Multi-cloud multi-copy storage auditing method and system based on multiple certificateless signatures

Abstract

The invention discloses a multi-cloud multi-copy storage auditing method and system based on multiple certificateless signatures, and relates to the field of cloud storage. The method comprises the following steps: generating public keys and private keys corresponding to a data owner and a plurality of storage servers respectively; the data owner generates a plurality of copies for a plurality of data blocks divided from the data file, generates a corresponding file signature for each copy according to a private key corresponding to the data owner, and distributes the copies and the file signatures to corresponding storage servers; the storage server generates a partial block label for each data block according to a private key corresponding to the storage server, and a data owner aggregates all the partial block labels to obtain an aggregation signature; in the data processing stage, a mode of firstly dividing and then constructing a copy is adopted, so that a data owner can easily obtain the content of the original data block even if part of data is taken back. And meanwhile, a copy label calculation task is completed by the storage servers belonging to different cloud service providers, so that the calculation burden of a local end is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cloud storage, and particularly relates to a multi-cloud multi-copy storage auditing method and system based on multiple certificateless signatures. BACKGROUND

[0002] With the explosive growth of data, individual or enterprise data owners are limited by the local storage architecture, and tend to outsource local data to untrusted servers for storage and subsequent management, of which cloud storage data hosting services are the most typical representative. Since there is no need to store data copies locally, once the outsourced data is lost or damaged, the data owner will lose the data forever. At the same time, the untrusted server may delete rarely accessed or almost unused data due to software or hardware errors or to save space. Therefore, the integrity of outsourced data has always been an important challenge for data outsourcing services to be applied to real-world scenarios. Researchers have proposed data storage auditing schemes that allow data owners to verify the integrity of outsourced data on untrusted servers, which is a common means. In the data processing stage, the data owner usually needs to calculate the corresponding authenticable label according to the content of the data block divided by the file, and then upload the label together with the data block set to the server. In the subsequent auditing stage, the data owner verifies the corresponding relationship between the data evidence and the label evidence generated by the server based on the random challenge. The construction of such data block labels often relies on BLS signatures, RSA signatures, identity-based signatures, and certificateless signatures. However, most of the schemes are for single-copy storage auditing, that is, only one copy is stored on the server side. Although various techniques are used to improve the performance and security of the scheme, the single-copy storage strategy always threatens the data availability, and once the copy is damaged, it means that the data owner will permanently lose the file.

[0003] To overcome the shortcomings of single-copy storage and improve the availability and recoverability of data, multi-copy storage strategies have been proposed. Currently, there are also some multi-copy storage auditing schemes that rely on digital signatures. However, most of them still rely on traditional public key infrastructure, involving a large amount of certificate overhead. Subsequently, some identity signature-based schemes have emerged, but they inevitably have inherent key custody problems. Overall, the existing multi-copy auditing schemes have the following problems: (1) Even if multi-copy storage is adopted, most schemes are essentially still geared towards a single cloud service provider, and there is a problem of concentrated failure. For example, a single cloud service provider may lose data due to company bankruptcy or being attacked. At the same time, the existing schemes are difficult to directly apply to multiple independent cloud service providers, because each independent cloud service provider has its own private key and public key, and the existing schemes have not adapted to the situation where each storage party has its own independent public key and private key. (2) The data owner needs to generate corresponding labels for all copy blocks. The label calculation frequently involves dot multiplication and exponentiation operations on the group. As the number of data blocks increases, such calculations will put significant pressure on the resource-constrained local end. Furthermore, public key infrastructure-based schemes cannot avoid high certificate management overhead, while identity-based schemes inherently have key escrow defects. (3) When creating multiple copies, existing schemes either do not adequately consider data privacy protection or directly encrypt the entire file to generate distinguishable copy blocks. This approach means that when the data owner retrieves the data, they must download the entire file to decrypt and read the plaintext, and cannot efficiently recover the plaintext content from only a portion of the data blocks. Summary of the Invention

[0004] Based on this, the present invention provides a multi-cloud multi-replica storage auditing method and system based on multiple certificateless signatures to solve the problems existing in the above-mentioned existing multi-replica auditing schemes.

[0005] Firstly, this application provides a multi-cloud, multi-replica storage auditing method based on multiple certificate-free signatures. The method includes:

[0006] The key generation center generates public parameters and the master private key;

[0007] The key generation center generates identity keys for the data owner and several storage servers based on public parameters and master private key. The data owner and storage servers generate corresponding private keys and corresponding public keys based on their respective identity keys. The key generation center generates an aggregate public key based on the corresponding public keys of several storage servers.

[0008] The data owner generates multiple copies of the data blocks divided into data files, generates a corresponding file signature for each copy based on the data owner's private key, and distributes the copies and file signatures to the corresponding storage servers;

[0009] After the storage server successfully verifies the copy and file signature based on the public key corresponding to the data owner, it generates a partial block tag for each data block based on the private key corresponding to the storage server, and receives the aggregate signature obtained by the data owner after aggregating the partial block tags generated by all storage servers. After verifying the correctness of the aggregate signature, the storage server stores the copy and the aggregate tag.

[0010] Third-party auditors perform data integrity audits on storage servers based on aggregated public keys.

[0011] In one embodiment, the key generation center generates identity keys for the data owner and several storage servers respectively based on public parameters and the master private key, including:

[0012] The key generation center generates corresponding identity keys based on the identity information and timestamps sent by the data owner and several storage servers.

[0013] In one embodiment, third-party auditing of data integrity on the storage server based on the aggregated public key includes:

[0014] A third-party audit creates a random challenge and sends it to all storage servers;

[0015] After receiving the audit proof for the random challenge generated by each storage server based on the replica and aggregation tags, the correctness of the audit proof is verified through a bilinear mapping operation to determine the data integrity on the corresponding storage server.

[0016] In one embodiment, the method further includes:

[0017] The replicas stored in the storage server are obtained by performing an XOR operation on the data block, the hash value of the data block, and the storage server sequence number.

[0018] In one embodiment, the method further includes:

[0019] When a data block on a storage server is corrupted, a copy of the corrupted data block is obtained from a neighboring storage server to rebuild the corrupted data block.

[0020] In one embodiment, the reconstructed corrupted data block is obtained by performing an XOR operation on the corresponding copy of the corrupted data block obtained from the neighboring storage server, the neighboring storage server sequence number, and the storage server sequence number of the corrupted data block.

[0021] In one embodiment, the method further includes:

[0022] When the data owner retrieves a data block, a copy of the data block to be retrieved is obtained from the nearest storage server. The data block to be retrieved is obtained by performing an XOR operation on the copy of the data block to be retrieved obtained from the nearest storage server, the hash value of the data block to be retrieved, and the sequence number of the nearest storage server.

[0023] In one embodiment, the hash value of the data block is stored locally on the data owner's machine.

[0024] In one embodiment, the method further includes:

[0025] When the identity key corresponding to the data owner has expired, the key generation center updates the identity key according to the new timestamp;

[0026] The data owner updates the file signature based on the updated identity key.

[0027] Secondly, this application also provides a multi-cloud, multi-replica storage auditing system based on multiple certificate-free signatures. The system includes:

[0028] The system includes a key generation center, a data owner, and several storage servers: among which,

[0029] The key generation center is used to generate public parameters and master private keys, and to generate identity keys for the data owner and each storage server based on the public parameters and master private keys;

[0030] The data owner is used to generate the corresponding private key and public key based on the identity key of the data owner; it is also used to generate multiple copies of the data file divided into multiple data blocks, generate a corresponding file signature for each copy based on the private key of the data owner, and distribute the copies and file signatures to the corresponding storage servers;

[0031] The storage server is used to generate a private key and a public key corresponding to the storage server based on the identity key of the storage server, so that the key generation center can generate an aggregate public key based on the public key of each storage server; it is also used to generate a partial block tag for each data block based on the private key of the storage server, and receive the aggregate signature obtained by the data owner after aggregating the partial block tags generated by all storage servers, and store a copy and the aggregate tag after verifying the correctness of the aggregate signature.

[0032] Third-party auditing is used to audit the data integrity of storage servers based on aggregated public keys.

[0033] The aforementioned multi-cloud, multi-replica storage auditing method and system based on multiple certificateless signatures includes the following steps: a key generation center generates public parameters and a master private key; the key generation center generates identity keys for the data owner and several storage servers based on the public parameters and master private key; the data owner and storage servers generate corresponding private keys and public keys based on their respective identity keys; the key generation center generates an aggregate public key based on the corresponding public keys of the several storage servers; the data owner generates multiple copies of the data file into multiple data blocks, generates a corresponding file signature for each copy based on the data owner's corresponding private key, and distributes the copies and file signatures to the corresponding storage servers; after successfully verifying the copies and file signatures based on the data owner's corresponding public key, the storage server generates a partial block tag for each data block based on its corresponding private key, and receives the aggregate signature obtained by the data owner aggregating the partial block tags generated by all storage servers; the storage server verifies the correctness of the aggregate signature and then stores the copies and aggregate tags; a third-party auditor performs data integrity auditing on the storage servers based on the aggregate public key. This scheme adopts a partitioning-then-replicating approach during the data processing stage, allowing the data owner to easily obtain the original data block content even if they retrieve only partial data. Meanwhile, the task of calculating replica labels is delegated to storage servers belonging to different cloud service providers, and data owners only need to aggregate labels from various storage service servers, reducing the local computing burden. Attached Figure Description

[0034] Figure 1 This is a flowchart illustrating a multi-cloud, multi-replica storage auditing method based on multiple certificateless signatures in one embodiment.

[0035] Figure 2 This is a block diagram of a multi-cloud, multi-replica storage auditing system based on multiple certificateless signatures in one embodiment. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0037] This application provides a method for auditing multi-cloud, multi-replica storage based on multiple certificateless signatures. The entities involved in this method include: Data Owner (DO), multiple Storage Servers (SS) belonging to different cloud service providers, a Key Generation Center (KGC), and a Third Party Auditor (TPA).

[0038] The respective responsibilities and obligations of the aforementioned entities are as follows:

[0039] (1) DO: has the original data file F, creates multiple distinct copies of the file, and distributes them across multiple SS.

[0040] (2) Multiple SS: Each SS belongs to a different cloud service provider and has sufficient storage and computing resources to be responsible for the storage of copies.

[0041] (3) KGC: responsible for key generation, distribution and encrypted storage management.

[0042] (4) TPA: Responsible for initiating audit adjustments to multiple SS during the audit interaction on behalf of DO, and performing batch verification of the returned audit evidence, and informing DO of the final audit results.

[0043] like Figure 1 As shown, the method includes the following steps:

[0044] S1, The key generation center generates public parameters and the master private key;

[0045] S2, the key generation center generates identity keys for the data owner and several storage servers respectively based on the public parameters and the master private key. The data owner and storage servers generate corresponding private keys and corresponding public keys based on the corresponding identity keys. The key generation center generates an aggregate public key based on the corresponding public keys of several storage servers.

[0046] S3, the data owner generates multiple copies of the data blocks divided into data files, generates a corresponding file signature for each copy based on the data owner's private key, and distributes the copies and file signatures to the corresponding storage servers;

[0047] S4. After the storage server successfully verifies the copy and file signature based on the public key corresponding to the data owner, it generates a partial block tag for each data block based on the private key corresponding to the storage server, and receives the aggregate signature obtained by the data owner after aggregating the partial block tags generated by all storage servers. After verifying the correctness of the aggregate signature, the storage server stores the copy and the aggregate tag.

[0048] S5 allows third-party auditors to perform data integrity audits on storage servers based on aggregated public keys.

[0049] First, the S1 complete system initialization process is performed, specifically, KGC generates the system public parameters pp and the master private key msk. Specifically:

[0050] S101, KGC selects two multiplicative cyclic groups of order q. and , where q is a large prime number, and a computable bilinear pair is chosen. .

[0051] S102, KGC selection One generator is And select four password hash functions, H1: {0,1}*→ H2: {0,1}*→ H3: {0,1}*→ H4: {0,1}*→ .

[0052] S103, KGC selects a secret parameter And calculate the system public key ,in =[1,2,...,q-1].

[0053] S104, KGC randomly selects another generator. And output the system's public parameters as pp={ , , e,q, The master private key is defined as follows: {, u, H1, H2, H3, H4}. It is secretly held by KGC.

[0054] Next, a key is generated via S2. This involves the data owner DO of the original file F and a set of storage servers. Interact with KGC to obtain each other's private and public keys. Then, KGC uses... Generate an aggregated public key APK from all public keys. Specifically:

[0055] S201, His identity information and current timestamp Send to KGC.

[0056] S202, KGC calculates the identity key And return it to DO.

[0057] S203, After receiving the identity key, the DO first checks... This verifies the validity of the identity key. If valid, proceed with further processing; otherwise, request the identity key again.

[0058] S204, DO selects a random secret value. Calculate the private key corresponding to DO

[0059] and public key Then DO released it. .

[0060] S205, similarly, refers to a storage server that stores DO files and has copies of them. Interact with KGC to obtain their own private and public keys. .in, For storage server Corresponding private key, For storage server Corresponding public key, For storage server Corresponding identity key, For storage server Corresponding ID, For storage server The system timestamp when the request was submitted. For storage server random secret value .

[0061] S206, KGC calculates the aggregate public key based on the public keys corresponding to all storage servers. ,in ,calculate At that time, public key It must be serialized into a bit string. Then KGC makes it public. .

[0062] Data processing is performed through S3. DO processes its owned data document F, including generating file hashes, creating copies, and generating file signatures. Specifically:

[0063] S301, First, calculate the hash value of data file F. Divide file F into n data blocks. . Generate L replicas The l-th copy of file F The construction of Since there is a one-to-one correspondence between the replica and the storage server, the replica sequence number l and the storage server sequence number l can be identical. Further divide the block into zones ,in . Divide the i-th data block into Each district, among which , For copy The maximum number of sectors into which a data block can be divided. Although dividing a data block into sectors can improve performance, subsequent tag calculations are still performed at the block level to reduce computational and communication overhead. That is, for a data block divided into sectors... For each region's data file, only n authentication tags need to be calculated.

[0064] S302, Based on the creation of copies, DO generates L file signatures. Then, it will copy the file and the corresponding file signature. Distribute to L For subsequent processing. That is, the l-th copy. and its corresponding file tags Send to the l-th server Further processing will be performed. The hash value of the original file. and the hash value of the original block Stored locally by DO for later data retrieval.

[0065] Generate an aggregate signature using S4, with L storage servers. Each entity verifies the correctness of the received file copy and its corresponding file signature, then calculates a partial block signature and sends it to the DO for aggregate signature generation.

[0066] S401, Through formula For file copies and corresponding file signatures The consistency is verified; if the equation holds, then... Proceed with subsequent operations; otherwise, it requests a copy again. Specifically:

[0067] S402, Calculate partial block labels for each data block Then, a partial set of block tags. Send to DO for aggregation.

[0068] S403, from L units Receive a set consisting of all partial block tags Then, DO calculates the aggregation label for each data block. Then it will aggregate tags. Send to .

[0069] S404, each The correctness of the received aggregate signature is verified by using a check formula: If the equation holds true, Accept aggregate signatures and tag sets and replica block sets Store it. Otherwise, Refuse to store.

[0070] Finally, a random challenge is created using the S5 third-party auditor TPA. Send it to all Each Generate corresponding audit certificates And return it to TPA. TPA Verification. The legality of the data stored is used to determine the validity of the data. The integrity of the data. Specifically:

[0071] S501, TPA creates a random challenge ,in From A set of c randomly selected indices, and The challenge will be randomly selected from among the participants. TPA will randomly select the challenge. Send to all .

[0072] S502, each Generate audit proof ,in , ,Then Will prove Send to TPA.

[0073] S503, TPA verifies the validity of received audit evidence using a bilinear mapping formula: If the equation is true, output "1" to prove that all... The data integrity has been verified; otherwise, output "0". Therefore, this application supports both public and batch auditing.

[0074] In one embodiment, assuming the first storage servers From the first To the The data block of the block is corrupted. From the neighboring Retrieve the corresponding copy ,in In order to rebuild a copy of itself: Data recovery does not require DO (Data Detection and Recovery) involvement. Here, "proximity to storage servers" refers to proximity in terms of network distance, such as physical proximity or low network hop count. Proximity significantly reduces network latency, while low network hop count improves data transfer speed and stability.

[0075] In one embodiment, when the DO wants to retrieve a specific data block, it retrieves it from the nearest storage server. Get the Data blocks .based on DO can retrieve plaintext data blocks as ,in Data is stored locally by DO. Since other entities cannot construct hash values ​​based on the original data blocks, they cannot extract plaintext from the encoded data, thus ensuring data privacy.

[0076] The term "nearest storage server" can be measured from multiple dimensions. For example, at the network level, it refers to physical proximity. A company located in Shanghai, whose data is stored on a local data center server in Shanghai, is considered "nearest" compared to servers stored in other cities (such as Urumqi). This results in shorter physical transmission routes, effectively reducing signal attenuation and interference during transmission, thus reducing latency. At the network level, it can also refer to low network latency. Even if the server and data owner are not geographically adjacent, the server with the shortest round-trip time (RTT) from the data owner's device to the server can be considered the closest. For instance, in some multinational corporations, employees work in Beijing, and data is stored on servers in the United States. However, due to optimized network lines and technologies, the US server has lower latency compared to servers with poor network conditions in other parts of China. Therefore, for the employee, this US server is the "nearest." At the network level, it can also refer to the fewest network hops. The server with the fewest network nodes (such as routers and switches) that data packets traverse from the data owner's device to the server can be considered the closest storage server.

[0077] The nearest server can also be measured from a performance perspective, including load balancing. If a data owner needs to quickly retrieve a large amount of data, then a server with reasonable CPU, memory, and disk I / O usage, and sufficient capacity to quickly respond to and process the data retrieval request, is the nearest. For example, after an e-commerce promotion, merchants need to quickly retrieve sales data from storage servers for analysis. If a server has a low load and can quickly process the data retrieval request, it is the nearest choice compared to servers that are already running at full capacity. Performance also includes response speed. Different servers will have different response times for the same data retrieval request due to differences in hardware configuration (such as high-performance hard drives, multi-core processors), software optimization, etc. A server with a fast response speed is equivalent to the nearest server. For example, in the financial industry, traders need to retrieve market data from storage servers in real time. A server with a fast response speed allows traders to obtain information and make decisions faster.

[0078] In one embodiment, assuming the DO's identity key has expired, the DO requests a new identity private key from the KGC. ,in This is a new timestamp, the timestamp at which the DO requests an update to its identity private key from the KGC. The DO then calculates its new private key. Based on the new private key, DO calculates the updated parameters. and send it to Each Sign its stored old files Updated to new .

[0079] In one embodiment, such as Figure 2 As shown, the interaction process between the various entities is as follows: (1) KGC is responsible for the initialization of the system, generating system public parameters and master private key. Based on the identity information and timestamp sent by DO and SS, it generates identity private keys for each of them and calculates the aggregate public key apk of all storage nodes for later verification. (2) DO divides the original data file F into blocks and generates multiple differentiated copies by performing an XOR operation with the hash value and the copy sequence number (consistent with the corresponding storage server) to achieve privacy protection. Subsequently, it generates a file signature for each copy and sends the different copies and their corresponding file signatures to the corresponding SS respectively. (3) After receiving the data copy and file signature sent by DO, SS first verifies its consistency. After the verification is passed, SS calculates a partial block label for each data block based on its own private key and sends it to DO. (4) DO collects the partial block labels sent by all SS, performs aggregation operation, generates the final aggregate label, and distributes it to all SS for storage. (5) During the audit phase, TPA initiates a random challenge and sends it to all SS. SS must calculate and return a data holding audit evidence based on the specified data copy blocks and tags stored therein. TPA verifies the correctness of this evidence through bilinear mapping operations to determine the integrity of the data stored on the SS. (6) During the data recovery phase, any SS with corrupted data can obtain the corresponding copy block from a neighboring SS and build its own copy block to perform data recovery. (7) During the data retrieval phase, DO can retrieve data from any SS and then perform a simple XOR operation to obtain the original data block content. (8) During the file signature update phase, DO obtains the updated identity key from KGC, calculates the tag update parameter based on the new and old identity keys, and sends the parameter to all SSs to update the file signature.

[0080] This application creatively proposes a multi-replica storage auditing scheme for multiple cloud service providers. This scheme allows each server and data owner to obtain their own independent private and public keys from a key generation center based on their own identity information and timestamps, and then calculate their complete private and public keys by combining them with self-selected secret parameters. The design utilizes certificateless signing, avoiding the certificate overhead of traditional public key infrastructures and solving the key escrow problem in identity-based signing.

[0081] During the data processing phase, this application first divides the original file and then XORs the original block with its hash value and the replica sequence number. This not only generates distinctive replica blocks but also protects data privacy because the hash value of the original block is stored only locally. The number of partitions is not fixed during data division, further enhancing the flexibility of the solution. Furthermore, if data corruption occurs on a cloud server, replica blocks can be retrieved directly from a neighboring server to complete data recovery without the data owner's involvement. This solution also allows the data owner to efficiently convert only a portion of the data blocks into readable plaintext.

[0082] Finally, this application also draws on the design concept of multi-signature. After the data owner completes the file partitioning and generates distinguishable copies, each copy is sent to the corresponding storage server. Each server uses its own complete private key and parameters derived from the public key of that server group to generate its own partial copy signature, which is then submitted to the data owner for aggregation. By distributing the tag generation task to each server, the data owner only needs to perform the aggregation operation, significantly reducing the computational burden on the local end.

[0083] Therefore, the beneficial effects of this application include:

[0084] 1. Adopting a certificateless signing system: The overall solution is based on certificateless signing and aggregated multi-signature technology to build a multi-certificateless signing mechanism, which not only gets rid of the certificate management overhead of traditional public key infrastructure, but also avoids the key custody problem in identity-based signing.

[0085] 2. Supports multi-replica, multi-cloud storage: Data copies are distributed across servers belonging to different cloud service providers, each using independent public and private keys. This mechanism effectively avoids the risk of data loss due to attacks or bankruptcy of a single cloud service provider.

[0086] 3. Local tag computation task transfer: The solution requires each cloud server to assign verifiable tags to the replica blocks, while the data owner only needs to aggregate the received replica tags on the local end, which significantly reduces the local computing burden.

[0087] 4. Supports data corruption recovery: If data on any server is corrupted, the server can directly obtain a copy block from a nearby service provider and autonomously complete the data recovery without the intervention of the data owner.

[0088] 5. Achieve data privacy protection: During the process of generating data copy blocks, the hash value of the original data block is introduced (this value is only stored on the owner's local end), so that no entity other than the data owner can obtain the original data content.

[0089] 6. Supports partial or full data retrieval: When accessing data, the owner can retrieve the entire file or a portion of the data block, which can be easily converted back into the original data content.

[0090] 7. The number of data partitions can be flexibly adjusted: Data blocks can be divided into different numbers of partitions to adapt to scenarios where the block size is not fixed due to semantically aware partitioning, thereby improving the applicability of the solution.

[0091] 8. Efficient Replacement of Owner Identity Key Upon Expiration: When the data owner identity key expires, only an update factor needs to be calculated locally and sent to each server, which will then automatically complete the file signature update. This process has extremely low computational overhead on the local end, being a constant-time operation.

[0092] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0093] Based on the same inventive concept, this application also provides a multi-cloud multi-replica storage auditing system based on multiple certificateless signatures for implementing the multi-cloud multi-replica storage auditing method based on multiple certificateless signatures described above. The solution provided by this system is similar to the implementation scheme described in the above method. Therefore, the specific limitations of one or more embodiments of the multi-cloud multi-replica storage auditing system based on multiple certificateless signatures provided below can be found in the limitations of the multi-cloud multi-replica storage auditing method based on multiple certificateless signatures described above, and will not be repeated here.

[0094] In one embodiment, such as Figure 2 As shown, a multi-cloud, multi-replica storage auditing system based on multiple certificate-free signatures is provided, comprising: a key generation center, a data owner, and several storage servers; wherein,

[0095] The key generation center is used to generate public parameters and master private keys, and to generate identity keys for the data owner and each storage server based on the public parameters and master private keys;

[0096] The data owner is used to generate the corresponding private key and public key based on the identity key of the data owner; it is also used to generate multiple copies of the data file divided into multiple data blocks, generate a corresponding file signature for each copy based on the private key of the data owner, and distribute the copies and file signatures to the corresponding storage servers;

[0097] The storage server is used to generate a private key and a public key corresponding to the storage server based on the identity key of the storage server, so that the key generation center can generate an aggregate public key based on the public key of each storage server; it is also used to generate a partial block tag for each data block based on the private key of the storage server, and receive the aggregate signature obtained by the data owner after aggregating the partial block tags generated by all storage servers, and store a copy and the aggregate tag after verifying the correctness of the aggregate signature.

[0098] Third-party auditing is used to audit the data integrity of storage servers based on aggregated public keys.

[0099] The modules in the aforementioned multi-cloud, multi-replica storage auditing system based on multiple certificate-free signatures can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of the computer device as software, so that the processor can invoke and execute the corresponding operations of each module.

[0100] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in all of the above method embodiments.

[0101] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in all of the above method embodiments.

[0102] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in all of the above method embodiments.

[0103] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0104] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0105] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0106] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for auditing multi-cloud, multi-replica storage based on multiple certificate-free signatures, characterized in that, The method includes: The key generation center generates public parameters and the master private key; The key generation center generates identity keys for the data owner and several storage servers respectively based on the public parameters and the master private key. The data owner and storage servers generate corresponding private keys and corresponding public keys based on the corresponding identity keys. The key generation center generates an aggregated public key based on the public keys of several storage servers. The data owner generates multiple copies of the data blocks divided into the data file, generates a corresponding file signature for each copy based on the data owner's private key, and distributes the copies and the file signatures to the corresponding storage servers. After the storage server successfully verifies the copy and the file signature based on the public key corresponding to the data owner, it generates a partial block tag for each data block based on the private key corresponding to the storage server, and receives the aggregated signature obtained by the data owner after aggregating the partial block tags generated by all storage servers. After verifying the correctness of the aggregated signature, the storage server stores the copy and the aggregated tag. A third-party auditor performs a data integrity audit on the storage server based on the aggregated public key.

2. The method according to claim 1, characterized in that, The key generation center generates identity keys for the data owner and several storage servers respectively, based on the public parameters and the master private key, including: The key generation center generates the corresponding identity key based on the identity information and timestamps sent by the data owner and several storage servers.

3. The method according to claim 1, characterized in that, The third-party audit, based on the aggregated public key, performs data integrity audits on the storage server, including: A third-party audit creates a random challenge and sends it to all storage servers; After receiving the audit proof for the random challenge generated by each storage server based on the replica and the aggregation tag, the correctness of the audit proof is verified by a bilinear mapping operation to determine the data integrity on the corresponding storage server.

4. The method according to claim 1, characterized in that, The method further includes: The replicas stored in the storage server are obtained by performing an XOR operation on the data block, the hash value of the data block, and the storage server sequence number.

5. The method according to claim 4, characterized in that, The method further includes: When a data block on a storage server is corrupted, a copy of the corrupted data block is obtained from a neighboring storage server to rebuild the corrupted data block.

6. The method according to claim 5, characterized in that: The reconstructed corrupted data block is obtained by performing an XOR operation on the corresponding copy of the corrupted data block obtained from the neighboring storage server, the neighboring storage server sequence number, and the storage server sequence number of the corrupted data block.

7. The method according to claim 4, characterized in that, The method further includes: When the data owner retrieves a data block, a copy of the data block to be retrieved is obtained from the nearest storage server. The data block to be retrieved is obtained by performing an XOR operation on the copy of the data block to be retrieved obtained from the nearest storage server, the hash value of the data block to be retrieved, and the sequence number of the nearest storage server.

8. The method according to claim 7, characterized in that: The hash value of the data block is stored locally on the data owner's machine.

9. The method according to claim 2, characterized in that, The method further includes: When the identity key corresponding to the data owner has expired, the key generation center updates the identity key according to the new timestamp; The data owner updates the file signature based on the updated identity key.

10. A multi-cloud, multi-replica storage auditing system based on multiple certificate-free signatures, characterized in that, The system includes a key generation center, a data owner, and several storage servers: wherein, The key generation center is used to generate public parameters and a master private key, and to generate identity keys for the data owner and each storage server respectively based on the public parameters and the master private key; The data owner is used to generate a private key and a public key corresponding to the data owner based on the identity key of the data owner; it is also used to generate multiple copies of the multiple data blocks divided into data files, generate a corresponding file signature for each copy based on the private key of the data owner, and distribute the copies and the file signatures to the corresponding storage servers. The storage server is used to generate a private key and a public key corresponding to the storage server based on the identity key of the storage server, so that the key generation center can generate an aggregate public key based on the public key corresponding to each storage server; it is also used to generate a partial block tag for each data block based on the private key corresponding to the storage server, and receive the aggregate signature obtained by the data owner after aggregating the partial block tags generated by all storage servers, and store a copy and the aggregate tag after verifying the correctness of the aggregate signature. Third-party auditing is used to perform data integrity auditing on the storage server based on the aggregated public key.

Images