基于多分支认证树的多用户多副本数据持有性证明方案

在云存储环境下,如何高效、动态地完成对多用户多副本数据的完整性验证是一个挑战性问题。基于双线性代数映射的签名机制和多分支认证树特性,提出了一种新的多用户多副本数据持有性证明方案。该方案通过使用随机掩码技术对密文进行处理确保数据隐私性,采用多分支认证树来提高数据分块的签名效率,能够支持数据动态更新操作。此外,引入第三方审计者对多用户多副本数据进行批量审计以减少计算开销。最后,分析表明本方案具有较高的安全性和效率。     

A provable-secure and practical two-party distributed signing protocol for SM2 signature algorithm

Mobile devices are widely used for data access,communications and storage.However,storing a private key for signature and other cryptographic usage on a single mobile device can be challenging,due to its computational limitations.Thus,a number of(t,n)threshold secret sharing schemes designed to minimize private key from leakage have been proposed in the literature.However,existing schemes generally suffer from key reconstruction attack.In this paper,we propose an efficient and secure two-party distributed signing protocol for the SM2 signature algorithm.The latter has been mandated by the Chinese government for all electronic commerce applications.The proposed protocol separates the private key to storage on two devices and can generate a valid signature without the need to reconstruct the entire private key.We prove that our protocol is secure under nonstandard assumption.Then,we implement our protocol using MIRACL Cryptographic SDK to demonstrate that the protocol can be deployed in practice to prevent key disclosure.     

一种有效率的方法用于检测云中数据的完整性(英文)

Cloud computing and storage services allow clients to move their data center and applications to centralized large data centers and thus avoid the burden of local data storage and maintenance.However,this poses new challenges related to creating secure and reliable data storage over unreliable service providers.In this study,we address the problem of ensuring the integrity of data storage in cloud computing.In particular,we consider methods for reducing the burden of generating a constant amount of metadata at the client side.By exploiting some good attributes of the bilinear group,we can devise a simple and efficient audit service for public verification of untrusted and outsourced storage,which can be important for achieving widespread deployment of cloud computing.Whereas many prior studies on ensuring remote data integrity did not consider the burden of generating verification metadata at the client side,the objective of this study is to resolve this issue.Moreover,our scheme also supports data dynamics and public verifiability.Extensive security and performance analysis shows that the proposed scheme is highly efficient and provably secure.     

物联网感知层基于资源分层的多用户访问控制方案

针对物联网感知层节点计算、存储能力受限情况下,多用户安全高效的资源访问需求,提出一种分层访问控制方案.将提供同级别资源的节点划分为一个层次节点,利用层次节点之间形成的偏序关系,设计了安全高效的密钥推导算法,使用户在掌握单个密钥材料的情况下,能够访问更多层次资源.同时引入Merkle树机制,使多个用户通过相互独立的哈希链,安全高效的获取层次节点的密钥材料.方案在存储开销、计算开销、可证明安全和可扩展方面,比现有类似方案更适合多用户在物联网感知层环境下资源的访问.     

标准模型下基于身份的广义签密方案*

首次对标准模型下基于身份广义签密体制进行了研究。利用双线性对,提出了基于身份的广义签密方案, 并在标准模型下证明了方案的安全性。结果表明,方案的保密性在DBDH假设下是适应性选择密文攻击下不可区分的,在CDHP假设下方案是适应性选择消息攻击下存在性不可伪造的。与其他两个基于身份广义签密方案相比,本方案效率较高,且是在标准模型下可证明是安全的。     

可证安全的口令认证/密钥交换协议的研究动态

口令认证／密钥交换（PAKE协议）协议允许通信双方利用短小易记的口令在不安全的网络上进行相互认证并建立安全的会话密钥,它有着非常广泛的实际应用背景和重要的理论意义。文章介绍了PAKE协议的研究发展动态、PAKE协议的通信模型和PAKE协议标准化工作的研究进展,分析了现有标准候选协议的优劣,指出了需要进一步研究的问题。     

基于灵活网架的分布式光伏电源准入容量研究

分析推导了分布式光伏电源接入区域配电网的影响,在此基础上,考虑主动配电网背景下的灵活网架,以一系列静态安全稳定指标作为约束,建立了分布式光伏电源准入容量求解模型。将单个以及多个光伏电源接入的情况分开求解,相应地分别采用基于二分法的枚举法以及混合智能遗传算法求解,保证了模型求解的高效性。利用所提模型、算法,对10 k V中压配电网的几种典型网架接线进行分布式光伏电源准入容量的计算、比较、分析,验证了方法的有效性,总结了相关规律,提出了建议。     

基于NTRU的全同态加密方案

本文提出一种基于公钥密码体制（Number Theory Research Unit,NTRU）选择明文攻击（Chosen Plaintext Attack,CPA）可证明安全的全同态加密方案.首先,对NTRU的密钥生成算法进行改进,通过格上的高斯抽象算法生成密钥对,避免了有效的格攻击,同时,没有改变密钥的分布.然后,基于改进的NTRU加密算法,利用Flattening技术,构造了一个全同态加密体制,并在标准模型下证明方案是选择明文攻击不可区分性IND-CPA安全的.     

一种可扩展的动态数据持有性证明方案

提出了一种能保护数据隐私的动态数据持有性证明方案, 并对方案的安全性进行了证明, 性能分析表明该方案具有低存储、计算和传输负载的特点。通过扩展实现了对公开可验证和多副本检查的支持, 扩展方案的特点在于公开验证中不需要可信第三方的参与, 而多副本检查可以方便地实现对所有副本的批量检查。     

Provable data possession scheme with authentication

To satisfy the requirements of identity authentication and data possession proven in the cloud application scenarios,a provable data possession scheme with authentication was proposed.Based on data tag signature and randomness reusing,the proposed scheme could accomplish several issues with three interactions,including the possession proof of cloud data,the mutual authentication between user and cloud computing server,the session key agreement and confirmation.Compared to the simple combination of authentication key agreement and provable data possession schemes,the proposed scheme has less computation and interactions,and better provable securities.In the random oracle model,the security proof of the proposed scheme is given under the computational Diffie-Hellman assumption.