manager first sets a security threshold. If the security level of a data block meets or exceeds this threshold, it is classified as high-security data and encrypted using a standard symmetric encryption algorithm (such as AES) to ensure confidentiality and integrity.

[0078] Step 3-2: If the data block belongs to a low security level, a two-layer encryption process is used to achieve efficient protection: In the first step, a hash function is used to calculate the hash value of the plaintext, ks i =H2(B i ), i = 1, 2, ..., n, get the convergent key, use the convergent encryption to encrypt the data block to generate the data block ciphertext cci =Enc(ks i ,B i ), (1<i<n), get the data block ciphertext set C i ={cc1,cc2,...,cc n}, ensuring data consistency and confidentiality, where ks i is the convergent key, and Enc() is the convergent encryption function.

[0079] In the second step, the data block is converted into an indivisible encrypted packet by combining the convergent all-or-nothing conversion (a variant of AONT) algorithm. i Use it to encrypt, first generate the encryption key k i =H2(cc i ), and then generate a convergent all-or-nothing transform package (c i ,tr i ), where c i The ciphertext of the packet is called tr i It is called the tail of the packet. Specifically, P means cc i The common blocks are of the same size, E() represents a symmetric encryption scheme, Indicates XOR. This prevents data leakage when the entire package is missing. This double-layer encryption method

[0080] The scheme can not only achieve deduplication of encrypted data blocks, but also provide effective privacy protection for deduplication data, optimize the utilization of storage resources, and achieve refined management of hierarchical encryption. The user generates a label t for the data block ciphertext using the previously defined hash function. i =H1{c i}; The user retains the key set {k1,k2,...,k i}, and label T a ={t1,t2,...,t n}Upload to edge node;

[0081] 4. The data deduplication stage

[0082] When a user prepares to upload a health data item to the cloud, the system performs the following two processing steps: First, the user generates a unique tag based on the encrypted data of the personal health record and uploads the tag to the edge node in the corresponding area.

[0083] Step 4-1: If it is the initial uploader, that is, the edge node checks the label for duplication: if the label does not exist, the system will feedback ηF=0 "upload complete data" instruction to the user. ηF indicates the identifier of whether the data block ciphertext exists, prompting the user to upload the complete encrypted data item and execute step 3-1.

[0084] Step 4-2: If a subsequent uploader has duplicate data, the system returns an identifier ηF = 1 to the user, indicating that the user is the subsequent uploader. For the edge node, storage record 1 stores the user's ownership and the file's unique tag, while storage record 2 stores the unique file tag and data block tag. After the edge server detects the duplication, the edge node interacts with the user based on the results. The user simply adds their ownership to the data owner list and does not need to upload the data again. To prevent duplicate forgery attacks, the user proves ownership of the data.

[0085] The specific steps to verify ownership are:

[0086] For each data block ciphertext c in the health data F i ,i∈[1,n], the algorithm generates the authentication tag δ according to the following equation. i =α(H1(i)+c i U) for storage. Randomly select U, is a coefficient, c i is the data block ciphertext, H1(i) is a hash function that provides a unique identifier for each data block, which is bound to the data block content and the random number. The user sends the tag set to the edge server. After receiving the request, the edge server verifies and confirms the ownership and randomly selects three random numbers l∈[1,n], Finite field, generate challenge set chal s ={l,a1,a2} and sends it to the user. The user is equivalent to the client and needs to generate the correct response information to prove its ownership of the data. By sending the challenge response, the challenge index and the corresponding coefficient are further calculated. f,π are two pseudo-random functions. The user's ciphertext block is proved and the verification value is calculated. Send it to the edge server, the edge server receives the proof and parameters, and calculates the label Verification formula That is, to determine whether the two are equal, V = αP is the public key. If the verification is successful, it is confirmed that the client owns the file and is added to the owner list. The following is the correctness of the verification formula:

[0087]

[0088] This formula uses the properties of bilinear mapping to achieve secure and reliable verification of user file ownership, ensuring the security and integrity of data in the cloud storage system. Confirm that the client user owns the file, then the user uploads the corresponding non-repeated data block ciphertext, label, the edge node updates the index table, and the edge node checks whether the data label uploaded by the region already exists in the index table to determine the data block set S of non-repeated data blocks.f The edge node will S f The data is sent to the cloud for further cloud-level duplicate detection. The cloud server updates the index table and stores the data block ciphertext.

[0089] Find files or blocks that need to be deleted, so that the same files are only uploaded once, which greatly saves network bandwidth. Use balanced binary tree (AVL) to compare tags to ensure faster search speed and scalability, which helps improve the overall index search efficiency of cloud service providers.

[0090] Tags are compared based on their hash values:

[0091] Each label is stored in a node of the AVL tree. The structure of the tree node can be defined as Node = (t i , c i , f i ), t i It is a data ciphertext label used to determine whether the data is repeated. i is the data ciphertext, f i It's counting.

[0092] The edge server receives the tag t sent by the user * After that, we check whether the tag already exists. We first find the root node tag t1 of the AVL tree that stores the tag. Then we check the equality between the received user tag and the root node tag. The result is represented by rs. The formula is as follows:

[0093]

[0094] If the label t * If it is equal to the current root node label t1, it means that the label already exists and the corresponding data block is repeated. Only one reference count f needs to be increased. i This means that each time the same data block is referenced, its reference count increases by f. i =f i +1, this will effectively identify duplicate data blocks;

[0095] For the label t * There are two cases where the current label t1 is not equal to the current label t1: The first case is that if the label t * If the label t1 is less than the current node, the search is performed along the left subtree of the current node. The second case is that if the label t *If the tag t1 of the current node is greater than the tag t, the right subtree of the current node is searched along, and based on such comparison rules, if there is a corresponding tag, the relevant node can be efficiently located in the AVL tree. Without actually storing multiple copies, the ciphertext is also avoided from being stored again. Through the continuous comparison and searching process, if an equal tag is not found, a suitable leaf node position will be finally found, and this position is the new tag t * Should be inserted.

[0096] Thanks to the characteristics of the AVL tree, the label storage structure has high efficiency in node insertion and deletion operations. In addition, neither the label comparison process nor the node update process needs the participation of the client.

[0097] 5、The data download stage

[0098] When the user attempts to download the data, the edge node first checks whether the user is the owner of the data. If the user is not the data owner, the edge node will reject the request; if the user identity is confirmed, the edge node will send the health data file tag T * to the cloud storage and obtain the corresponding encrypted data block. After the user obtains the encrypted data from the cloud storage, the ciphertext of the encrypted block c i (t) is decrypted through the deformation scheme of AONT, and the ciphertext of the block c i is obtained.

[0099] Then, the user decrypts the ciphertext c i using the known convergence key to obtain the original data block B i . Since the original order of the data blocks has been recorded when the file is chunked, the user can recombine the data blocks B i into a complete file F according to this order to recover the original content of the file.

[0100] Description of the function implemented by the present application:

[0101] 1、The present application realizes hierarchical deduplication according to the security level of health data, that is, the data is divided into different security levels, and different deduplication strategies are set for the data of each security level. Different encryption methods are adopted for data with higher security level and data with lower security level, so as to ensure that sensitive data is always fully protected during the deduplication process.

[0102] 2、For different data characteristics, text health data is processed by block-level chunking, and image data is processed by file-level chunking, which ensures the flexibility and efficiency of the system and improves the transmission speed and system response ability. CDC automatically adjusts the chunking boundary and flexibly processes local changes.

[0103] 3. An edge-based deduplication framework, where deduplication is performed directly by edge nodes, significantly reducing transmission pressure and reducing the burden on the cloud. Using AVL trees for deduplication helps manage metadata for data blocks to quickly detect and remove duplicate data, thereby improving storage efficiency.

[0104] 4. The key server receives auxiliary information generated by the data block and uses the Count-Min Sketch technique to approximate the frequency estimate to calculate the security level of the data block, while also identifying abnormal or sensitive data. This helps ensure user privacy during the deduplication process, thereby better balancing security and personalization needs.

[0105] 5. Using a variant of AONT for convergent encryption followed by ciphertext encryption can effectively improve data security by introducing an additional encryption layer to protect data while reducing reliance on the original data and enhancing data integrity. Proof of ownership ensures that only authorized users can access and use specific data, resisting repeated forgery attacks.

[0106] Obviously, the specific implementation of the present invention is not limited to the above-mentioned methods. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, they are all within the scope of protection of the present invention.

Claims

1. A secure layered duplicate data processing method for edge-assisted cloud, characterized by: The processing method includes implementing layered deduplication using different encryption strategies based on the security level of health data, defining the security level of blocks based on their relevance to users to measure user security needs, delegating deduplication operations to edge nodes, and managing deduplication by using an AVL tree; The method includes a health data block security assessment step, and the health data block security assessment step includes: Personal health records (PHRs) are divided into text-based PHRs and image-based PHRs based on file semantic information. Block-level deduplication and file-level deduplication are used respectively. The user inputs a health data file and outputs a number of blocks of variable length. The file is divided into multiple data blocks, and the security level of each data block is defined based on its sensitivity and importance. This is used to measure the protection requirements of the data blocks and design corresponding encryption methods for different security levels. The health data file is divided into multiple data blocks B1...B n , where n represents the number of divided data blocks; B i Represents the i-th data block after division; The method also includes a data encryption and upload phase, in which the key manager is responsible for calculating the security level of each data block and assigning a corresponding encryption scheme to each data block, and completing the upload to the edge node after encryption is completed; In the data encryption and upload phase, for files or file blocks with lower security levels, a double-layer encryption process is used to achieve efficient protection, and a hash function is used to calculate the hash value of the plaintext, ks i =H2(B i ), i = 1, 2, ..., n, get the convergent key, use the convergent encryption to encrypt the data block to generate the data block ciphertext cc i =Enc(ks i ,B i ), (1<i<n), get the data block ciphertext set C i ={cc1,cc2,...,cc n }, ensuring data consistency and confidentiality, where ks i is the convergent key, Enc() is the convergent encryption function; For each cc i Use it to encrypt, first generate the encryption key k i =H2(cc i ), and then generate a convergent all-or-nothing transform package (c i ,tr i ), where c i The ciphertext of the packet is called tr i It is called the tail of the packet; P means cc i The common blocks are of the same size, E() represents a symmetric encryption scheme, Represents XOR to prevent data leakage when the entire package is missing; the defined hash function generates the label t i =H1{c i }; The user retains the key set {k1,k2,...,k i }, and label T a ={t1,t2,...,t n }Upload to the edge node.

2. The secure layered duplicate data processing method for edge-assisted cloud according to claim 1, characterized in that: The method comprises an initialization step, wherein the initialization step comprises: Step 1-1: Initialize the system's public parameters PP = {q, P, G, G t ,e,H1,H2,f,π}; Step 1-2: Key server random selection As the key, and calculate the public key V = αP, P is the generator of G; Where q is a prime number, G and G t are two prime numbers p-factorial cyclic groups, P is the generator of G, and e is a bilinear map: e(G,G)→G t , is a group modulo q, the hash function Used to generate long hashes, mapping binary strings of arbitrary length to Elements in; hash function H2: {0, 1} * →G t Used for convergent key generation, mapping binary strings of arbitrary length to G t Middle element; two pseudo-random functions and The definition of is to produce consistent challenge coefficients and block numbers.

3. The secure layered duplicate data processing method for edge-assisted cloud according to claim 1, characterized in that: The method also includes a health data deduplication stage: Step 6-1: Each label t i Stored in the node of the AVL tree, the structure of the tree node is defined as: Node = (t i ,c i ,f i ); Step 6-2: Verify label t in AVL tree i Whether it already exists, find the corresponding label position through the characteristics of the binary search tree; Step 6-3: If the same label already exists in the AVL tree, the data item is considered to already exist, and the duplicate data is directly ignored, and only one copy is saved; Step 6-4: If there is no matching label, the AVL tree inserts the new label into the tree and stores the corresponding unique copy; Step 6-5: For scenarios with limited network bandwidth, edge nodes will periodically upload deduplicated data to the cloud. After receiving the uploaded data, the cloud will further deduplicate it to prevent multiple users or multiple edge nodes from uploading the same data block.

4. The secure layered duplicate data processing method for edge-assisted cloud according to claim 3, characterized in that: The method also includes a health data downloading phase, in which the downloading of health data by the user is controlled according to whether the user is the data owner.

5. The secure layered duplicate data processing method for edge-assisted cloud according to claim 4, characterized in that: For each data block ciphertext c in the health data F i ,i∈[1,n] The edge server generates the authentication tag δ i =α(H1(i)+c i U) and store it; the user sends the tag set to the edge server. After receiving the request, the edge server verifies and confirms the ownership. The edge node checks whether the data tag uploaded in the area already exists in the index table to determine the data block set S of non-duplicate data blocks. f ,If the verification passes, the cloud server confirms that the user owns the data; otherwise, it ,determines that the user is not the owner of the data.

6. The secure layered duplicate data processing method for edge-assisted cloud according to claim 5, characterized in that: When a user tries to download data, the edge node first checks whether the user is the owner of the data. If the user is not the owner of the data, the edge node will reject the request. If the user's identity is confirmed, the edge node will label the health data file T * Send to cloud storage and obtain the corresponding encrypted data block; after the user obtains the encrypted data from the cloud storage, the encrypted block is marked (c i ,t) decrypts and obtains the ciphertext cc of the block i ; Then, the user uses the known convergent key to ciphertext cc i Decrypt to obtain the original data block B i ; Since the original order of the data blocks has been recorded when the file is divided into blocks, the data block B is divided into i Reassemble into a complete file F and restore the original content of the file.

7. A secure layered duplicate data processing method for edge-assisted cloud according to any one of claims 1 to 6, characterized in that: The system involved in the processing method includes four entities: user, edge server, cloud server, and key server; The cloud service provider is a centralized server that provides long-term data storage and retrieval services; Manage all edge nodes in the system; The edge server is an entity that provides storage services and lightweight computing tasks at the edge of the network. Each edge node is connected to the cloud and manages all users in a specific area. The key server performs identity authentication for entities and manages the keys of each entity in the system; The user is used to upload / download personal health data PHR to the cloud.

Images