An efficient non-interactive auditing method for satellite network data security
Patent Information
- Application Number
- CN202611424705.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-09-15
- Publication Date
- 2026-10-30
AI Technical Summary
[0003]然而，卫星网络具有链路时延高、连接间歇、节点计算与存储资源受限等特点，传统多轮交互式审计容易因通信中断造成验证失败或状态恢复成本增加；同时，复杂密码学验证若直接上链执行，会增加链上计算负担，且审计结果与链上确认过程相互分离时，难以形成可信、连续的数据持有性确认结果
一种面向卫星网络数据安全的高效非交互式审计方法，通过由审计者基于本地保存的完整性标签和挑战集合预先计算预期聚合结果，并将该预期聚合结果转换为解锁秘密生成适配器预签名，使存储卫星仅在依据本地缓存数据计算出对应证明群元素并获得正确解锁秘密因子时，才能恢复出可被区块链验证节点接受的完整交易签名，由此将数据持有性验证过程与链上签名确认过程形成绑定；同时，审计者在发送挑战集合、审计交易消息、适配器预签名和离散对数相等证明后无需再接收存储卫星回传的数据持有性证明，减少了卫星链路间歇连接下多轮交互造成的中断风险；区块链验证节点仅需执行标准签名验证即可得到链上审计确认结果，避免在链上执行复杂的双线性映射或聚合证明验证，从而更适合资源受限、时延较高且通信状态不稳定的卫星网络数据安全审计场景。
Smart Images
Figure CN123020053A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of satellite network data security technology, specifically to an efficient non-interactive auditing method for satellite network data security. Background Technology
[0002] Satellite network data security auditing methods are primarily used in scenarios such as onboard data acquisition, on-orbit caching, cross-node forwarding, and on-demand delivery. Their purpose is to verify whether the storage satellite has completely preserved the specified data, preventing data damage, loss, or tampering during long-term caching or cross-entity transmission. Existing methods typically involve the auditor generating a challenge message, the storage node generating an integrity certificate based on the challenged data block, and then the auditor verifying the certificate to determine the data holding status.
[0003] However, satellite networks are characterized by high link latency, intermittent connections, and limited node computing and storage resources. Traditional multi-round interactive auditing is prone to verification failures or increased state recovery costs due to communication interruptions. Furthermore, performing complex cryptographic verifications directly on the blockchain increases the on-chain computational burden, and when audit results are separated from the on-chain confirmation process, it is difficult to form a reliable and continuous confirmation of data ownership. Therefore, an efficient non-interactive auditing method for satellite network data security is needed to address these issues. Summary of the Invention
[0004] To address the above problems, this invention provides the following technical solution: an efficient non-interactive auditing method for satellite network data security, comprising: S1. Initialize the satellite network audit environment, generate bilinear mapping public parameters, data producer's tag signature key pair, auditor's on-chain transaction signature key pair, and determine the on-chain receiving address or account identifier of the stored satellite. S2. The data producer divides the original data file into blocks, generates file identifiers and homomorphic integrity tags corresponding to each data block, sends the data block set to the storage satellite cache, and sends the tag set and file identifiers to the auditor for storage. S3. The auditor generates a challenge set based on the file identifier, calculates the expected aggregation result based on the tag set and the challenge set, converts the expected aggregation result into an unlock secret, generates an audit transaction message, an adapter pre-signature, and a discrete logarithm equality proof associated with this challenge set based on the unlock secret, and sends the challenge set, the audit transaction message, the adapter pre-signature, and the discrete logarithm equality proof to the storage satellite all at once. S4. The storage satellite reads the locally cached data blocks according to the challenge set, and calculates the proof group element corresponding to the expected aggregation result when the data is complete based on the locally cached data blocks and public parameters, and converts the proof group element into the unlock secret factor. S5. The storage satellite verifies the discrete logarithm equality proof. When the verification is successful, the unlock secret factor is used to adapt the adapter pre-signature to obtain the complete transaction signature corresponding to the audit transaction message. S6. The storage satellite broadcasts the audit transaction message and the complete transaction signature to the blockchain verification node. The blockchain verification node verifies the complete transaction signature based on the auditor's on-chain transaction signature public key, and uses the signature verification result as the on-chain audit confirmation result of the data holding of the original data file.
[0005] Furthermore, the bilinear mapping public parameters include a first cyclic group of prime order, a second cyclic group, a target group, a bilinear mapping, a generator of the first cyclic group, a generator of the second cyclic group, a first hash function for mapping file identifiers and data block indices to the first cyclic group, a second hash function for mapping the serialization result of group elements to the on-chain signature scalar field, and elliptic curve parameters for generating on-chain transaction signatures.
[0006] Furthermore, the data producer performs block processing on the original data file, generating file identifiers and homomorphic integrity tags corresponding to each data block, including: The original data file is divided into a set of data blocks arranged by index; Generate a unique file identifier for the original data file; Generate a corresponding homomorphic integrity tag based on the file identifier, data block index, data block content, and the data producer's tag signing private key; The homomorphic integrity tag is bound to the file identifier and the data block index to form a tag set.
[0007] Furthermore, the challenge set consists of a subset of challenged data block indexes and random challenge coefficients corresponding to each challenged data block index. The subset of challenged data block indexes is randomly selected from all data block indexes of the original data file, and the random challenge coefficients are used to constrain subsequent tag aggregation calculations and data block aggregation calculations.
[0008] Furthermore, the step of calculating the expected aggregation result based on the tag set and the challenge set, converting the expected aggregation result into an unlock secret, and generating an audit transaction message, adapter pre-signature, and discrete logarithm equality proof associated with the current challenge set based on the unlock secret includes: The auditor performs homomorphic aggregation on the homomorphic integrity labels corresponding to the index of the challenged data block according to the random challenge coefficient, and obtains the aggregated labels; The auditor performs a bilinear mapping operation on the aggregation label and the second cyclic group generator to obtain the expected aggregation result; The auditor performs normalized serialization and hash mapping on the expected aggregation result to obtain the unlock secret; The auditor maps the unlock secret to elliptic curve points and generates an adapter pre-signature based on the auditor's on-chain transaction signing private key, the audit transaction message, and the elliptic curve points; The auditor generates a proof that the discrete logarithms generated from the same random number are equal to those of the standard commitment and the cryptographic commitment in the adapter's pre-signature.
[0009] Furthermore, the storage satellite reads locally cached data blocks according to the challenge set, and calculates the proof group element corresponding to the expected aggregation result when the data is complete, based on the locally cached data blocks and common parameters. The proof group element is then converted into an unlocking secret factor, including: The storage satellite reads locally cached data blocks according to the subset of the challenged data block index; The storage satellite performs linear aggregation on the read data blocks according to the random challenge coefficient to obtain the data aggregation value; The storage satellite generates aggregated public base terms based on the file identifier, the index of the challenged data block, and the random challenge coefficient; The storage satellite calculates proof group elements based on the data aggregation value, the aggregation public base item, and the data producer's tag signature public key; The storage satellite performs normalized serialization and hash mapping on the elements of the proof group to obtain the unlocking secret factor.
[0010] Furthermore, the storage satellite verifies the discrete logarithm equality proof. Upon successful verification, it adapts the adapter pre-signature using the unlock secret factor to obtain the complete transaction signature corresponding to the audit transaction message, including: The storage satellite generates verification elliptic curve points based on the unlocking secret factor; The storage satellite performs discrete logarithmic equality verification using the verification elliptic curve points, the standard commitment in the adapter pre-signature, the cryptographic commitment, and the discrete logarithmic equality proof; When the discrete logarithm equality verification passes, the storage satellite uses the unlocking secret factor to decrypt a portion of the signature in the adapter pre-signature to obtain the complete signature scalar; The storage satellite combines the complete signature scalar with the cryptographic commitment x-coordinate in the adapter pre-signature to obtain the complete transaction signature.
[0011] Furthermore, the audit transaction message includes at least a file identifier, challenge set association information, auditor's on-chain account identifier, and storage satellite's on-chain account identifier. When verifying the complete transaction signature, the blockchain verification node performs standard signature verification on the audit transaction message and the complete transaction signature based on the on-chain transaction signature public key corresponding to the auditor's on-chain account identifier.
[0012] Furthermore, after sending the challenge set, the audit transaction message, the adapter pre-signature, and the discrete logarithm equality proof, the auditor does not receive the data holding proof returned by the storage satellite. After generating the complete transaction signature locally, the storage satellite directly broadcasts it to the blockchain verification node, thus transforming the data holding audit from challenge-response verification between the auditor and the storage satellite into signature verification between the storage satellite and the blockchain verification node.
[0013] Furthermore, when any of the following conditions are met: the discrete logarithm equality proof fails to pass verification, the complete transaction signature fails to pass verification, or the file identifier does not match the challenge set association information, an on-chain audit confirmation failure status is generated; when the complete transaction signature verification passes and the file identifier in the audit transaction message matches the challenge set association information, an on-chain audit confirmation pass status is generated and the corresponding on-chain audit confirmation information is recorded.
[0014] Compared with the prior art, the present invention has the following beneficial effects: An efficient non-interactive auditing method for satellite network data security is proposed. This method involves the auditor pre-calculating the expected aggregation result based on locally stored integrity tags and challenge sets, and then converting this expected aggregation result into an adapter pre-signature for unlocking secrets. This ensures that the storage satellite can only recover a complete transaction signature acceptable to the blockchain verification node when it calculates the corresponding proof group elements based on locally cached data and obtains the correct unlocking secret factor. This binds the data possession verification process with the on-chain signature confirmation process. Simultaneously, after sending the challenge set, audit transaction message, adapter pre-signature, and discrete logarithm equality proof, the auditor no longer needs to receive the data possession proof returned by the storage satellite, reducing the risk of interruption caused by multiple rounds of interaction under intermittent satellite link connections. The blockchain verification node only needs to perform standard signature verification to obtain the on-chain audit confirmation result, avoiding the need to perform complex bilinear mapping or aggregation proof verification on the chain. Therefore, this method is more suitable for satellite network data security auditing scenarios with limited resources, high latency, and unstable communication states. Attached Figure Description
[0015] Figure 1 A schematic diagram of the overall process of an efficient non-interactive auditing method for satellite network data security provided by the present invention; Figure 2This is a schematic diagram of the non-interactive audit architecture for satellite network data security provided by the present invention; Figure 3 This is a schematic diagram of data outsourcing and tag distribution provided by the present invention; Figure 4 This is a schematic diagram of the non-interactive auditing and signature unlocking process based on adapter pre-signature provided by the present invention. Detailed Implementation
[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0017] To enable those skilled in the art to better understand the present invention, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.
[0018] like Figure 1 As shown, this invention provides an efficient non-interactive auditing method for satellite network data security, comprising: S1. Initialize the satellite network audit environment, generate bilinear mapping public parameters, data producer's tag signature key pair, auditor's on-chain transaction signature key pair, and determine the on-chain receiving address or account identifier of the stored satellite. Specifically, this embodiment first performs satellite network audit environment initialization, ensuring that subsequent data outsourcing, challenge generation, proof calculation, signature unlocking, and on-chain confirmation all use consistent cryptographic parameters and entity identity information. For example... Figure 2 As shown, the entities participating in this method include data producers, storage satellites, auditors, and blockchain verification nodes; among them, data producers are used to generate raw data and generate integrity tags, storage satellites are used to cache raw data blocks and generate proof group elements based on local data during auditing, auditors are used to initiate audits and generate adapter pre-signatures, and blockchain verification nodes are used to perform standard signature verification on the final complete transaction signature.
[0019] In this embodiment, the system selects the first cyclic group of order prime. Second Cyclic Group Target Group And define a bilinear mapping:
[0020] Wherein, the generator of the first cyclic group is The generator of the second cyclic group is Data producers generate private keys for tag signing. And generate the corresponding tag signing public key:
[0021] The auditor generates the private key for signing on-chain transactions. And based on elliptic curve generators Generate on-chain transaction signature public key:
[0022] in, This is used by blockchain verification nodes to identify the source of the signature when subsequently verifying the complete transaction signature. The on-chain receiving address or account identifier of the storage satellite is used to write audit transaction messages, enabling the on-chain audit confirmation result to be bound to the corresponding storage satellite.
[0023] Furthermore, in one embodiment provided in this application, the bilinear mapping common parameters include a first cyclic group of prime order, a second cyclic group, a target group, a bilinear mapping, a first cyclic group generator, a second cyclic group generator, a first hash function for mapping file identifiers and data block indices to the first cyclic group, a second hash function for mapping the serialization result of group elements to the on-chain signature scalar field, and elliptic curve parameters for generating on-chain transaction signatures.
[0024] Specifically, the first hash function is denoted as Its inputs are a file identifier and a data block index, and its output is the elements in the first cyclic group, used to bind the data block location and file identity to the integrity label. The second hash function is denoted as... Its input is the canonical serialization result of the target group elements, and its output is a scalar in the on-chain signature scalar field. It is used to convert the group elements calculated by the bilinear mapping into scalars that can be used for adapter signature unlocking. Elliptic curve parameters include curve generators. Curve order and on-chain signature message hash function ,in This parameter is used to limit the range of scalar values in the adapter signature and the complete transaction signature. After the above parameters are uniformly determined during the initialization phase, data producers, auditors, storage satellites, and blockchain verification nodes use the same parameters during their respective execution processes to avoid discrepancies in tag aggregation results, proof group elements, or on-chain signature verification results due to parameter inconsistencies.
[0025] S2. The data producer divides the original data file into blocks, generates file identifiers and homomorphic integrity tags corresponding to each data block, sends the data block set to the storage satellite cache, and sends the tag set and file identifiers to the auditor for storage. Specifically, such as Figure 3 As shown, after generating or collecting raw data files, the data producer sends these raw data files as outsourced cache objects to the storage satellite and sends the corresponding tag set to the auditor. The raw data files can be remote sensing imagery, space exploration logs, onboard sensor data, or other data that needs to be cached and delivered within the satellite network. After the data producer divides the raw data files into blocks, each data block has a unique index, enabling the storage satellite to read the corresponding data block according to the index when subsequently receiving challenge sets.
[0026] Furthermore, in one embodiment provided in this application, the data producer performs block processing on the original data file, generating file identifiers and homomorphic integrity tags corresponding to each data block, including: The original data file is divided into a set of data blocks arranged by index; Generate a unique file identifier for the original data file; Generate a corresponding homomorphic integrity tag based on the file identifier, data block index, data block content, and the data producer's tag signing private key; The homomorphic integrity tag is bound to the file identifier and the data block index to form a tag set.
[0027] Specifically, data producers will use the original data files Divided into One data block:
[0028] in, Indicates that the index is The data blocks. The data producer generates a unique file identifier for the original data file. This file identifier can be obtained by hashing file metadata, timestamps, data producer identity, and a random salt value, and is used to distinguish different original data files. For indexes... For data blocks, the data producer generates homomorphic integrity labels:
[0029] in, This represents the first cyclic group element obtained by mapping file identifiers and data block indices. This represents the exponential representation of the data block content within the first cyclic group. This represents the private key used to sign the data producer's tag. Because of the tag... It simultaneously contains file identifiers, data block indexes, and data block content. The storage satellite cannot replace the challenged data block with data blocks from other files or data blocks from other indexes. Data producers will collect data blocks... Send to the stored satellite cache, tag set and file identifier Sending the data to the auditor allows the auditor to calculate the expected aggregation results in subsequent audits without having to save the original data blocks.
[0030] S3. The auditor generates a challenge set based on the file identifier, calculates the expected aggregation result based on the tag set and the challenge set, converts the expected aggregation result into an unlock secret, generates an audit transaction message, an adapter pre-signature, and a discrete logarithm equality proof associated with this challenge set based on the unlock secret, and sends the challenge set, the audit transaction message, the adapter pre-signature, and the discrete logarithm equality proof to the storage satellite all at once. Specifically, when auditors need to confirm whether the stored satellites still retain the original data files intact, they rely on file identifiers. Initiate an audit session. For example... Figure 4 As shown, the auditor does not require the storage satellite to return proof of data ownership first. Instead, the auditor pre-calculates the expected aggregation result that the correct proof of data ownership should correspond to locally using the tag set and the random challenge set. The auditor then converts the expected aggregation result into the unlock secret, so that the storage satellite can only obtain the same secret factor and unlock the complete transaction signature when the local data matches the challenge set.
[0031] Furthermore, in one embodiment provided in this application, the challenge set consists of a subset of challenged data block indexes and random challenge coefficients corresponding to each challenged data block index. The subset of challenged data block indexes is randomly selected from all data block indexes of the original data file, and the random challenge coefficients are used to constrain subsequent tag aggregation calculations and data block aggregation calculations.
[0032] Specifically, the auditor starts from the complete data block index set of the original data file. Randomly select a subset of the challenged data block indexes And index each challenged data block. Generate random challenge coefficients The challenge set is represented as:
[0033] in, Used to limit which data blocks are read in this audit. This is used to limit the weight of each challenged data block in the aggregation calculation. The introduction of random challenge coefficients prevents Storage Satellite from simply caching fixed aggregation results to cope with subsequent audits, because the index subset and coefficients may be different for each audit. Subsequent tag aggregation calculations and data block aggregation calculations must be performed around the same set of challenges.
[0034] Furthermore, in one embodiment provided in this application, the step of calculating the expected aggregation result based on the tag set and the challenge set, converting the expected aggregation result into an unlock secret, and generating an audit transaction message, an adapter pre-signature, and a discrete logarithm equality proof associated with the current challenge set based on the unlock secret includes: The auditor performs homomorphic aggregation on the homomorphic integrity labels corresponding to the index of the challenged data block according to the random challenge coefficient, and obtains the aggregated labels; The auditor performs a bilinear mapping operation on the aggregation label and the second cyclic group generator to obtain the expected aggregation result; The auditor performs normalized serialization and hash mapping on the expected aggregation result to obtain the unlock secret; The auditor maps the unlock secret to elliptic curve points and generates an adapter pre-signature based on the auditor's on-chain transaction signing private key, the audit transaction message, and the elliptic curve points; The auditor generates a proof that the discrete logarithms generated from the same random number are equal to those of the standard commitment and the cryptographic commitment in the adapter's pre-signature.
[0035] Specifically, auditors base their decisions on the set of challenges. From the tag set Retrieving the index The corresponding homomorphic integrity labels are then homomorphically aggregated according to the random challenge coefficient to obtain aggregated labels:
[0036] Then, the auditor performs a bilinear mapping operation on the aggregation labels and the second cyclic group generators to obtain the expected aggregation result:
[0037] because For target group The group elements in the context, while adapter signature unlocking requires the use of scalars, and the auditor... After performing canonical serialization, the second hash function is called to obtain the unlock secret:
[0038] in, Indicates the target group elements The unique byte serialization result, This represents the order of the elliptic curve for the on-chain signature. The auditor then maps the unlock secret to elliptic curve points:
[0039] Audit transaction messages are recorded as It is associated with this challenge set and carries a file identifier, challenge set association information, auditor's on-chain account identifier, and storage satellite on-chain account identifier. The auditor selects a random number. Generate standard commitments and cryptographic commitments:
[0040]
[0041] Take crypto commitment The x-coordinate is And calculate a portion of the signature in the adapter pre-signature:
[0042] in, This represents the hash value of an on-chain transaction message. This represents the auditor's on-chain transaction signature private key. The auditor generates a proof of discrete logarithmic equality:
[0043] The proof of the equality of discrete logarithms is used to show and From the same random number Relative to and Generation. The auditor will challenge the set. Audit transaction messages Adapter pre-signature Proof that it is equal to the discrete logarithm The data is sent to the storage satellite in a single transmission. Once this transmission is complete, the auditor does not need to wait for the storage satellite to return integrity verification during the current audit session, making it suitable for scenarios with high satellite network link latency and short communication windows.
[0044] S4. The storage satellite reads the locally cached data blocks according to the challenge set, and calculates the proof group element corresponding to the expected aggregation result when the data is complete based on the locally cached data blocks and public parameters, and converts the proof group element into the unlock secret factor. Specifically, after receiving the challenge set, the storage satellite reads the locally cached data blocks according to the indexes of the challenged data blocks contained in the challenge set. If the locally cached data blocks are not lost, tampered with, or mismatched in their indexes, the storage satellite can use these data blocks to calculate the proof group elements corresponding to the auditor's expected aggregation result. If any challenged data block is missing or its content is inconsistent, the calculated proof group elements will not correspond to the auditor's pre-locked expected aggregation result, and thus the correct unlocking secret factor cannot be obtained.
[0045] Furthermore, in one embodiment provided in this application, the storage satellite reads locally cached data blocks according to the challenge set, and calculates the proof group element corresponding to the expected aggregation result when the data is complete based on the locally cached data blocks and common parameters, and converts the proof group element into an unlocking secret factor, including: The storage satellite reads locally cached data blocks according to the subset of the challenged data block index; The storage satellite performs linear aggregation on the read data blocks according to the random challenge coefficient to obtain the data aggregation value; The storage satellite generates aggregated public base terms based on the file identifier, the index of the challenged data block, and the random challenge coefficient; The storage satellite calculates proof group elements based on the data aggregation value, the aggregation public base item, and the data producer's tag signature public key; The storage satellite performs normalized serialization and hash mapping on the elements of the proof group to obtain the unlocking secret factor.
[0046] Specifically, storing satellite read index subset corresponding data blocks And calculate the aggregated data value according to the random challenge coefficients in the challenge set:
[0047] in, This represents the linear aggregation result of the challenged data blocks in this challenge. The storage satellite also generates aggregate public base terms based on the file identifier, the index of the challenged data blocks, and the random challenge coefficients:
[0048] Subsequently, the storage satellite uses the aggregated data value, the aggregated public base term, and the data producer's tag-signed public key to compute proof group elements:
[0049] in, The public key for the data producer's tag signature originates from the initialization phase. If the data block held locally by the storage satellite is the same as the data block used by the data producer when generating the tag, then:
[0050] Further results were obtained:
[0051] The auditor's expected aggregation result is:
[0052] According to the properties of bilinear mapping, when the data is complete and the challenge set is consistent, Storage satellites prove group elements. Perform normalized serialization and call the second hash function to obtain the unlock secret factor:
[0053] when hour, This equality relationship directly links the data possession proof result to the subsequent adapter pre-signature unlocking action, eliminating the need for the storage satellite to send the data back to the auditor. Or traditional integrity proof, but instead utilize Initiate the signature unlocking process locally.
[0054] S5. The storage satellite verifies the discrete logarithm equality proof. When the verification is successful, the unlock secret factor is used to adapt the adapter pre-signature to obtain the complete transaction signature corresponding to the audit transaction message. Specifically, such as Figure 4 As shown, after receiving the unlock secret factor, the storage satellite does not immediately broadcast the transaction. Instead, it first verifies whether the adapter pre-signature sent by the auditor matches the unlock secret factor. This verification is used to prevent the auditor from sending invalid pre-signatures that cannot be correctly unlocked, and also to prevent the storage satellite from constructing a valid on-chain signature without calculating the correct data ownership result.
[0055] Furthermore, in one embodiment provided in this application, the storage satellite verifies the discrete logarithm equality proof, and upon successful verification, adapts the adapter pre-signature using the unlocking secret factor to obtain the complete transaction signature corresponding to the audit transaction message, including: The storage satellite generates verification elliptic curve points based on the unlocking secret factor; The storage satellite performs discrete logarithmic equality verification using the verification elliptic curve points, the standard commitment in the adapter pre-signature, the cryptographic commitment, and the discrete logarithmic equality proof; When the discrete logarithm equality verification passes, the storage satellite uses the unlocking secret factor to decrypt a portion of the signature in the adapter pre-signature to obtain the complete signature scalar; The storage satellite combines the complete signature scalar with the cryptographic commitment x-coordinate in the adapter pre-signature to obtain the complete transaction signature.
[0056] Specifically, the storage satellite uses the unlocking secret factor calculated locally. Generate elliptic curve points for verification:
[0057] Storage satellite utilization verification elliptic curve points Standard Commitment Encryption commitment Proof that it is equal to the discrete logarithm Execution verification:
[0058] If the verification result is 1, it means that the standard commitment and cryptographic commitment in the adapter pre-signature can be interpreted by the same random number relation, and the stored satellite calculates... It can be matched with the cryptographic commitment. If the verification result is not 1, it means that the pre-signature does not match the locally calculated secret factor, and the storage satellite will no longer perform signature unlocking to avoid broadcasting invalid transactions to the blockchain network.
[0059] When the discrete logarithm equality verification passes, the storage satellite uses the unlocking secret factor to verify a portion of the signature. After adaptation, the complete signature scalar is obtained:
[0060] in, express The multiplicative inverse in the on-chain signature scalar field; when If no valid inverse exists, the storage satellite determines that the signature unlocking has failed. Upon successful unlocking, the storage satellite extracts the encrypted commitment. x-coordinate And combine them to obtain the complete transaction signature:
[0061] Full transaction signature Audit transaction messages Correspondingly, only when the storage satellite uses the correct local data to calculate the proof group elements that are consistent with the auditor's expected aggregation result can a result that can be verified by the on-chain standard signature be obtained. Therefore, the complete transaction signature is not a separate payment signature, but rather an on-chain confirmation credential obtained by unlocking the result of data holding calculations.
[0062] S6. The storage satellite broadcasts the audit transaction message and the complete transaction signature to the blockchain verification node. The blockchain verification node verifies the complete transaction signature based on the auditor's on-chain transaction signature public key, and uses the signature verification result as the on-chain audit confirmation result of the data holding of the original data file.
[0063] Specifically, after the storage satellite obtains the complete transaction signature locally, it will audit the transaction message. and complete transaction signature The message is broadcast to the blockchain verification node. Unlike traditional challenge-response verification schemes that require the storage satellite to send proof back to the auditor, who then initiates on-chain confirmation, in this embodiment, the storage satellite does not need to send data possession proof back to the auditor. Instead, it directly broadcasts the complete transaction signature obtained by unlocking the proof result to the blockchain verification node. The blockchain verification node does not perform bilinear mapping operations, nor does it need to read homomorphic integrity tags or data block content; it only needs to perform standard signature verification to obtain the on-chain audit confirmation result.
[0064] Furthermore, in one embodiment provided in this application, the audit transaction message includes at least a file identifier, challenge set association information, auditor on-chain account identifier, and storage satellite on-chain account identifier. When verifying the complete transaction signature, the blockchain verification node performs standard signature verification on the audit transaction message and the complete transaction signature based on the on-chain transaction signature public key corresponding to the auditor on-chain account identifier.
[0065] Specifically, the file identifier in the audit transaction message is used to specify the original data file corresponding to this on-chain audit confirmation; the challenge set association information is used to specify the challenge content used in this audit; the auditor's on-chain account identifier is used to determine the on-chain transaction signature public key required for signature verification; and the storage satellite's on-chain account identifier is used to determine the storage satellite corresponding to this audit confirmation result. The blockchain verification node reads or determines the auditor's on-chain transaction signature public key based on the auditor's on-chain account identifier. It also performs standard signature verification on the audited transaction messages and the complete transaction signature. In one implementation, the blockchain verification node computes:
[0066]
[0067]
[0068] in, Represents a complete signature scalar Multiplicative inverse in the scalar field of on-chain signature This represents a verification point. Blockchain verification nodes determine whether the x-coordinate of the verification point matches the x-coordinate of the complete transaction signature. Consistency:
[0069] If they match, the complete transaction signature verification passes; if they do not match, the complete transaction signature verification fails. This is because the complete transaction signature contains... Unlocking the secret factor The pre-signature adaptation of the adapter and the successful signature verification indicate that the storage satellite has successfully obtained the unlock secret factor corresponding to the auditor's expected result off-chain.
[0070] Furthermore, in one embodiment provided in this application, after the auditor sends the challenge set, the audit transaction message, the adapter pre-signature, and the discrete logarithm equality proof, the auditor does not receive the data holding proof returned by the storage satellite. After the storage satellite generates the complete transaction signature locally, it directly broadcasts it to the blockchain verification node, so that the data holding audit is transformed from challenge-response verification between the auditor and the storage satellite into signature verification between the storage satellite and the blockchain verification node.
[0071] Specifically, in traditional challenge-response verification schemes, after the auditor sends a challenge to the storage satellite, the storage satellite needs to send back a data possession proof. The auditor then verifies the proof before performing on-chain confirmation. This process relies on multiple round trips via the satellite-to-ground link, and the audit state needs to be resynchronized when the communication window is interrupted. This embodiment embeds the expected aggregation result calculated locally by the auditor into the unlocking conditions of the adapter pre-signature, enabling the storage satellite to complete the calculation of the proof group elements, the generation of the unlocking secret factor, and the recovery of the complete transaction signature locally. The storage satellite does not need to send back a challenge to the auditor. Alternatively, with other proof of possession, blockchain verification nodes do not need to understand the data block and tag structure. The link interaction is changed from "challenge-proof-verification-confirmation" to "challenge and pre-signature sending-signature local unlocking-on-chain signature verification", reducing the risk of audit interruption caused by intermittent satellite link connections.
[0072] Furthermore, in one embodiment provided in this application, when any of the following conditions are met: the discrete logarithm equality proof verification fails, the complete transaction signature verification fails, or the file identifier does not match the challenge set association information, an on-chain audit confirmation failure status is generated; when the complete transaction signature verification passes and the file identifier in the audit transaction message matches the challenge set association information, an on-chain audit confirmation pass status is generated and the corresponding on-chain audit confirmation information is recorded.
[0073] Specifically, the on-chain audit confirmation status is generated based on the key verification conditions of this audit. When the storage satellite fails to perform a discrete logarithm equality proof locally, it indicates that the adapter pre-signature cannot be correctly interpreted by the secret factor, and the storage satellite does not generate a valid complete transaction signature. When the blockchain verification node fails to verify the complete transaction signature, it indicates that the broadcast signature cannot prove that the audited transaction message was generated by the auditor's on-chain transaction signature private key. When the file identifier does not match the challenge set association information, it indicates that the on-chain transaction message does not correspond to this challenge session and cannot be used as the basis for confirming the data ownership of the original data file. If any of the above conditions are met, an on-chain audit confirmation failure status is generated.
[0074] When the complete transaction signature verification passes and the file identifier in the audited transaction message matches the challenge set association information, the blockchain verification node or on-chain recording logic generates an on-chain audit confirmation status and records the corresponding on-chain audit confirmation information. The on-chain audit confirmation information may include the file identifier, challenge set association information, auditor's on-chain account identifier, storage satellite's on-chain account identifier, signature verification result, and block confirmation information. This record does not need to contain the original data block, tag set, or proof group elements, which reduces the on-chain verification burden and allows the on-chain record to represent that the storage satellite completed the data holding audit confirmation at the corresponding moment of this challenge.
[0075] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.
[0076] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A highly efficient non-interactive auditing method for satellite network data security, characterized in that, include: S1. Initialize the satellite network audit environment, generate bilinear mapping public parameters, data producer's tag signature key pair, auditor's on-chain transaction signature key pair, and determine the on-chain receiving address or account identifier of the stored satellite. S2. The data producer divides the original data file into blocks, generates file identifiers and homomorphic integrity tags corresponding to each data block, sends the data block set to the storage satellite cache, and sends the tag set and file identifiers to the auditor for storage. S3. The auditor generates a challenge set based on the file identifier, calculates the expected aggregation result based on the tag set and the challenge set, converts the expected aggregation result into an unlock secret, generates an audit transaction message, an adapter pre-signature, and a discrete logarithm equality proof associated with this challenge set based on the unlock secret, and sends the challenge set, the audit transaction message, the adapter pre-signature, and the discrete logarithm equality proof to the storage satellite all at once. S4. The storage satellite reads the locally cached data blocks according to the challenge set, and calculates the proof group element corresponding to the expected aggregation result when the data is complete based on the locally cached data blocks and public parameters, and converts the proof group element into the unlock secret factor. S5. The storage satellite verifies the discrete logarithm equality proof. When the verification is successful, the unlock secret factor is used to adapt the adapter pre-signature to obtain the complete transaction signature corresponding to the audit transaction message. S6. The storage satellite broadcasts the audit transaction message and the complete transaction signature to the blockchain verification node. The blockchain verification node verifies the complete transaction signature based on the auditor's on-chain transaction signature public key, and uses the signature verification result as the on-chain audit confirmation result of the data holding of the original data file.
2. The efficient non-interactive auditing method for satellite network data security according to claim 1, characterized in that, The bilinear mapping public parameters include a first cyclic group of prime order, a second cyclic group, a target group, a bilinear mapping, a generator of the first cyclic group, a generator of the second cyclic group, a first hash function for mapping file identifiers and data block indices to the first cyclic group, a second hash function for mapping the serialization result of group elements to the on-chain signature scalar field, and elliptic curve parameters for generating on-chain transaction signatures.
3. The efficient non-interactive auditing method for satellite network data security according to claim 1, characterized in that, The data producer divides the original data file into blocks, generating file identifiers and homomorphic integrity tags corresponding to each data block, including: The original data file is divided into a set of data blocks arranged by index; Generate a unique file identifier for the original data file; Generate a corresponding homomorphic integrity tag based on the file identifier, data block index, data block content, and the data producer's tag signing private key; The homomorphic integrity tag is bound to the file identifier and the data block index to form a tag set.
4. The efficient non-interactive auditing method for satellite network data security according to claim 1, characterized in that, The challenge set consists of a subset of challenged data block indexes and random challenge coefficients corresponding to each challenged data block index. The subset of challenged data block indexes is randomly selected from all data block indexes of the original data file. The random challenge coefficients are used to constrain subsequent tag aggregation calculations and data block aggregation calculations.
5. The efficient non-interactive auditing method for satellite network data security according to claim 4, characterized in that, The step of calculating the expected aggregation result based on the tag set and the challenge set, converting the expected aggregation result into an unlock secret, and generating an audit transaction message, adapter pre-signature, and discrete logarithm equality proof associated with the current challenge set based on the unlock secret includes: The auditor performs homomorphic aggregation on the homomorphic integrity labels corresponding to the index of the challenged data block according to the random challenge coefficient, and obtains the aggregated labels; The auditor performs a bilinear mapping operation on the aggregation label and the second cyclic group generator to obtain the expected aggregation result; The auditor performs normalized serialization and hash mapping on the expected aggregation result to obtain the unlock secret; The auditor maps the unlock secret to elliptic curve points and generates an adapter pre-signature based on the auditor's on-chain transaction signing private key, the audit transaction message, and the elliptic curve points; The auditor generates a proof that the discrete logarithms generated from the same random number are equal to those of the standard commitment and the cryptographic commitment in the adapter's pre-signature.
6. The efficient non-interactive auditing method for satellite network data security according to claim 5, characterized in that, The storage satellite reads locally cached data blocks according to the challenge set, and calculates the proof group element corresponding to the expected aggregation result when the data is complete, based on the locally cached data blocks and common parameters. The proof group element is then converted into an unlocking secret factor, including: The storage satellite reads locally cached data blocks according to the subset of the challenged data block index; The storage satellite performs linear aggregation on the read data blocks according to the random challenge coefficient to obtain the data aggregation value; The storage satellite generates aggregated public base terms based on the file identifier, the index of the challenged data block, and the random challenge coefficient; The storage satellite calculates proof group elements based on the data aggregation value, the aggregation public base item, and the data producer's tag signature public key; The storage satellite performs normalized serialization and hash mapping on the elements of the proof group to obtain the unlocking secret factor.
7. The efficient non-interactive auditing method for satellite network data security according to claim 6, characterized in that, The storage satellite verifies the discrete logarithm equality proof. Upon successful verification, it adapts the adapter pre-signature using the unlock secret factor to obtain the complete transaction signature corresponding to the audit transaction message, including: The storage satellite generates verification elliptic curve points based on the unlocking secret factor; The storage satellite performs discrete logarithmic equality verification using the verification elliptic curve points, the standard commitment in the adapter pre-signature, the cryptographic commitment, and the discrete logarithmic equality proof; When the discrete logarithm equality verification passes, the storage satellite uses the unlocking secret factor to decrypt a portion of the signature in the adapter pre-signature to obtain the complete signature scalar; The storage satellite combines the complete signature scalar with the cryptographic commitment x-coordinate in the adapter pre-signature to obtain the complete transaction signature.
8. The efficient non-interactive auditing method for satellite network data security according to claim 1, characterized in that, The audit transaction message includes at least a file identifier, challenge set association information, auditor's on-chain account identifier, and storage satellite's on-chain account identifier. When verifying the complete transaction signature, the blockchain verification node performs standard signature verification on the audit transaction message and the complete transaction signature based on the on-chain transaction signature public key corresponding to the auditor's on-chain account identifier.
9. The efficient non-interactive auditing method for satellite network data security according to claim 1, characterized in that, After sending the challenge set, the audit transaction message, the adapter pre-signature, and the discrete logarithm equality proof, the auditor does not receive the data holding proof returned by the storage satellite. The storage satellite generates the complete transaction signature locally and broadcasts it directly to the blockchain verification node, thus transforming the data holding audit from a challenge-response verification between the auditor and the storage satellite into a signature verification between the storage satellite and the blockchain verification node.
10. A highly efficient non-interactive auditing method for satellite network data security according to claim 8, characterized in that, When any of the following conditions are met: the discrete logarithm equality proof fails to pass verification, the complete transaction signature fails to pass verification, or the file identifier does not match the challenge set association information, an on-chain audit confirmation failure status is generated; when the complete transaction signature verification passes and the file identifier in the audit transaction message matches the challenge set association information, an on-chain audit confirmation pass status is generated and the corresponding on-chain audit confirmation information is recorded.