Reducing Computational and Communication Complexity for Dynamic Provable Data Possession

Nowadays, an increasing number of persons choose to outsource their computing demands and storage demands to the Cloud. In order to ensure the integrity of the data in the untrusted Cloud, especially the dynamic files which can be updated online, we propose an improved dynamic provable data possession model. We use some homomorphic tags to verify the integrity of the file and use some hash values generated by some secret values and tags to prevent replay attack and forgery attack. Compared with previous works, our proposal reduces the computational and communication complexity from O(logn) to O(1). We did some experiments to ensure this improvement and extended the model to file sharing situation.

A Novel Provable Data Possession Scheme Based on Geographic Location Attribute

Increment of mobile cloud video motivates mobile users to utilize cloud storage service to address their demands, cloud storage provider always furnish a location-independent platform for managing user＇s data. However, mobile users wonder if their cloud video data leakage or dynamic migration to illegal service providers. In this paper, we design a novel provable data possession protocol based on data geographic location attribute, which allows data owner to auditing the integrity of their video data, which put forward an ideal choice for remote data possession checking in the mobile cloud storage. In our proposed scheme, we check out whether the video data dynamic migrate to an unspecified location （such as： overseas） by adding data geographic location attribute tag into provable data possession protocol. Moreover, we make sure the security of our proposed scheme under the Computational Diffic-Hellman assumption. The analysis and experiment results demonstrate that our proposed scheme is provably secure and efficient.

Blockchain-Based Light-Weighted Provable Data Possession for Low Performance Devices

Provable Data Possession(PDP)schemes have long been proposed to solve problem of how to check the integrity of data stored in cloud service without downloading.However,with the emerging of network consisting of low performance devices such as Internet of Things,we find that there are still two obstacles for applying PDP schemes.The first one is the heavy computation overhead in generating tags for data blocks,which is essential for setting up any PDP scheme.The other one is how to resist collusion attacks from third party auditors with any possible entities participating the auditing.In this paper,we propose a novel blockchain-based light-weighted PDP scheme for low performance devices,with an instance deployed on a cloud server.We design a secure outsourced tag generating method for low performance devices,which enables a kind of“hash-sign-switch”two-phase tag computing.With this method,users with low performance devices can employ third party auditors to compute modular exponential operations that accounts for the largest portion of computation overhead in tag generation,without leaking their data content.Chaincodes in blockchain network ensure the correctness of such outsourcing and prevent collusion attacks.The security analysis and performance evaluation prove that our scheme is both secure and efficient.

Sec-Auditor:A Blockchain-Based Data Auditing Solution for Ensuring Integrity and Semantic Correctness

Currently,there is a growing trend among users to store their data in the cloud.However,the cloud is vulnerable to persistent data corruption risks arising from equipment failures and hacker attacks.Additionally,when users perform file operations,the semantic integrity of the data can be compromised.Ensuring both data integrity and semantic correctness has become a critical issue that requires attention.We introduce a pioneering solution called Sec-Auditor,the first of its kind with the ability to verify data integrity and semantic correctness simultaneously,while maintaining a constant communication cost independent of the audited data volume.Sec-Auditor also supports public auditing,enabling anyone with access to public information to conduct data audits.This feature makes Sec-Auditor highly adaptable to open data environments,such as the cloud.In Sec-Auditor,users are assigned specific rules that are utilized to verify the accuracy of data semantic.Furthermore,users are given the flexibility to update their own rules as needed.We conduct in-depth analyses of the correctness and security of Sec-Auditor.We also compare several important security attributes with existing schemes,demonstrating the superior properties of Sec-Auditor.Evaluation results demonstrate that even for time-consuming file upload operations,our solution is more efficient than the comparison one.

Towards Comprehensive Provable Data Possession in Cloud Computing

To check the remote data integrity in cloud computing,we have proposed an efficient and full data dynamic provable data possession（PDP） scheme that uses a SN（serial number）-BN（block number） table to support data block update.In this article,we first analyze and test its performance in detail.The result shows that our scheme is efficient with low computation,storage,and communication costs.Then,we discuss how to extend the dynamic scheme to support other features,including public auditability,privacy preservation,fairness,and multiple-replica checking.After being extended,a comprehensive PDP scheme that has high efficiency and satisfies all main requirements is provided.

基于身份的密钥隔离的多云多副本可证数据持有方案

可证数据持有方案(Provable Data Possession, PDP)可以让用户在不下载全部数据的情况下验证其外包数据是否完好无损。为了提高外包数据的可用性和安全性,许多用户将数据的多个副本存储在单云服务器上,但是单云服务器在发生故障或者其他意外情况时,用户存储的数据副本也会遭到破坏因而无法恢复原始数据。同时,许多可证数据持有方案依赖于公钥基础设施(Public Key Infrastructure, PKI)技术,存在密钥管理问题。此外,现有的可证数据持有方案大多是在用户端使用密钥对数据进行处理。由于用户端的安全意识较弱或者安全设置较低,密钥可能会有泄露的风险。恶意云一旦获得了用户端的密钥,就可以通过伪造虚假的数据持有证明来隐藏数据丢失的事件。基于上述问题,提出了一种基于身份的密钥隔离的多云多副本可证数据持有方案(Identity-Based Key-Insulated Provable Multi-Copy Data Possession in Multi-Cloud Storage, IDKIMC-PDP)。基于身份的可证数据持有方案消除了公钥基础设施技术中复杂的证书管理。多云多副本确保了即使在某个云服务器上的副本被篡改或者被破坏的情况下,用户仍然可以从其他云服务器上获取副本并恢复数据。同时,方案中使用了密钥隔离技术实现了前向和后向安全。即使某一时间段内的密钥泄露,其他时间段内云存储审计的安全性也不会受到影响。给出了该方案的正式定义、系统模型和安全模型;在标准困难问题下,给出了该方案的安全性证明。安全性分析表明,IDKIMC-PDP方案具有强抗密钥泄露性、可检测性以及数据块标签和证明的不可伪造性。实验结果表明,与现有的多云多副本相关方案相比,IDKIMC-PDP方案具有相对较高的效率。

公有云中身份基多源IoT终端数据PDP方案

针对公有云中多源物联网(IoT)数据完整性验证问题,提出了一种身份基多源IoT终端数据可证明数据持有(ID-MPDP)方案。首先,给出了ID-MPDP方案的系统模型和安全模型的形式化定义。然后,使用RSA设计了具体的ID-MPDP方案。最后,给出了该方案的性能分析和安全性分析。性能分析和安全性分析结果表明,该方案是可证安全的、高效和可转换的,并具有以下优势:可用于多源IoT终端的数据完整性检测;具有较低的块扩展率;使用身份基公钥密码技术,消除了证书管理;满足可转换性。

Blockchain-based Privacy-Preserving Group Data Auditing with Secure User Revocation

Progress in cloud computing makes group data sharing in outsourced storage a reality.People join in group and share data with each other,making team work more convenient.This new application scenario also faces data security threats,even more complex.When a user quit its group,remaining data block signatures must be re-signed to ensure security.Some researchers noticed this problem and proposed a few works to relieve computing overhead on user side.However,considering the privacy and security need of group auditing,there still lacks a comprehensive solution to implement secure group user revocation,supporting identity privacy preserving and collusion attack resistance.Aiming at this target,we construct a concrete scheme based on ring signature and smart contracts.We introduce linkable ring signature to build a kind of novel meta data for integrity proof enabling anonymous verification.And the new meta data supports secure revocation.Meanwhile,smart contracts are using for resisting possible collusion attack and malicious re-signing computation.Under the combined effectiveness of both signature method and blockchain smart contracts,our proposal supports reliable user revocation and signature re-signing,without revealing any user identity in the whole process.Security and performance analysis compared with previous works prove that the proposed scheme is feasible and efficient.

Data Integrity Checking Protocol with Data Dynamics in Cloud Computing

We introduce a model for provable data possession (PDP) which allows a client that has stored data at an untrusted server to verify that the server possesses the original data without retrieving it. In a previous work, Ateniese et al. proposed a remote data integrity checking protocol that supports data partial dynamics. In this paper, we present a new remote data possession checking protocol which allows an unlimited number of file integrity verifications and efficiently supports dynamic operations, such as data modification, deletion, insertion and append. The proposed protocol supports public verifiability. In addition, the proposed protocol does not leak any private information to third-party verifiers. Through a specific analysis, we show the correctness and security of the protocol. After that, we demonstrate the proposed protocol has a good performance.

Blockchain-Based Privacy-Preserving Public Auditing for Group Shared Data

Cloud storage has been widely used to team work or cooperation devel-opment.Data owners set up groups,generating and uploading their data to cloud storage,while other users in the groups download and make use of it,which is called group data sharing.As all kinds of cloud service,data group sharing also suffers from hardware/software failures and human errors.Provable Data Posses-sion(PDP)schemes are proposed to check the integrity of data stored in cloud without downloading.However,there are still some unmet needs lying in auditing group shared data.Researchers propose four issues necessary for a secure group shared data auditing:public verification,identity privacy,collusion attack resis-tance and traceability.However,none of the published work has succeeded in achieving all of these properties so far.In this paper,we propose a novel block-chain-based ring signature PDP scheme for group shared data,with an instance deployed on a cloud server.We design a linkable ring signature method called Linkable Homomorphic Authenticable Ring Signature(LHARS)to implement public anonymous auditing for group data.We also build smart contracts to resist collusion attack in group auditing.The security analysis and performance evalua-tion prove that our scheme is both secure and efficient.

可证数据持有研究进展

海量远程数据完整性检测是云计算安全领域的一个研究热点,可证数据持有(Provable Data Possession,PDP)是一种轻量级远程数据完整性概率检测模型。从不同的公钥基础架构的角度,综述了PDP的研究进展。首先,针对公钥架构(Public Key Infrastructure,PKI)、身份基公钥密码和无证书公钥密码体制,分别阐述了PDP的研究背景和主要研究进展。其次,给出了结合新型网络技术的PDP方案,如区块链技术、DNA技术等。最后,展望了未来PDP研究的一些重要方向,包括量子计算和抗量子PDP、新型智慧城市和基于我国商用密码标准的PDP、6G和内生安全PDP等。

面向云存储的机载软件持有性证明

随着民用航空机载软件数量的不断增长,传统的软件分发方式面临效率低、成本高、安全性差的问题。为了提高机载软件的分发效率,将云存储与机载软件相结合,提出了一种基于Cloud-P2P的机载软件存储架构,实现了机载软件的分布式云存储以及机载软件共享。在此基础上,提出了一种数据持有性证明协议,通过将标识与公钥绑定,降低了共谋风险,并通过抽样审计完成对云上机载软件的完整性验证,减小了验证成本。安全性分析表明,所提方案具有不可伪造性和抗重放攻击的能力,并且证明了数据持有性证明协议的正确性。与现有的数据完整性审计方案相比,计算开销减少了10%,通信开销减少了20%。该研究对保证机载软件的高效安全分发具有实际意义。

抗密钥泄露的代理可证数据持有

云存储近年来发展迅猛,越来越多的用户选择将他们的数据存储在云服务器中。为了检验云存储数据的完整性,研究者们提出了可证数据持有(Provable Data Possession,PDP)。用户在某些情况下无法访问互联网,例如在远洋轮渡上,或是参加某些涉密的项目时,因此必须将远程数据完整性检验委托给代理。然而在代理PDP中,一旦用户的私钥泄露,审计方案将无法进行。针对上述问题,所提方案将密钥隔离技术与代理PDP相结合,在系统模型中引入了物理上安全但计算受限的助手设备。助手设备在每个时间段生成更新信息并发送给用户,帮助用户计算当前时段的签名密钥。在此方案下,敌手无法在密钥未泄露的时间段伪造用户生成的认证器。安全性分析和性能分析表明,所提方案是安全高效的。

基于电力系统多用户的数据持有证明计算方法

基于云计算的电力系统多用户业务应用将不可避免地规模化发展,为保障电力系统业务应用的数据安全可靠,不被伪造和攻击,论文提出一种多用户的数据持有证明计算方法,通过数据持有证明计算方法,不仅保护业务应用数据不被攻击者伪造,恶意管理员伪造,而且能很好地满足电力智慧物联体系的规模化业务应用;同时,通过对数据持有证明计算方法的安全性进行验证,计算性能进行了评估,使得该计算方法能够很好地应用于智慧物联体系下电力业务系统规模化应用。

云存储中的数据完整性证明研究及进展

随着云存储模式的出现,越来越多的用户选择将应用和数据移植到云中,但他们在本地可能并没有保存任何数据副本,无法确保存储在云中的数据是完整的.如何确保云存储环境下用户数据的完整性,成为近来学术界研究的一个热点.数据完整性证明(Provable Data Integrity,PDI)被认为是解决这一问题的重要手段,该文对此进行了综述.首先,给出了数据完整性证明机制的协议框架,分析了云存储环境下数据完整性证明所具备的特征;其次,对各种数据完整性证明机制加以分类,在此分类基础上,介绍了各种典型的数据完整性验证机制并进行了对比;最后,指出了云存储中数据完整性验证面临的挑战及发展趋势.

云计算下的数据存储安全可证明性综述

云计算的数据服务外包可以减少数据所有者本地的存储和维护压力,然而用户会因此失去对数据可靠性和安全的物理控制。于是如何确保云中数据的安全就成为了非常有挑战性的任务和难题。在全面研究云计算数据存储安全现有成果的基础上,介绍了云计算数据存储的基本架构,并从可检索证明和可证明数据拥有两个角度分析了相关研究方案的发展,从公共认证、同态认证、数据动态化、隐私保护、批审计和多服务器环境得方面讨论了协议的功能设计,并且列表进行了功能和开销对比,在此基础上提出了一个比较完备的云计算环境下的协议框架。最后总结并阐述了后续工作。

移动云计算环境中基于代理的可验证数据存储方案

现有云计算可验证数据存储协议无法直接应用于终端存储和计算能力有限的移动计算环境。针对该问题,提出移动计算环境下基于代理的可验证云存储协议,在终端和云服务器之间引入一个半可信的安全计算代理,利用代理来帮助移动终端用户完成计算密集的操作,从而使得可验证数据存储方案可用于移动计算环境。提出一个具体的可验证数据存储协议,形式化证明了所提协议满足随机预言机模型下的选择明文攻击(CPA)安全,量化分析结果表明协议设计适用于移动计算环境,符合设计目标。

云存储中数据完整性自适应审计方法

作为云存储安全的重要问题,数据完整性验证技术受到学术界和工业界的广泛关注.为了验证云端数据完整性,研究者提出了多个数据完整性公开审计模型.然而,现有的数据完整性审计模型采用固定参数审计所有文件,浪费了大量计算资源,导致系统审计效率不高.为了提高系统的审计效率,提出了一种自适应数据持有性证明方法(self-adaptive provable data possession,SA-PDP),该方法基于文件属性和用户需求动态调整文件的审计方案,使得文件的审计需求和审计方案的执行强度高度匹配.为了增强审计方案更新的灵活性,依据不同的审计需求发起者,设计了2种审计方案动态更新算法.主动更新算法保证了审计系统的覆盖率,而被动更新算法能够及时满足文件的审计需求.实验结果表明:相较于传统方法,SA-PDP的审计总执行时间至少减少了50%,有效增加了系统审计文件的数量.此外,SAPDP方法生成的审计方案的达标率比传统审计方法提高了30%.

一种支持完美隐私保护的批处理数据拥有性证明方案

数据拥有性证明技术是当前云存储安全领域中的一项重要研究内容,可使用户无须下载所有文件就能高效地远程校验用户数据是否完整存储于云服务器。现实中,用户趋向于委托第三方验证机构TPA代替自己来验证数据的完整性;然而,多数支持第三方公开审计的数据拥有性证明方案通常只考虑恶意服务器是否能够伪造标签或证明的问题,鲜有考虑恶意TPA可能会窃取用户隐私的情况。近几年,一些既针对服务器保证数据的安全性又针对TPA实现数据隐私保护的数据拥有性证明方案逐渐被提出,但多应用于单云服务器环境下;个别应用在多云服务器环境下可支持批量审计的方案,或者不能有效抵抗恶意云服务器的攻击,或者无法实现针对TPA的零知识隐私保护。因此,文中在Yu等工作的基础上,提出了一个多云服务器环境下支持批量审计的数据拥有性证明方案。所提方案既可保证针对恶意云服务器的安全性,还可实现针对TPA的完美零知识隐私保护。性能分析及仿真实验表明所提方案是高效且可行的。

支持并发更新的云存储数据持有性审计方法

数据持有性审计是保证云存储数据完整性的重要方法,但并发更新操作会导致审计系统效率大幅降低。为此,提出一种支持并发更新的云存储数据持有性审计方法。通过改进Merkle哈希树(MHT)结构,将多个请求更新MHT中间节点的过程延后执行,生成更新状态树,分离出多个叶子节点更新路径并合并执行,从而避免重复节点更新,降低云存储数据完整性验证系统的更新成本。形式化分析及实验结果表明,该方法能减少更新MHT节点数,提高云存储数据持有性审计的更新效率。