云存储访问控制方案的安全性分析与改进

对Tang等（TANG Y，LEE P，LUI J，et al. Secure overlay cloud storage with access control and assured deletion. IEEE Transactions on Dependable and Secure Computing，2012，9（6)：903-916）提出的一种云存储的细粒度访问控制方案进行安全性分析，发现其存在不能抵抗合谋攻击的问题，并给出了具体的攻击方法。针对该方案安全性方面的不足，利用基于属性的加密算法抗合谋攻击的特性，对使用访问树结构的密文策略加密（CP-ABE）算法进行改进，使改进后的算法能够直接运用到云存储访问控制方案中而不需要对云存储服务器进行任何修改，同时可实现细粒度的访问控制和用户数据的彻底删除。最后基于判断双向性Deffie-Hellman（DBDH）假设，证明了该方案在选择明文攻击下的安全性，并通过将方案运用到实际的云环境中进行分析后证明改进后的方案能够抵抗合谋攻击。

Security analysis and improvement of access control scheme for cloud storage

An access control scheme for cloud storage proposed by Tang et al. (TANG Y，LEE P，LUI J，〖WTBX〗et al.〖WTBZ〗 Secure overlay cloud storage with access control and assured deletion. IEEE Transactions on Dependable and Secure Computing，2012，9(6)：903-916） was analyzed and proved to be vulnerable to collusion attacks, and a detailed attack method was given. To address this problem of the given scheme, this paper took the advantage of the property of collusion attack resistant of the attribute based encryption algorithm and improved a ciphertext-policy attribute-based encryption (CP-ABE) algorithm which used the access tree. Then the improved algorithm could be used seamlessly into the access control and assured deletion scheme for cloud storage without changing the cloud server. Finally, the security against the chosen plaintext attack was proved under the Decision Bilinear Diffie-Hellman (DBDH) assumption, and the ability of resisting the collusion attack of the scheme was proved by analyzing a practical cloud situation.