双云架构下云存储审计协议研究

With the increasing large-scale adoption of cloud storage, users are posing more concerns on cloud storage security. As a key technique for ensuring cloud storage security, cloud storage auditing has a huge application prospect. Due to the single cloud architecture adopted by current cloud storage auditing researches, current proposed solutions are not able to recover data after a data damage detection and are not efficient for practical uses. Combined together, the deployment of cloud storage auditing in real systems is hindered. To solve these problems, adopting a twin cloud architecture with double data copy is promising. Thus, in this project, we propose to investigate cloud storage auditing using the twin cloud architecture. Specifically, we will first propose an efficient, provably secure cloud storage auditing protocol using the twin cloud architecture and the modeling of distributed string equality checking. The proposed protocol will detect any data damage for outsourced cloud storage. Then, with the help of locally updatable algebraic hash functions and verifiable computation, we will enhance the proposed protocol to support data dynamics. To further secure cloud storage and handle the incident that cloud storage auditing discovers data damage, we will propose an algorithm to efficiently locate and recover the damaged data, which is modeled as the classical Hamming distance problem. We will also propose a smart contract protocol to automatically arbitrate the responsibility between the user and the cloud for the data damage incident. Finally, we will extend the proposed protocol to support privacy-preserving third-party public auditing, which additionally reduces the auditing burden of the users. Based on these researches, this project will potentially lay a systematic, theoretical foundation for cloud storage auditing with the twin cloud architecture; therefore, the project will promote the resolution of cloud storage auditing in the wild.

随着云存储大规模应用，用户对云存储安全的担忧逐渐增加，云存储审计作为云存储数据安全核心技术之一，应用前景广泛。当前云存储审计研究由于单云架构的限制，检测出数据损坏后，未能支持损坏数据处理，且效率较低，阻碍了云存储审计的落地。使用双云架构双份数据的优势，将有望解决以上问题，因而本课题提出研究双云架构下的云存储审计。课题将基于分布式字符串匹配建模及双云的优势，构造高效的双云存储审计协议，帮助用户检测云端数据是否损坏；使用代数哈希函数的局部更新特征及可验证计算技术，进一步支持数据动态更新；而后，基于汉明距离问题建模及智能合约技术，进一步支持损坏数据定位、修复及用户与云端间的责任自动仲裁，深入保障云存储数据的安全；最后，基于随机化技术，支持第三方公开审计，降低用户的云存储审计负担。通过以上研究，本课题有望形成双云架构下云存储审计的一套有效理论方法，为云存储审计问题的实际落地解决奠定理论与实践基础。

随着数据安全相关法律的实施，云存储审计作为云数据安全关键技术之一，得到了国内外学术界、工业界的广泛重视。本课题在此背景下展开，以新兴的双云存储架构为立足点，研究该新型架构下云存储审计技术，并取得以下成果。第一，课题采用了新的研究路径，提出了一种新的高效的双云存储审计方案。所提方案仅使用代数哈希函数，实现了云中数据是否损坏的判断。所提方案支持数据动态更新、数据恢复以及第三方公开审计。相比之下，传统的云存储审计方案算需要效率较低的大整数算术运算，所提方案效率得到了较大的提升。第二，课题针对当前主流的云对象存储，提出了云存储同步系统，该系统可保障数据在多终端平台下保持实时同步性。所提方案仅使用公有云对象存储所提供的对外开放的数据读写接口（API），不依赖于特定的云平台，因而具有普适性。相比于传统的云同步系统，所提方案的开放性支持用户定制，在保障数据隐私、平台独立、功能个性化方面具有较高的优势。第三，提出了融合纠错码的云存储审计技术。该技术的基本思想仍然是遵循传统的同态认证审计范式，但新颖之处在于将纠错码与同态认证一起进行组合并压缩为一个步骤。相比于传统的云审计方案，在保障数据局部可纠错性的同时节约了存储开销。基于以上研究，本课题发表了17篇学术论文，申请了2项专利（已获授权1项）与2项软件著作权，培养了6名网络与信息安全领域硕士研究生。