一种基于RFID感应的U盘加密方法

随着计算机应用和存储设备的不断普及,移动存储设备的使用越来越广泛,如何保证移动存储设备的安全存储显得尤为重要。这里提供一种基于RFID感应的U盘加密方法,该方法以射频识别技术为依托,通过将接收到的电子密钥和预先存入的相比较,根据识别结果采取不同的处理机制。电子密钥相互匹配则自动转入U盘的存储区,通过存储区中嵌入的加密体系自动对文件进行加密存储。电子密钥不匹配或者无法感应到射频识别信号时,自动转向U盘的引导区,通过手动输入正确密码,进入U盘存储区进行文件加密存储,有效提高了U盘存储的安全性。     

云环境下安全的可验证多关键词搜索加密方案

云计算的高虚拟化与高可扩展性等优势,使个人和企业愿意外包加密数据到云端服务器。然而,加密后的外包数据破坏了数据间的关联性。尽管能够利用可搜索加密(SE)进行加密数据的文件检索,但不可信云服务器可能篡改、删除外包数据或利用已有搜索陷门来获取新插入文件相关信息。此外,现有单关键词搜索由于限制条件较少,导致搜索精度差,造成带宽和计算资源的浪费。为了解决以上问题,提出一种高效的、可验证的多关键词搜索加密方案。所提方案不仅能够支持多关键词搜索,也能实现搜索模式的隐私性和文件的前向安全性。此外,还能实现外包数据的完整性验证。通过严格的安全证明,所提方案在标准模型下被证明是安全的,能够抵抗不可信云服务器的离线关键词猜测攻击(KGA)。最后,通过与最近3种方案进行效率和性能比较,实验结果表明所提方案在功能和效率方面具有较好的综合性能。     

Enhanced security‐aware technique and ontology data access control in cloud computing

Nowadays, security and data access control are some of the major concerns in the cloud storage unit, especially in the medical field. Therefore, a security‐aware mechanism and ontology‐based data access control (SA‐ODAC) has been developed to improve security and access control in cloud computing. The model proposed in this research work is based on two operational methods, namely, secure awareness technique (SAT) and ontology‐based data access control (ODAC), to improve security and data access control in cloud computing. The SAT technique is developed to provide security for medical data in cloud computing, based on encryption, splitting and adding files, and decryption. The ODAC ontology is launched to control unauthorized persons accessing data from storage and create owner and administrator rules to allow access to data and is proposed to improve security and restrict access to data. To manage the key of the SAT technique, the secret sharing scheme is introduced in the proposed framework. The implementation of the algorithm is performed by MATLAB, and its performance is verified in terms of delay, encryption time, encryption time, and ontology processing time and is compared with role‐based access control (RBAC), context‐aware RBAC and context‐aware task RBAC, and security analysis of advanced encryption standard and data encryption standard. Ultimately, the proposed data access control and security scheme in SA‐ODAC have achieved better performance and outperform the conventional technique.     

MCSERS云存储方案数据安全研究

数据安全是云存储的关键问题之一。本文对于一个实现数据加密分割的模块化云存储方案MCSERS（Modular Cloud Storage with Encryption and Redundancy Splitting）中的数据安全问题进行讨论。论文中定量的使用仿真实验分析数据冗余分割方案中算法性能与数据安全之间的关系,为优化选用合适的数据冗余分割方案提供理论依据。     

云计算与密码技术

文章在对云计算模式与密码技术的研究基础上,进一步研究了云计算模式与密码技术的有益结合。一方面,讨论了云计算中目前应关注的主要密码应用模式,从云存储中的数据加密、虚拟机的安全、身份认证与访问控制、安全审计等关键点出发,进行了概念性的讨论;另一方面,探讨了密码技术的云化,即以云计算模式作为构建密码系统的基础支撑,整合各种安全密码设备,形成密码服务资源池,实现"密码即服务"。     

一种基于保形加密的大数据脱敏系统实现及评估

数据脱敏,是指对数据中包含的一些涉及机密或隐私的敏感信息进行特殊处理,以达到保护私密及隐私信息不被恶意攻击者非法获取的目的.保形加密是众多数据脱敏技术的一种,但其具有保持原始数据格式不变的重要优势,从而在一定程度上对上层应用透明.随着大数据时代的到来以及Hadoop平台的广泛应用,传统的基于关系型数据库的数据脱敏技术已不能满足实际的生产需要.针对Hadoop大数据平台实现了一种基于保形加密的数据脱敏系统,支持对多种数据存储格式以及纯数字、纯字母或数字一字母混合等多种数据类型敏感数据的加密脱敏处理.然后对3种不同的实现方式进行了探讨,并开展了一系列实验对系统的加密脱敏性能进行详细的评估比较.     

Secure‐aware and privacy‐preserving electronic health record searching in cloud environment

Cloud storage has become a trend of storage in modern age. The cloud‐based electronic health record (EHR) system has brought great convenience for health care. When a user visits a doctor for a treatment, the doctor may be necessary to access the history health records generated at other medical institutions. Thus, we present a secure EHR searching scheme based on conjunctive keyword search with proxy re‐encryption to realize data sharing between different medical institutions. Firstly, we propose a framework for health data sharing among multiple medical institutions based on cloud storage. We explore the public key encryption with conjunctive keyword search to encrypt the original data and store it in the cloud. It ensures data security with searchability. Furthermore, we adopt the identity‐based access control mechanism and proxy re‐encryption scheme to guarantee the legitimacy of access and the privacy of the original data. Generally speaking, our work can achieve authentication, keyword privacy, and privacy preservation. Moreover, the performance evaluation shows that the scheme can achieve high computational efficiency.     

云内容的安全框架及其关键技术

文章从云内容面临的安全挑战出发,针对云内容面临的安全问题,提出云内容的安全模型。模型包括云内容管理安全、云内容访问安全、云内容的健康性安全3个层次。在此模型基础上,文章探讨了云内容的安全框架及关键技术,包括云内容隔离安全保障技术、云内容存储安全保障技术、数据加密存储技术、密钥管理技术、数据备份技术、数据销毁技术、密码认证技术、密钥认证技术、用户权限管理技术、筛子理论、加密协议识别技术、用户访问行为检测技术等。摘要:     

Data access control policy of encrypted deduplication system

To solve the problem that convergent encryption was commonly used in existing encrypted deduplication systems in cloud storage and data owner couldn’t effectively enforce access control on their outsourced data,an encrypted deduplication system was proposed to support access control functions such as identity authentication,authorization deduplication and the update of access control policy.The outsourced data was only deduplicated with the authorized users,and the unauthorized users couldn’t obtain any data information.CP-ABE and the partition of the ElGamal private key were used to update the access control policy of data.Self-control objects was used to encapsulate user’s data and its access policy,providing authentication for data visitors and ensuring the access control policies enforced effectively.Security analysis and simulation results demonstrate that the proposed system enables data access control and executes efficiently.     

Dynamic searchable encryption with privacy protection for cloud computing

The dynamic searchable encryption schemes generate search tokens for the encrypted data on a cloud server periodically or on a demand. With such search tokens, a user can query the encrypted data whiles preserving the data's privacy; ie, the cloud server can retrieve the query results to the user but do not know the content of the encrypted data. A framework DSSE with Forward Privacy (dynamic symmetric searchable encryption [DSSE] with forward privacy), which consists of Internet of Things and Cloud storage, with the attributes of the searchable encryption and the privacy preserving are proposed. Compared with the known DSSE schemes, our approach supports the multiusers query. Furthermore, our approach successfully patched most of the security flaws related to the sensitive information's leakage in the DSSE schemes. Both security analysis and simulations show that our approach outperforms other DSSE schemes with respect to both effectiveness and efficiency.     

Encrypted Storage and Retrieval in Cloud Storage Applications

Problems with data security impede the widespread application of cloud computing. Although data can be protected through encryption, effective retrieval of encrypted data is difficult to achieve using traditional methods. This paper analyzes encrypted storage and retrieval technologies in cloud storage applications. A ranking method based on fully homomorphic encryption is proposed to meet demands of encrypted storage. Results show this method can improve efficiency.     

基于双层信息流控制的云敏感数据安全增强

已有的云安全防护方法如加密、访问控制和虚拟机隔离等不能够提供数据端到端的安全防护。首先,提出了一个面向云环境的双层信息流控制模型,给出了模型的关键要素定义、集中式与分布式信息流控制规则、能力标记调整规则、标记传播规则和降密规则.然后,综合动态污点跟踪和虚拟机自省技术,设计并实现了原型系统IFCloud,可为云租户提供信息流跟踪与控制即服务,为云平台提供常见系统攻击如栈溢出、缓冲区溢出等攻击的防护机制.最后,给出了原型系统IFCloud的功能测试结果.表明IFCloud能够灵活、正确、实时地跟踪和控制云下敏感数据流.可应用于云平台下面向软件即服务的细粒度数据安全保护.     

云资源池数据安全生命周期研究与实践

随着云计算的发展需要,面临着越来越多的威胁,网络与信息安全也随之提升到了一个前所未有的高度,任何工作上的疏漏,都有可能造成非常严重的负面影响,影响到企业安全可持续。随着信息化云计算时代的到来,涉及敏感信息的安全保护正面临着越来越严峻的考验。网络攻击、病毒破坏、木马、存储介质盗取、遗失,非法授权或授权滥用、内部人员不经意失密、泄密,都构成严重的信息安全威胁,我们发现服务安全、数据安全、操作规范等安全问题,始终是云平台正常投入使用所面临的最大问题和业务隐患。本文阐述为了加强新疆移动云资源池数据安全,实现对云计算环境下虚拟机业务数据调取传输以及迁移过程中各类敏感数据的创建、生产、使用、销毁等各环节的全生命周期安全管控。监控处于数据生命周期各环节的各虚拟机传输过程和存储涉及哪类敏感数据;对敏感数据传输、分类,并给虚拟机打上需要销毁的标签,可靠擦除,避免虚拟机被共享后数据恢复。同时,实现对敏感数据宿主虚拟机的传输实时监控,发现异常和违规行为,避免违规或非法人员通过网络访问、隐蔽通道、非常规端口等方式盗取敏感数据。     

移动云服务的数据安全与隐私保护综述

移动云服务相比传统云具有移动互联、灵活终端应用和便捷数据存取等特点。然而,丰富的移动云服务应用也带来了更多的安全与隐私泄露问题。在阐述移动云服务的基本概念、应用与安全问题的基础上,给出了其安全与隐私保护体系结构,主要围绕安全协议与认证、访问控制、完整性验证、移动可信计算和基于加密、匿名、混淆的隐私保护等关键技术,分析其研究现状,论述已有技术的优势和不足,并探讨了未来的研究方向。     

Research on cloud storage systems supporting secure sharing

A practical scheme for the cloud storage system was proposed to ensure security and efficiency during data sharing.The scheme which combine attribute-based encryption,proxy encryption with symmetric encryption,could integrate access control,efficient search with encryption well together.The scheme archived conjunctive-keyword non-field subset search by using bilinear mapping and polynomial equation.The scheme reduced the cost of decryption by outsourcing most of the decryption operations from the terminal to the cloud.At last,the performance was analyzed and an experiment was made for verification.     

云环境下基于属性加密体制算法加速方案

云计算为租户提供存储、计算和网络服务，数据安全保护和租户间的数据共享与访问控制是其必不可少的能力。基于属性的加密体制是一种一对多的加密体制，可以根据用户属性实现细粒度访问控制，适用于云计算环境多租户数据共享。但现有的基于属性加密体制的算法效率较低，难以在实际环境中应用。分析了基于属性的加密体制的两种类型及其应用场景，提出一个基于属性加密体制算法的加速方案。通过实验表明，提出的方案可提高基于属性加密体制的密钥生成算法、加密算法和解密算法的效率。     

Multi-tenant virtual domain isolation construction method based on L-DHT

Aiming at the problem of security isolation of multi-tenant data in cloud environment,a tenant virtual domain isolation construction method based on L-DHT was proposed.Firstly,through the design of multi-tenant isolation mapping algorithm based on label-hash mapping,the balanced mapping mechanism of tenant resources was constructed to realize the distributed management of tenant resources.Secondly,for the security isolation and access between tenant data mapped to the same storage node,based on the predicate encryption mechanism,through the effective binding of security labels and tenant data,a tenant data isolation storage algorithm based on label predicate encryption was designed.Finally,by the design of multi-dimensional tenant data isolation control rules and using the analysis and authentication of security labels,independent,logical and secure virtual domains between tenants were built hierarchically.The security analysis shows that the method constructs tenant virtual domains which are secure and non-interference with each other.The simulation results show that the mapping algorithm can achieve a better dynamic load balance.The efficiency and security of data access are verified by the comparative analysis of tenant data retrieval efficiency and authentication access security.     

Reversible data hiding in encrypted color images using cross-channel correlations

In recent years, the increasing requirements in cloud storage and cloud computing have made it necessary to encrypt digital images for privacy protection. Meanwhile, many reversible data hiding (RDH) algorithms in the encrypted domain have been proposed. However, most of these algorithms are for gray-level images, and the intrinsic cross-channel correlations of color images cannot be utilized to improve the embedding capacity. In this paper, we propose a novel data hiding method for encrypted color images. In the encryption stage, the homomorphic property of encryption is achieved by basic modular addition. During the data hiding process, the cross-channel correlations between R, G and B channels are generated in encrypted domain, and data hiding is performed by the difference histogram shifting. Analysis and experiments demonstrate that the proposed method is secure and the RDH performance is superior.     

商密云存储系统应用研究

分析了云存储及其应用面临的安全需求,提出了以商用密码和云存储技术为基础的商密云存储业务系统。系统地介绍了商密云存储业务系统的系统架构及功能设计,并通过实施高强度安全认证、数据加密存储、统一密钥管理、数据传输加密以及安全隔离等安全机制,保障用户数据在网络传输、处理、存储等全流程的安全,最后从政企客户和公众客户两个层面提出商密云存储产品的服务形态设计思路。     

面向云存储安全的可自愈拜占庭Quorum系统

针对云存储系统中的数据安全问题,提出了一种面向云存储安全的可自愈拜占庭Quorum系统.该系统以虚拟机作为后端存储设备构建虚拟存储节点,利用虚拟机多样化操作系统,以及动态迁移、快速部署等机制构建动态异构的存储系统架构.在拜占庭容错门限的基础上,提出自愈门限的概念,并设计相应系统安全协议,实现存储节点的自动化异常检测和状态复原.实验结果表明,提出的云存储系统具有较高的鲁棒性,能有效提高存储数据的安全性.