高效且可验证的多授权机构属性基加密方案

移动云计算对于移动应用程序来说是一种革命性的计算模式,其原理是把数据存储及计算能力从移动终端设备转移到资源丰富及计算能力强的云服务器.但是这种转移也引起了一些安全问题,例如,数据的安全存储、细粒度访问控制及用户的匿名性.虽然已有的多授权机构属性基加密云存储数据的访问控制方案,可以实现云存储数据的保密性及细粒度访问控制;但其在加密和解密阶段要花费很大的计算开销,不适合直接应用于电力资源有限的移动设备;另外,虽然可以通过外包解密的方式,减少解密计算的开销,但其通常是把解密外包给不完全可信的第三方,其并不能完全保证解密的正确性.针对以上挑战,本文提出了一种高效的可验证的多授权机构属性基加密方案,该方案不仅可以降低加密解密的计算开销,同时可以验证外包解密的正确性并且保护用户隐私.最后,安全分析和仿真实验表明了方案的安全性和高效性.     

Access control aware data retrieval for secret sharing based database outsourcing

Enforcing dynamic and confidential access control policies is a challenging issue of data outsourcing to external servers due to the lack of trust towards the servers. In this paper, we propose a scalable yet flexible access control enforcement mechanism when the underlying relational data, on which access policies are defined, has been shared through a secret sharing scheme. For sharing values of an attribute in a relation, the attribute is assigned a secret distribution key and its values are split and distributed among data servers according to a Shamir based secret sharing scheme. Given access control policies over attributes of the relation schema, access to distribution keys, used further for reconstructing original values, is managed using the Chinese remainder theorem. Our solution, in addition to preserving the confidentiality of access control policies, is flexible to efficiently adopt grant and revoke of authorizations. Moreover, it prevents the possibility of information leakage caused by query processing through an access control aware retrieval of data shares. That is, our solution not only enforces access control policies for reconstructing shares and obtaining original values, but also for retrieving shares in query processing scenario. We implemented our mechanism and performed extensive experiments, whose results confirm its efficiency and considerable scalability in practice.     

Key Derivation Policy for data security and data integrity in cloud computing

Cloud computing is currently emerging as a promising next-generation architecture in the Information Technology (IT) industry and education sector. The encoding process of state information from the data and protection are governed by the organizational access control policies. An encryption technique protects the data confidentiality from the unauthorized access leads to the development of fine-grained access control policies with user attributes. The Attribute-Based Encryption (ABE) verifies the intersection of attributes to the multiple sets. The handling of adding or revoking the users is difficult with respect to changes in policies. The inclusion of multiple encrypted copies for the same key raised the computational cost. This paper proposes an efficient Key Derivation Policy (KDP) for improvement of data security and integrity in the cloud and overcomes the problems in traditional methods. The local key generation process in proposed method includes the data attributes. The secret key is generated from the combination of local keys with the user attribute by a hash function. The original text is recovered from the ciphertext by the decryption process. The key sharing between data owner and user validates the data integrity referred MAC verification process. The proposed efficient KDP with MAC verification analyze the security issues and compared with the Cipher Text–Attribute-Based Encryption (CP-ABE) schemes on the performance parameters of encryption time, computational overhead and the average lifetime of key generation. The major advantage of proposed approach is the updating of public information and easy handling of adding/revoking of users in the cloud.     

云存储中支持属性撤销的多关键词可搜索加密方案

云存储的便捷性和管理高效性使得越来越多的用户选择将数据存放在云端。为支持用户对云端加密数据进行检索,提出云存储中基于属性加密支持属性撤销的多关键词搜索方案。采用线性秘密共享矩阵来表示访问控制结构,实现密文细粒度访问控制,在属性撤销过程中不需要更新密钥,应对用户属性变更的情况,在此基础上构造基于多项式方程的搜索算法支持多关键词搜索,从而提高搜索精度。理论分析和实验结果表明,该方案具有陷门不可伪造性和关键词隐私性,能够保证用户数据的隐私和安全,相比CP-ABE方案,具有较高的存储性能和计算效率,功能性更强。     

LR-FEAD: leakage-tolerating and attribute-hiding functional encryption mechanism with delegation in affine subspaces

In large-scale networks, such as cloud computing and Internet of Things, functional encryption mechanism provides a flexible and powerful cryptographic primitive in constructing the secure transmission and communication protocols. However, as the side-channel attacks in open environments, the attacker can gain partial sensitive information from the pre-defined system by virtue of the time, power analysis, cold-boot attacks, etc. In this work, we design a leakage-resilient functional encryption scheme, which tolerates amount of bounded master-key leakage and user private-key leakage. In our scheme, encryption policies are specified as point vectors and decryption roles are defined as affine subspaces. Role delegation is implemented by specifying the affine transformation over subspaces. Our scheme achieves payload hiding and attribute hiding in the sense that the attacker is able to specify any efficiently computable leakage functions and learns the function outputs taking the master/private keys as inputs. Also, our scheme can tolerate the continual leakage for master key and private key, since we can periodically update the master key and the private key to generate a new and re-randomized key with the same distribution to the previous keys. We construct the scheme in composite-order bilinear groups and prove the security with dual system encryption methodology. We also analyze and discuss the performance of allowable leakage bound, leakage ratio and possible leakage probability. Our scheme has flexible applications in secure data communication and authorization delegation in open cloud computing systems.     

用户和属性授权机构可追责的在线/离线属性基加密方案

属性基加密作为一种一对多的加密机制,能够为云存储提供良好的安全性和细粒度访问控制。但在密文策略属性基加密中,一个解密私钥可能会对应多个用户,因此用户可能会非法共享其私钥以获取不当利益,半可信的属性授权机构亦可能会给非法用户颁发解密私钥。此外,加密消息所产生的指数运算随着访问策略复杂性的增加而增长,其产生的计算开销给通过移动设备进行加密的用户造成了重大挑战。对此,文中提出了一种支持大属性域的用户和属性授权机构可追责的在线/离线密文策略属性基加密方案。该方案是基于素数阶双线性群构造的,通过将用户的身份信息嵌入该用户的私钥中实现可追责性,利用在线/离线加密技术将大部分的加密开销转移至离线阶段。最后,给出了方案在标准模型下的选择性安全和可追责证明。分析表明,该方案的加密开销主要在离线阶段,用于追责的存储开销也极低,其适用于使用资源受限的移动设备进行加密的用户群体。     

云环境下基于属性策略隐藏的可搜索加密方案

基于属性的可搜索加密技术可以实现对数据的细粒度访问控制,但现有的可搜索加密方案,关键字的搜索、访问控制、文件加密基本上是分别执行的,导致攻击者可能跳过访问策略直接进行关键字索引匹配或文件解密;其次,现有方案中数据拥有者需将加密文件的密钥以安全通道传给用户,增加了数据拥有者的开销;此外,大多基于树型的访问控制策略是公开的,容易造成隐私泄露。因此,基于线性秘密分享（LSSS,linear secret sharing schemes）访问结构,提出了一种云环境下基于属性策略隐藏的可搜索加密方案。通过将策略秘密值嵌入关键字加密与文件存储加密,实现访问控制、关键字搜索与文件加密的有机结合;通过聚合密钥技术实现用户无须与数据拥有者交互,即可对文件进行解密的功能,减轻了密钥管理的负担,存储空间提高约30%。实验结果及安全性分析表明,所提方案具有数据存储的安全性、访问策略的隐私性、陷门的不可连接性等功能,具有较高的密文检索效率,与已有主流方案相比,检索效率提高至20%以上。     

DECENT: Secure and fine-grained data access control with policy updating for constrained IoT devices

The Internet of Things (IoT) is a novel paradigm where many of the objects that surround us can be connected to the internet. Since IoT is always related to user’s personal information, it raises lot of data security and privacy issues. In this paper, we present a secure and fine-grained data access control scheme for constrained IoT devices and cloud computing based on hierarchical attribute-based encryption, which reduces the key management by introducing hierarchical attribute authorities. In order to relieve local computation burden, we propose an outsourced encryption and decryption construction by delegating most of laborious operations to gateway and cloud server. Further, our scheme achieves efficient policy updating, which allows the sender device to update access policies without retrieving and re-encrypting the data. The security and performance analysis results show that our scheme is secure and efficient.     

一种支持快速加密的基于属性加密方案

基于属性加密算法因含有大量耗时的指数运算和双线性对运算,一些方案提出将加密外包给云服务器.然而这些方案并没有给出外包加密在云服务器中的并行计算方法,而且还存在用户保管私钥过多、授权中心生成用户私钥成本过大的问题.针对这些问题,提出一种基于Spark大数据平台的快速加密与共享方案.在该方案中,根据共享访问树的特点设计加密并行化算法,该算法将共享访问树的秘密值分发和叶子节点加密并行化之后交给Spark集群处理,而用户客户端对每个叶子节点仅需要一次指数运算;此外,用户私钥的属性计算也外包给Spark集群,授权中心生成一个用户私钥仅需要4次指数运算,并且用户仅需要保存一个占用空间很小的密钥子项.     

移动网络中心云计算存储数据访问安全自动监测系统设计

为了提高移动网络中心云计算存储数据访问和安全监测能力,提出一种基于深度学习和交叉编译控制的移动网络中心云计算存储数据访问安全自动监测系统设计方法。采用混合属性数据模糊加权聚类方法进行移动网络中心云计算存储数据的优化访问控制模型设计,根据云计算存储数据之间的属性相似度进行离散化数值属性分解,提取移动网络中心云计算存储数据的混合属性特征量,根据最小化云存储数据访问成本为代价进行移动网络中心云计算存储数据访问的安全监测。结合深度学习方法进行数据访问的自适应控制,在交叉编译环境下实现云计算存储数据访问安全自动监测系统开发设计。测试结果表明,采用该方法进行移动网络中心云计算存储数据访问的安全性较好,自动化控制能力较强。     

可公开定责的密文策略属性基加密方案

属性基加密利用属性集和访问结构之间的匹配关系实现用户解密权限的控制,从功能上高效灵活地解决了“一对多”的密数据共享问题,在云计算、物联网、大数据等细粒度访问控制和隐私保护领域有光明的应用前景。然而,在属性基加密系统中(以密文策略属性基加密为例),一个属性集合会同时被多个用户拥有,即一个解密私钥会对应多个用户,因此用户敢于共享其解密私钥以非法获利。此外,半可信的中心存在为未授权用户非法颁发私钥的可能。针对属性基加密系统中存在的两类私钥滥用问题,通过用户和中心分别对私钥进行签名的方式,提出一个密文策略属性基加密方案。该方案支持追踪性和公开定责性,任何第三方可以对泄露私钥的原始持有者的身份进行追踪,审计中心可以利用公开参数验证私钥是用户泄露的还是半可信中心非法颁发的。最后,可以证明方案的安全性基于其依赖的加密方案、签名方案。     

Removing escrow from ciphertext policy attribute-based encryption

Attribute-based encryption (ABE) is a promising cryptographic primitive for fine-grained access control of distributed data. In ciphertext policy attribute-based encryption (CP-ABE), each user is associated with a set of attributes and data are encrypted with access policies on attributes. A user is able to decrypt a ciphertext if and only if his attributes satisfy the access policy embedded in the ciphertext. However, key escrow is inherent in ABE systems. A curious key generation center in that construction has the power to decrypt every ciphertext. We found that most of the existing ABE schemes depending on a single key authority suffer from the key escrow problem. In this study, we propose a novel CP-ABE key issuing architecture that solves the key escrow problem. The proposed scheme separates the power of issuing user keys into two parties: the key generation center and the attribute authority. In the proposed construction, the key generation center and the attribute authority issue different parts of secret key components to users through a secure two-party computation protocol such that none of them can determine the whole set of keys of users individually. We demonstrate how the proposed key issuing protocol can be applied in the existing CP-ABE scheme and resolve the key escrow problem.     

基于同态加密的密文策略属性加密方案

属性加密方案极其适用于云存储环境下的数据访问控制,但用户私钥的安全问题仍然是一个极具挑战的问题,影响了属性加密的实际运用。针对该问题,提出一种基于同态加密的密文策略属性加密方案,属性授权中心和云服务中心拥有包含各自系统私钥信息的秘密坐标,两者利用各自秘密坐标进行保密计算两点一线斜率的方式来交互生成用户私钥。分析结果表明,所提方案在消除单密钥生成机构的同时极大地降低了生成用户密钥所需的通信交互次数,从而降低了交互过程中秘密信息泄露的风险。     

MASHED: Security and privacy-aware mutual authentication scheme for heterogeneous and distributed mobile cloud computing services

ABSTRACT

Rapid development in mobile devices and cloud computing technologies has increased the number of mobile services from different vendors on the cloud platform. However, users of these services are facing different security and access control challenges due to the nonexistence of security solutions capable of providing secure access to these services, which are from different vendors, using a single key. An effective security solution for heterogeneous Mobile Cloud Computing (MCC) services should be able to guarantee confidentiality and integrity through single key-based authentication scheme. Meanwhile, a few of the existing authentication schemes for MCC services require different keys to access different services from different vendors on a cloud platform, thus increases complexity and overhead incurred through generation and storage of different keys for different services.

In this paper, an efficient mutual authentication scheme for accessing heterogeneous MCC services is proposed. The proposed scheme combines the user’s voice signature with cryptography operations to evolve efficient mutual authentication scheme devoid of key escrow problem and allows authorized users to use single key to access the heterogeneous MCC services at a reduced cost.     

Privacy-preserving data utilization in hybrid clouds

As cloud computing becomes prevalent, more and more sensitive data is being centralized into the cloud, which raises a new challenge on how to utilize the outsourced data in a privacy-preserving manner. Although searchable encryption allows for privacy-preserving keyword search over encrypted data, it could not work effectively for restricting unauthorized access to the outsourced private data. In this paper, aiming at tackling the challenge of privacy-preserving utilization of data in cloud computing, we propose a practical hybrid architecture in which a private cloud is introduced as an access interface between the data owner/user and the public cloud. Under this architecture, a data utilization system is provided to achieve both exact keyword search and fine-grained access control over encrypted data. Security and efficiency analysis for the proposed system are presented in detail. Then, further enhancements for this system are considered in two steps. (1) We show how to extend our system to support efficient fuzzy keyword search while overcoming the disadvantage of insignificant decryption in the existing privacy-preserving fuzzy keyword search scheme. (2) We demonstrate approaches to realize an outsourcing cryptographic access control mechanism and further reduce the computational cost at the data user side.     

Revocable attribute-based encryption from standard lattices

Attribute-based encryption (ABE) is an attractive extension of public key encryption, which provides fine-grained and role-based access to encrypted data. In its key-policy flavor, the secret key is associated with an access policy and the ciphertext is marked with a set of attributes. In many practical applications, and in order to address scenarios where users become malicious or their secret keys are compromised, it is necessary to design an efficient revocation mechanism for ABE. However, prior works on revocable key-policy ABE schemes are based on classical number-theoretic assumptions, which are vulnerable to quantum attacks. In this work, we propose the first revocable key-policy ABE scheme that offers an efficient revocation mechanism while maintaining fine-grained access control to encrypted data. Our scheme is based on the learning with errors (LWE) problem, which is widely believed to be quantum-resistant. Our scheme supports polynomial-depth policy function and has short secret keys, where the size of the keys depends only on the depth of the supported policy function. Furthermore, we prove that our scheme satisfies selective revocation list security in the standard model under the LWE assumption.     

基于雾节点的分布式属性基加密方案

为解决云存储中对用户访问数据权限划分笼统、细粒度化控制访问权限受限以及单授权机构中存在的单点失效问题,提出基于雾节点的分布式密文策略属性基加密方案。将数据的部分解密运算外包给雾节点,减少终端用户的计算开销,并由不同的属性授权机构为用户生成属性密钥,以适用于细粒度的访问控制要求,使用全局身份将属于特定用户的各种属性进行“捆绑”,防止各属性机构间的共谋攻击,同时引入权重属性简化访问结构,节省系统的存储空间。实验结果表明,基于判定性q-parallel BDHE问题证明了该方案的安全性,与基于区块链的多授权机构访问控制方案和mHealth中可追踪多授权机构基于属性的访问控制方案相比,该方案终端用户在解密阶段具有更小的计算开销。     

基于CP-ABE和XACML多权限安全云存储访问控制方案

为了保护云存储系统中用户数据的机密性和用户隐私,提出了一种基于属性加密结合XACML框架的多权限安全云存储访问控制方案。通过CP-ABE加密来保证用户数据的机密性,通过XACML框架实现基于属性细粒度访问控制。云存储系统中的用户数据通过对称加密机制进行加密,对称密钥采用CP-ABE加密。仿真实验表明,该方案是高效灵活并且安全的。安全性分析表明,该方案能够抵抗共谋攻击,具有数据机密性以及后向前向保密性。     

高效可撤销的雾协同云访问控制方案

密文策略属性加密技术在实现基于云存储的物联网系统中数据细粒度访问控制的同时,也带来了用户与属性的撤销问题。然而,在现有的访问控制方案中,基于时间的方案往往撤销并不即时,基于第三方的方案通常需要大量重加密密文,效率较低且开销较大。为此,基于RSA密钥管理机制提出了一种高效的支持用户与属性即时撤销的访问控制方案,固定了密钥与密文的长度,借助雾节点实现了用户撤销,同时将部分加解密工作从用户端卸载到临近的雾节点,降低了用户端的计算负担。基于aMSE-DDH假设的安全性分析结果表明,方案能够抵抗选择密文攻击。通过理论分析和实验仿真表明,所提方案能够为用户属性变更频繁且资源有限的应用场景提供高效的访问控制。     

基于属性加密的雾协同云数据共享方案

为解决现有的属性加密数据共享方案粗粒度和开销大等问题,提出一种能保证数据隐私且访问控制灵活的雾协同云数据共享方案(FAC-ABE)。设计属性加密机制,将数据的访问控制策略分为个性化和专业化两种。通过个性化的访问策略,根据用户的经验和偏好,将数据共享给相应的云端。利用雾节点对数据分类,将共享的数据分流,保障数据共享给专业的云服务器。安全分析结果表明,该方案能保障数据机密性,实现更细粒度的访问控制。实验结果表明,用户能将加密开销转移到雾节点上,降低了云端用户开销。