A method for realizing ciphertext data deduplication against subversion

Abstract

The present application provides a kind of anti-subversion implementation ciphertext data deduplication method, belong to information security technical field.The present application first in generating message lock encryption key and reinforcing password, password reverse firewall is sent and received to the blind value of user computer with re-randomization processing, while guaranteeing the security of data, password and message lock encryption key in the reservation protocol function and security.Second, in the encryption message lock encryption key, password reverse firewall is re-randomized to the ciphertext of password derived public key encryption, so that the potential channel in the subversion implementation of encryption algorithm is invalid, to prevent key leakage.The present application removes the potential channel in the message lock encryption of server assistance by using password reverse firewall, effectively resists subversion implementation.In addition, the present application uses multiple key servers to assist user to generate message lock encryption key and reinforcing password, can resist offline dictionary guessing attack and brute force dictionary attack while avoiding single point failure problem.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, specifically relating to a method for deduplicating encrypted data with anti-subversion capabilities. Background Technology

[0002] Digital transformation, widespread internet access, and the surge in connected devices have led to an explosive growth in data volume. Cloud storage services allow users to outsource data to cloud servers to alleviate local storage burdens and achieve data access anytime, anywhere. However, data often contains sensitive user information, and direct outsourcing can lead to privacy breaches. To protect privacy, users typically encrypt data before outsourcing. However, traditional encryption algorithms, due to differences in keys and randomness, can generate different ciphertexts for the same data, making it difficult for cloud servers to identify duplicate data across users and perform data deduplication, resulting in a huge waste of storage space and costs.

[0003] Message Lock Encryption (MLE) is a symmetric encryption algorithm that supports ciphertext deduplication. It deterministically derives the encryption key from the data itself, ensuring that different users with the same copy of the data produce the same ciphertext, allowing cloud servers to delete duplicate ciphertext. However, MLE is vulnerable to brute-force dictionary attacks: given a ciphertext, an attacker (such as a malicious cloud server) can enumerate candidate data from the data space, use MLE to generate corresponding ciphertext, and compare it with the target ciphertext, thereby recovering the data hidden in the ciphertext, severely infringing on user privacy.

[0004] To combat brute-force dictionary attacks, server-assisted MLE (Mean Leakage Assistance) has been proposed. This method introduces a dedicated key server that assists users in deriving MLE keys through a blind signature protocol. Users blind data using random numbers and send it to the key server, which signs the blinded value. The user then deblinds the signature to obtain the MLE key. Because ciphertext generation requires online interaction with the key server, attackers cannot perform brute-force dictionary attacks offline. However, the security of this method depends on the reliability of the key server. Once the key server is compromised, the security of the scheme degrades to ordinary MLE, presenting a single point of failure. To address this single point of failure, threshold blind signatures can be used to distribute key derivation across multiple key servers. Each server holds a subkey of the signing private key. As long as the number of compromised servers is less than the threshold value, the security of the scheme can be guaranteed.

[0005] Furthermore, in practical applications, users typically protect their MLE keys with passwords. To prevent attackers from performing offline dictionary guessing attacks on the ciphertext of the password-encrypted key, users generate hardened passwords by performing threshold blind signatures with multiple key servers, then encrypt the MLE key with the hardened passwords, and outsource the key ciphertext along with the data ciphertext.

[0006] Despite the security advantages of server-assisted MLE solutions, existing solutions still have serious flaws when facing subversive implementations (also known as backdoor attacks). Malicious manufacturers may secretly embed latent channels in the implementation of randomization algorithms, and by carefully selecting random numbers, they can cause the output to deviate, thereby secretly leaking secrets without the user's notice. Specifically, subversive implementations can occur in the following three stages: (1) During the MLE key generation process, users need to blind the data. If the implementation of the blinding algorithm is subversive, the biased blinding value will leak one bit of the data information. In the deduplication scenario, the data may be owned by multiple users, and each user can gradually leak the complete data by executing the algorithm once. (2) During the password reinforcement generation process, users need to blind the password. The subversive blinding implementation will cause the blinding value to leak one bit of the password information. The algorithm will be executed every time data is outsourced or accessed, and multiple operations will leak the entire password. (3) When using a hardened password to encrypt the MLE key, if the encryption algorithm is overturned, a partial ciphertext may leak one bit of information of the MLE key or the hardened password. Multiple encryptions will completely leak the secret information. Summary of the Invention

[0007] This invention provides a method for deduplicating encrypted data to resist subversive implementations. It aims to address how to prevent adversaries (such as malicious manufacturers) from obtaining secret information from subversive implementations of server-assisted MLE methods, thereby resisting subversive implementations. This invention utilizes a cryptographic reverse firewall to re-randomize the output of the randomization algorithm in the server-assisted MLE method to remove potential channels in subversive implementations. Simultaneously, it introduces multiple key servers to assist in the generation of MLE keys and hardened passwords in a threshold manner, resisting single points of failure.

[0008] The technical solution adopted in this invention is: a method for deduplicating encrypted data with anti-subversion implementation, which includes the following steps:

[0009] Initialization steps:

[0010] System public parameters are generated based on security parameters; the key server group jointly executes the distributed key generation protocol to generate a master key shared in a threshold manner, each key server holds subkeys of the master key and publishes the master public key and all subkeys; each key server generates its own public-private key pair and publishes the public key; the cloud server generates its own public-private key pair and publishes the public key.

[0011] User registration steps:

[0012] Users select an identity identifier and password, construct a polynomial based on multiple randomly selected secret values, and calculate a strengthened password;

[0013] Users generate password-derived public and private key pairs using the hardened password as a random source, and publish the password-derived public key.

[0014] The user divides the selected secret value into multiple sub-secrets, sends the identity identifier and sub-secrets to each key server through a secure channel, and publishes the corresponding public key share and the public key corresponding to the secret value;

[0015] The key server secretly stores user identity identifiers and subsecrets, maintains public information, and initializes authentication failure counters and MLE key request counters;

[0016] The user deletes all confidential information except the password;

[0017] Data outsourcing and encryption steps:

[0018] The user selects a random number, calculates the password blinding value and the file blinding value, and sends the identity identifier and password blinding value to the password reverse firewall;

[0019] The password reverse firewall selects a random number, calculates the rerandomized password blinding value, and sends the identity identifier and the rerandomized password blinding value to all key servers.

[0020] Each key server checks whether the authentication failure counter has exceeded the limit. If not, it selects a challenge value, calculates the sub-signature of the re-randomized password blind value and the challenge value ciphertext, and sends it to the cryptographic reverse firewall; if so, it terminates.

[0021] The password reverse firewall verifies the validity of subsignatures. After collecting no less than a threshold number of valid subsignatures, it aggregates them to generate a complete signature and sends the complete signature and challenge value ciphertext to the user.

[0022] Users use the complete signature to calculate the password signature and verify the password signature. After successful verification, the password is restored and a password-derived public-private key pair is generated based on the restored password.

[0023] The user decrypts the challenge value ciphertext to obtain the challenge value, encrypts the challenge value and file blinding value with the public key of each key server, generates ciphertext, and sends it to the password reverse firewall.

[0024] The password reverse firewall re-randomizes the ciphertext and sends the re-randomized ciphertext to the corresponding key server.

[0025] Each key server decrypts the rerandomized ciphertext and authenticates the challenge value. If authentication fails, it updates the authentication failure counter and terminates. If the message lock encryption MLE key request counter exceeds the limit, it terminates. Otherwise, it updates the MLE key request counter, signs the file blind value with the subkey, and returns the generated subsignature.

[0026] The user verifies the validity of the sub-signatures. After collecting no less than a threshold number of valid sub-signatures, the user aggregates and calculates the file signature, and finally calculates the MLE key.

[0027] Users encrypt files using the MLE key to obtain file ciphertext, encrypt the MLE key using the password-derived public key to obtain key ciphertext, generate file tags, and send the file ciphertext, key ciphertext, and tag to the password reverse firewall.

[0028] The password reverse firewall re-randomizes the key ciphertext to generate a rerandomized key ciphertext, and outsources the file ciphertext, the rerandomized key ciphertext, and the tag to the cloud server.

[0029] Users delete the hardened password, password-derived private key, and MLE key, and only remember the password;

[0030] Ciphertext deduplication steps:

[0031] The cloud server maintains a data storage list and a user association list. Upon receiving outsourced data, it calculates the encrypted hash of the file and queries the data storage list. If the hash value already exists, it retrieves the corresponding file index and appends only the file index and the re-randomization key ciphertext to the user record. Otherwise, it generates a file index, stores the file index, file encrypted hash, file encrypted data, and tag in the data storage list, and adds the file index and re-randomization key ciphertext to the user association list. Therefore, only one copy of the encrypted data for the same file is stored, achieving encrypted deduplication.

[0032] Data access steps:

[0033] The user selects a random number, calculates the password blinding value, and sends the identity identifier and the password blinding value to the password reverse firewall.

[0034] The password reverse firewall selects a random number, calculates the rerandomized password blinding value, and sends the identity identifier and the rerandomized password blinding value to all key servers.

[0035] The key server checks whether the authentication failure counter has exceeded the limit. If it has, it terminates the process. Otherwise, it selects a challenge value, calculates the sub-signature of the re-randomized password blind value and the challenge value ciphertext, and sends them to the cryptographic reverse firewall.

[0036] The password reverse firewall verifies the validity of subsignatures, collects no less than a threshold number of valid subsignatures, generates a complete signature, and sends it to the user.

[0037] Users use the complete signature to calculate the password signature and verify the password signature. After successful verification, the password is restored and a password-derived public-private key pair is generated based on the restored password.

[0038] Users decrypt the challenge value ciphertext to obtain the challenge value, encrypt it with the public key of each key server, and send the ciphertext to the corresponding key server.

[0039] The key server decrypts the ciphertext and verifies the challenge value. If they do not match, the authentication fails, the failure counter is updated, and the process terminates.

[0040] Users and cloud servers execute an authentication key exchange protocol to mutually authenticate their identities and negotiate session keys to establish a secure channel;

[0041] Users download the encrypted file, the rerandomized key, and the tag through a secure channel, then decrypt them sequentially to obtain the MLE key and the plaintext file, and verify the tag to confirm the file's integrity.

[0042] This invention re-randomizes randomized outputs such as blinded values ​​and ciphertexts through a cryptographic reverse firewall, effectively cutting off potential channels in subversion and preventing attackers from extracting any secret information from biased outputs. At the same time, it employs multiple key servers to assist in the derivation of keys and hardened passwords in a threshold manner, resisting offline brute-force dictionary attacks and avoiding single points of failure. This comprehensively improves the system's anti-subversion capability while ensuring the ciphertext deduplication function.

[0043] The present invention also provides a computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the encrypted data deduplication method of the present invention with anti-subversion implementation.

[0044] Furthermore, the present invention also provides a computer program product, including a computer program / instruction that, when hot-run by a processor, implements the anti-subversion encrypted data deduplication method of the present invention.

[0045] The technical solution provided by this invention brings at least the following beneficial effects:

[0046] (1) Based on the cryptographic reverse firewall, the encrypted data deduplication is realized. The hidden channel of the randomization algorithm in the server-assisted MLE is removed by re-randomization, which effectively resists subversion.

[0047] (2) Utilize multiple key servers to collaboratively assist users in generating MLE keys and hardened passwords, thereby resisting offline dictionary guessing attacks and brute-force dictionary attacks while avoiding single points of failure. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be described in detail and completely below. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments.

[0049] This invention provides a method for deduplicating encrypted data to resist subversive implementations, addressing the problem that existing server-assisted MLEs cannot resist subversive implementations. This invention introduces a cryptographic reverse firewall into the server-assisted MLE. The cryptographic reverse firewall is deployed between the user's computer and the external network. It eliminates latent channels in the randomization algorithm by re-randomizing the messages sent and received by the user, preventing the leakage of confidential information. Specifically, in the blind signature interaction between MLE key generation and password reinforcement generation, the cryptographic reverse firewall re-randomizes the blinded value sent by the user, preventing attackers from extracting data or password information from the blinded value. For the algorithm that encrypts the MLE key using the password reinforcement, this invention designs a re-randomized public key encryption mechanism derived from the password reinforcement. The user encrypts the MLE key using the public key derived from the password reinforcement, and the cryptographic reverse firewall re-randomizes the generated ciphertext, thereby preventing leakage caused by subversive implementation of the encryption algorithm. Simultaneously, this invention uses multiple key servers to assist in the derivation of the MLE key and password reinforcement using threshold blind signatures, avoiding single points of failure.

[0050] To resist subversion and prevent the leakage of confidential information, the specific implementation steps of a subversive encrypted data deduplication method provided in this invention include:

[0051] Step S1: Initialization

[0052] According to safety parameters Generate system common parameters ,in Number of key servers For threshold value, For large prime numbers, for Additive cyclic group for generator, for Factorial cyclic group For bilinear mapping , It is a re-randomized public-key encryption scheme. It is a symmetric encryption scheme. For authentication key exchange protocol, , , For hash functions, The upper limit on the number of message lock encryption keys a user can request within a single period. The maximum number of failed user authentication attempts. Symmetric encryption schemes ( ), authentication key exchange protocol ( ) and re-randomized public-key encryption schemes ( The following is an introduction:

[0053] Symmetric encryption schemes ( The key space of this scheme is: It consists of two deterministic algorithms:

[0054] (1) Encryption algorithm Enter key and messages Output ciphertext ;

[0055] (2) Decryption algorithm Enter key and ciphertext Output message .

[0056] Authentication Key Exchange Protocol ( This protocol allows both communicating parties to use their respective long-term public-private key pairs for two-way authentication and to negotiate and share a session key for subsequent secure communication. for Factorial cyclic group ( (for large prime numbers), generator is , and For hash functions, This is the session key space. Assume the user... Holding long-term public-private key pairs cloud server Holding long-term public-private key pairs , The process is as follows:

[0057] (1) Select random number Calculate user-exposed elements And send to ; For model an integer ring;

[0058] (2) Select random number Calculate publicly available elements on the server side And send to ,Then Calculate the intermediate value and Generate session key ;

[0059] (3) Calculate the same intermediate value and Generate session key .

[0060] Re-randomized public-key encryption schemes ( This scheme is a public-key encryption scheme that supports ciphertext rerandomization, and the rerandomized ciphertext does not affect the decryption result. It consists of the following probabilistic multinomial-time algorithm:

[0061] (1) Key generation algorithm Enter security parameters Output public / private key pair ;

[0062] (2) Encryption algorithm Enter public key and messages Output ciphertext ;

[0063] (3) Decryption algorithm Enter your private key and ciphertext Output message ;

[0064] (4) Re-randomization algorithm Enter public key and ciphertext Output new ciphertext ;by Alternative As input to the decryption algorithm Still output the original message .

[0065] The key generation algorithm is actually based on generating public-private key pairs using random numbers. In the scheme of this invention, random numbers can be used as explicit input, and it is assumed that... Enter random numbers It operates in a deterministic manner.

[0066] Key server group With cloud servers Generate a key by performing the following steps:

[0067] (1) Key server group Jointly execute the distributed key generation protocol: Select random values and polynomial of degree Calculate and broadcast elements ( ), and transmit the function evaluation value through a secure channel Send to ( ); Validation element Is it equal to element? After successful verification, the subkey is calculated. and corresponding sub-public key Calculate the master public key ; Secure storage subkey Publicly disclose the master key and all child public keys ;in, Denotes the multiplication group modulo p; Represents a set ;

[0068] (1) Running Algorithm Generate public / private key pairs , public key ;

[0069] (2) Running Algorithm Generate public / private key pairs , public key .

[0070] Step S2: User Registration

[0071] Step S201: User Select Identity and password ;

[0072] Step S202: Randomly select secret value ,structure polynomial of degree Calculate the reinforcement password ;

[0073] Step S203: Strengthen the password As a random source, run Generate password-derived public / private key pairs Public password derived public key ;

[0074] Step S204: For , computational sub-secret via secure channel Send to and publicly disclose public key shares and secret value Corresponding public key ;

[0075] Step S205: Secret storage Maintaining open information and initialize the authentication failure counter. and MLE key request counter ;

[0076] Step S206: delete , , and all Only remember the password .

[0077] Step S3: Data Outsourcing and Encryption Steps

[0078] Step S301: Select random number Calculate password blinding value and file blinding value ,Will( , Send to password reverse firewall ;

[0079] Step S302: Select random number Calculate the re-randomized password blinding value and will ( , Send to all key servers;

[0080] Step S303: Check authentication failure counter If the condition is not met, the process terminates; otherwise, a random number is selected. Calculate sub-signature Challenge Value Cipher ,Will Send to ;

[0081] Step S304: Verify the equation Whether it is valid is used to verify the validity of the signature; collection Valid subsignatures (let their index set be ) The corresponding sub-signature is recorded as Then, using the Lagrange coefficients Calculate the complete signature Then Send to ;

[0082] Step S305: Calculate password signature using complete signature And through equations Verify the password signature; once verified, the hardened password will be restored. And generate a password-derived public / private key pair. ;

[0083] Step S306: Decrypt Challenge Value Ciphertext Gain Challenge Points Calculate ciphertext ,Will Send to ;

[0084] Step S307: Compute rerandomized ciphertext ,Will Send to ;

[0085] Step S308: Decryption yields the receiving challenge value and the file blinding value. ;

[0086] like If authentication fails, update the authentication failure counter. And terminate;

[0087] If MLE key request counter Then terminate; otherwise update. Using subkey Calculate subsignature ,send Give ;

[0088] Step S309: Verify the equation To verify the validity of the sub-signature, during the collection Calculate the file signature after each valid sub-signature. Finally, the MLE key was obtained. ;

[0089] Step S310: Calculate the encrypted file and key ciphertext and generate tags ,Will Send to ;

[0090] Step S311: Generate rerandomized key ciphertext Then Outsourced to cloud servers ;

[0091] Step S312: delete , and Only remember the password .

[0092] Step S4: Deduplication of Ciphertext

[0093] cloud server Maintain data storage list User-related list . Record file index, file ciphertext hash ciphertext and tags ; Record user And its corresponding list of (file index, rerandomized key ciphertext) pairs.

[0094] When cloud server receive Then, calculate Query .like If it already exists, retrieve the corresponding file index. ,Will Add to middle Otherwise, generate a new index. ,exist Store in and in China Add to Therefore, only one copy of the ciphertext of the same file is stored, thus achieving ciphertext deduplication.

[0095] Step S5: Data Access

[0096] Step S501: Select random number Calculate password blinding value and will ( , Send to password reverse firewall ;

[0097] Step S502: Select random number Calculate the re-randomized password blinding value Then ( , Send to all key servers;

[0098] Step S503: For Key server Check authentication failure counter Check if the condition is met; if not, terminate the process. Otherwise, Select challenge value Calculate sub-signature Challenge Value Cipher ,Will Send to ;

[0099] Step S504: After receiving the message, verify the equation. The validity of the sub-signature is verified by checking its validity. (Collection) After obtaining a valid sub-signature, the Lagrange coefficient is used. Calculate the complete signature Then Send to ;

[0100] Step S505: Calculate password signature using complete signature Through equation The validity period is used to verify the password signature; recovery is restored upon successful verification. and generate ;

[0101] Step S506: For each , Decrypt Challenge Value Ciphertext Gain Challenge Points Then use public key encryption Obtain the ciphertext and will Send to ;

[0102] Step S507: Decrypting the ciphertext Receive challenge value ;like If authentication fails, update. And terminate;

[0103] Step S508: Hold the password to derive public and private key pairs , Holding public and private key pairs Both parties execute the HMQV authentication key exchange protocol, authenticate each other's identities, and negotiate a shared session key to establish a secure channel;

[0104] Step S509: via secure channel download ,use Decrypting the ciphertext Obtain the MLE key ,use Decrypting the ciphertext Obtain data And check the label. If the condition is met, accept the data; otherwise, reject it.

[0105] Server-assisted message lock encryption methods are vulnerable to implementation subversion. Attackers could secretly embed back channels into the implementation of this method, leaking users' confidential information in an undetectable manner.

[0106] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the foregoing embodiments have described the present invention in detail, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the embodiments of the present invention.

[0107] The above descriptions are merely some embodiments of the present invention. Those skilled in the art can make various modifications and improvements without departing from the inventive concept of the present invention, and these all fall within the scope of protection of the present invention.

Claims

1. A method for deduplicating encrypted data with anti-subversion implementation, characterized in that, Includes the following steps: Initialization steps: The system generates public parameters based on security parameters; the key server group jointly executes the distributed key generation protocol to generate a master key shared in a threshold manner, and each key server holds a subkey of the master key and publishes the master public key and all subkeys. Each key server generates its own public-private key pair and publishes the public key; The cloud server generates its own public-private key pair and publishes the public key. User registration steps: Users select an identity identifier and password, construct a polynomial based on multiple randomly selected secret values, and calculate a strengthened password; Users generate password-derived public and private key pairs using the hardened password as a random source, and publish the password-derived public key. The user divides the selected secret value into multiple sub-secrets, sends the identity identifier and sub-secrets to each key server through a secure channel, and publishes the corresponding public key share and the public key corresponding to the secret value; The key server secretly stores user identity identifiers and subsecrets, maintains public information, and initializes authentication failure counters and MLE key request counters; The user deletes all confidential information except the password; Data outsourcing and encryption steps: The user selects a random number, calculates the password blinding value and the file blinding value, and sends the identity identifier and password blinding value to the password reverse firewall; The password reverse firewall selects a random number, calculates the rerandomized password blinding value, and sends the identity identifier and the rerandomized password blinding value to all key servers. Each key server checks whether the authentication failure counter has exceeded the limit. If not, it selects a challenge value, calculates the sub-signature of the re-randomized password blind value and the challenge value ciphertext, and sends it to the cryptographic reverse firewall; if so, it terminates. The password reverse firewall verifies the validity of subsignatures. After collecting no less than a threshold number of valid subsignatures, it aggregates them to generate a complete signature and sends the complete signature and challenge value ciphertext to the user. Users use the complete signature to calculate the password signature and verify the password signature. After successful verification, the password is restored and a password-derived public-private key pair is generated based on the restored password. The user decrypts the challenge value ciphertext to obtain the challenge value, encrypts the challenge value and file blinding value with the public key of each key server, generates ciphertext, and sends it to the password reverse firewall. The password reverse firewall re-randomizes the ciphertext and sends the re-randomized ciphertext to the corresponding key server. Each key server decrypts the rerandomized ciphertext and authenticates the challenge value. If authentication fails, it updates the authentication failure counter and terminates. If the message lock encryption MLE key request counter exceeds the limit, it terminates. Otherwise, it updates the MLE key request counter, signs the file blind value with the subkey, and returns the generated subsignature. The user verifies the validity of the sub-signatures. After collecting no less than a threshold number of valid sub-signatures, the user aggregates and calculates the file signature, and finally calculates the MLE key. Users encrypt files using the MLE key to obtain file ciphertext, encrypt the MLE key using the password-derived public key to obtain key ciphertext, generate file tags, and send the file ciphertext, key ciphertext, and tag to the password reverse firewall. The password reverse firewall re-randomizes the key ciphertext to generate a rerandomized key ciphertext, and outsources the file ciphertext, the rerandomized key ciphertext, and the tag to the cloud server. Users delete the hardened password, password-derived private key, and MLE key, and only remember the password; Ciphertext deduplication steps: The cloud server maintains a data storage list and a user association list; upon receiving outsourced data, it calculates the file ciphertext hash and queries the data storage list; if the hash value already exists, it retrieves the corresponding file index and appends only the file index and the rerandomized key ciphertext to the user record; otherwise, it generates a file index, stores the file index, file ciphertext hash, file ciphertext, and tag in the data storage list, and adds the file index and the rerandomized key ciphertext to the user association list. Data access steps: The user selects a random number to calculate the password blinding value, and sends the identity identifier and the password blinding value to the password reverse firewall. The password reverse firewall selects a random number, calculates the rerandomized password blinding value, and sends the identity identifier and the rerandomized password blinding value to all key servers. The key server checks whether the authentication failure counter has exceeded the limit. If it has, it terminates the process. Otherwise, it selects a challenge value, calculates the sub-signature of the re-randomized password blind value and the challenge value ciphertext, and sends them to the cryptographic reverse firewall. The password reverse firewall verifies the validity of subsignatures, collects no less than a threshold number of valid subsignatures, generates a complete signature, and sends it to the user. Users use the complete signature to calculate the password signature and verify the password signature. After successful verification, the password is restored and a password-derived public-private key pair is generated based on the restored password. Users decrypt the challenge value ciphertext to obtain the challenge value, encrypt it with the public key of each key server, and send the ciphertext to the corresponding key server. The key server decrypts the ciphertext and verifies the challenge value. If they do not match, the authentication fails, the failure counter is updated, and the process terminates. Users and cloud servers execute an authentication key exchange protocol to mutually authenticate their identities and negotiate session keys to establish a secure channel; Users download the encrypted file, the rerandomized key, and the tag through a secure channel, then decrypt them sequentially to obtain the MLE key and the plaintext file, and verify the tag to confirm the file's integrity.

2. The method as described in claim 1, characterized in that, The initialization steps are as follows: According to safety parameters Generate system common parameters ,in Number of key servers For threshold value, For large prime numbers, for Additive cyclic group for generator, for Factorial cyclic group For bilinear mapping , It is a re-randomized public-key encryption algorithm. It is a symmetric encryption algorithm. For authentication key exchange protocol, There are three hash functions, which are: , , , The upper limit on the number of message lock encryption keys a user can request within a single period. The maximum number of failed user authentication attempts.

3. The method as described in claim 2, characterized in that, The user registration process specifically includes: user Select Identity and password ; user Randomly select secret value ,structure polynomial of degree Calculate the reinforcement password ; user To strengthen passwords As a random source, run The key generation algorithm generates password-derived public and private key pairs. Public password to derive public key ; for , computational secret via secure channel Send to key server and publicly disclose public key shares and secret value Corresponding public key ; Key server Secret storage Maintaining open information and initialize the authentication failure counter. and MLE key request counter ;in, Represents a set ; user delete , , and all Only remember the password .

4. The method as described in claim 3, characterized in that, The data outsourcing and encryption steps specifically include: user Select random number Calculate password blinding value and file blinding value ,Will( , Send to password reverse firewall ; Select random number Calculate the re-randomized password blinding value and will ( , Send to all key servers; Key server Check authentication failure counter If the condition is not met, the process terminates; otherwise, a random number is selected. Calculate sub-signature Challenge Value Cipher ,Will Send to ;in, express The encryption algorithm; Verify the equation Whether it is valid is used to verify the validity of the signature; collection Let there be valid sub-signatures, and let their index set be . The corresponding sub-signature is recorded as ); using Lagrange coefficients Calculate the complete signature Then Send to user ; Calculate password signature using complete signature And through equations Verify the password signature; once verified, the hardened password will be restored. And generate a password-derived public / private key pair. ;in, express The key generation algorithm; Decrypt Challenge Value Ciphertext Gain Challenge Points Calculate ciphertext ,Will Send to ; Compute rerandomized ciphertext ,Will Send to ;in, express The re-randomization algorithm; Decryption yields the receiving challenge value and the file blinding value. ;like Authentication failed. Update the authentication failure counter. And terminate; if the MLE key request counter Then terminate; otherwise update. Using subkey Calculate subsignature ,send Give ;in, express The decryption algorithm; Verify the equation To verify the validity of the sub-signature, during the collection Calculate the file signature after each valid sub-signature. Finally, the MLE key was obtained. ; Calculate the encrypted file and key ciphertext and generate tags ,Will Send to ;in, express The key generation algorithm; Generate rerandomized key ciphertext Then Outsourced to cloud servers ; delete , and Only remember the password .

5. The method as described in claim 4, characterized in that, The specific steps for deduplicating encrypted text include: cloud server Maintain data storage list User-related list ;in, Record file index, file ciphertext hash ciphertext and tags ; Record user Its file index and a list of pairs of rerandomized key ciphertexts; When cloud server receive Then, calculate Query ; like If it already exists, retrieve the corresponding file index. ,Will Add to middle Otherwise, generate a new index. ,exist Store in and in China Add to .

6. The method as described in claim 5, characterized in that, The data access steps specifically include: Select random number Calculate password blinding value and will ( , Send to password reverse firewall ; Select random number Calculate the re-randomized password blinding value Then ( , Send to all key servers; for Key server Check authentication failure counter If the condition is not met, the process terminates; otherwise, Select challenge value Calculate sub-signature Challenge Value Cipher ,Will Send to ; After receiving the message, verify the equation. The validity of the sub-signature is verified by checking its validity. (Collection) After obtaining a valid sub-signature, the Lagrange coefficient is used. Calculate the complete signature Then Send to ; Calculate password signature using complete signature Through equation The validity period is used to verify the password signature; recovery is restored upon successful verification. and generate ;in express Key generation algorithm For each , Decrypt Challenge Value Ciphertext Gain Challenge Points Then use public key encryption Obtain the ciphertext and will Send to ; Decrypting the ciphertext Receive challenge value ;like If authentication fails, update. And terminate; Hold the password to derive public and private key pairs , Holding public and private key pairs Both parties execute the HMQV authentication key exchange protocol, authenticate each other's identities, and negotiate a shared session key to establish a secure channel; via secure channel download ,use Decrypting the ciphertext Obtain the MLE key ,use Decrypting the ciphertext Obtain data And check the label. If the condition is met, accept the data; otherwise, reject it.

7. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 6.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are hot-run by the processor, they implement the steps of the method according to any one of claims 1 to 6.

Images