云存儲中數(shù)據(jù)完整性的聚合盲審計方法研究
發(fā)布時間：2018-07-25 14:17
【摘要】：云存儲是云計算的一種重要服務,允許數(shù)據(jù)所有者將其數(shù)據(jù)托管在云服務器中,并通過網(wǎng)絡向用戶提供數(shù)據(jù)訪問。通過這種數(shù)據(jù)的外包服務,可以給數(shù)據(jù)所有者帶來諸多方便：1)減少存儲管理的壓力；2)減少存儲硬件和軟件以及數(shù)據(jù)維護的費用；3)可以實現(xiàn)任意地點、任意時間的數(shù)據(jù)訪問。與此同時,云存儲也帶來了新的安全問題。數(shù)據(jù)存儲在云端后,其安全性高度依賴于云服務提供商。事實上云服務提供商是不能被完全信任的。首先,由于自然災害、硬件故障、軟件故障和黑客攻擊等原因不可避免地造成數(shù)據(jù)的丟失。其次,云服務提供商可能對數(shù)據(jù)所有者的數(shù)據(jù)采取不可信的行為。如通過丟棄沒有或很少被訪問的數(shù)據(jù)來節(jié)省存儲空間,或者隱瞞數(shù)據(jù)損壞事件來維護其聲譽。由此可以看出,云存儲并不能保證數(shù)據(jù)所有者數(shù)據(jù)的完整性。傳統(tǒng)基于簽名或者消息驗證碼的完整性驗證方法需要先從云服務器下載全部原始數(shù)據(jù),然后驗證對應的簽名或者消息驗證碼的正確性。在云存儲環(huán)境下,因數(shù)據(jù)量大,該方法是非常低效的。為了安全高效地驗證云端數(shù)據(jù)的完整性,第三方審計方法是近年來的研究熱點。數(shù)據(jù)所有者將數(shù)據(jù)文件分塊并為每一數(shù)據(jù)塊計算相應的數(shù)據(jù)標簽。數(shù)據(jù)塊和標簽都存儲在云端,審計者通過抽樣檢查部分數(shù)據(jù)塊與標簽是否匹配來驗證數(shù)據(jù)的完整性。其優(yōu)勢有：1)不需要下載全部原始數(shù)據(jù)。2)將審計工作委托給審計者,減輕了數(shù)據(jù)所有者的負擔。3)為數(shù)據(jù)所有者和云服務器商提供公平可信的審計結(jié)果。在第三方審計過程中,必須保證審計者是在不能獲取數(shù)據(jù)內(nèi)容的前提下進行盲審計。否則,它將給所有者的數(shù)據(jù)帶來新的安全問題。當考慮群組中多用戶都可以對云端同一份數(shù)據(jù)文件進行訪問和修改時,共享數(shù)據(jù)的完整性審計面臨著新的挑戰(zhàn),比如身份隱私保護和用戶撤銷等問題。數(shù)據(jù)所有者關心其數(shù)據(jù)完整性的同時,云服務提供商同樣會關注存儲效率。當將重復數(shù)據(jù)刪除技術和完整性審計結(jié)合考慮時,重刪數(shù)據(jù)的完整性審計面臨著新的挑戰(zhàn),比如密文情況下重復數(shù)據(jù)刪除和重復標簽刪除,以及重刪后怎么樣進行完整性審計。當檢查到云端數(shù)據(jù)被破壞或者丟失時,數(shù)據(jù)所有者更關心的是被破壞或丟失的數(shù)據(jù)能否被修復。當考慮再生碼存儲數(shù)據(jù)的完整性審計問題時,其面臨著新的挑戰(zhàn),比如分布式存儲的完整性審計和錯誤定位、修復過程的污染攻擊以及支持編碼數(shù)據(jù)更新的動態(tài)審計。本文從個人數(shù)據(jù)、共享數(shù)據(jù)、密文重刪數(shù)據(jù)和再生碼存儲數(shù)據(jù)等四個方面對云存儲中的數(shù)據(jù)完整性審計問題進行研究,提出了不同情況下的盲審計方法分別解決不同的關鍵問題。論文的主要工作可以總結(jié)為以下幾個方面：(1)提出了一種基于雙線性映射加密的個人數(shù)據(jù)完整性盲審計方法。首先,設計了個人數(shù)據(jù)盲審計方案的框架并給出了相應的定義,該定義由5個算法組成。利用雙線性對映射的性質(zhì),在云服務器端將數(shù)據(jù)證據(jù)和標簽證據(jù)加密后再合并,實現(xiàn)審計者在不知數(shù)據(jù)內(nèi)容的情況下進行盲審計。其次,設計高效的索引機制支持數(shù)據(jù)更新,使數(shù)據(jù)更新操作不會導致大量額外的計算和通信開銷,實現(xiàn)了動態(tài)審計。最后針對多個審計請求,設計將不同的證據(jù)聚合的方法,以支持對多所有者多云服務器多文件的批量審計,使批量審計的通信開銷與審計請求的數(shù)量無關。理論分析和實驗結(jié)果表明,該方法是可證明安全的,與現(xiàn)有的方案相比,提出的方案有效提高了審計效率。(2)提出了一種基于代理重簽名的共享數(shù)據(jù)完整性盲審計方法。設計了共享數(shù)據(jù)盲審計方案的框架并給出了相應的定義,該定義由6個算法組成。結(jié)合共享數(shù)據(jù)的特點,重點研究審計過程中身份隱私保護和用戶撤銷問題。利用代理重簽名方法,計算標簽證據(jù)時將其他用戶簽名的標簽轉(zhuǎn)成成質(zhì)詢用戶簽名的標簽,從而實現(xiàn)身份隱私保護。同時使得審計開銷與用戶數(shù)據(jù)無關。該方法還實現(xiàn)了用戶直接撤銷,不需要重新計算被撤銷用戶簽名的標簽。詳細的安全性分析表明,本章的方案是可證明安全的。與現(xiàn)有的方案相比,在審計和用戶撤銷等方面提高了效率。(3)提出了一種基于代理重加密的密文重刪數(shù)據(jù)完整性盲審計方法。設計了密文重刪數(shù)據(jù)盲審計方案的框架并給出了相應的定義,該定義由7個算法組成。在同一框架下實現(xiàn)了客戶端密文重復數(shù)據(jù)刪除和云端數(shù)據(jù)完整性審計。利用代理重加密方法,實現(xiàn)了密文重刪對所有者加密的密鑰沒有限制。設計新的標簽生成方法,實現(xiàn)了標簽重刪,使得存儲開銷與所有者數(shù)量無關。同時,審計者可以代表任意數(shù)據(jù)所有者驗證重刪數(shù)據(jù)的完整性。詳細的安全性分析表明,本章的方案是可證明安全的。與現(xiàn)有的方案相比,在審計和重刪等方面提高了效率。(4)提出了一種基于增量矩陣的再生碼存儲數(shù)據(jù)完整性盲審計方法。設計了再生碼存儲數(shù)據(jù)盲審計方案的框架并給出了相應的定義,該定義由10個算法組成。審計者不僅能一次性驗證存儲在不同服務器上的數(shù)據(jù)的完整性,還能快速定位出錯的服務器。數(shù)據(jù)修復時先進行完整性檢查,以防止云服務器發(fā)起地污染攻擊。為了支持動態(tài)審計,提出了基于增量矩陣和索引機制的數(shù)據(jù)更新方法,使得數(shù)據(jù)更新不需要重新下載和編碼云端數(shù)據(jù)。詳細的安全性分析表明,本章的方案是可證明安全的。實驗結(jié)果對方案的效率進行了驗證。
[Abstract]:Cloud storage is an important service in cloud computing that allows data owners to host their data in a cloud server and provide data access to users through the network. Through the outsourced service of this data, it can bring a lot of convenience to the data owners: 1) reduce storage management pressure; 2) reduce storage hardware and software and data dimension. At the same time, cloud storage also brings new security problems. When data is stored in the cloud, the security is highly dependent on cloud service providers. In fact, cloud service providers are not completely trusted. First, natural disasters, hardware failures, and software reasons. Barriers and hacker attacks inevitably cause data loss. Secondly, cloud service providers may take untrusted behavior for data owners' data, such as saving storage space by discarding data that is not or rarely accessed, or concealing data damage events to maintain their reputation. The integrity of data owner data is not guaranteed. The integrity verification method based on the traditional signature or message validation code needs to download all the original data from the cloud server first, and then verify the correctness of the corresponding signature or message authentication code. In the cloud storage environment, the method is very inefficient because of the large amount of data. The third party audit method is the research hotspot in recent years. The data owner blocks the data file and calculates the corresponding data labels for each data block. The data block and label are stored in the cloud. The auditor checks the integrity of the data by sampling the matching of the part of the data block to the label. The advantages are: 1) no need to download all the original data.2) to delegate the audit to the auditor, reduce the burden of the data owner.3) to provide a fair and credible audit result for the data owner and the cloud server. In the third party audit process, the auditor must be blinded on the premise that the data is not available. Otherwise, it will bring new security issues to the owner's data. When many users in the group can access and modify the same data file in the cloud, the integrity audit of shared data is faced with new challenges, such as identity privacy protection and user revocation. Data owners are concerned with their data integrity. At the same time, cloud service providers also pay attention to storage efficiency. When considering duplication of data deletions and integrity audits, the integrity audit of heavy censored data faces new challenges, such as repeated data deletions and repeat label deletions under the case of ciphertext, and how to carry out integrity audits after heavy censoring. When inspecting the cloud end When data is destroyed or lost, data owners are more concerned with whether the data being destroyed or lost can be repaired. When considering the integrity audit of the regenerated code storage data, it faces new challenges, such as the integrity audit and error location of the distributed storage, the pollution attack of the repair process, and the support for the update of the coded data. This paper studies the audit of data integrity in the cloud storage from four aspects, such as personal data, shared data, ciphertext censored data and regenerative code storage data, and puts forward the different key problems in different cases. The main work of this paper can be summarized as follows: (1) a blind audit method of personal data integrity based on bilinear map encryption is proposed. First, the framework of the personal data blind audit scheme is designed and the corresponding definition is given. The definition is composed of 5 algorithms. Using the properties of the bilinear pairing, the data evidence and the label evidence are encrypted and consolidated on the cloud server side. The present auditor performs a blind audit without knowing the content of the data. Secondly, the efficient index mechanism is designed to support the data updating, so that the data update operation does not lead to a large amount of additional computing and communication overhead and realizes the dynamic audit. Finally, the different methods of aggregation of evidence are designed to support multiple audit requests. The batch audit of multi cloud server multiple files makes the communication overhead of batch audit unrelated to the number of audit requests. The theoretical analysis and experimental results show that the method is proved to be safe. Compared with the existing schemes, the proposed scheme effectively improves the audit efficiency. (2) a kind of shared data integrity based on proxy re signature is proposed. The framework of the blind audit scheme of the shared data is designed and the corresponding definition is designed. The definition is composed of 6 algorithms. Combining the characteristics of the shared data, the identity privacy protection and the user revocation problem in the audit process are focused on. The proxy resignature method is used to calculate the label evidence when the labels of other users are transferred. This method also makes the audit cost unrelated to the user data. This method also implements the user direct revocation without recalculating the label of the revoked user's signature. Detailed security analysis shows that the scheme of this chapter is proved to be safe. Compared with the existing scheme, The efficiency of audit and user revocation is improved. (3) a blind data integrity audit method based on agent re encryption is proposed. The framework of the blind audit scheme of ciphertext re censoring data is designed and the corresponding definition is given. The definition is composed of 7 algorithms. In the same framework, the repeated data deletion of the client ciphertext is realized. And cloud data integrity audit. Using the agent re encryption method, there is no restriction on the encryption key of the owner. A new label generation method is designed to realize the tag deletion, which makes the storage cost unrelated to the number of the owners. At the same time, the auditor can verify the integrity of the deleted data on behalf of the owner of the data. The detailed security analysis shows that the scheme of this chapter is proved to be safe. Compared with the existing schemes, it improves the efficiency in audit and censoring. (4) a blind audit method of data integrity for regenerated codes based on incremental matrix is proposed. The framework of the regenerated code storage number based blind Audit Scheme is designed and the corresponding definition is given. The definition is composed of 10 algorithms. The auditor can not only verify the integrity of the data stored on different servers, but also quickly locate the wrong server. The integrity check is carried out to prevent the cloud server from launching pollution attacks. In order to support the dynamic audit, the incremental matrix and index machine are proposed. The data update method makes the data update without the need to re download and code the cloud data. Detailed security analysis shows that the scheme is proved to be safe. The experimental results verify the efficiency of the scheme.
【學位授予單位】：武漢大學
【學位級別】：博士
【學位授予年份】：2016
【分類號】：TP333
本文編號：2144086
[Abstract]:Cloud storage is an important service in cloud computing that allows data owners to host their data in a cloud server and provide data access to users through the network. Through the outsourced service of this data, it can bring a lot of convenience to the data owners: 1) reduce storage management pressure; 2) reduce storage hardware and software and data dimension. At the same time, cloud storage also brings new security problems. When data is stored in the cloud, the security is highly dependent on cloud service providers. In fact, cloud service providers are not completely trusted. First, natural disasters, hardware failures, and software reasons. Barriers and hacker attacks inevitably cause data loss. Secondly, cloud service providers may take untrusted behavior for data owners' data, such as saving storage space by discarding data that is not or rarely accessed, or concealing data damage events to maintain their reputation. The integrity of data owner data is not guaranteed. The integrity verification method based on the traditional signature or message validation code needs to download all the original data from the cloud server first, and then verify the correctness of the corresponding signature or message authentication code. In the cloud storage environment, the method is very inefficient because of the large amount of data. The third party audit method is the research hotspot in recent years. The data owner blocks the data file and calculates the corresponding data labels for each data block. The data block and label are stored in the cloud. The auditor checks the integrity of the data by sampling the matching of the part of the data block to the label. The advantages are: 1) no need to download all the original data.2) to delegate the audit to the auditor, reduce the burden of the data owner.3) to provide a fair and credible audit result for the data owner and the cloud server. In the third party audit process, the auditor must be blinded on the premise that the data is not available. Otherwise, it will bring new security issues to the owner's data. When many users in the group can access and modify the same data file in the cloud, the integrity audit of shared data is faced with new challenges, such as identity privacy protection and user revocation. Data owners are concerned with their data integrity. At the same time, cloud service providers also pay attention to storage efficiency. When considering duplication of data deletions and integrity audits, the integrity audit of heavy censored data faces new challenges, such as repeated data deletions and repeat label deletions under the case of ciphertext, and how to carry out integrity audits after heavy censoring. When inspecting the cloud end When data is destroyed or lost, data owners are more concerned with whether the data being destroyed or lost can be repaired. When considering the integrity audit of the regenerated code storage data, it faces new challenges, such as the integrity audit and error location of the distributed storage, the pollution attack of the repair process, and the support for the update of the coded data. This paper studies the audit of data integrity in the cloud storage from four aspects, such as personal data, shared data, ciphertext censored data and regenerative code storage data, and puts forward the different key problems in different cases. The main work of this paper can be summarized as follows: (1) a blind audit method of personal data integrity based on bilinear map encryption is proposed. First, the framework of the personal data blind audit scheme is designed and the corresponding definition is given. The definition is composed of 5 algorithms. Using the properties of the bilinear pairing, the data evidence and the label evidence are encrypted and consolidated on the cloud server side. The present auditor performs a blind audit without knowing the content of the data. Secondly, the efficient index mechanism is designed to support the data updating, so that the data update operation does not lead to a large amount of additional computing and communication overhead and realizes the dynamic audit. Finally, the different methods of aggregation of evidence are designed to support multiple audit requests. The batch audit of multi cloud server multiple files makes the communication overhead of batch audit unrelated to the number of audit requests. The theoretical analysis and experimental results show that the method is proved to be safe. Compared with the existing schemes, the proposed scheme effectively improves the audit efficiency. (2) a kind of shared data integrity based on proxy re signature is proposed. The framework of the blind audit scheme of the shared data is designed and the corresponding definition is designed. The definition is composed of 6 algorithms. Combining the characteristics of the shared data, the identity privacy protection and the user revocation problem in the audit process are focused on. The proxy resignature method is used to calculate the label evidence when the labels of other users are transferred. This method also makes the audit cost unrelated to the user data. This method also implements the user direct revocation without recalculating the label of the revoked user's signature. Detailed security analysis shows that the scheme of this chapter is proved to be safe. Compared with the existing scheme, The efficiency of audit and user revocation is improved. (3) a blind data integrity audit method based on agent re encryption is proposed. The framework of the blind audit scheme of ciphertext re censoring data is designed and the corresponding definition is given. The definition is composed of 7 algorithms. In the same framework, the repeated data deletion of the client ciphertext is realized. And cloud data integrity audit. Using the agent re encryption method, there is no restriction on the encryption key of the owner. A new label generation method is designed to realize the tag deletion, which makes the storage cost unrelated to the number of the owners. At the same time, the auditor can verify the integrity of the deleted data on behalf of the owner of the data. The detailed security analysis shows that the scheme of this chapter is proved to be safe. Compared with the existing schemes, it improves the efficiency in audit and censoring. (4) a blind audit method of data integrity for regenerated codes based on incremental matrix is proposed. The framework of the regenerated code storage number based blind Audit Scheme is designed and the corresponding definition is given. The definition is composed of 10 algorithms. The auditor can not only verify the integrity of the data stored on different servers, but also quickly locate the wrong server. The integrity check is carried out to prevent the cloud server from launching pollution attacks. In order to support the dynamic audit, the incremental matrix and index machine are proposed. The data update method makes the data update without the need to re download and code the cloud data. Detailed security analysis shows that the scheme is proved to be safe. The experimental results verify the efficiency of the scheme.
【學位授予單位】：武漢大學
【學位級別】：博士
【學位授予年份】：2016
【分類號】：TP333
【相似文獻】
相關期刊論文 前10條
1 李師謙;基于雜湊函數(shù)的數(shù)據(jù)完整性研究[J];山東理工大學學報(自然科學版);2003年03期
2 高春玲,張新顏;數(shù)據(jù)完整性機制的認識與應用[J];洛陽大學學報;2003年04期
3 武立福,毛宇光;多級安全數(shù)據(jù)庫保密性和數(shù)據(jù)完整性研究[J];計算機工程與應用;2004年08期
4 溫一軍;數(shù)據(jù)完整性應用的深入研究[J];沙洲職業(yè)工學院學報;2004年01期
5 郭艷光,于慶峰,胡敏,高明堂;淺析數(shù)據(jù)完整性問題及應用[J];內(nèi)蒙古石油化工;2004年06期
6 劉慧娟,張奕黃;嵌入式系統(tǒng)中閃存數(shù)據(jù)完整性處理方法[J];儀器儀表學報;2004年S1期
7 張華偉;楊凱;;Microsoft SQL Server 2000中的數(shù)據(jù)完整性機制探討[J];河南科技;2007年03期
8 龍映宏;;淺析數(shù)據(jù)完整性及其實現(xiàn)[J];電腦編程技巧與維護;2009年24期
9 張俊楷;谷小婭;;空氣質(zhì)量監(jiān)測系統(tǒng)數(shù)據(jù)完整性研究[J];電腦知識與技術;2013年19期
10 閃四清;數(shù)據(jù)完整性[J];個人電腦;1999年08期
相關會議論文 前5條
1 劉慧娟;張奕黃;;嵌入式系統(tǒng)中閃存數(shù)據(jù)完整性處理方法[A];第二屆全國信息獲取與處理學術會議論文集[C];2004年
2 曹丹陽;;數(shù)據(jù)完整性的檢測研究[A];中國計量協(xié)會冶金分會2008年會論文集[C];2008年
3 曹丹陽;;數(shù)據(jù)完整性的檢測研究[A];2008全國第十三屆自動化應用技術學術交流會論文集[C];2008年
4 彭涼;賴繼宏;梁余發(fā);;MES中數(shù)據(jù)完整性的解決方案[A];冶金企業(yè)MES和ERP技術實踐論文集[C];2005年
5 吳愛珍;;CICS與數(shù)據(jù)完整性[A];中國航海學會內(nèi)河船舶駕駛專業(yè)委員會學術年會論文集[C];2004年
相關重要報紙文章 前3條
1 記者 劉學習;NonStop拒絕宕機惡夢[N];計算機世界;2003年
2 本報記者 周蕾;期待NonStop的新成長[N];網(wǎng)絡世界;2003年
3 賽迪評測硬件與網(wǎng)絡事業(yè)部網(wǎng)絡通信實驗室;十項考驗煉“真金”[N];通信產(chǎn)業(yè)報;2004年
相關博士學位論文 前4條
1 張新鵬;云數(shù)據(jù)完整性與可用性研究[D];電子科技大學;2016年
2 何凱;云存儲中數(shù)據(jù)完整性的聚合盲審計方法研究[D];武漢大學;2016年
3 郝卓;遠程數(shù)據(jù)完整性和認證技術研究[D];中國科學技術大學;2011年
4 周強;無線傳感器網(wǎng)絡安全數(shù)據(jù)融合技術研究[D];南京郵電大學;2014年
相關碩士學位論文 前10條
1 董慶運;基于存儲證據(jù)的云端數(shù)據(jù)完整性驗證機制研究[D];河北大學;2015年
2 陳科;基于動態(tài)變色龍認證樹的流式數(shù)據(jù)完整性驗證研究與應用[D];東北大學;2014年
3 孟奕光;橋梁長期監(jiān)測數(shù)據(jù)完整性研究[D];石家莊鐵道大學;2016年
4 王士雨;高效的云端數(shù)據(jù)完整性驗證機制研究[D];電子科技大學;2016年
5 陳陽;云環(huán)境下基于身份的數(shù)據(jù)完整性證明的研究及應用[D];電子科技大學;2016年
6 吳遠棟;云存儲下數(shù)據(jù)完整性和安全性研究[D];長安大學;2016年
7 楊光洋;云計算外包存儲中數(shù)據(jù)完整性審計的研究[D];青島大學;2016年
8 鄭平;在藥品生產(chǎn)質(zhì)量管理體系中的數(shù)據(jù)完整性[D];上海交通大學;2015年
9 孫志峰;云存儲中能量有效的數(shù)據(jù)完整性校驗算法研究[D];東華大學;2016年
10 于美麗;云存儲數(shù)據(jù)完整性校驗中數(shù)據(jù)抽樣算法的研究[D];東華大學;2015年
，本文編號：2144086
本文鏈接：http://www.wukwdryxk.cn/shoufeilunwen/xxkjbs/2144086.html
最近更新
教材專著
