Secure authentication using ciphertext policy attribute-based encryption in mobile multi-hop networks

With the dramatic increase of the number of mobile devices such as smartphones and tablet PCs, mobile traffic has increased enormously. Especially, the multimedia data accounts for bulk of the traffic transmitted in mobile networks. To accommodate this growth, device-to-device connection (D2D), which provides infra-connection off-loading, is receiving significant attention. However, we have observed that the majority of the current D2D protocols including Bluetooth and Wi-Fi Direct are vulnerable to man-in-the-middle (MITM) and replay attacks in mobile multi-hop networks. To resolve this problem, in this paper, we propose a novel D2D authentication protocol with a secure initial key establishment using ciphertext-policy attribute-based encryption (CP-ABE). By leveraging CP-ABE, the proposed scheme allows the communicating parties to mutually authenticate and derive the link key in an expressive and secure manner in a multi-hop network environment. We also propose several variations of the proposed scheme for different scenarios in a multi-hop networks without network infrastructure. We prove that the proposed scheme is secure against MITM and replay attack in D2D mobile multi-hop networks. Experimental results indicate that the proposed scheme incurs reasonable computation cost in the real world.     

Accountable authority key policy attribute-based encryption

We present an accountable authority key policy attribute-based encryption (A-KPABE) scheme.In this paper,we extend Goyal’s work to key policy attribute-based encryption setting.We first generalize the notion of accountable authority in key policy attribute-based encryption scenario,and then give a construction.In addition,our scheme is shown to be secure in the standard model under the modified Bilinear Decisional Diffie-Hellman (mBDDH) assumption.     

固定密文长度的可验证属性基外包解密方案

传统密钥策略属性基加解密方案存在密文长度随着属性增加而线性增加,在通信过程中消耗用户大量的通信带宽的缺点。提出了属性加密的改进方案,基于密钥策略属性加密,提出具有固定密文长度的可验证外包解密方案,在非单调访问结构实现密文长度固定,有效节省通信带宽,通过对外包密钥生成算法的改进,实现一次模指数运算,有效缩短外包密钥生成时间。通过运用哈希函数,实现外包解密的验证性,并对其安全性进行了证明。     

具有固定密文长度的多授权属性基密钥协商协议

为适应云环境中移动手机等资源限制型设备的使用,降低基于多授权属性基加密的会话密钥协议的计算和通信代价,提出一种能生成固定密文长度交换消息的协议。该协议基于多值访问结构,加强了数据拥有者对系统模型的权限控制;在基于属性的BJM(Blake-Johnson-Menezes)模型和选择访问结构安全模型下,基于判定性q并行双线性Diffie-Hellman指数(q-PBDHE)假设证明了该协议的安全性。通过实验比较分析了类似协议的性能,表明该协议具有较高效率和安全性,适合在轻量级应用场景上使用。     

Complex and flexible data access policy in attribute-based encryption

The Journal of Supercomputing - With the development of cloud computing application, attribute-based encryption (ABE) with flexibly fine-grained data access control is widely adopted. However,...     

支持带权属性撤销的密文策略属性基加密方案

针对目前大部分密文策略属性基加密（CP-ABE）方案都不支持属性的多状态表示,加密、解密阶段计算开销庞大的问题,提出一种支持带权属性撤销的CP-ABE方案（CPABEWAR）。一方面,通过引入带权属性的概念,增强了属性的表达能力;另一方面,为了降低计算开销,在保证数据安全的情况下将部分计算过程外包给云服务提供商（CSP）。分析结果表明,所提方案基于判定双线性DH （DBDH）假设是选择明文安全的（CPS）。所提方案以增加少量存储空间为代价简化了访问树结构,提高了系统效率和访问控制的灵活性,适合计算能力受限的云用户。     

可实现隐私保护的基于属性密文可搜索方案

针对现有的基于属性的密文可搜索方案存在隐私泄露问题以及当授权用户不在线时如何安全有效地将密文以及搜索权限委托给其他人的问题进行了研究,将隐藏访问结构的基于属性密文可搜索方案与代理重加密技术融合,提出了具有部分隐藏访问结构的支持代理重加密的功能的基于属性的密文检索方案。该方案不仅有效地解决了上述问题,而且还支持关键字的更新。最后在随机预言模型下基于DL(D-linear)假设和q-BDHE (decisional q-parallel bilinear Diffie-Hellman exponent)假设,证明了本方案的安全性。     

Revocable attribute-based encryption from standard lattices

Attribute-based encryption (ABE) is an attractive extension of public key encryption, which provides fine-grained and role-based access to encrypted data. In its key-policy flavor, the secret key is associated with an access policy and the ciphertext is marked with a set of attributes. In many practical applications, and in order to address scenarios where users become malicious or their secret keys are compromised, it is necessary to design an efficient revocation mechanism for ABE. However, prior works on revocable key-policy ABE schemes are based on classical number-theoretic assumptions, which are vulnerable to quantum attacks. In this work, we propose the first revocable key-policy ABE scheme that offers an efficient revocation mechanism while maintaining fine-grained access control to encrypted data. Our scheme is based on the learning with errors (LWE) problem, which is widely believed to be quantum-resistant. Our scheme supports polynomial-depth policy function and has short secret keys, where the size of the keys depends only on the depth of the supported policy function. Furthermore, we prove that our scheme satisfies selective revocation list security in the standard model under the LWE assumption.     

Key escrow encryption Bill hits congress

After years of FBI Director Louis Freeh, White House operatives, and various National Security Agency (NSA) and Justice Department officials threats that failure by industry to voluntarily embrace government encryption key recovery schemes would result in mandatory programmes and legislation, such a forecast may have been realized.     

基于密文策略属性基加密系统访问机制的缓存替换策略

为提高基于密文策略属性基加密（CP-ABE）系统的数据缓存性能,针对CP-ABE加密的数据,提出一种有效的缓存替换算法--最小属性价值（MAV）算法。该算法结合CP-ABE加密文件的访问策略并统计高频属性值的个数,利用余弦相似度方法和高频属性值统计表来计算属性相似度;同时结合属性相似度和文件大小计算缓存文件的属性值价值,并替换属性值价值最小的文件。在与最近最少使用（LRU）、最不经常使用（LFU）、Size缓存替换算法的对比实验中,针对CP-ABE加密后的数据,MAV算法在提高加密文件请求命中率和字节命中率方面具有更好的性能。     

Hidden policy ciphertext-policy attribute-based encryption with keyword search against keyword guessing attack

Attribute-based encryption with keyword search (ABKS) enables data owners to grant their search capabilities to other users by enforcing an access control policy over the outsourced encrypted data. However, existing ABKS schemes cannot guarantee the privacy of the access structures, which may contain some sensitive private information. Furthermore, resulting from the exposure of the access structures, ABKS schemes are susceptible to an off-line keyword guessing attack if the keyword space has a polynomial size. To solve these problems, we propose a novel primitive named hidden policy ciphertext-policy attribute-based encryption with keyword search (HP-CPABKS). With our primitive, the data user is unable to search on encrypted data and learn any information about the access structure if his/her attribute credentials cannot satisfy the access control policy specified by the data owner. We present a rigorous selective security analysis of the proposed HP-CPABKS scheme, which simultaneously keeps the indistinguishability of the keywords and the access structures. Finally, the performance evaluation verifies that our proposed scheme is efficient and practical.     

面向移动终端的密文可验证属性基可搜索加密方案

轻量级设备的数据大多都存储在云服务器上。由于云服务不完全可信,且传统的单关键词可搜索加密会产生许多与检索内容无关的信息,因此提出一个面向移动终端的密文可验证属性基可搜索加密方案。该方案结合CP-ABE技术控制访问细粒度,引入可信第三方进行数据完整性验证,同时帮助用户进行部分解密工作。该方案在困难问题假设下被证明是选择性不可区分的密文策略和选择明文攻击IND-sCP-CPA及不可区分的选择关键词攻击IND-CKA。理论分析和数值模拟实验表明,该方案具有更高的效率。     

支持通用电路的多线性映射外包属性加密方案

针对基于多线性映射的属性加密方案存在密文扩展率大、解密效率低、密钥托管的问题,将外包技术和用户秘密值法运用于方案中,设计了一个密钥策略的多线性映射属性加密方案。方案以通用多项式电路作为访问结构,支持任意扇出,其用户的私钥由密钥生成中心和用户共同产生。密文长度固定为|G|+|Z|,按照椭圆曲线标准设置合理参数后,与已知密文量最小的方案对比,存储代价减少25%。用户解密时仅对转换密文作运算,且外包正确性可验证,解密所需多线性运算次数仅为3次,大大降低了用户的计算代价。在标准模型下利用多线性判断Diffie-Hellman困难问题证明了方案的安全性。该方案也能适用于运算能力有限的小型移动设备。     

一个新的理想格上基于属性的加密方案

随着密码学技术不断发展,基于属性的密码学作为密码算法的新概念,近年来受到广泛关注。但是,已提出的基于属性的加密方案大都是基于大整数分解和离散对数问题等传统数学问题之上的公钥密码方案,这些方案存在运算效率较低、不能抵抗亚指数攻击和量子攻击等缺点,这限制了其在密码体制中的发展。提出了一个新的理想格上基于属性的加密方案,与已有的基于属性的加密方案相比,该加密方案利用了理想格上的特殊结构,容易实现,具有较短的公钥和密文;加密、解密都通过格上的函数调用实现,大大减小了运算量。     

Securely outsourcing the ciphertext-policy attribute-based encryption

Attribute-based Encryption (ABE) is a new and promising public key encryption that allows fine-grained authorization on data based on user attributes. Such property is favorable for multiple applications that require encrypted storage or access control on data, in particular: eHealth applications. However, ABE schemes are known not to be efficient in the encryption phase because ciphertext size and the time required to encrypt grow with the complexity of the access policy. Such drawback is critical in the context of pervasive computing, for instance, in the Internet of Things, where data producers are usually resource-constrained devices, e.g. smart phones or sensing platforms. In this work, we propose OEABE standing for Outsourcing mechanism for the Encryption of Ciphertext-Policy ABE (CP-ABE). We show how a user can offload expensive operations of CP-ABE encryption to a semi-trusted party in a secure manner. Our proposed mechanism requires only one exponentiation on resource-constrained devices. We provide also an informal security analysis of possible attacks from a semi-honest adversary against the proposed solution. To demonstrate the performance gains of our mechanism, we first conducted a performance estimation on an emulated Wismote sensor platform. Then, we implemented our proposal and did comparison to an existing implementation of CP-ABE on a laptop.     

Ciphertext-policy attribute-based encryption supporting access policy update and its extension with preserved attributes

Attribute-based encryption (ABE) allows one-to-many encryption with static access control. In many occasions, the access control policy must be updated, but the original encryptor might be unavailable to re-encrypt the message, which makes it impractical. Unfortunately, to date the work in ABE does not consider this issue yet, and hence this hinders the adoption of ABE in practice. In this work, we consider how to update access policies in ciphertext-policy attribute-based encryption (CP-ABE) systems efficiently without encrypting each ciphertext with new access policies. We introduce a new notion of CP-ABE supporting access policy update that captures the functionalities of attribute addition and revocation to access policies. We formalize the security requirements for this notion and subsequently construct two provably secure CP-ABE schemes supporting AND-gate access policy with constant-size ciphertext for user decryption. The security of our schemes are proved under the augmented multi-sequences of exponents decisional Diffie–Hellman assumption. We also present a different construction in which certain attributes in an access policy can be preserved by the original encryptor, while other attributes can be revoked efficiently so that the ability of attribute revocation can be appropriately restrained.     

基于门限属性加密的安全分布式云存储模型

针对云存储存在越来越多的安全问题,设计了一种新的基于门限属性加密的安全分布式云存储模型。该模型由加密、存储、解密三个阶段组成且均具有分布式特点。利用基于属性加密体制不仅提高数据存储的安全性,而且多属性服务器的模式也使得该模型能支持门限解密功能及任意个属性服务器的加入与撤出问题;在存储阶段使用的分布式删除码可充分保障模型的健壮性,且该模型能抵抗共谋攻击。在一些特有云环境中,该模型可向用户提供较好的安全云存储服务。     

一种基于策略控制的可撤销属性基代理加密方案

在分析现有一些可撤销属性基加密方案的基础上,提出了一种基于策略控制的可撤销属性基代理加密方案,该方案的仲裁者通过两个策略控制表(属性撤销表和属性代理表)灵活控制属性撤销和解密权利代理.通过查看属性撤销表,仲裁者拒绝对已撤销属性的用户进行解密操作,达到属性即时撤销的目的;当被代理者将解密权利代理出去时,将发送代理转换密钥给仲裁者,仲裁者利用属性代理表判定被代理用户是否具有密钥代理的权利,以达到属性灵活代理的目的.方案采用了线性秘密分享矩阵构造访问策略,以支持灵活的访问控制结构,同时利用了密钥分割技术为用户分发密钥.最后证明了方案的正确性和安全性.