基于云边协同的无证书多用户多关键字密文检索方案

针对工业物联网环境中密文数据检索面临的单用户单关键字搜索、计算开销过大、安全等级较低等问题,提出了一种基于云边协同的无证书多用户多关键字密文检索方案。所提方案通过设定用户访问权限表并执行一次加密算法,实现了支持用户访问权限更新的多用户搜索。利用线性扫描方法进行关键字密文与陷门的匹配计算,并引入云边协同的计算模式提高计算效率,实现了关键字索引不完全包含检索关键字情况下的多关键字密文检索。基于无证书加密体制解决了密钥托管与证书管理问题,并使用数字签名技术确保了关键字密文的可认证性。安全分析结果表明,所提方案在随机预言模型下能抵抗内部关键字猜测攻击。仿真实验结果表明,与同类方案相比较,所提方案具有较高的计算效率。     

云环境中抵御内部关键字猜测攻击的快速公钥可搜索加密方案

随着云计算的发展,以密文检索为核心的安全和搜索性能问题成为研究的重点。在传统的加密方案中,大多只解决了抵御外部关键字猜测攻击问题,往往忽视了诚实且好奇的云服务器问题。为了提高密文安全性,该文提出快速搜索的抵御内部关键字攻击方案。首先,引入高效的加密倒排索引结构的公钥密文搜索方案,实现关键字的并行搜索任务。其次,在构建密文倒排索引时加入数据拥有者的私钥抵御恶意云服务器的关键字攻击。与传统的公钥可搜索加密相比,该方案在很大程度上增强了搜索系统的安全性和搜索效率。     

云环境中抵御内部关键字猜测攻击的快速公钥可搜索加密方案

随着云计算的发展,以密文检索为核心的安全和搜索性能问题成为研究的重点.在传统的加密方案中,大多只解决了抵御外部关键字猜测攻击问题,往往忽视了诚实且好奇的云服务器问题.为了提高密文安全性,该文提出快速搜索的抵御内部关键字攻击方案.首先,引入高效的加密倒排索引结构的公钥密文搜索方案,实现关键字的并行搜索任务.其次,在构建密文倒排索引时加入数据拥有者的私钥抵御恶意云服务器的关键字攻击.与传统的公钥可搜索加密相比,该方案在很大程度上增强了搜索系统的安全性和搜索效率.     

基于身份的具有否认认证的关键字可搜索加密方案

云存储技术的发展实现了资源共享,为用户节省了数据管理开销。可搜索加密技术,既保护用户隐私又支持密文检索,方便了用户查找云端密文数据。现有的公钥关键字可搜索加密方案虽然支持身份认证,但未实现否认的属性。为了更好地保护发送者的身份隐私,该文将否认认证与公钥关键字可搜索加密技术相结合,提出一种基于身份的具有否认认证的关键字可搜索加密方案(IDAPKSE)。在该方案中,发送者上传密文后,能够对自己上传密文这一通信行为进行否认,与此同时,接收者可以确认密文数据的来源,但是,即使与第三方合作,接收者也不能向第三方证明其所掌握的事实。在随机预言模型下,基于双线性Diffie-Hellman(BDH)和决策双线性Diffie-Hellman(DBDH)数学困难问题,证明了该文方案满足不可伪造性、密文和陷门的不可区分性。     

云存储中加密数据的相似检索技术应用研究

随着云存储的广泛应用，大量数据存储在云服务器。尽管云服务提供很多便利，但数据的隐私及安全性一直是重点关注的问题，为解决数据安全问题需要将外储数据以加密的形式进行存储。加密存储的方式保护了数据不被恶意访问，然而数据的一些重要的基本应用如检索等不能实现。为了在不泄露隐私的条件下实现对加密数据的检索，很多可检索的加密方案被提出。然而，这些方案多数只能处理确切的关键字匹配检索而不能进行相似的关键字检索，相似检索在现实应用中又极其重要。本文提出一个高效的支持加密数据相似检索的方案，为了实现相似密文的检索我们利用一种被称为位置敏感的哈希算法。为了确保数据的机密性和安全性，我们给出了严格的安全定义，并且在安全定义下证明了方案的安全性。      

对称可搜索加密技术研究进展

云计算作为一种新型计算模式,具有海量资源、动态扩展、按需分配等特点。资源受限的用户可以将计算任务外包给云服务器,在享受高质量数据服务的同时大大降低了本地管理开销。然而,数据外包导致数据所有权与管理权分离,如何保证数据的安全性成为云计算中亟待解决的关键问题。传统的加密技术虽然可以保证数据的机密性,但是在密文中如何执行有意义的检索操作成为一个巨大的挑战。为了保证数据机密性的同时实现密文数据的高效检索,可搜索加密技术应运而生。近年来,可搜索加密方案的设计日趋多样化,旨在提高方案的实用性。该文主要围绕目前可搜索加密方案的研究热点,从4个方面展开阐述,具体包括:单关键词检索、多模式检索、前/后向安全检索和可验证检索。该文主要介绍和分析具有代表性的研究成果,总结最新研究进展及提炼关键技术难点,最后对未来的研究方向进行展望。     

支持关键字搜索的无证书密文等值测试加密方案

公钥加密等值测试(PKEET)可以实现云环境下不同公钥加密数据之间的密文等值比较，即不对密文解密的情况下测试两个密文对应的明文是否一致。但是，密文等值测试加密不提供关键字密文搜索功能。已有密文等值测试加密方案直接以消息生成陷门作为等值测试的凭证，测试的准确度不高，搜索效率较低。针对此问题，该文首先提出了支持关键字搜索的无证书密文等值测试加密(CLEETS)方案。方案通过关键字检索判断是否包含自己需要的信息，根据判断结果选择执行等值测试，从而避免无效测试。然后，在随机预言机模型下证明该方案满足适应性选择关键词不可区分性。最后，对方案进行功能和效率对比。对比结果表明，该文方案的计算代价略高，但是方案在密文等值测试加密中实现了关键字的检索功能，弥补了效率低的不足。     

区块链上基于云辅助的密文策略属性基数据共享加密方案

针对云存储的集中化带来的数据安全和隐私保护问题,该文提出一种区块链上基于云辅助的密文策略属性基(CP-ABE)数据共享加密方案。该方案采用基于属性加密技术对加密数据文件的对称密钥进行加密,并上传到云服务器,实现了数据安全以及细粒度访问控制;采用可搜索加密技术对关键字进行加密,并将关键字密文上传到区块链(BC)中,由区块链进行关键字搜索保证了关键字密文的安全,有效地解决现有的云存储共享系统所存在的安全问题。该方案能够满足选择明文攻击下的不可区分性、陷门不可区分性和抗串联性。最后,通过性能评估,验证了该方案的有效性。     

区块链上基于云辅助的密文策略属性基数据共享加密方案

针对云存储的集中化带来的数据安全和隐私保护问题,该文提出一种区块链上基于云辅助的密文策略属性基(CP-ABE)数据共享加密方案.该方案采用基于属性加密技术对加密数据文件的对称密钥进行加密,并上传到云服务器,实现了数据安全以及细粒度访问控制;采用可搜索加密技术对关键字进行加密,并将关键字密文上传到区块链(BC)中,由区块链进行关键字搜索保证了关键字密文的安全,有效地解决现有的云存储共享系统所存在的安全问题.该方案能够满足选择明文攻击下的不可区分性、陷门不可区分性和抗串联性.最后,通过性能评估,验证了该方案的有效性.     

云存储环境下多服务器的密钥聚合可搜索加密方案

密钥聚合可搜索加密不仅可以通过关键字检索密文,还可以减少用户密钥管理的代价和安全风险。该文分析了一个可验证的密钥聚合可搜索加密方案,指出该方案不满足关键字猜测攻击,未经授权的内部用户可以猜测其他用户的私钥。为了提高原方案的安全性,提出了云存储环境下多服务器的密钥聚合可搜索加密方案。所提方案不仅改进了原方案的安全性问题,还增加了多服务的特性,提高了上传和存储的效率,更适合一对多的用户环境。     

基于区块链的多关键词模糊搜索加密方案

针对1对多数据密文共享中多关键词模糊匹配和用户公平性问题,该文提出一种基于区块链的多关键词模糊搜索加密方案。该文提出一种R-HashMap索引结构,通过使用对偶编码函数和位置敏感哈希函数来构建安全索引,并采用K最近邻算法来加密索引,通过计算欧式距离度量查询关键词向量与索引节点之间的相似性,实现多关键词模糊密文搜索。该文除了消除预定义词典和降低存储开销外,还在不增加搜索复杂度的前提下实现对安全索引的更新。此外,将以太坊区块链技术与可搜索加密方案相结合避免了恶意服务器对数据的篡改,使用智能合约作为可信第三方进行检索工作,不仅可以防止云服务器内部的关键词猜测攻击,还可以解决检索结果不正确的问题。通过安全性证明分析,该文不但满足自适应选择关键词语义安全性,还可以保护用户隐私和数据安全。将该文与其他方案进行实验对比,证明该文在保证精确度的前提下,时间开销上具有更好的效率优势。     

A time-aware searchable encryption scheme for EHRs

Despite the benefits of EHRs (Electronic Health Records), there is a growing concern over the risks of privacy exposure associated with the technologies of EHR storing and transmission. To deal with this problem, a time-aware searchable encryption with designated server is proposed in this paper. It is based on Boneh's public key encryption with keyword search and Rivest's timed-release cryptology. Our construction has three features: the user cannot issue a keyword search query successfully unless the search falls into the specific time range; only the authorized user can generate a valid trapdoor; only the designated server can execute the search. Applying our scheme in a multi-user environment, the number of the keyword ciphertexts would not increase linearly with the number of the authorized users. The security and performance analysis shows that our proposed scheme is securer and more efficient than the existing similar schemes.     

支持关键词搜索的属性代理重加密方案

属性代理重加密机制既能实现数据共享又能实现数据转发,但这种机制通常并不支持数据检索功能,阻碍了属性代理重加密的发展应用。为了解决这一问题,该文提出一个支持关键词搜索的密文策略的属性代理重加密方案。通过将密钥分为属性密钥和搜索密钥,不仅可以实现关键词可搜索,而且实现了代理重加密。在验证阶段,云服务器既执行关键词验证,又可以对原始密文和重加密密文进行部分解密,从而减轻用户的计算负担。通过安全性分析,该方案可以实现数据安全性、检索分离、关键词隐藏和抗共谋攻击。     

Electronic medical record data sharing scheme based on searchable encryption via consortium blockchain

Considering that it was difficult to share medical record data among different medical institutions in cloud storage,an electronic medical record data sharing scheme based on searchable encryption on blockchain was proposed.In order to realize the secure storage and sharing of electronic medical records in the scheme,the patient’s electronic medical record ciphertext was stored in the hospital server,the ciphertext hash value was stored in the private blockchain,and the keyword index was stored in the consortium blockchain.Searchable encryption was used to implement secure search of keywords in the consortium blockchain,and proxy re-encryption technology was used to realize the sharing of electronic medical records of patients by other data users.Security analysis shows that the proposed scheme can achieve ciphertext security and keyword security.Moreover,the performance of the scheme was analyzed by function analysis,computational efficiency analysis and numerical simulation.The performance analysis shows that the scheme can achieve high computational efficiency.     

Constructing designated server public key encryption with keyword search schemes withstanding keyword guessing attacks

Designated server public key encryption with keyword search (dPEKS) removes the secure channel requirement in public key encryption with keyword search (PEKS). With the dPEKS mechanism, a user is able to delegate the search tasks on the ciphertexts sent to him/her to a designated storage server without leaking the corresponding plaintexts. However, the current dPEKS framework inherently suffers from the security vulnerability caused by the keyword guessing (KG) attack. How to build the dPEKS schemes withstanding the KG attacks is still an unsolved problem up to now. In this work, we introduce an enhanced dPEKS (edPEKS) framework to remedy the security vulnerability in the current dPEKS framework. The edPEKS framework provides resistance to the KG attack by either the outside attacker or the malicious designated server. We provide a semi‐generic edPEKS construction that exploits the existing dPEKS schemes. Our security proofs demonstrate that the derived edPEKS scheme achieves the keyword ciphertext indistinguishability, the keyword ciphertext unforgeability, and the keyword trapdoor indistinguishability if the underlying dPEKS scheme satisfies the keyword ciphertext indistinguishability and the hash Diffie‐Hellman problem is intractable. In addition, a concrete edPEKS scheme is presented to show the instantiation of the proposed semi‐generic construction.     

Secure‐aware and privacy‐preserving electronic health record searching in cloud environment

Cloud storage has become a trend of storage in modern age. The cloud‐based electronic health record (EHR) system has brought great convenience for health care. When a user visits a doctor for a treatment, the doctor may be necessary to access the history health records generated at other medical institutions. Thus, we present a secure EHR searching scheme based on conjunctive keyword search with proxy re‐encryption to realize data sharing between different medical institutions. Firstly, we propose a framework for health data sharing among multiple medical institutions based on cloud storage. We explore the public key encryption with conjunctive keyword search to encrypt the original data and store it in the cloud. It ensures data security with searchability. Furthermore, we adopt the identity‐based access control mechanism and proxy re‐encryption scheme to guarantee the legitimacy of access and the privacy of the original data. Generally speaking, our work can achieve authentication, keyword privacy, and privacy preservation. Moreover, the performance evaluation shows that the scheme can achieve high computational efficiency.     

An Efficient SCF-PEKS Without Random Oracle Under Simple Assumption

The Public key encryption scheme with keyword search (PEKS), firstly put forward by Boneh et al., can achieve the keyword searching without revealing any information of the initial data. However, the original PEKS scheme was required to construct a secure channel, which was usually expensive. Aimed at resolving this problem, Baek et al. put forward an improved scheme, which tried to construct a Secure channel free PEKS (SCF-PEKS). Subsequently, several SCF-PEKS schemes were proposed, however most of them turned out only secure in the random oracle model, which possibly lead to the construction of insecure schemes. Therefore, Fang et al. put forward an enhanced SCF-PEKS construction, which was provably secure in the standard model, however this construction needed a strong and complicated assumption. Then Yang et al. put forward an SCF-PEKS construction under simple assumption, but their construction had a big reduction in efficiency. In this article, we propose an SCF-PEKS construction, which is provably secure under the same assumption as that of Yang et al.'s scheme, however, with better performance. Then we give its full security proof, along with the performance analysis. Finally, we improve the SCF-PEKS construction to resist Keyword guessing attack (KGA) and give its security demonstration.     

Designing a secure designated server identity-based encryption with keyword search scheme: still unsolved

There exist only a few papers in the literature which target the problem of “proposing a secure designated server identity-based encryption with keyword search scheme.” In this paper, we prove that they all suffer from security issues, and therefore, this challenging problem still remains open.