基于多分支认证树的多用户多副本数据持有性证明方案

在云存储环境下,如何高效、动态地完成对多用户多副本数据的完整性验证是一个挑战性问题。基于双线性代数映射的签名机制和多分支认证树特性,提出了一种新的多用户多副本数据持有性证明方案。该方案通过使用随机掩码技术对密文进行处理确保数据隐私性,采用多分支认证树来提高数据分块的签名效率,能够支持数据动态更新操作。此外,引入第三方审计者对多用户多副本数据进行批量审计以减少计算开销。最后,分析表明本方案具有较高的安全性和效率。     

一种新的满足隐私性的云存储公共审计方案

在云存储网络环境中,数据的安全性、完整性和隐私性是用户最关心的问题之一.云存储服务中,用户将存储的数据和认证标识信息存储在云服务器中.为了保证存储数据的完整性,云存储服务提供者需要向用户或第三方审计者证明其正确地持有用户存储的数据.公共审计是指由用户以外的第三方代替用户完成审计工作,这对于计算资源比较有限的用户尤其重要.目前多数云存储审计方案没有考虑隐私性问题.本文提出了一种新的可聚合基于签名的广播加密(ASBB)方案,并在此基础上设计了新的满足隐私性的云存储公共审计方案.新方案在随机预言模型下是可证安全的,并且在计算开销方面更具有优势.     

一个改进的云存储数据完整性验证方案

在云计算环境中,客户将数据存储在不可信的云存储服务器上.如何在本地没有数据副本的情况下,高效地对客户存储的远程数据进行完整性验证是一个亟待解决的问题,针对此问题已相继提出一系列解决方案.提出已知证据伪造攻击的概念,即拥有一定数量证据的敌手可以伪造新的合法证据.指出已有的一些数据完整性验证方案无法抵抗已知证据伪造攻击.利用基于等级的认证跳表提出一个改进方案,该方案支持完全数据更新和公开审计.     

支持条件身份匿名的云存储医疗数据轻量级完整性验证方案

医疗云存储服务是云计算技术的一个重要应用,同时外包医疗数据的完整性和用户的身份隐私保护已变得越来越重要。该文提出适用于无线医疗传感器网络的支持条件身份匿名的外包云存储医疗数据轻量级完整性验证方案。方案结合同态哈希函数设计了聚合签名,通过第三方审计者(TPA)对外包云存储医疗数据进行完整性验证,在TPA端存放审计辅助信息,利用同态哈希函数的同态性质将TPA端的计算优化为常量运算,大大降低了第三方审计者的计算开销,同时支持TPA对多个数据文件执行批量验证,其验证开销几乎是恒定的,与医疗数据文件的数量无关。方案有效防止了第三方审计者通过求解线性方程恢复原始医疗数据,并且设计了条件身份匿名算法,密钥生成中心(PKG)根据用户唯一标识的身份信息为用户生成匿名身份及对应的签名私钥。即使攻击者截获到用户传输的医疗数据,也无法获知拥有此数据的真实身份,有效避免了对公钥证书的复杂管理,同时使得密钥生成中心可以有效追踪医疗信息系统中具有恶意行为的用户。安全性分析与性能评估结果表明该方案能够安全高效地部署在云辅助无线医疗传感器网络。     

基于区块链且可验证的智能电网多维数据聚合与分享方案

针对如何支持轻量级多维数据聚合,实现系统整体过程中多维数据的双端完整性验证,以及处理云服务器集中化等问题,提出了一种基于区块链且可验证的智能电网多维数据聚合与分享方案。首先,为了满足智能电网对电量数据细粒度分析的需求,利用掩蔽值和霍纳法则实现了隐私保护多维数据聚合。在此基础上,针对现有数据聚合方案在云存储数据与第三方分享方面存在的数据完整性验证问题,借用基于RSA的乘法同态承诺方案和同态哈希函数的同态性设计了一种新的签名算法,使云服务器不仅可以验证聚合数据的完整性,还可以验证数据分享阶段的完整性,即实现了云存储数据的双端可验证性,并且可以抵抗内部攻击。同时,提出了一种基于联盟链多链的聚合数据分享体系结构,有效地避免单机处理瓶颈和易受攻击等集中化问题。理论分析证明了所提方案的安全性。性能实验表明,所提方案比已有方案具有更低的计算和通信成本。     

云存储系统中数据副本服务的可靠性保障研究

以数据节点与网络链路的可靠性因素分析为基础,提出了云存储系统的数据副本服务可靠性模型。根据访问可靠性与数据副本数量、用户访问量之间的关系,设计数据服务可靠性、副本生成时机、存储节点选择的确定方法,实现了副本分布、删除算法,并在云存储系统ERS-Cloud上进行一系列实验,结果表明该方法能够有效保障数据服务的可靠性,进一步降低副本的冗余存储数量。     

基于分治表的云存储数据完整性审计方案

本文基于分治表和双线性对技术,提出基于分治表的云存储数据完整性审计方案。提出的方案不但能满足云存储数据的完整性审计的安全要求,同时设计的数据结构分治表(DCT)能更加高效的支持外包的动态操作。云存储数据完整性检查受到了学术各界的广泛关注,而且现有的数据审计方案并不能很好数据动态更新问题。     

基于联盟链的云存储完整性审计机制研究

针对云存储完整性审计公正性问题,提出一种基于联盟区块链的云存储完整性审计模型(CSACB,Cloud Storage Integrity Auditing Model Based on Consortium Blockchains).首先,该模型以树型结构描述审计联盟(AC,Audit Consortium)构成,同时利用层级证书链(LCC,Layer Certificate Chain)对联盟成员进行身份标识和权限控制.其次,采用完整性审计链与动态操作链的双链形式支持可变云存储审计.最后,利用智能合约(SC,Smart Contract)并结合数据块标签索引机制构建公正的动态操作审计模型,理论分析和实验结果表明该模型在安全性和性能上具备明显优势.     

Cloud-P2P云存储结构的模型建立与性能分析

基于Cloud-P2P云存储结构,针对云中心和P2P节点存储层数据副本的访问机制,考虑节点存储层数据副本的修复过程,建立一个三维连续时间Markov链模型。使用矩阵几何解方法导出该模型的稳态解,并给出节点存储层传输率,数据访问延迟和副本修复率等系统性能指标的表达式。通过数值实验和系统仿真定量刻画数据副本数等系统参数对Cloud-P2P云存储结构性能的影响。构造利润函数,进行用户存储层副本数的优化设置。     

信息系统审计证据生成技术研究

对信息系统下计算机取证工作的需求进行分析,提出了信息系统审计证据生成系统模型。该模型解决了信息系统审计数据作为电子证据时存在的完整性保护不足问题,为依据GB／T25070-2010《信息安全技术信息系统等级保护安全设计技术要求》建设的信息系统增加带有时间戳的审计证据完整性保护功能,可以在不修改信息系统审计数据原保存格式的前提下,使系统审计数据满足电子证据取证需要。该模型采用简单时间戳协议和审计数据分组签名算法,有效降低了审计证据生成系统对网络带宽和存储空间资源的占用。     

Secure deduplication and integrity audit system based on convergent encryption for cloud storage

Cloud storage applications quickly become the best choice of the personal user and enterprise storage with its convenience,scalability and other advantages,secure deduplication and integrity auditing are key issues for cloud storage.At first,convergent key encapsulation/decoupling algorithm based on blind signature was set up,which could securely store key and enable it to deduplicate.Besides,a BLS signature algorithm based on convergence key was provided and use TTP to store public key and proxy audit which enables signature and pubic key deduplication and reduces client storage and computing overhead.Finally,cloud-based secure deduplicaion and integrity audit system was designed and implemented.It offered user with data privacy protection,deduplication authentication,audit authentication services and lowered client and cloud computation overhead.     

An integrity verification scheme of completeness and zero‐knowledge for multi‐Cloud storage

To resist the attacks from the malicious Cloud service providers and the organizer, an integrality verification of completeness and zero‐knowledge property (IVCZKP) scheme for multi‐Cloud environment is proposed. First, the bilinear pairing maps are adopted as a basis of theoretical support for IVCZKP scheme. Second, the change of file blocks is recorded, and the hash value of each block is generated through the index‐hash table in the verification process. Finally, the hash value of each block is updated through this index‐hash table to support the dynamic updates to user's data, such as data modification, data insertion, and data deletion. Compared with the original scheme, IVCZKP scheme can resist the forgery attacks and has the completeness and zero‐knowledge property. Theory analysis and the experimental results show that this scheme can reduce the computation time and has more performance on integrity verification in multi‐Cloud environment.     

一种SD卡用户身份认证方案的设计与实现

通过分析当前云计算中基于口令与证书的模式身份认证,发现存在口令泄露、证书劫持、恶意攻击等导致信息泄密的安全隐患。结合安全卡携带方便、认证效率高、安全度强的特性,基于椭圆算法设计实现了用户与云计算服务器安全认证、密钥协商以及数据密文传输,有效地解决了终端用户身份认证存在的安全问题,并增强了云计算服务的安全性。     

Provable data possession scheme based on public verification and private verification

More and more users choose to transfer their applications and data into the cloud.Data security is a key issue for cloud storage systems.To ensure the integrity and validity of the data stored in the cloud,provable data possession (PDP) scheme is particularly important.In order to verify whether the cloud storage service provider had stored the data of the user completely,a scheme on the basis of NRPDP (non-repudiable PDP) was improved and extended,and a data retention scheme based on public authentication and private authentication was proposed.The scheme can verify the trustworthiness of the service provider and the user in the cloud storage at the same time,which satisfies the non-repudiation of the verification.The theory proves the non-repudiation of the proposed scheme.The experiment proves that the efficiency of each stage is better than that of the existing single public verification method or private authentication method.     

Lightweight integrity verification scheme for cloud based group data

In order to protect the security of the data stored in the cloud by group users,a data integrity verification scheme was designed which can protect the privacy of the group users.The scheme can efficiently detect the shared data in the cloud and support the dynamic updating of the data,and use the characteristic of the ring signature to hide the iden-tity of the signer corresponding to the data block.That is,the third-party verifier can not spy on the users identity and other private information when validating.The aggregated approach is used to generate data labels,which reduces the storage cost of labels and supports the dynamic operation of group data,so that the users in the group can easily modify the cloud group data.     

普适环境中基于一次性公钥的匿名认证方案

提出一种基于身份的一次性公钥及签名算法,与现有算法相比,该算法具有较小的计算和通信开销。基于该算法设计了一种普适环境中的匿名认证方案,当用户进行恶意操作时,服务提供者通过和可信中心合作可以揭示恶意用户身份。方案在提供强匿名性的同时,可有效防止用户进行恶意活动。     

云计算环境下基于评价可信度的动态信任评估模型

针对云用户如何选取可信的云服务提供商问题,提出了基于评价可信度的动态信任评估模型。该模型将云服务提供商的服务能力和云用户所需求的服务能力分别划分等级,有效地解决了云服务提供商服务能力动态变化对模型存在的潜在破坏问题。建立了信任度随时间窗变化的动态信任机制,在计算信誉度时,将用户的评价可信度作为其评价证据的可信权重,通过引入评价可信度和评价相似度提高了计算推荐行为可信度的准确率。仿真结果表明,该模型的评估结果更贴近云服务提供商的真实信任度,同时能有效抵御恶意云用户的攻击。     

Multimedia Broadcast Authentication Based on Batch Signature [Advances in Mobile Multimedia]

Conventional block-based broadcast authentication protocols overlook the heterogeneity of receivers in mobile computing by letting the sender choose the block size, divide a broadcast stream into blocks, associate each block with a signature, and spread the effect of the signature across all the packets in the block through hash or coding algorithms. They suffer from some drawbacks. First, they require that the entire block with its signature be collected before authenticating every packet in the block. This authentication latency can lead to the jitter effect on real-time applications at receivers. Second, the block-based approach is vulnerable to packet loss in mobile computing in the sense that the loss of some packets makes the other packets unable to be authenticated, especially when the block signature is lost. Third, they are also vulnerable to DoS attacks caused by the injection of forged packets. In this article we propose a novel broadcast authentication protocol based on an efficient cryptographic primitive called a batch signature. Our protocol supports the verification of the authenticity of any number of packets simultaneously and avoids the shortcomings of the block-based approach.     

A secure mutual authentication scheme with non‐repudiation for vehicular ad hoc networks

Vehicular ad hoc networks (VANETs) have been a research focus in recent years. VANETs are not only used to enhance the road safety and reduce the traffic accidents earlier but also conducted more researches in network value‐added service. As a result, the security requirements of vehicle communication are given more attention. In order to prevent the security threat of VANETs, the security requirements, such as the message integrity, availability, and confidentiality are needed to be guaranteed further. Therefore, a secured and efficient verification scheme for VANETs is proposed to satisfy these requirements and reduce the computational cost by combining the asymmetric and symmetric cryptology, certificate, digital signature, and session key update mechanism. In addition, our proposed scheme can resist malicious attacks or prevent illegal users' access via security and performance analysis. In summary, the proposed scheme is proved to achieve the requirements of resist known attacks, non‐repudiation, authentication, availability, integrity, and confidentiality. Copyright © 2015 John Wiley & Sons, Ltd.     

Securing QoS signaling in IP-based military Ad Hoc networks

QoS qualifiers in the IP header are prone to attacks. Malicious modifications may lead to theft of service as well as denial of service. Standard IPsec does not cover these header fields, leaving them prone to attacks. The article proposes a variant of the IPsec authentication header that includes protection of these fields. The solution is designed for single-domain networks with planned origin, such as military ad hoc networks.