A method and system for aggregated storage attestation

Abstract

The application discloses a kind of polymeric storage certification method and system, it is related to blockchain technology and distributed storage field, which comprises the following steps: generating a key pair based on the data in the target file set;Obtain challenge value;Single file certificate is generated based on challenge value, the data of storage file and evidence key;Get aggregated proof based on multiple single file certificates and challenge value;Get aggregated verification key based on verification key;Determine whether aggregated proof and aggregated verification key satisfy bilinear mapping equation based on public key;If it satisfies bilinear mapping equation, the target file set is correctly stored and has not been tampered at challenge time;If it does not satisfy bilinear mapping equation, the target file set is not correctly stored or tampered at challenge time;Challenge time refers to the time when challenge value is obtained.The application can improve the efficiency of batch storage certification aggregation verification.

Description

Technical Field

[0001] This application relates to the fields of blockchain technology and distributed storage, and in particular to an aggregated storage proof method and system. Background Technology

[0002] With the explosive growth of data volume, traditional centralized storage models face problems such as single points of failure and loss of data sovereignty, leading to the emergence of decentralized storage networks (DSNs). In decentralized storage systems, proofs of storage are the core cryptographic tool for verifying the integrity of data in the cloud. Essentially, they enable verifiers to be confident with a high probability that the storage provider holds the correct copy of the data without transmitting the complete data.

[0003] As decentralized storage networks continue to expand, the bottleneck problem of proof verification in large-scale storage scenarios is becoming increasingly prominent. Traditional storage proof mechanisms typically require independent verification of each proof in multi-file, multi-node scenarios, and the on-chain computational and communication overhead increases rapidly with the number of proofs. Verifying massive amounts of data unit by unit leads to significant latency and may even cause the entire verification system to fail, making it difficult to meet the needs of large-scale storage in the Web3.0 era.

[0004] To address the aforementioned bottlenecks in proof verification, academia and industry have proposed several convergent verification technology approaches, mainly including the following three directions: (1) Aggregation schemes based on zero-knowledge proofs. Zero-knowledge proofs (such as zero-knowledge succinct non-interactive proof of knowledge (zk-SNARK)) have been introduced into the field of privacy-preserving auditing, which can reduce the on-chain verification cost of storing proofs by two orders of magnitude while protecting data privacy. The communication overhead of the zk-SNARK enhanced protocol can reach the O(1) level. However, the proof generation process of such schemes has high computational complexity, usually at the O(m) level, which requires a lot of computing resources and imposes strict requirements on the hardware configuration of the prover.

[0005] (2) Aggregation scheme based on recursive proof. The recursive proof system achieves incremental aggregation through the proof of proof, which in theory can compress any number of proofs into a constant size. However, the construction complexity of recursive circuits is extremely high, and each level of recursion introduces additional computational overhead, which faces significant performance bottlenecks in actual engineering deployment.

[0006] (3) Homomorphic algebraic aggregation schemes. Using bilinear mappings or homomorphic hashing algebraic structures, aggregation operations can be directly performed on underlying proofs. Early PP-PDP (Privacy-Preserving Provable DataPossession) schemes introduced homomorphic linear authenticators (HLAs) to achieve linear aggregation of multiple proofs; CPDP (Cooperative Provable DataPossession) schemes, by building a multi-service provider collaboration mechanism, enable third-party auditors to verify distributed data with near-single-cloud overhead. However, existing homomorphic algebraic aggregation schemes have significant limitations in practical applications: they do not support efficient batch proof aggregation verification; verifiers still need to perform independent verification processes for each stored proof, making it impossible to truly verify multiple proofs at once. Their scalability is severely limited in large-scale, multi-node scenarios, making them difficult to adapt to decentralized networks containing hundreds of thousands of storage nodes.

[0007] In summary, the current decentralized storage proof verification field mainly faces the following two core problems: First, the computational complexity of proof generation and verification is too high. While zero-knowledge proof aggregation schemes can achieve constant-level communication and verification overhead, the proof generation phase requires complex arithmetic circuit operations. The computational complexity of proof generation in the zk-SNARK scheme is... In practice, it can take several seconds or even minutes to generate a single proof. This high computational cost limits the deployment of the solution on resource-constrained nodes, making it difficult to meet the real-time auditing requirements of tens of thousands of nodes in large-scale storage networks. While recursive proof systems are theoretically elegant, the additional overhead introduced by each level of recursion makes them difficult to implement in engineering practice.

[0008] II. Verification communication overhead and on-chain gas consumption increase linearly with scale. Traditional storage proof mechanisms (such as PDP (Provable Data Possession) and PoR (Proof of Retrievability)) require validators to receive and process independent proofs submitted by each storage node when handling multi-file, multi-node scenarios. Experiments show that when the number of proofs increases from 2 to 32, the communication payload in sequential verification mode increases from 784 bytes to 12,896 bytes, exhibiting a strict linear growth trend. Simultaneously, on-chain gas consumption also increases linearly, from 223,000 Gas for a single proof to 5,031,000 Gas for 32 proofs. In ultra-large-scale networks (such as those containing hundreds of thousands of storage nodes), this linearly increasing communication overhead and gas consumption will severely deplete network bandwidth and on-chain resources, making verification costs unbearable. Summary of the Invention

[0009] The purpose of this application is to provide an aggregated storage proof method and system that can improve the efficiency of batch storage proof aggregate verification.

[0010] To achieve the above objectives, this application provides the following solution: Firstly, this application provides an aggregated storage proof method, including: A key pair is generated based on the data in the target file set; the key pair includes a public key, an evidence key, and a verification key; the target file set includes multiple target files; during the process of storing files from the data owner to the storage service provider, the files in the data owner are target files, and the files in the storage service provider are storage files; Gain challenge points; A single-file proof is generated based on the challenge value, the data in the stored file, and the evidence key; An aggregated proof is derived based on multiple single-file proofs and the challenge value; The aggregated verification key is obtained based on the verification key; Based on the public key, determine whether the aggregated proof and the aggregated verification key satisfy the bilinear mapping equation; if the bilinear mapping equation is satisfied, the target file set is correctly stored and not tampered with at the challenge time; if the bilinear mapping equation is not satisfied, the target file set is not correctly stored or tampered with at the challenge time; the challenge time refers to the moment when the challenge value is obtained.

[0011] In one embodiment, the public key includes a first generator, a second generator, a mapping cyclic group, a first global perturbation constant, a second global perturbation constant, the number of target files, and remainder coefficients; the evidence key includes random mask coefficients, elements of the first quotient group, and elements of the second quotient group. Generate key pairs based on data in the target file set, including: Obtain a first generator and a second generator; construct a first cyclic group and a second cyclic group based on the first generator and the second generator, respectively; obtain a mapping cyclic group based on the first cyclic group and the second cyclic group. A hash function is used to generate a first perturbation constant and a second perturbation constant based on the current timestamp; A first division polynomial is constructed based on the first perturbation constant; a second division polynomial is constructed based on the second perturbation constant; the first global perturbation constant and the second global perturbation constant are determined based on the first perturbation constant and the second perturbation constant, respectively. The data in the target file is encoded to obtain a coefficient vector; Construct a data polynomial based on the coefficient vector; A mask polynomial is constructed based on random mask coefficients; the random mask coefficients are randomly generated. The difference polynomial is obtained based on the data polynomial and the mask polynomial; The mask polynomial and the difference polynomial are decomposed using Euclidean division based on the first and second dividing polynomials, respectively; the remainder coefficients are determined based on the remainders of the decomposed mask polynomial and the remainders of the decomposed difference polynomial. The elements of the first quotient group are determined based on the quotient of the decomposed mask polynomial; the elements of the second quotient group are determined based on the quotient of the decomposed difference polynomial. The verification key is obtained based on the remainder coefficients.

[0012] In one embodiment, the single-file proof includes a response value, a first proof element, and a second proof element; Generate a single-file proof based on the challenge value, the data in the stored file, and the evidence key, including: Encode the data in the storage file to obtain the storage coefficient vector; Construct a storage data polynomial based on the storage coefficient vector; The response value is obtained based on the stored data polynomial and the challenge value; The first proof element is obtained based on the challenge value and the elements of the first quotient group. The second proof element is obtained based on the challenge value and the elements of the second quotient group.

[0013] In one implementation, an aggregated proof is obtained based on multiple single-file proofs and the challenge value, including: A random oracle is used to generate the aggregation coefficient of the target file based on the challenge value and the identifier of the target file; The aggregation coefficient is used to aggregate multiple single-file proofs to obtain the aggregated proof.

[0014] In one embodiment, the aggregation proof includes an aggregation response value, a first aggregation proof element, and a second aggregation proof element; The aggregated proof is obtained by aggregating multiple single-file proofs using the aggregation coefficient, including: The aggregated response value is obtained by weighted summing of the response values ​​from multiple single-file proofs using the aggregation coefficient. The aggregation coefficient is used to perform exponential aggregation on the first and second proof elements in multiple single-file proofs to obtain the first aggregated proof element and the second aggregated proof element.

[0015] In one embodiment, obtaining the aggregated verification key based on the verification key includes: The verification key is obtained by exponentially aggregating the aggregation coefficient.

[0016] In one embodiment, the random oracle is represented as: ; In the formula, Indicates the first The aggregation coefficients of the target files Represents a cryptographically secure hash function. This indicates that a random salt value is publicly available. Indicates the challenge value. Indicates the first The identifier of the target file.

[0017] In one embodiment, the bilinear mapping equation is expressed as: ; In the formula, Represents a bilinear mapping. Denotes the first generator. This represents the power of the aggregate response value of the second generator. , Let represent the first perturbation constant and the second perturbation constant, respectively. Indicates the challenge value. , These represent the first aggregate proof element and the second aggregate proof element, respectively. This represents the aggregated verification key.

[0018] Secondly, this application provides an aggregated storage proof system, comprising: a data ownership end and a storage service end; the data ownership end is connected to the storage service end; the data ownership end stores a set of target files; the set of target files includes multiple target files; The data owner is used to generate key pairs based on data in the target file set; the key pairs include a public key, an evidence key, and a verification key; the data owner is also used to obtain a challenge value; The storage service terminal is used to generate a single-file proof based on the challenge value, the data of the stored file, and the evidence key; wherein, during the process of storing the file from the data owner terminal to the storage service terminal, the file in the data owner terminal is the target file, and the file in the storage service terminal is the stored file; The data owner is also used to obtain an aggregated proof based on multiple single-file proofs and the challenge value; the data owner is also used to obtain an aggregated verification key based on the verification key; the data owner is also used to determine whether the aggregated proof and the aggregated verification key satisfy the bilinear mapping equation based on the public key; if the bilinear mapping equation is satisfied, the target file set is correctly stored and not tampered with at the challenge time; if the bilinear mapping equation is not satisfied, the target file set is not correctly stored or tampered with at the challenge time; the challenge time refers to the time when the challenge value is obtained.

[0019] In one embodiment, the data ownership terminal includes an original file module, a key pair generation module, a proof aggregation module, and an aggregation verification module; the original file module is connected to the storage service terminal; the key pair generation module is connected to the original file module, the proof aggregation module, and the storage service terminal respectively; the proof aggregation module is connected to the storage service terminal; and the aggregation verification module is connected to the storage service terminal and the proof aggregation module respectively. The original file module stores the target file set; the original file module is used to store the target file set to the storage service client; The key pair generation module is used to generate the key pair based on the data in the target file set; The proof aggregation module is used to obtain the aggregated proof based on multiple single-file proofs and the challenge value; the proof aggregation module is also used to obtain the aggregated verification key based on the verification key; The aggregation verification module is used to generate a challenge value; the aggregation verification module is also used to determine, based on the public key, whether the aggregation proof and the aggregation verification key satisfy the bilinear mapping equation.

[0020] According to the specific embodiments provided in this application, this application has the following technical effects: This application provides an aggregated storage proof method and system. It generates key pairs based on data in a target file set, and generates single-file proofs based on challenge values, data in the stored files, and evidence keys. Then, it obtains aggregated proofs based on multiple single-file proofs and challenge values, aggregating the single-file proofs of multiple files into a fixed-size aggregated proof. This significantly reduces network transmission bandwidth requirements and reduces data storage occupation (Gas fees) on the blockchain, solving the problem of linearly increasing communication overhead and Gas consumption severely consuming network bandwidth and on-chain resources in existing technologies. Finally, it determines whether the aggregated proof and aggregated verification key satisfy the bilinear mapping equation based on the public key, so that no matter how large the number of target files N to be verified is, only one bilinear pairing operation is needed to complete the verification of the target file set, reducing the verification complexity from O(N) to O(1), improving the efficiency of batch storage proof aggregated verification, and greatly saving computing resources. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of an aggregated storage proof method according to an embodiment of this application; Figure 2 This is a schematic diagram of the structure of an aggregated storage proof system according to an embodiment of this application. Detailed Implementation

[0023] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0024] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0025] In one exemplary embodiment, such as Figure 1 As shown, an aggregated storage proof method is provided, including: Step S1: Generate a key pair based on the data in the target file set. The key pair includes a public key, a evidence key, and a verification key. The target file set includes multiple target files. During the process of storing files from the data owner to the storage service provider, the files in the data owner's end are the target files, and the files in the storage service provider's end are the storage files.

[0026] Step S2: Obtain the challenge value.

[0027] Step S3: Generate a single-file proof based on the challenge value, the data in the stored file, and the evidence key.

[0028] Step S4: Obtain the aggregated proof based on multiple single-file proofs and challenge values.

[0029] Step S5: Obtain the aggregated verification key based on the verification key.

[0030] Step S6: Determine whether the aggregate proof and aggregate verification keys satisfy the bilinear mapping equation based on the public key. If the bilinear mapping equation is satisfied, the target file set is correctly stored and has not been tampered with at the challenge time. If the bilinear mapping equation is not satisfied, the target file set is not correctly stored or has been tampered with at the challenge time. The challenge time refers to the moment when the challenge value is obtained.

[0031] In one embodiment, the public key includes a first generator, a second generator, a mapping cyclic group, a first global perturbation constant, a second global perturbation constant, the number of target files, and remainder coefficients. The evidence key includes random mask coefficients, elements of the first quotient group, and elements of the second quotient group. Based on this, the implementation process of generating key pairs based on data in the target file set in step S1 includes: S11, obtain the first generator and the second generator. Construct the first cyclic group and the second cyclic group based on the first generator and the second generator, respectively. Obtain the mapping cyclic group based on the first cyclic group and the second cyclic group.

[0032] S12, using a hash function to generate the first perturbation constant and the second perturbation constant based on the current timestamp.

[0033] S13. Construct a first dividing polynomial based on the first perturbation constant. Construct a second dividing polynomial based on the second perturbation constant. Determine the first global perturbation constant and the second global perturbation constant based on the first perturbation constant and the second perturbation constant, respectively.

[0034] S14: Encode the data in the target file to obtain a coefficient vector. Construct a data polynomial based on the coefficient vector.

[0035] S15, Constructing a mask polynomial based on random mask coefficients. The random mask coefficients are generated randomly. Specifically, the random mask coefficients are derived from a finite field. Generated by uniform random sampling.

[0036] S16, the difference polynomial is obtained based on the data polynomial and the mask polynomial.

[0037] S17. The mask polynomial and the difference polynomial are decomposed using Euclidean division based on the first and second dividing polynomials, respectively. The remainder coefficients are determined based on the remainders of the decomposed mask polynomial and the difference polynomial.

[0038] S18. Determine the elements of the first quotient group based on the quotient of the decomposed mask polynomial. Determine the elements of the second quotient group based on the quotient of the decomposed difference polynomial.

[0039] S19, the verification key is obtained based on the remainder coefficient.

[0040] For example, select the first generator. Second generator Based on and Constructing a prime number First cyclic group Second Cyclic Group , And on and Bilinear mapping yields the mapping cyclic group. ,Right now , This represents a bilinear mapping function.

[0041] Using a hash function based on the current timestamp Calculate two fundamental parameters (the first perturbation constant is one of them). Second perturbation constant ): . Represents a cryptographically secure hash function; 00 indicates a field separator label used to distinguish the hash calculations of the first and second perturbation constants. The hash calculations are performed based on the first perturbation constant. Second perturbation constant Construct the first divisor polynomial Second division polynomial In practical deployments, these perturbations can be replaced with on-chain random numbers or VRF (Verifiable Random Function) outputs to enhance unpredictability. A first global perturbation constant is determined based on the first and second perturbation constants. Second global disturbance constant : .

[0042] The first target files Content encoded as a finite field coefficient vector on (That is, encoding the data in the target files to obtain a coefficient vector). The target file set includes N target files. The upper bound of the polynomial degree is given by the object file. The size determines the further construction of the data polynomial: .

[0043] In the formula, Indicates the first The data polynomial of the target file, This represents the encoded value of the original data block (a finite field element, i.e., the first...). The data polynomial of the nth target file (coefficients) The independent variable of a polynomial.

[0044] Generate random mask coefficients Based on this, a mask polynomial is constructed: .

[0045] In the formula, Indicates the first The data polynomial of the target file, Indicates the first In the mask polynomial of the n target files, the th A random mask coefficient.

[0046] Further define the difference polynomial . Indicates the first The difference polynomial of the target files.

[0047] Based on respectively and Using Euclidean division to and Decompose: .

[0048] .

[0049] In the formula, This represents the quotient of the mask polynomial after decomposition. ; This represents the quotient of the difference polynomial after decomposition. ; This represents the remainder of the mask polynomial after decomposition. This represents the remainder of the difference polynomial after decomposition. Based on this, the total remainder polynomial is calculated. .in, Indicates the first The coefficients of the linear terms of the total remainder polynomial of each target file Indicates the first The constant term coefficients of the total remainder polynomial of each target file.

[0050] based on and Generating remainder coefficients: . Denotes the coefficients of the remainder of the constant term. This represents the coefficient of the linear remainder.

[0051] The elements of the first quotient group are determined based on the quotient of the mask polynomial after the above decomposition. : The elements of the second quotient group are determined based on the quotient of the difference polynomial after the above decomposition. : .

[0052] The verification key is obtained based on the remainder coefficients: . Indicates the first The verification key for each target file. In all embodiments provided in this application, This represents a calculation and is denoted as; for example, This indicates calculation And record the calculation result as .

[0053] Finally, the public key was obtained. , Evidence Key and verification key .

[0054] In one embodiment, to ensure the unpredictability and verifiability of the challenge, step S2 can be implemented as follows: from a finite domain A single element is randomly selected from the uniformly distributed elements as the challenge value: .

[0055] A single-file proof includes a response value, a first proof element, and a second proof element. Based on this, the implementation process of step S3 includes: S31, the data in the storage file is encoded to obtain the storage coefficient vector.

[0056] S32, constructs a storage data polynomial based on the storage coefficient vector.

[0057] S33, based on the stored data polynomial and challenge value, yields the response value.

[0058] S34, the first proof element is obtained based on the challenge value and the elements of the first quotient group.

[0059] S35, based on the challenge value and the elements of the second quotient group, the second proof element is obtained.

[0060] For example, in the target files After being stored on the storage service server, the storage file will be stored on the storage service server. Content encoded as a finite field Storage coefficient vector on (That is, encoding the data in the stored file to obtain the stored coefficient vector). And constructing the stored data polynomial. : Further calculation of the stored data polynomial for the challenge value. The value of is used as the response value. : .

[0061] This calculation requires that the stored file must hold complete file data coefficients (i.e., the stored coefficient vector is the same as the coefficient vector), thus proving data holding.

[0062] Using the elements of the first and second quotient groups in the evidence key, the exponential forms of the two quotients with respect to the challenge value are calculated respectively to obtain the first proof element. Second Proof : .

[0063] .

[0064] Finally, the number was obtained Single file proof of storage files .

[0065] In one embodiment, to prevent malicious aggregators from concealing invalid proofs, the implementation process of step S4 includes: S41 uses a random oracle to generate the aggregation coefficients of the corresponding target file based on the challenge value and the identifier of the target file. The random oracle is represented as follows: .

[0066] In the formula, Indicates the first The aggregation coefficients of the target files This refers to a cryptographically secure hash function (such as a collision-resistant hash function). This indicates that a random salt value is publicly available. Indicates the challenge value. Indicates the first The identifier of the target file.

[0067] S42, aggregate multiple single-file proofs using aggregation coefficients to obtain an aggregated proof. The aggregated proof includes an aggregated response value, a first aggregated proof element, and a second aggregated proof element. Specifically, the response values ​​from multiple single-file proofs are weighted and summed using aggregation coefficients to obtain the aggregated response value. The first and second proof elements from multiple single-file proofs are then exponentially aggregated using aggregation coefficients to obtain the first and second aggregated proof elements.

[0068] For example, the aggregation coefficient is used to perform a weighted summation of all response values: .

[0069] In the formula, This represents the aggregate response value.

[0070] Utilizing the homomorphism of the bilinear group, exponential aggregation is performed on all first and second proof elements using aggregation coefficients: .

[0071] .

[0072] In the formula, Denotes the first aggregate proof element. This represents the second aggregate proof element.

[0073] Finally, the aggregation proof was obtained. The size of the aggregate proof is It always consists of one domain element (i.e., the aggregate response value) and two group elements (i.e., the first aggregate proof element and the second aggregate proof element), and the number of original proofs (i.e., the target file) Complete decoupling.

[0074] The implementation process of step S5 includes: The verification keys are exponentially aggregated using aggregation coefficients to obtain the aggregated verification key. Specifically, the verification keys for each target file are aggregated according to the aggregation method described above: .

[0075] In the formula, This represents the aggregated verification key.

[0076] In one implementation, by verifying whether the bilinear mapping equation holds true (i.e., determining whether the bilinear mapping equation is satisfied) based on the aforementioned aggregate proof, aggregate verification key, and publicly available parameters in the public key (i.e., the first generator, the second generator, the first global perturbation constant, and the second global perturbation constant), it can be determined whether the target file set is correctly stored and has not been tampered with at the challenge time. If the bilinear mapping equation holds true (i.e., the bilinear mapping equation is satisfied), then output 1 (i.e., the target file set is correctly stored and has not been tampered with at the challenge time). If the bilinear mapping equation does not hold true (i.e., the bilinear mapping equation is not satisfied), then output 0 (i.e., the target file set is not correctly stored or has been tampered with at the challenge time).

[0077] The bilinear mapping equation can be expressed as: .

[0078] In the formula, Represents a bilinear mapping. Denotes the first generator. The second generator represents the power of the aggregate response value (i.e., the second generator). of (power of power) , Let represent the first perturbation constant and the second perturbation constant, respectively. Indicates the challenge value. , These represent the first aggregate proof element and the second aggregate proof element, respectively. This represents the aggregated verification key.

[0079] The above bilinear mapping equation satisfies batch integrity; if at least one invalid single-file proof exists in the aggregate proof, the probability of successful verification is at most 1 / 3. ( (where is the order of the cyclic group), which is negligible in a cryptographic sense.

[0080] Compared with traditional one-by-one verification schemes, the core advantage of this application lies in reducing the computational complexity of the verification side from Reduce to In actual computation, the number of bilinear pairing operations ranges from... The number of verification operations is reduced to a fixed 3 (i.e., when verifying the bilinear mapping equation, a bilinear pairing operation is performed once for each of the first aggregate proof element, the second aggregate proof element, and the aggregate verification key), thus achieving complete decoupling between verification overhead and the number of proofs.

[0081] In conjunction with the content of the above embodiments, this application has the following beneficial effects: 1. Qualitative leap in verification efficiency (constant-level verification): This application utilizes the properties of bilinear mapping to achieve homomorphic aggregation. It supports efficient batch proof aggregation verification. No matter how large the number of target files N to be verified is (e.g., 1000 or 10000), only one bilinear pairing operation needs to be performed (i.e., step S6 is executed), reducing the verification complexity from O(N) to O(1), which greatly saves computing resources.

[0082] 2. Ultimate optimization of communication and storage resources: Through the aggregation algorithm (i.e., step S4), the single-file proofs of N files are compressed into a fixed-size aggregated proof. This significantly reduces network transmission bandwidth requirements and reduces data storage consumption (Gas fees) on the blockchain, enabling multiple proofs to be verified once and solving the state explosion problem.

[0083] 3. Intrinsic security and anti-counterfeiting: Dynamic weights are introduced during the aggregation process. (Based on salt, file identifier, and challenge value). This design ensures that attackers (i.e., malicious storage service providers whose aim is to deceive the data owner into believing that the data is stored correctly even if the target file data is not actually stored or has been tampered with) cannot cancel each other out during the aggregation process by constructing specific erroneous data blocks, thus guaranteeing that the security of aggregation verification is completely equivalent to that of step-by-step verification.

[0084] Based on the same inventive concept, this application also provides an aggregated storage proof system for implementing the aggregated storage proof method described above. The solution provided by this system is similar to the implementation described in the above method; therefore, the specific limitations in one or more aggregated storage proof system embodiments provided below can be found in the limitations of the aggregated storage proof method described above, and will not be repeated here.

[0085] In one exemplary embodiment, such as Figure 2 As shown, an aggregated storage proof system is provided, comprising: a data ownership end and a storage service end. The data ownership end is connected to the storage service end. The data ownership end stores a set of target files. The set of target files includes multiple target files.

[0086] The data owner is used to generate key pairs based on data in the target file set. Each key pair includes a public key, a proof key, and a verification key. The data owner is also used to obtain the challenge value.

[0087] The storage service is used to generate a single-file proof based on the challenge value, the data in the stored file, and the evidence key. Specifically, during the process of storing a file from the data owner to the storage service, the file in the data owner's end is the target file, and the file in the storage service is the stored file.

[0088] The data ownership end is also used to derive an aggregated proof based on multiple single-file proofs and challenge values. It is also used to obtain an aggregated verification key based on the verification key. Furthermore, it is used to determine, based on the public key, whether the aggregated proof and the aggregated verification key satisfy the bilinear mapping equation. If the bilinear mapping equation is satisfied, the target file set is correctly stored and not tampered with at the challenge time. If the bilinear mapping equation is not satisfied, the target file set is not correctly stored or has been tampered with at the challenge time. The challenge time refers to the moment when the challenge value is obtained.

[0089] As an optional implementation, the data ownership terminal includes an original file module, a key pair generation module, a proof aggregation module, and an aggregation verification module. The original file module is connected to the storage service terminal. The key pair generation module is connected to the original file module, the proof aggregation module, and the storage service terminal, respectively. The proof aggregation module is connected to the storage service terminal. The aggregation verification module is connected to both the storage service terminal and the proof aggregation module, respectively.

[0090] The original file module stores the set of target files. The original file module is used to store the set of target files to the storage service provider.

[0091] The key pair generation module is used to generate key pairs based on data in the target file set.

[0092] The proof aggregation module is used to derive aggregated proofs based on multiple single-file proofs and challenge values. The proof aggregation module is also used to derive aggregated verification keys based on verification keys.

[0093] The aggregation verification module is used to generate challenge values. It also determines, based on the public key, whether the aggregation proof and the aggregation verification key satisfy the bilinear mapping equation.

[0094] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0095] In one exemplary embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0096] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0097] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0098] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0099] The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, etc., and are not limited to these.

[0100] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0101] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for aggregated storage proof, characterized in that, include: Generate key pairs based on the data in the target file set; The key pair includes a public key, an evidence key, and a verification key; The target file set includes multiple target files; In the process of storing a file from the data owner to the storage service provider, the file in the data owner is the target file, and the file in the storage service provider is the storage file. Gain challenge points; A single-file proof is generated based on the challenge value, the data in the stored file, and the evidence key; An aggregated proof is derived based on multiple single-file proofs and the challenge value; The aggregated verification key is obtained based on the verification key; Based on the public key, determine whether the aggregated proof and the aggregated verification key satisfy the bilinear mapping equation; if the bilinear mapping equation is satisfied, the target file set is correctly stored and not tampered with at the challenge time; if the bilinear mapping equation is not satisfied, the target file set is not correctly stored or tampered with at the challenge time; the challenge time refers to the moment when the challenge value is obtained.

2. The method of claim 1, wherein, The public key includes a first generator, a second generator, a mapping cyclic group, a first global perturbation constant, a second global perturbation constant, the number of target files, and remainder coefficients; the evidence key includes random mask coefficients, elements of the first quotient group, and elements of the second quotient group. Generate key pairs based on data in the target file set, including: Obtain a first generator and a second generator; construct a first cyclic group and a second cyclic group based on the first generator and the second generator, respectively; obtain a mapping cyclic group based on the first cyclic group and the second cyclic group. A hash function is used to generate a first perturbation constant and a second perturbation constant based on the current timestamp; A first division polynomial is constructed based on the first perturbation constant; a second division polynomial is constructed based on the second perturbation constant; the first global perturbation constant and the second global perturbation constant are determined based on the first perturbation constant and the second perturbation constant, respectively. The data in the target file is encoded to obtain a coefficient vector; Construct a data polynomial based on the coefficient vector; A mask polynomial is constructed based on random mask coefficients; the random mask coefficients are randomly generated. The difference polynomial is obtained based on the data polynomial and the mask polynomial; The mask polynomial and the difference polynomial are decomposed using Euclidean division based on the first and second dividing polynomials, respectively; the remainder coefficients are determined based on the remainders of the decomposed mask polynomial and the remainders of the decomposed difference polynomial. The elements of the first quotient group are determined based on the quotient of the decomposed mask polynomial; the elements of the second quotient group are determined based on the quotient of the decomposed difference polynomial. The verification key is obtained based on the remainder coefficients.

3. The method of claim 2, wherein, The single-file proof includes a response value, a first proof element, and a second proof element; Generate a single-file proof based on the challenge value, the data in the stored file, and the evidence key, including: Encode the data in the storage file to obtain the storage coefficient vector; Construct a storage data polynomial based on the storage coefficient vector; The response value is obtained based on the stored data polynomial and the challenge value; The first proof element is obtained based on the challenge value and the elements of the first quotient group. The second proof element is obtained based on the challenge value and the elements of the second quotient group.

4. The aggregated storage proof method according to claim 3, characterized in that, An aggregated proof is derived based on multiple single-file proofs and the challenge value, including: A random oracle is used to generate the aggregation coefficient of the target file based on the challenge value and the identifier of the target file; The aggregation coefficient is used to aggregate multiple single-file proofs to obtain the aggregated proof.

5. The aggregated storage proof method according to claim 4, characterized in that, The aggregation proof includes an aggregation response value, a first aggregation proof element, and a second aggregation proof element; The aggregated proof is obtained by aggregating multiple single-file proofs using the aggregation coefficient, including: The aggregated response value is obtained by weighted summing of the response values ​​from multiple single-file proofs using the aggregation coefficient. The aggregation coefficient is used to perform exponential aggregation on the first and second proof elements in multiple single-file proofs to obtain the first aggregated proof element and the second aggregated proof element.

6. The aggregated storage proof method according to claim 4, characterized in that, Based on the verification key, an aggregated verification key is obtained, including: The verification key is obtained by exponentially aggregating the aggregation coefficient.

7. The aggregated storage proof method according to claim 4, characterized in that, The random oracle is represented as: ； In the formula, Indicates the first The aggregation coefficients of the target files Represents a cryptographically secure hash function. This indicates that the random salt value is publicly available. Indicates the challenge value. Indicates the first The identifier of the target file.

8. The aggregated storage proof method according to claim 1, characterized in that, The bilinear mapping equation is expressed as: ； In the formula, Represents a bilinear mapping. Denotes the first generator. Indicates the second generator Aggregate response value Power of 1 , Let represent the first perturbation constant and the second perturbation constant, respectively. Indicates the challenge value. , These represent the first aggregate proof element and the second aggregate proof element, respectively. This represents the aggregated verification key.

9. An aggregated storage proof system, characterized in that, include: The data owner and the storage service provider are connected; The data owner stores a set of target files; The target file set includes multiple target files; The data owner is used to generate key pairs based on data in the target file set; the key pairs include a public key, an evidence key, and a verification key; the data owner is also used to obtain a challenge value; The storage service terminal is used to generate a single-file proof based on the challenge value, the data of the stored file, and the evidence key; wherein, during the process of storing the file from the data owner terminal to the storage service terminal, the file in the data owner terminal is the target file, and the file in the storage service terminal is the stored file; The data owner is also used to obtain an aggregated proof based on multiple single-file proofs and the challenge value; the data owner is also used to obtain an aggregated verification key based on the verification key; the data owner is also used to determine whether the aggregated proof and the aggregated verification key satisfy the bilinear mapping equation based on the public key; if the bilinear mapping equation is satisfied, the target file set is correctly stored and not tampered with at the challenge time; if the bilinear mapping equation is not satisfied, the target file set is not correctly stored or tampered with at the challenge time; the challenge time refers to the time when the challenge value is obtained.

10. The aggregated storage proof system according to claim 9, characterized in that, The data ownership terminal includes an original file module, a key pair generation module, a proof aggregation module, and an aggregation verification module; the original file module is connected to the storage service terminal; the key pair generation module is connected to the original file module, the proof aggregation module, and the storage service terminal respectively; the proof aggregation module is connected to the storage service terminal; and the aggregation verification module is connected to the storage service terminal and the proof aggregation module respectively. The original file module stores the target file set; The original file module is used to store the target file set to the storage service client; The key pair generation module is used to generate the key pair based on the data in the target file set; The proof aggregation module is used to obtain the aggregated proof based on multiple single-file proofs and the challenge value; the proof aggregation module is also used to obtain the aggregated verification key based on the verification key; The aggregation verification module is used to generate a challenge value; the aggregation verification module is also used to determine, based on the public key, whether the aggregation proof and the aggregation verification key satisfy the bilinear mapping equation.

Images