CN105491069A - Integrity verification method based on active attack resistance in cloud storage - Google Patents

Abstract

The invention discloses an integrity verification method for resisting active attacks, which mainly solves the problem that the prior art cannot resist active attacks. The scheme is: 1. The user evenly divides the file into blocks, generates primary tags and auxiliary tags, and selects a cryptographic hash function, pseudo-random function and pseudo-random permutation function; 2. The user sends the file block to the cloud service provider, and Delete the local file, and the user generates an inquiry message and sends it to the cloud service provider; 3. The cloud service provider generates proof information, and the user passes the proof information, and uses the one-way property of the hash function to resist active attacks; 4. The user passes the local Generate verification information to verify the certification information sent by the cloud service provider. If the verification is passed, the user data is considered complete; otherwise, the data is destroyed. The invention reduces the traffic, improves the ability to resist active attack, and can be used in cloud storage to support the client to verify the integrity of the data under the premise of losing the ownership of the data.

Description

Integrity verification method based on resisting active attacks in cloud storage

technical field

The invention belongs to the field of communication security, and in particular relates to a data integrity verification method, which can be used in cloud storage to support a client to complete data integrity verification under the premise of losing data ownership.

Background technique

As a new type of storage model, cloud storage has the ability to store data remotely and has been widely used. More and more companies are outsourcing their data to the cloud to reduce the pressure on local data storage. With the emergence of these advantages, the security of cloud storage has also become a focus of attention, especially in cloud storage, when users lose ownership of data, attackers and unsafe cloud service providers will not be able to control user data. The resulting data corruption becomes a major security concern. Therefore, data integrity verification has become a hot topic.

In the paper "Enabling public verifiability and availability for secure data storage in cloud computing" written by Rashmi M. Jogdand and R. H. Goudar, the concept of hash tree was first proposed, which greatly improved the performance of user verification data integrity, but this paper did not take into account the problems brought by insecure clouds. Replay attacks and authentication problems caused by local users losing ownership of data.

In response to the above security issues, Mehdi Sookhak, Abdullah Gani, Muhammad Khurram Khan and Rajkumar Buyya proposed a remote data integrity verification method in the case of loss of data ownership in the paper "Dynamicremoted data auditing for securing big data storage in cloud computing", and this method can dynamically update user data in the cloud and use the DCT model (DivideandConquerTable) reduces the computational complexity caused by data updates. However, the defect of this method is that after the active attacker maliciously modifies the user data stored in the cloud, and intercepts and modifies the integrity certification information sent by the cloud service provider, and then sends the modified certification information to the user, this certification information can deceive The user has passed the user's verification, but in fact the data stored in the cloud by the user has been maliciously tampered with. Faced with such an active attack, this method cannot resist.

Contents of the invention

The purpose of the present invention is to propose a data integrity verification method that resists active attacks in view of the security problems existing in the above-mentioned prior art that are unable to resist active attacks, so as to avoid data integrity verification and dynamic update of data on the cloud. Malicious tampering of data improves the ability to resist active attacks.

The technical idea of the present invention is: protect the overly exposed certification information generated by the cloud service provider CSP through cryptographic hash functions, such as MD5 and SHA-1; After the message is certified, the proof information cannot be modified arbitrarily through ordinary calculations, so that the verification stage of the subsequent user end cannot be passed, preventing malicious attackers from deceiving the user.

According to above train of thought, the realization scheme of the present invention comprises as follows:

(1) User initialization steps:

The user divides the file F into n blocks to generate a block file pass Main tag for generating chunked files and auxiliary tags

The user selects a cryptographic hash function H, a pseudo-random function f, and a pseudo-random permutation function π, and saves two tags locally

(2) User communication and inquiry steps:

(2a) The user sends the chunked file to the cloud service provider CSP, and then deleted locally To save user storage space;

(2b) The user selects the first security parameter k ₁ for the pseudo-random function f, selects the second security parameter k ₂ for the pseudo-random permutation π, and selects the number of blocks of the file to be verified c, and generates query information chal={c,k ₁ ,k ₂ } to the cloud service provider CSP;

Wherein c is not less than 10% of the total number n of block files, the length of the first security parameter k ₁ is not less than 512 bits, and the length of the second security parameter k ₂ is not less than 512 bits.

(3) Steps to resist active attack:

(3a) After the cloud service provider CSP receives the query information, it passes the c block files that the user needs to verify Generate proof information proof to the user, where:

$\mathrm{<span\; class="notranslate">\; p</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; \&gamma;</span>}}<span\; class="notranslate">\; (</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; c</span>}}{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>$

Among them, H( ) represents the hash function, S _γ ( ) represents the algebraic signature function, γ represents an element in the Galois field, a _j represents the jth coefficient generated by the pseudo-random function, f(i _j ) Indicates the i _j -th file block, i _j represents the serial number of the j-th file block generated by the pseudo-random permutation function, and j represents the c block files that the user needs to verify The serial number of , 1≤j≤c, c indicates the number of blocks of the verification file selected by the user.

(3b) Through the one-way characteristic of the hash function H, the user resists the behavior of the active attacker to modify the proof information proof, so that the attacker's attack result fails, and the protection proof information proof cannot be modified arbitrarily;

(4) User verification steps:

(4a) After resisting the behavior of active attack, the user saves c primary tags locally and c auxiliary tags Generate authentication information μ for local users:

$\mathrm{<span\; class="notranslate">\; \&mu;</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; c</span>}}{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; T</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; \&CirclePlus;</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>$

in, Indicates the i _jth primary label, Indicates the i _jth auxiliary label;

(4b) Use the hash value H(μ) of the user’s verification information μ to verify the received proof information proof:

If the equation H(μ)=proof is established, the user believes that the user data stored in the cloud service provider CSP is complete;

Otherwise, the user considers the data corrupted.

Compared with the prior art, the present invention has the following advantages:

1. In the present invention, the user verifies the certificate information returned by the cloud service provider through the certificate information generated by the locally saved main label and auxiliary label, and can complete the integrity verification task of the remote data.

2. In the present invention, since the user only sends the file segments, instead of sending the main tag and the auxiliary tag generated by the user himself, the communication volume of data is reduced.

3. In the present invention, since the cloud service provider protects the proof information by using the hash function when sending the proof information, and utilizes the one-way characteristic of the hash function, the proof information is protected from being destroyed, thereby resisting the possibility of active attack Behavior.

Description of drawings

Fig. 1 is the realization flowchart of the present invention.

Fig. 2 is a subflow chart of resisting active attacks in the present invention.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings.

With reference to Fig. 1, the realization steps of the present invention are as follows:

Step 1, user initialization.

(1a) Chunk the file:

When the user needs to send the local file F to the cloud service provider CSP, the user first needs to perform the block operation of the file. The file block technology includes uniform block technology, overlapping block technology, and variable length block technology. The example selects the uniform block technology, that is, the user needs to divide the file F to be stored into n blocks evenly, and set the length of the file F to be L to generate a block file The length of each block is When the last block cannot reach the block length When , add 0 behind it to make its length reach

(1b) The user divides the block file by the following formula Main tag for generating chunked files and auxiliary tags

T _i ＝S _γ (f(i)||(ID _F ||i||L _i ||V _i ))

C _i ＝S _γ (ID _F ||i||L _i ||V _i )

Among them, f(i) represents the i-th block file, i represents the serial number of the block file f(i) in the overall file, 1≤i≤n, n represents the number of blocks in the block file, and the || symbol represents the parameter The cascading, ID _F represents the unique identity information of the file, L _i represents the serial number of the block file f(i) in the divide-and-conquer table DCT, where the divide-and-conquer table DCT represents a model for sequentially storing data, which is composed of general The sequential storage model cutting results, and label the storage space obtained by cutting, V _i represents the version number of the block file f(i) in the partition table DCT, S _γ ( ) represents the algebraic signature function, is a hash function with algebraic properties, and its main algebraic properties satisfy γ represents an element in the Galois field;

(1c) The user selects a cryptographic hash function H:

Among many hash function algorithms, the digital signature algorithm SHA-1 and the information-digest algorithm 5 (MD5) are the most commonly used. In this example, the user selects the information-digest algorithm 5 (MD5) as the cryptographic hash function H;

(1d) Among the many pseudo-random functions, the pseudo-random function based on random table lookup and the MonteCarlo pseudo-random function are the most common. In this example, the user chooses the MonteCarlo pseudo-random function Its function form is: k ₁ means pseudorandom function The security parameters of , x represents the pseudo-random transformation function The input length of , l represents the pseudo-random function the length of the output;

(1e) At the same time, among many pseudo-random permutation functions, the pseudo-random permutation function based on cyclic shift permutation and the Durstenfeld pseudo-random permutation function are more common. In this example, the user chooses the Durstenfeld pseudo-random permutation function The function form is: k ₂ represents the pseudorandom permutation function The security parameters of , y represents the pseudo-random permutation function The length of the input and output.

Step 2, user communication and inquiry:

(2a) The user sends on an insecure channel To the cloud service provider CSP, then locally delete the chunk file To save user storage space;

(2b) The user selects the verification file block c, the number of c is not less than 10% of the total block number n, and 20% is selected in this example;

(2c) The user selects the pseudo-random transformation function The security parameter k ₁ of , the length of the k ₁ is not less than 512 bits, and 512 bits are selected in this example;

(2d) The user selects a pseudo-random permutation function The security parameter k ₂ , the length of the k ₂ is not less than 512 bits, and 512 bits are selected in this example;

(2e) The user generates inquiry information chal={c,k ₁ ,k ₂ } according to the selected parameters, and sends the inquiry information to the cloud service provider CSP.

Step 3, resist active attack.

Referring to Figure 2, the specific implementation of the steps is as follows:

(3a) The attacker modifies the user information in the cloud service provider CSP;

(3b) According to the query information chal={c,k ₁ ,k ₂ }, the cloud service provider CSP passes the c block files that need to be verified by the user Generate the following proof information proof and send it to the user:

$\mathrm{<span\; class="notranslate">\; p</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; \&gamma;</span>}}<span\; class="notranslate">\; (</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; c</span>}}{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>$

in, express The transformed file is divided into blocks, f(i _j ) represents the i _jth file block, and i _j represents the pseudo-random permutation function The collection of j-bit strings in It is obtained by cross-producting the set of k ₂ -bit strings and the set of log ₂ j-bit strings; a _j represents the jth coefficient generated by the pseudo-random function, which in the pseudo-random function It is obtained by cross multiplying the set of k ₁ -bit strings and the set of log ₂ j-bit strings, and j represents the c block files that the user needs to verify The serial number of , 1≤j≤c, c indicates the number of blocks of the verification file selected by the user, H( ) indicates the hash function, S _γ ( ) indicates the algebraic signature function, which is a hash function with algebraic properties, Its algebraic properties satisfy $S_{\mathrm{\&gamma;}}\left(\underset{i=1}{\overset{\mathrm{no}}{\&Sigma;}}f\right(i))=\underset{i=1}{\overset{\mathrm{no}}{\&Sigma;}}{S}_{\mathrm{\&gamma;}}\left(f\right(i\left)\right),$ γ represents an element in the Galois field;

(3c) The attacker intercepts the proof information proof sent by the cloud service provider CSP and modifies it;

(3d) The user uses the one-way characteristic of the hash function H to resist the behavior of the active attacker to modify the proof information, so that the attacker's attack result fails, and the protection proof information proof cannot be modified arbitrarily;

Step 4, user verification steps:

(4a) After resisting the behavior of active attack, the user saves c primary tags locally and c auxiliary tags Generate authentication information μ for the following local users:

$\mathrm{<span\; class="notranslate">\; \&mu;</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; c</span>}}{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; T</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; \&CirclePlus;</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span>$

in, Indicates the i _jth primary label, Indicates the i _jth auxiliary label, Indicates XOR operation;

(4b) The user takes the user verification information μ as the input of the hash function H, performs hash calculation to obtain the hash value H(μ) of the user verification information, and uses H(μ) to verify the proof information proof:

If the equation H(μ)=proof holds true, the user believes that the user data stored by the cloud service provider CSP is complete; otherwise, the user believes that the data is damaged.

The above description is only a specific example of the present invention, and does not constitute any limitation to the present invention. Obviously, for those skilled in the art, after understanding the content and principles of the present invention, it is possible to make various modifications and changes in form and details without departing from the principles and results of the present invention, but these are based on The modification and change of the idea of the present invention are still within the protection scope of the claims of the present invention.

Claims (6)

1. A remote authentication method based on anti-active attack in cloud storage, including: (1) User initialization steps: The user divides the file F into n blocks to generate a block file pass Main tag for generating chunked files and auxiliary tags The user selects a cryptographic hash function H, a pseudo-random function f, and a pseudo-random permutation function π, and saves two tags locally ${\left\{T_i\right\}}_{i=1}^{\mathrm{no}},{\left\{C_i\right\}}_{i=1}^{\mathrm{no}};$ (2) User communication and inquiry steps: (2a) The user sends the chunked file to the cloud service provider CSP, and then deleted locally To save user storage space; (2b) The user selects the first security parameter k ₁ for the pseudo-random function f, selects the second security parameter k ₂ for the pseudo-random permutation π, and selects the number of blocks of the file to be verified c, and generates query information chal={c,k ₁ ,k ₂ } to the cloud service provider CSP; Wherein c is not less than 10% of the total number n of block files, the length of the first security parameter k ₁ is not less than 512 bits, and the length of the second security parameter k ₂ is not less than 512 bits. (3) Steps to resist active attack: (3a) After the cloud service provider CSP receives the query information, it passes the c block files that the user needs to verify Generate proof information proof to the user, where: $\mathrm{<span\; class="notranslate">\; p</span>}\mathrm{<span\; class="notranslate">\; r</span>}\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; o</span>}\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; S</span>}}_{\mathrm{<span\; class="notranslate">\; \&gamma;</span>}}<span\; class="notranslate">\; (</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; c</span>}}{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; \&Center\; Dot;</span>\mathrm{<span\; class="notranslate">\; f</span>}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span><span\; class="notranslate">\; )</span>$ Among them, H( ) represents the hash function, S _γ ( ) represents the algebraic signature function, γ represents an element in the Galois field, a _j represents the jth coefficient generated by the pseudo-random function, f(i _j ) Indicates the i _j -th file block, i _j represents the serial number of the j-th file block generated by the pseudo-random permutation function, and j represents the c block files that the user needs to verify The serial number of , 1≤j≤c, c indicates the number of blocks of the verification file selected by the user; (3b) Through the one-way characteristic of the hash function H, the user resists the behavior of the active attacker to modify the proof information proof, so that the attacker's attack result fails, and the protection proof information proof cannot be modified arbitrarily; (4) User verification steps: (4a) After resisting the behavior of active attack, the user saves c primary tags locally and c auxiliary tags Generate authentication information μ for local users: $\mathrm{<span\; class="notranslate">\; \&mu;</span>}<span\; class="notranslate">\; =</span>\underset{\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}}{\overset{\mathrm{<span\; class="notranslate">\; c</span>}}{<span\; class="notranslate">\; \&Sigma;</span>}}{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; T</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; \&CirclePlus;</span>{\mathrm{<span\; class="notranslate">\; C</span>}}_{{\mathrm{<span\; class="notranslate">\; i</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span>$ in, Indicates the i _jth primary label, Indicates the i _jth auxiliary label; (4b) Use the hash value H(μ) of the user’s verification information μ to verify the received proof information proof: if the equation H(μ)=proof holds true, the user believes that the proof information stored in the cloud service provider CSP The user data is intact; otherwise, the user considers the data corrupted. 2. The method according to claim 1, wherein in the step (1), the user divides the file F into blocks, and the file F to be stored is evenly divided into n blocks, that is, the length of the file F is L, and each block length is When the last block cannot reach the block length When , add 0 behind it to make its length reach 3. The method according to claim 1, wherein in step (1), the user passes the block file Main tag for generating chunked files and auxiliary tags is generated using the following formula: T _i ＝S _γ (f(i)||(ID _F ||i||L _i ||V _i )) C _i ＝S _γ (ID _F ||i||L _i ||V _i ) f(i) represents the i-th block file, 1≤i≤n, n represents the block number of the block file, the || symbol represents the concatenation of parameters, ID _F represents the unique identity information of the file, L _i represents the block File f(i) is serial numbered in the divide-and-conquer table DCT, and the divide-and-conquer table DCT represents a model for sequentially storing data, V _i represents the version number of the block file f(i) in the divide-and-conquer table DCT, S _γ ( ) represents the algebraic signature function, which is a hash function with algebraic properties, and its algebraic properties satisfy γ represents an element in the Galois field. 4. The method according to claim 1, wherein the cryptographic hash function H selected by the user in the step (1) adopts information-digest algorithm 5, namely MD5. 5. The method according to claim 1, wherein the pseudo-random function selected by the user in the step (1) adopts MonteCarlo pseudo-random function, and its functional form is: where k ₁ represents the pseudorandom function The security parameters of , x represents the pseudo-random transformation function The input length of , l represents the pseudo-random function output length. 6. The method according to claim 1, wherein the pseudo-random permutation function selected by the user in the step (1) adopts the Durstenfeld pseudo-random permutation function, and the function form is, where k ₂ represents the pseudorandom permutation function The security parameters of , y represents the pseudo-random permutation function The length of the input and output.