CN103425941B - The verification method of cloud storage data integrity, equipment and server - Google Patents

Abstract

The invention provides a method for verifying the integrity of cloud storage data, including: generating an identifier of a file to be stored, and encoding the file to obtain multiple module files; using the user's public key and private key to The file is calculated to obtain the authentication label of each module file, and public authentication data is generated for each authentication label; the identifier, module file and authentication label are submitted to the server; a file integrity query request is generated, and the query is sent to the server Request, receiving the report information of the file returned by the server, using the user public key, identifier, module file and authentication label corresponding to the module file; using the user public key and the public authentication data to verify the report information. The invention also provides a corresponding verification device and a verification server, which can publicly verify the integrity of cloud storage data.

Description

Method, device and server for verifying cloud storage data integrity

technical field

The present invention relates to the technical field of cloud storage, in particular to a method for verifying the integrity of cloud storage data, a device for verifying the integrity of cloud storage data, and a server for verifying the integrity of cloud storage data.

Background technique

Cloud storage is an emerging solution that puts storage resources on the network for people to access. Compared with traditional storage methods, cloud storage has advantages that cannot be ignored in terms of economy, scale, and management. For example, when a customer cannot store a large number of data files due to the small local storage space, the customer does not need to upgrade his own hardware and other facilities to solve this problem, and only needs to spend a reasonable fee to store these massive data in the The cloud provided by the cloud storage service provider can save many unnecessary troubles. Although the convenience brought by cloud storage is obvious, the accompanying security issues cannot be ignored. For resource saving or economic considerations, the server may delete or modify the files uploaded by users. Therefore, for a prudent cloud storage user, it is very important to verify the integrity of data files stored in the cloud.

Assume that the uploading user stores some data files in the cloud, and deletes these files stored in the cloud locally, and these files stored in the cloud are shared by other users, so at this time, the shared users of these stored files can independently Perform file integrity verification. In other words, in some special scenarios (such as on a train or plane), the uploading user cannot personally verify the integrity of the data files he stores in the cloud. At this time, the uploading user has to entrust a trusted party (relative, friend or subordinate) to verify the integrity of the cloud storage file for him. In the above situation, the uploading user sends his private key to others in order to allow other entities to verify the integrity of the data files stored in the cloud. Obviously, there is a great security risk. Therefore, it is necessary to design a proof-of-storage scheme that supports public authentication to solve the above security problems.

Ateniese et al. gave the definition of publicly verifiable schemes for the first time, and formally described the storage proof problem as the provable data storage (PDP) problem. However, the public certification PDP scheme proposed by them is not ideal in terms of communication and computing efficiency on the cloud storage server side.

Juels and Kaliski proposed the first concept of Proof of Retrievability (POR), and gave a detailed description of the secure POR system. To put it simply, in a secure POR system, if a cloud storage server can return a correct answer to the user's query for the user to accept, then the user and the server interact with each other multiple times in polynomial time, from In these interactive messages, users can restore the original data files. The first scheme mentioned in the literature does not have public verifiability (only supports private key authentication), and only supports a predefined constant number of authentications; although the second scheme can perform unlimited public authentications, it does not The server is required to send O(l) authentication values during the authentication interaction.

Shacham and Waters also gave two effective POR schemes, the first scheme only supports private key authentication, and the second scheme is publicly certifiable, but the calculation costs of these two schemes on the user and cloud server side are relatively high .

In addition, using the homomorphic encryption method, XuJia proposed several POR schemes. But these schemes also only support private key authentication. Alptekin Kupcu proposed the first effective full-motion PDP scheme. Users can update their files stored in the cloud and still be able to authenticate the integrity of the files. However, when their scheme is extended to support public verifiability, it will incur high computational and communication costs. Yuan Jiawei and Yu Shucheng also proposed a publicly verifiable POR scheme, using a secure polynomial commitment scheme. Their scheme achieves a fixed communication cost, but their scheme requires the server to perform multiple exponential operations.

Contents of the invention

Based on this, the present invention provides a method for verifying the integrity of cloud storage data, a verification device and a verification server, capable of publicly verifying the integrity of cloud storage data.

A verification method for cloud storage data integrity, comprising the steps of:

generating an identifier of the file to be stored, and encoding the file at the same time to obtain a plurality of module files;

Calculate each module file by using the user's public key and private key to obtain an authentication label for each module file, and generate public authentication data for each authentication label;

submitting said identifier, module file and authentication tag to the server;

Generate a file integrity query request, send the query request to the server, receive the report information of the file returned by the server, using the user public key, identifier, module file, and authentication label corresponding to the module file to generate;

The report information is verified using the user public key and the public authentication data.

A verification method for cloud storage data integrity, comprising the steps of:

Receive and store the identifier, module file and authentication label corresponding to the module file sent by the client;

Receive the file integrity query request sent by the user terminal, use the user's file integrity query request, public key, identifier, module file and the authentication label corresponding to the module file to generate report information and feed it back to the user terminal for all User-side authentication described above.

A verification device for cloud storage data integrity, comprising:

An encoding module, configured to generate an identifier of a file to be stored, and simultaneously perform module encoding on the file to obtain a plurality of module files;

A generating module, configured to calculate each module file by using the user's public key and private key to obtain an authentication label for each module file, and generate public authentication data for each authentication label;

submitting a module for submitting the identifier, the module file and the authentication label to the server;

A query module, configured to generate a file integrity query request, send the query request to the server, and receive the file returned by the server and generated using the user public key, identifier, module file, and authentication label corresponding to the module file report information;

A verification module, configured to verify the report information by using the user's public key and the public authentication data.

A verification server for cloud storage data integrity, comprising:

The receiving module is used to receive and store the identifier, the module file and the authentication label corresponding to the module file sent by the client;

The feedback module is used to receive the file integrity query request sent by the user terminal, and use the user's file integrity query request, public key, identifier, module file and authentication label corresponding to the module file to generate report information and feed back to the user terminal for authentication by the client.

In the method, device and server for verifying the integrity of cloud storage data, the user calculates the authentication label of the encoded module file to generate public authentication data, and the server stores the module file and the authentication label of the module file. When verifying, there is no need to provide the user's private information. The server can use the user's public key to generate report information on the stored module files and authentication labels, and the verifier can use the user's public key to verify the report information to achieve public authentication of cloud storage data integrity. ; The present invention allows any authorized verifier to verify the integrity of the data files stored in the cloud by the user without obtaining the user's private information, and without downloading the files.

Description of drawings

FIG. 1 is a schematic flowchart of a method for verifying cloud storage data integrity in Embodiment 1 of the present invention.

FIG. 2 is a schematic flowchart of the method for verifying the integrity of cloud storage data in Embodiment 2 of the present invention.

FIG. 3 is a schematic flowchart of the third embodiment of the method for verifying the integrity of cloud storage data in the present invention.

FIG. 4 is a schematic structural diagram of a verification device for cloud storage data integrity in Embodiment 4 of the present invention.

FIG. 5 is a schematic structural diagram of a verification server for cloud storage data integrity in Embodiment 5 of the present invention.

detailed description

The present invention will be described in further detail below in conjunction with the embodiments and accompanying drawings, but the embodiments of the present invention are not limited thereto.

The solution of the present invention may include three types of participants: users, cloud servers and verifiers. A user stores certain files to a cloud server and deletes these files locally. Cloud servers claim to have the ability to completely store customer data files. The verifier has the authority to verify the integrity of the customer's data files stored in the cloud server, and does not need the customer's private data.

Embodiment one

As shown in Figure 1, it is a schematic flow diagram of the verification method of cloud storage data integrity in this embodiment of the present invention. In this embodiment, the processing flow at the client end is used as an example to illustrate, including the following steps:

S11. Generate identifiers of files to be stored, and simultaneously encode the files to obtain multiple module files;

S12. Calculate each module file by using the user's public key and private key to obtain an authentication label for each module file, and generate public authentication data for each authentication label;

S13. Submit the identifier, module file and authentication label to the server;

S14. Generate a file integrity query request, send the query request to the server, and receive the report information of the file returned by the server and generated by using the user public key, identifier, module file, and authentication label corresponding to the module file ;

S15. Verify the report information by using the user public key and the public authentication data.

In step S11, the user needs to preprocess the file before uploading the file to the cloud server to generate the identifier of the file; and then process the file F to be stored, which can be processed by the rate-ρ algorithm. The user first sets System parameter ρ∈(0,1), apply the rate-ρ error correction code to encode the data file F and generate multiple module files (F ₀ ,…,F _n-1 ), so that each module F _i ∈{ 0,1} ^mλ , and any ρn modules F _i can restore the original data file F, where n is the total number of the module files.

In this embodiment, the user's public key and private key can be generated by the RSA key generation algorithm, and the specific generation steps are as follows:

The upload user randomly selects a λbits RSA modulus N=pq, so that Both are prime numbers, and p, q have the same bit length;

make in (N) is the Euler function, indicating the number of positive integers not greater than N and mutually prime with N;

Randomly select a generator g from QR _N , where QR _N represents the quadratic residual subgroup modulo N;

choose randomly in, express with coprime and in the modulus the remaining classes under;

Randomly select a seed seed from the key space of the pseudo-random function family {PRF _seed :{0,1} ^2λ →Z _φ(N) };

Let g _τ =g ^τ , the public key is pk=(N,g,g _τ ), and the private key is sk=(p,q,τ,seed).

In one embodiment, the identifier of the file satisfies the constraint condition id ∈ {0,1} ^λ , where id is the identifier, and λ is the bit length of the modulus in the user's public key.

After obtaining multiple module files F _i , the user needs to use the public key and private key to calculate the authentication label of each module file, and then generate public authentication data for each authentication label;

The step of using the user public key and private key to calculate the file of each module to obtain the authentication label of each module file can be:

The authentication label is generated according to the following formula:

Among them, i is the number of the module file, F _i is the i-th module file, σ _i is the authentication label corresponding to the module file i, τ is the random number in the user's private key, and PRF _seed is the random seed in the user's private key The pseudo-random number corresponding to the seed, i∈[0,n-1], n is the total number of the module files, and N is the modulus in the user's public key.

The step of generating public authentication data for each authentication tag may be:

Each public authentication data is generated according to the following formula:

${\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; PRF</span>}}_{\mathrm{<span\; class="notranslate">\; seeds</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; id</span>}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span>}$

Among them, g _i is the public authentication data of the i-th module file, and g is the generator in the user's public key.

After processing the module file, the user uploads the file to the cloud server. In step S13, the data submitted by the user to the cloud server only needs to include the identifier, the module file and its corresponding authentication label; Send to the server, only store (id,n) locally and make it public in $g^{\mathrm{\&sigma;}}={\mathrm{\&Pi;}}_{i\&Element;C}{\left(g_i\right)}^{v_i}{g}_{\mathrm{\&tau;}}^m\mathrm{mod}N$

After the data is successfully submitted, the verifier can generate a file integrity query request, send the query request to the server, and receive the report information returned by the server; finally verify the report information and judge the integrity of the data;

In one of the embodiments, the step of generating a file integrity query request may be:

Randomly select a subset of size |C|=l For each i ∈ C, from Randomly select a weight ν _i in , and the query request is {(i,ν _i ):i∈C}. ;

The steps for verifying the report information are:

Determine whether the following equation holds:

${\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

Wherein, the report information is (M, σ), M=Σ _i∈C ν _i F _i modN, σ=Σ _i∈C ν _i σ _i modN, i is the serial number of the module file, n is the total number of the module files, ν _i is the random weight corresponding to the number i, F _i is the i-th module file, N is the modulus in the user public key, and σ _i is the i-th module file corresponding certification label;

If true, the file storage is complete; if not, the file storage is incomplete.

Embodiment two

As shown in Figure 2, it is a schematic flow diagram of the method for verifying the integrity of cloud storage data in this embodiment of the present invention. In this embodiment, the processing flow of the cloud server is used as an example to illustrate, including the following steps:

S22. Receive and store the identifier, the module file and the authentication label corresponding to the module file sent by the client;

S23. Receive the file integrity query request sent by the client, use the file integrity query request, the public key, the identifier, the module file, and the authentication label corresponding to the module file to generate report information and feed it back to the client, to for the client to verify.

In one of the embodiments, the file verification request includes the serial number of the module file and the random weight corresponding to the serial number;

The report information is (M, σ), and the report information is generated according to the following formula:

M=Σ _i∈C ν _i F _i modN,σ=Σ _i∈C ν _i σ _i modN

Among them, i is the number of the module file, n is the total number of the module files, ν _i is the random weight corresponding to the number i, F _i is the i-th module file, N is the modulus in the user public key, and σ _i is the i-th module file corresponding certification label.

Embodiment three

As shown in FIG. 3 , the processing flow of the present invention is described through a specific embodiment. In this embodiment, the two-way interaction between the client and the server is taken as an example for illustration.

S31. The client generates an identifier of a file to be stored, and simultaneously encodes the file to obtain a plurality of module files;

S32. The user end calculates each module file by using the user public key and private key to obtain an authentication label of each module file, and generates public authentication data for each authentication label;

S33. The client submits the identifier, the module file and the authentication label to the server;

S34. The server receives and stores the identifier, the module file and the authentication label corresponding to the module file sent by the user;

S35. The client generates a file integrity query request, and sends the query request to the server;

S36. When the server receives the query request sent by the user, it uses the user's public key, the identifier, the module file, and the authentication label corresponding to the module file to generate the report information of the file and feed it back to the client;

S37. The client receives the report information returned by the server;

S38. The user terminal verifies the report information by using the user public key and the public authentication data;

1. Key generation ((1 ^λ )→(pk,sk))

a) The upload user randomly selects a λbits RSA modulus N=pq, so that Both are prime numbers and p, q have the same bit length;

b) order in is the Euler function, indicating the number of positive integers not greater than N and mutually prime with N;

c) Randomly select a generator g from QR _N , where QR _N represents a quadratic residual subgroup modulo N;

d) randomly selected in, express with coprime and in the modulus the remaining classes under;

e) from the family of pseudorandom functions Randomly select a seed seed in the key space of ;

Let g _τ =g ^τ , the public key is pk=(N,g,g _τ ), and the private key is sk=(p,q,τ,seed).

2. Coding $(\mathrm{sk},f)\&Right\; Arrow;(\mathrm{id},\stackrel{\&OverBar;}{f},\mathrm{no},{\left\{g_i\right\}}_{i=1}^{\mathrm{no}})$

a) Upload user setting system parameters ρ∈(0,1). Apply the rate-ρ error correction code to encode the data file F and generate file modules (F ₀ ,…,F _n-1 ), so that each module F _i ∈ {0,1} ^mλ , and any ρn All modules F _i can restore the original data file F;

b) Choose a unique identifier id∈{0,1} ^λ for the file F;

c) For each data file module F _i , i∈[0,n-1], calculate an authentication label

d) Let the encoded file be Will Send to cloud storage server;

e) Compute a public authentication data for each σ _i

The encoded file is customer will Send to the server, only store (id,n) locally and make it public

3. Challenge(id,n)→Q

a) The verifier randomly selects a subset with size |C|=l

b) For each i ∈ C, the verifier starts from Randomly select a weight ν _i in ;

Let Q={(i,ν _i ):i∈C};

4. Proof $(\mathrm{id},\stackrel{\&OverBar;}{f},Q)\&Right\; Arrow;(m,\mathrm{\&sigma;})$

a) The cloud server receives the (id, Q) sent by the verifier;

b) The cloud server finds the encoded file according to the identifier id

c) The cloud server calculates the report message (M, σ);

M=Σ _i∈C ν _i F _i modN, σ=Σ _i∈C ν _i σ _i modN.

The server sends (M,σ) to the verifier.

5. Verify $(\mathrm{pk},{\left\{g_i\right\}}_{i=0}^{\mathrm{no}-1},Q,(m,\mathrm{\&sigma;}))\&Right\; Arrow;$ reject or accept

Using the public key pk and the corresponding public information sequence {g _i }, the verifier verifies whether the following equation holds:

${\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; .</span>$

If the equation is true, output "accept", indicating that the file is complete; otherwise, output "reject", indicating that the file is incomplete.

Embodiment Four

As shown in FIG. 4, it is a schematic structural diagram of a verification device for cloud storage data integrity in this embodiment of the present invention. In this embodiment, a user device is used for illustration, including:

An encoding module 41, configured to generate an identifier of a file to be stored, and simultaneously encode the file to obtain a plurality of module files;

Generating module 42, is used for utilizing user's public key and private key to calculate each module file to obtain the authentication label of each module file, and generates public authentication data for each authentication label;

A submission module 43, configured to submit the identifier, module file and authentication label to the server;

The query module 44 is configured to generate a file integrity query request, send the query request to the server, and receive the query returned by the server, using the user public key, identifier, module file, and authentication label generated by the module file. the report information of the file;

A verification module 45, configured to verify the report information by using the user's public key and the public authentication data.

In one of the embodiments, the user public key and private key in the generation module 42 are generated by RSA key algorithm:

Randomly select a λbits RSA modulus N=pq, so that Both are prime numbers, and p, q have the same bit length;

make in (N) is the Euler function, indicating the number of positive integers not greater than N and mutually prime with N;

Randomly select a generator g from QR _N , where QR _N represents the quadratic residual subgroup modulo N;

choose randomly in, express with coprime and in the modulus the remaining classes under;

From the family of pseudorandom functions Randomly select a seed seed in the key space of ;

Let g _τ =g ^τ , the user public key is pk=(N,g,g _τ ), and the user private key is sk=(p,q,τ,seed).

In one embodiment, the identifier of the file satisfies the constraint condition id ∈ {0,1} ^λ , where id is the identifier, and λ is the bit length of the modulus in the user's public key.

In one of the embodiments, the generating module is also used for:

The authentication label is generated according to the following formula:

Among them, i is the number of the module file, F _i is the i-th module file, σ _i is the authentication label corresponding to the module file i, τ is the random number in the user's private key, and PRF _seed is the random seed in the user's private key The pseudo-random number corresponding to the seed, i∈[0,n-1], n is the total number of the module files, and N is the modulus in the user's public key.

In one of the embodiments, the generating module is also used for:

Each public authentication data is generated according to the following formula:

${\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; PRF</span>}}_{\mathrm{<span\; class="notranslate">\; seeds</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; id</span>}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span>}$

Among them, g _i is the public authentication data of the i-th module file, and g is the generator in the user's public key.

In one of the embodiments, the query module is also used for:

Randomly select a subset of size |C|=l For each i ∈ C, from Randomly select a weight v _i from which the query request is {(i,ν _i ):i∈C}.

In one of the embodiments, the verification module is also used for:

Determine whether the following equation holds:

${\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

Wherein, the report information is (M, σ), M=Σ _i∈C ν _i F _i modN, σ=Σ _i∈C ν _i σ _i modN, i is the serial number of the module file, n is the total number of the module files, ν _i is the random weight corresponding to the number i, F _i is the i-th module file, N is the modulus in the user public key, and σ _i is the i-th module file corresponding certification label;

If true, the file storage is complete; if not, the file storage is incomplete.

Embodiment five

As shown in FIG. 5, it is a schematic structural diagram of a verification server for cloud storage data integrity in this embodiment of the present invention. In this embodiment, the server is used as an example for illustration, including:

The receiving module 51 is used to receive and store the identifier, the module file and the authentication label corresponding to the module file sent by the client;

The feedback module 52 is configured to receive the file integrity query request sent by the client, and use the user's file integrity query request, public key, identifier, module file, and authentication label corresponding to the module file to generate report information and feed it back to the a client for authentication by the client.

In one of the embodiments, the file verification request includes the serial number of the module file and the random weight corresponding to the serial number;

The report information is (M, σ), and the feedback module is also used to generate the report information according to the following formula:

M=Σ _i∈C ν _i F _i modN,σ=Σ _i∈C ν _i σ _i modN

Among them, i is the number of the module file, n is the total number of the module files, ν _i is the random weight corresponding to the number i, F _i is the i-th module file, N is the modulus in the user public key, and σ _i is the i-th module file corresponding certification label.

Next, the beneficial effects of the present invention are set forth.

First, there are the following definitions:

Definition 1: If for any output of the algorithm defined above (key generation, encoding, challenge, proof, verification), the response returned by the proof algorithm can always make the output of the verification algorithm acceptable, and the verification process does not involve any The private key sk output by the key generation algorithm, then the scheme composed of these algorithms is called publicly provable data storage (PPDP).

Definition 2: If an honest cloud server can always be accepted by the verifier when it does store the client's data file completely and runs the proof algorithm honestly to generate a response, then such a PPDP scheme is complete.

In order to prove the security of the PPDP scheme, a security game needs to be introduced here.

Setup: The challenger runs the key generation algorithm to generate a pair of public and private keys (pk, sk). The challenger discloses the public key pk and only saves the private key sk.

Learning: The attacker adaptively makes some queries like:

Storage query: the attacker selects a data file F and sends it to the challenger, and the challenger returns in response. At the end of this step, the challenger only saves (id,n), and the attacker can get the encoded file And the corresponding file identifier id and a set of public authentication information

Verification query: The attacker sends a file identifier id to the challenger. If the id is generated by the attacker in the storage query in the previous step, the challenger initiates the following authentication to the attacker for the file F corresponding to the id Inquire:

Using the metadata n, the challenger is able to choose a random query Q and send it to the attacker.

For the query Q sent by the challenger, the attacker will generate a response R and return it to the challenger (R may be generated by any means).

The challenger runs the verification algorithm to verify R, and outputs b ∈ {accept, reject}.

The challenger sends the resolution bit b to the attacker. Also, if the id was not generated by the attacker in a previous stored query, the challenger does nothing.

Submit: The attacker selects a file identifier id* from the learning process and sends it to the challenger. Let F* denote the data file associated with id*.

Retrieval: The challenger initiates a polynomial PPDP verification query on the data file F*. Among them, the challenger acts as the verifier, and the attacker acts as the cloud storage server. From these interactive information, the challenger can obtain a data file module F' by using some PPT recovery algorithms. For the query initiated by the challenger, if the response of the attacker makes the challenger output acceptance during the authentication process, the attacker wins the game; if the file module F' obtained by the challenger is equal to the original file module F*, the challenge wins the game.

From the above safe game, give the following definition:

Definition 3: A PPDP scheme is rational if the difference between the probability of the attacker winning and the probability of the challenger winning in the defined security game is negligible. (For the query Q initiated by the challenger, when the response (M′,σ′) output by the attacker can pass the authentication, but (M′,σ′)≠(M,σ), the probability of this event is negligible , where (M,σ) denotes the true answer with proof algorithm output.)

Lemma 1 (Completeness of PPDP): The above PPDP scheme is complete under the description of Definition 2.

prove:

${\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

$<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}{\mathrm{<span\; class="notranslate">\; PRF</span>}}_{\mathrm{<span\; class="notranslate">\; seeds</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; id</span>}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; +</span>{\mathrm{<span\; class="notranslate">\; \&Sigma;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}\mathrm{<span\; class="notranslate">\; \&tau;</span>}{\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

$<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; PRF</span>}}_{\mathrm{<span\; class="notranslate">\; seeds</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; id</span>}<span\; class="notranslate">\; |</span><span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; )</span>}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}<span\; class="notranslate">\; \&Center\; Dot;</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

$<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

Theorem 1: If the pseudo-random function family PRF in the present invention is safe, and the discrete logarithm problem and the large integer decomposition problem are difficult to solve, then the PPDP scheme of the present invention is reasonable.

Before proving the above conclusion, the following lemma is given first.

Lemma 2 If the pseudorandom function family PRF in the present invention is safe, and the discrete logarithm problem and the large integer decomposition problem are difficult to solve, then the attacker of the PPT can get the relevant τ after interacting in the safe game probability of some useful information And since λ≈logN≈2+2logp', is negligible, where φ(N), p′, q′ are defined in the key generation algorithm, and let p′=min{p′,q′}.

Proof: Because the pseudo-random function PRF is secure, there is no such PPT attacker who can distinguish the output of PRF from the real random number in Z _φ(N) in the security game. Therefore, the secret value of τ is well hidden in _σi . Moreover, since the DLP problem is intractable, there is also no such PPT attacker who can obtain any valid information related to τ from the public key pkg _τ . So there is no PPT attacker who obtains any valid information about τ from the security game.

Proof of Theorem 1: Assume that the attacker acts as a cloud server to generate a valid response (M', σ') in any way and make the challenger accept it, and the real response generated by the proof algorithm is (M, σ), obviously for Both valid response (M′,σ′) and true response (M,σ) authentication equations will hold. so we have

${\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span>$

${\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{{\mathrm{<span\; class="notranslate">\; m</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>$

Divide (1) by (2) to get

$\frac{{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}}{{\mathrm{<span\; class="notranslate">\; g</span>}}^{{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}}<span\; class="notranslate">\; =</span>\frac{{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}}}{{\mathrm{<span\; class="notranslate">\; \&Pi;</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; C</span>}}{<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; )</span>}^{{\mathrm{<span\; class="notranslate">\; v</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}}{\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{{\mathrm{<span\; class="notranslate">\; m</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

$<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; \&sigma;</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

${\mathrm{<span\; class="notranslate">\; g</span>}}_{\mathrm{<span\; class="notranslate">\; \&tau;</span>}}^{\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; m</span>}}^{<span\; class="notranslate">\; \&prime;</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

$<span\; class="notranslate">\; =</span>{\mathrm{<span\; class="notranslate">\; g</span>}}^{<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; m</span>}<span\; class="notranslate">\; -</span>{\mathrm{<span\; class="notranslate">\; m</span>}}^{<span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; )</span>\mathrm{<span\; class="notranslate">\; \&tau;</span>}}\mathrm{<span\; class="notranslate">\; mod</span>}\mathrm{<span\; class="notranslate">\; N</span>}$

Through the above calculation, the attacker can get the following equation

g ^σ-σ′ = g ^(MM′)τ mod N (3)

For (3), consider the following two different cases.

case1: M≠M'. If M is not equal to M', the PPT attacker can get some valid information related to τ from the above formula (3). But according to the conclusion of Lemma 2, the probability of this situation happening is negligible. (Otherwise, there exists another attacker β that can invoke the above-mentioned attacker to solve the DLP problem with non-negligible probability.)

case2: M=M'. When M=M', it means that the challenger wins the security game. Here M′=Σ _i∈C ν _i F _i , which is a linear equation system about the encoding module, and its coefficient is the challenger's weight set {ν _i } _i∈C . Therefore, in order to obtain l=|C| linearly independent equations about the unknown F _i ,i∈C, the challenger needs to execute the protocol l=|C|times on the consensus index set C. In this way, by solving a linear equation system, the challenger can restore the original file module F _i ,i∈C.

Through the above analysis, the following inferences can be drawn:

Corollary 1: The probability of an attacker winning the security game is equal to the probability of case1 occurring plus the probability of case2 occurring. which is

Pr[the attacker wins the security game] = Pr[case1 happened] + Pr[case2 happened]

Since Pr[case1 occurrence] is negligible and case2 occurrence means the challenger wins the security game, Theorem 1 is proved.

The invention allows any authorized verifier to verify the integrity of the data files stored in the cloud by the client without obtaining the secret knowledge of the client, and without downloading all these files.

The server of the invention does not need to perform any exponential calculation, and is more effective and practical than many existing public authentication schemes in terms of calculation efficiency.

Complexity analysis: The cloud storage server uses homomorphism to integrate these module MAC pairs (F _i , σ _i ) queried by the verifier into a single module, and returns the calculated (M, σ) to the verifier as a response , such an operation makes the calculation of the present invention on the communication and server side very effective: both the user and the server have a communication cost of O(λ) and a storage cost of O(λ), where λ is the bit length of N. For each query issued by the verifier, the size of the response returned by the server is 2λ bits. And the server only needs to perform 21 multiplication operations and 21 addition operations to generate such a response, which makes the scheme of the present invention superior to many existing public authentication schemes in this respect. After receiving the response from the server, the verifier needs to perform l+2 exponent operations and l+1 multiplication operations to execute the authentication algorithm, which is also comparable to those existing public authentication schemes. Therefore, all these computational costs are linear in the number of elements in the query. From the labels σ _i ∈ {0,1} ^λ and F _i ∈ {0,1} ^mλ , it can be known that the storage cost of the server is However, during the setup phase, customers need to perform a group multiplication, a group addition and a PRF calculation for each data module to generate a corresponding label. In addition, the client also needs to perform a group exponent operation to generate the public information g _i , and all these preprocessing processes can be performed offline. Here l=|C| represents the index number selected in the authentication process.

The above-mentioned embodiments only express several implementation modes of the present invention, and the description thereof is relatively specific and detailed, but should not be construed as limiting the patent scope of the present invention. It should be pointed out that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent for the present invention should be based on the appended claims.

Claims (18)

1. A verification method for cloud storage data integrity is characterized by comprising the following steps:

generating an identifier of a file to be stored, and coding the file to be stored to obtain a plurality of module files;

calculating each module file by using the user public key and the private key to obtain an authentication tag of each module file, and generating public authentication data for each authentication tag;

submitting the identifier, the module file and the authentication tag to a server;

generating a file integrity query request, sending the query request to a server, and receiving report information of the file to be stored, which is returned by the server and generated by using a user public key, an identifier, a module file and an authentication tag corresponding to the module file;

verifying the reporting information using a user public key and the public authentication data;

the step of coding the file to be stored to obtain a plurality of module files comprises the following steps:

processing by adopting a rate-rho algorithm, setting system parameters rho ∈ (0,1), coding the file F by using an error correcting code of the rate-rho and generating a plurality of module files (F₀,…,F_n-1) So that each module file F_i∈{0,1}^mλAnd arbitrary ρ n module files F_iThe original file F can be restored.

2. The method for verifying the integrity of cloud storage data according to claim 1, wherein the user public key and the user private key are generated by an RSA key generation algorithm:

randomly selecting a lambda bits RSA modulus N ═ pq so thatAre both prime numbers, and p, q have the same bit length;

order toWhereinIs Euler function, and represents the number of positive integers not greater than N and prime with N;

from QR_NIn the method, a generator g is randomly selected, wherein, QR_NRepresenting a quadratic residue subgroup modulo N;

random selectionWherein tau is a random number in the user private key;is shown andrelatively prime and in the moldThe remaining classes of;

from a family of pseudo-random functionsRandomly selecting a seed from the key space;

let g_τ＝g^τThe user public key is pk ═ (N, g)_τ) The user private key sk ═ (p, q, τ, seed).

3. The verification method for the integrity of cloud storage data according to claim 2, wherein the identifier of the file satisfies the constraint condition id ∈ {0,1}^λAnd wherein id is the identifier, and λ is the bit length of the modulus in the user public key.

4. The method for verifying the integrity of the cloud storage data according to claim 3, wherein the step of calculating the file of each module by using the public key and the private key of the user to obtain the authentication tag of the file of each module comprises:

calculating the authentication tag according to:

wherein i is the number of the module file, F_iFor the ith module file, σ_iFor authentication tags, PRF, corresponding to module files i_seedPseudo-random number corresponding to random seed in user private key, i ∈ [0, n-1]N is the total number of the module files, and N is the modulus in the user public key.

5. The method for verifying the integrity of cloud storage data according to claim 3, wherein the step of generating public authentication data for each authentication tag is:

each public authentication data is generated according to the following formula:

$g_i=g^{{\mathrm{PRF}}_{seed}\left(id\right|\left|i\right)}$

wherein, g_iG is a generator in the public key of the user for the public authentication data of the ith module file.

6. The method for verifying the integrity of the cloud storage data according to claim 5, wherein the step of generating the file integrity query request is as follows:

randomly selecting a subset with the scale of | C | ═ lC is a set [0, n-1 ]]L represents the number of elements in C, for each i ∈ C, fromIn the method, a weight v is randomly selected_iWhat is, what isThe query request is { (i, v)_i):i∈C}。

7. The method for verifying the integrity of the cloud storage data according to claim 6, wherein the step of verifying the report information is:

determining whether the following equation holds:

$g^{\mathrm{\&sigma;}}={\mathrm{\&Pi;}}_{i\&Element;C}{\left(g_i\right)}^{{\mathrm{\&nu;}}_i}{g}_{\mathrm{\&tau;}}^M\mathrm{mod}N$

wherein the report information is (M, σ), and M is ∑_i∈Cν_iF_imodN,σ＝∑_i∈Cν_iσ_imod N, i is the number of the module file,n is the total number of the module files, v_iIs a random weight corresponding to the number i, F_iFor the ith module file, N is the modulus, σ, in the user's public key_iAn authentication label corresponding to the ith module file;

if yes, the file is stored completely; if not, the file storage is incomplete.

8. A verification method for cloud storage data integrity is characterized by comprising the following steps:

receiving and storing an identifier, a module file and an authentication tag corresponding to the module file sent by a user side;

receiving a file integrity query request sent by a user side, and generating report information by using the file integrity query request, a public key, an identifier, a module file and an authentication tag corresponding to the module file of the user to feed back to the user side for the user side to verify;

the module file is as follows:

processing by adopting a rate-rho algorithm, setting system parameters rho ∈ (0,1), coding the file F by using an error correcting code of the rate-rho and generating a plurality of module files (F₀,…,F_n-1) So that each module file F_i∈{0,1}^mλAnd arbitrary ρ n module files F_iThe original file F can be restored.

9. The method for verifying cloud storage data according to claim 8,

the file verification request comprises the serial number of the module file and the random weight corresponding to the serial number;

the report information is (M, σ), and is generated according to the following formula:

M＝∑_i∈Cν_iF_imodN,σ＝∑_i∈Cν_iσ_imodN

wherein i is the number of the module file,c is a set [0, n-1 ]]N is the total number of the module files, v_iIs a random weight corresponding to the number i, F_iFor the ith module file, N is the modulus, σ, in the user's public key_iAnd the identification label is corresponding to the ith module file.

10. A verification device for cloud storage data integrity, comprising:

the encoding module is used for generating identifiers of files to be stored and encoding the files to be stored to obtain a plurality of module files;

the generating module is used for calculating each module file by utilizing the public key and the private key of the user to obtain an authentication tag of each module file and generating public authentication data for each authentication tag;

the submitting module is used for submitting the identifier, the module file and the authentication tag to a server;

the query module is used for generating a file integrity query request, sending the query request to a server, and receiving report information of the file to be stored, which is returned by the server and generated by using a user public key, an identifier, a module file and an authentication tag corresponding to the module file;

a verification module for verifying the reporting information using a user public key and the public authentication data;

the step of coding the file to be stored to obtain a plurality of module files comprises the following steps:

processing by adopting a rate-rho algorithm, setting system parameters rho ∈ (0,1), coding the file F by using an error correcting code of the rate-rho and generating a plurality of module files (F₀,…,F_n-1) So that each module file F_i∈{0,1}^mλAnd arbitrary ρ n module files F_iThe original file F can be restored.

11. The apparatus for verifying integrity of cloud storage data according to claim 10, wherein the user public key and private key in the generation module are generated by RSA key generation algorithm:

randomly selecting a lambda bits RSA modulus N ═ pq so thatAre both prime numbers, and p, q have the same bit length;

order toWhereinIs Euler function, and represents the number of positive integers not greater than N and prime with N;

from QR_NIn the method, a generator g is randomly selected, wherein, QR_NRepresenting a quadratic residue subgroup modulo N;

random selectionWherein tau is a random number in the user private key;is shown andrelatively prime and in the moldThe remaining classes of;

from a family of pseudo-random functionsRandomly selecting a seed from the key space;

let g_τ＝g^τThe user public key is pk ═ (N, g)_τ) The user private key sk ═ (p, q, τ, seed).

12. The cloud storage data integrity verification device according to claim 11, wherein the identifier of the file satisfies a constraint condition id ∈ {0,1}^λAnd wherein id is the identifier, and λ is the bit length of the modulus in the user public key.

13. The apparatus for verifying integrity of cloud storage data according to claim 12, wherein the generating module is further configured to:

calculating the authentication tag according to:

wherein i is the number of the module file, F_iFor the ith module file, σ_iFor authentication tags, PRF, corresponding to module files i_seedPseudo-random number corresponding to random seed in user private key, i ∈ [0, n-1]N is the total number of the module files, and N is the modulus in the user public key.

14. The apparatus for verifying integrity of cloud storage data according to claim 12, wherein the generating module is further configured to:

each public authentication data is generated according to the following formula:

$g_i=g^{{\mathrm{PRF}}_{seed}\left(id\right|\left|i\right)}$

wherein, g_iG is a generator in the public key of the user for the public authentication data of the ith module file.

15. The apparatus for verifying integrity of cloud storage data according to claim 14, wherein the query module is further configured to:

randomly selecting a subset with the scale of | C | ═ lC is a set [0, n-1 ]]A sub ofSet, l represents the number of elements in C, for each i ∈ C, fromIn the random selection of a weight v_iThe query request is { (i, v)_i):i∈C}。

16. The apparatus for verifying integrity of cloud storage data as claimed in claim 15, wherein said verification module is further configured to:

determining whether the following equation holds:

$g^{\mathrm{\&sigma;}}={\mathrm{\&Pi;}}_{i\&Element;C}{\left(g_i\right)}^{{\mathrm{\&nu;}}_i}{g}_{\mathrm{\&tau;}}^M\mathrm{mod}N$

wherein the report information is (M, σ), and M ═ Σ_i∈Cν_iF_imodN,σ＝Σ_i∈Cν_iσ_imod N, i is the number of the module file,n is the total number of the module files, v_iIs a random weight corresponding to the number i, F_iFor the ith module file, N is the modulus, σ, in the user's public key_iAn authentication label corresponding to the ith module file;

if yes, the file is stored completely; if not, the file storage is incomplete.

17. A verification server for cloud storage data integrity, comprising:

the receiving module is used for receiving and storing the identifier, the module file and the authentication tag corresponding to the module file which are sent by the user side;

the feedback module is used for receiving a file integrity query request sent by a user side, and generating report information by using the file integrity query request, a public key, an identifier, a module file and an authentication tag corresponding to the module file of the user to feed back to the user side for the user side to verify;

the module file is as follows:

processing by adopting a rate-rho algorithm, setting system parameters rho ∈ (0,1), coding the file F by using an error correcting code of the rate-rho and generating a plurality of module files (F₀,…,F_n-1) So that each module file F_i∈{0,1}^mλAnd arbitrary ρ n module files F_iThe original file F can be restored.

18. The cloud storage data validation server of claim 17,

the file verification request comprises the serial number of the module file and the random weight corresponding to the serial number;

the report information is (M, σ), and the feedback module is further configured to generate the report information according to the following equation:

M＝Σ_i∈Cν_iF_imodN,σ＝Σ_i∈Cν_iσ_imodN

wherein i is the number of the module file, and C is the set [0, n-1 ]]Is selected from a group consisting of (a) a subset of,n is the total number of the module files, v_iIs a random weight corresponding to the number i, F_iFor the ith module file, N is the modulus, σ, in the user's public key_iAnd the identification label is corresponding to the ith module file.