基于属性加密的雾协同云数据共享方案

为解决现有的属性加密数据共享方案粗粒度和开销大等问题,提出一种能保证数据隐私且访问控制灵活的雾协同云数据共享方案(FAC-ABE)。设计属性加密机制,将数据的访问控制策略分为个性化和专业化两种。通过个性化的访问策略,根据用户的经验和偏好,将数据共享给相应的云端。利用雾节点对数据分类,将共享的数据分流,保障数据共享给专业的云服务器。安全分析结果表明,该方案能保障数据机密性,实现更细粒度的访问控制。实验结果表明,用户能将加密开销转移到雾节点上,降低了云端用户开销。     

Secure and efficient data collaboration with hierarchical attribute-based encryption in cloud computing

With the increasing trend of outsourcing data to the cloud for efficient data storage, secure data collaboration service including data read and write in cloud computing is urgently required. However, it introduces many new challenges toward data security. The key issue is how to afford secure write operation on ciphertext collaboratively, and the other issues include difficulty in key management and heavy computation overhead on user since cooperative users may read and write data using any device. In this paper, we propose a secure and efficient data collaboration scheme, in which fine-grained access control of ciphertext and secure data writing operation can be afforded based on attribute-based encryption (ABE) and attribute-based signature (ABS) respectively. In order to relieve the attribute authority from heavy key management burden, our scheme employs a full delegation mechanism based on hierarchical attribute-based encryption (HABE). Further, we also propose a partial decryption and signing construction by delegating most of the computation overhead on user to cloud service provider. The security and performance analysis show that our scheme is secure and efficient.     

Cloud based data sharing with fine-grained proxy re-encryption

Conditional proxy re-encryption (CPRE) enables fine-grained delegation of decryption rights, and has many real-world applications. In this paper, we present a ciphertext-policy attribute based CPRE scheme, together with a formalization of the primitive and its security analysis. We demonstrate the utility of the scheme in a cloud deployment, which achieves fine-grained data sharing. This application implements cloud server-enabled user revocation, offering an alternative yet more efficient solution to the user revocation problem in the context of fine-grained encryption of cloud data. High user-side efficiency is another prominent feature of the application, which makes it possible for users to use resource constrained devices, e.g., mobile phones, to access cloud data. Our evaluations show promising results on the performance of the proposed scheme.     

Efficient revocation in ciphertext-policy attribute-based encryption based cryptographic cloud storage

It is secure for customers to store and share their sensitive data in the cryptographic cloud storage.However,the revocation operation is a sure performance killer in the cryptographic access control system.To optimize the revocation procedure,we present a new efficient revocation scheme which is efficient,secure,and unassisted.In this scheme,the original data are first divided into a number of slices,and then published to the cloud storage.When a revocation occurs,the data owner needs only to retrieve one slice,and re-encrypt and re-publish it.Thus,the revocation process is accelerated by affecting only one slice instead of the whole data.We have applied the efficient revocation scheme to the ciphertext-policy attribute-based encryption(CP-ABE) based cryptographic cloud storage.The security analysis shows that our scheme is computationally secure.The theoretically evaluated and experimentally measured performance results show that the efficient revocation scheme can reduce the data owner’s workload if the revocation occurs frequently.     

改进的属性撤销权重属性基加密方案

在PHR（Personal Health Records,个人健康记录）系统中,用户会动态地加入或离开,及时撤销细粒度的属性更加适用于实际应用系统。为此,提出一种改进的基于仲裁者的密文策略的属性基加密方案,使其能够在具有外包解密的同时可以实现细粒度属性及时撤销。该方案通过构造KEK树及时更新密钥和密文以此来及时撤销细粒度属性。此外,针对现有的密文策略属性基加密方案较少考虑到属性重要性,将属性权重的概念引入该方案中,使其更加适合PHR系统。安全性分析和仿真实验表明,与已有方案相比,所提方案可以抵抗合谋攻击,保证数据机密性以及前向安全和后向安全。此外,该方案具有更低的计算复杂度。     

基于属性加密的云存储隐私保护机制研究

以典型的云存储体系结构为研究对象,从数据拥有者、云服务器、授权机构、用户以及用户撤销机制5个方面对云存储系统的隐私保护机制进行了研究,通过分析比较发现,云存储系统中的隐私保护问题主要可以分为系统参与者的身份隐私问题、敏感属性信息泄露问题、云存储系统敏感内容信息泄露问题。针对上述问题,研究了当前基于属性加密的云存储系统隐私保护机制,并讨论了其中存在的不足、可能的解决方案以及未来可能的研究方向。     

一种用于云存储的可撤销的属性加密方案

由于云存储用户数量大,成分复杂,云存储中数据的安全防护问题成为其发展的一大制约,近年来,基于属性加密技术解决云存储中数据安全存储问题成为研究热点,但传统的属性加密方案存在密文长度相对较大且属性撤销复杂等问题。引入代理重加密技术,针对以上问题提出一种可撤销的密文属性基加密方案,在缩短密文长度的同时实现属性撤销操作,并证明该方案在DBDH假设下CPA是安全的。     

一种基于策略控制的可撤销属性基代理加密方案

在分析现有一些可撤销属性基加密方案的基础上,提出了一种基于策略控制的可撤销属性基代理加密方案,该方案的仲裁者通过两个策略控制表(属性撤销表和属性代理表)灵活控制属性撤销和解密权利代理.通过查看属性撤销表,仲裁者拒绝对已撤销属性的用户进行解密操作,达到属性即时撤销的目的;当被代理者将解密权利代理出去时,将发送代理转换密钥给仲裁者,仲裁者利用属性代理表判定被代理用户是否具有密钥代理的权利,以达到属性灵活代理的目的.方案采用了线性秘密分享矩阵构造访问策略,以支持灵活的访问控制结构,同时利用了密钥分割技术为用户分发密钥.最后证明了方案的正确性和安全性.     

素数阶群上可追踪并撤销叛徒的ABE方案*

叛徒追踪和撤销是属性基加密(ABE)需要解决的问题。目前满足自适应安全且可追踪并撤销叛徒的ABE方案(ABTR)在合数阶群上构造。针对合数阶群上双线性配对计算开销过大的问题,利用对偶正交基,首先提出了一个素数阶群上具有扩展通配符的ABE方案(PGWABE),并证明该方案满足自适应安全;在此基础上,利用完全子树构架,将PGWABE方案转变为素数阶群上可追踪并撤销叛徒的ABE方案(PABTR)。与现有方案相比,该方案在同等安全性上效率更高。     

云存储环境下属性基加密综述*

属性基加密作为一种新型的密码方案,将用户私钥和密文与属性相关联,为解决云存储环境下数据安全共享、细粒度访问控制和安全存储等问题提供了一种解决思路。在对密钥策略属性基加密、密文策略属性基加密和混合策略属性基加密深入研究后,根据不同的功能扩展,针对隐藏访问结构、多授权机构、复杂计算安全外包、可搜索加密机制、属性撤销、叛徒追踪等重点难点问题进行了深入探讨研究。最后总结了现有研究工作的不足,并指出了未来的研究方向。     

ABDKS: attribute-based encryption with dynamic keyword search in fog computing

Attribute-based encryption with keyword search (ABKS) achieves both fine-grained access control and keyword search. However, in the previous ABKS schemes, the search algorithm requires that each keyword to be identical between the target keyword set and the ciphertext keyword set, otherwise the algorithm does not output any search result, which is not conducive to use. Moreover, the previous ABKS schemes are vulnerable to what we call a peer-decryption attack, that is, the ciphertext may be eavesdropped and decrypted by an adversary who has sufficient authorities but no information about the ciphertext keywords.In this paper, we provide a new system in fog computing, the ciphertext-policy attribute-based encryption with dynamic keyword search (ABDKS). In ABDKS, the search algorithm requires only one keyword to be identical between the two keyword sets and outputs the corresponding correlation which reflects the number of the same keywords in those two sets. In addition, our ABDKS is resistant to peer-decryption attack, since the decryption requires not only sufficient authority but also at least one keyword of the ciphertext. Beyond that, the ABDKS shifts most computational overheads from resource constrained users to fog nodes. The security analysis shows that the ABDKS can resist Chosen-PlaintextAttack (CPA) and Chosen-Keyword Attack (CKA).     

Generic user revocation systems for attribute-based encryption in cloud storage

Cloud-based storage is a service model for businesses and individual users that involves paid or free storage resources. This service model enables on-demand storage capacity and management to users anywhere via the Internet. Because most cloud storage is provided by third-party service providers, the trust required for the cloud storage providers and the shared multi-tenant environment present special challenges for data protection and access control. Attribute-based encryption (ABE) not only protects data secrecy, but also has ciphertexts or decryption keys associated with fine-grained access policies that are automatically enforced during the decryption process. This enforcement puts data access under control at each data item level. However, ABE schemes have practical limitations on dynamic user revocation. In this paper, we propose two generic user revocation systems for ABE with user privacy protection, user revocation via ciphertext re-encryption (UR-CRE) and user revocation via cloud storage providers (UR-CSP), which work with any type of ABE scheme to dynamically revoke users.     

支持撤销的外包加解密CP-ABE方案

属性基加密（attribute-based encryption,ABE）方案在云存储中得到了越来越广泛的应用,它能够实现细粒度的访问控制,但是现有的大多数ABE方案存在撤销方案效率低、开销大的问题。为了解决这一问题,提出一种更高效、细粒度的支持属性撤销的属性基加密方案。该方案将部分加解密运算外包给代理服务器,从而降低用户的加解密计算量。同时还提出了一种有效的属性撤销方法,该方法只需更新与撤销属性相关联的密文和用户密钥,所以属性撤销的代价很小。并结合了双因子身份认证机制,提高算法的安全性。该方案基于DBDH假设,在标准模型下被证明是安全的。     

A highly secured and streamlined cloud collaborative editing scheme along with an efficient user revocation in cloud computing

These days with the expanded fame of cloud computing, the interest for cloud-based collaborative editing service is rising. The encryption method is utilized to ensure and secure the data, during the collaborative editing process. In the encryption process, the cloud requires more time to work the collaborative editing. This paper proposes an efficient scheme for reducing the encryption burden over the cooperative users, as the possibilities of cooperative users read and write data by means of any gadget. In the proposed scheme, the encrypted file sent by the data owner is split into smaller segments and stored in the cloud by the cloud service provider (CSP) along with specific tags. Once the cooperative user receives and decrypts the file from the CSP, it modifies and encrypts only the modified segment and resends to the CSP. The CSP after verifying the signature replace the original file segment in the cloud with the modified segment based on the tag information. The scheme that is put forward is performed based on the modified ciphertext-policy hierarchical attribute–based encryption, and the security process is done based on the attribute-based signature schemes. This work employs a proficient attribute updating method to accomplish the dynamic change of users' attributes, consisting granting new attributes, revoking previous attributes, and regranting formerly revoked attributes. A writer's attributes and keys have been revoked, and the stale information cannot be written.     

支持带权属性撤销的密文策略属性基加密方案

针对目前大部分密文策略属性基加密（CP-ABE）方案都不支持属性的多状态表示,加密、解密阶段计算开销庞大的问题,提出一种支持带权属性撤销的CP-ABE方案（CPABEWAR）。一方面,通过引入带权属性的概念,增强了属性的表达能力;另一方面,为了降低计算开销,在保证数据安全的情况下将部分计算过程外包给云服务提供商（CSP）。分析结果表明,所提方案基于判定双线性DH （DBDH）假设是选择明文安全的（CPS）。所提方案以增加少量存储空间为代价简化了访问树结构,提高了系统效率和访问控制的灵活性,适合计算能力受限的云用户。     

移动云环境下的多授权机构属性基加密方案

针对移动云数据的访问控制进行了研究,提出一种高效的、无需CA的多授权机构密文策略属性基加密方案。通过借助外部资源,在数据加密和解密过程分别增加预加密操作和可验证外包解密操作,从而降低用户的加解密计算量,并采用双因子身份认证机制实现对用户的匿名认证。安全性分析表明,新方案基于判断性q-BDHE（decisional q-parallel Bilinear Diffie-Hellman Exponent）假设可证明是选择明文安全的,并且方案能够抵抗合谋攻击。仿真实验表明,新方案有效降低了数据加密、解密的计算开销以及对密文的通信开销。因此,新方案能够实现对移动云数据安全、高效的访问控制。     

一种轻量级的雾计算属性基外包加密算法

为减少属性基加密算法占用的资源,在安全数据访问控制的属性基加密算法的基础上提出了一种改进的属性基外包加密算法。改进算法将加密算法中的复杂双线性对计算外包给雾节点以减少用户的计算开销;同时通过简化系统参数,减少属性中心为属性生成的随机因子以缩短密文和密钥长度,降低了用户和雾节点的存储和通信开销。同时对提出的改进算法进行了安全性证明,证明了该改进算法是安全的。     

基于属性的可净化签名方案

在属性基签名（attribute-based signature, ABS）方案中,签名者密钥由不同的属性生成,只有当所拥有的属性满足给定的签名策略时才能够产生有效签名.验证者不需要知道签名者真实身份就能判断签名是否有效.所以ABS因其匿名性而受到广泛关注.在ABS方案中,一旦密钥发生泄露,那么获得密钥的攻击者就可以生成一个有效签名.原始消息中往往包含一些敏感信息,例如在电子医疗或电子金融场景中,个人的医疗记录或交易记录中包含个人隐私信息,若未经脱敏处理将会导致个人敏感信息泄露.为了解决密钥泄露和敏感信息泄露问题,提出了一种前向安全的高效属性基可净化签名（forward-secure attribute-based sanitizable signature, FABSS）方案.基于η-DHE（η-Diffie-Hellman exponent）困难问题假设,在标准模型下证明了该方案的安全性.提出的方案不仅可以抵抗密钥泄露,保护签名者隐私,同时还具有敏感信息隐藏功能.此外,提出的方案具有固定签名长度,并且在验证阶段只需要计算常数个配对运算.实验分析表明提出方案的性能是高效的.

     

一种用于云存储的密文策略属性基加密方案

云存储的应用环境中存在缺乏细粒度访问控制、密钥管理难度大、难以抵御合谋攻击等问题,为此提出了一种新的用于云存储的密文策略属性基加密(ciphertext-policy attribute-based encryption,CP-ABE)方案。通过引入由数据属主独立控制的许可属性,构建不同属性域的CP-ABE方案,能够防止云存储系统特权用户的内部攻击,使数据属主能完全控制其他共享用户对其云数据的访问。实验结果表明,该方案在提供安全性的同时能极大地提高用户属性撤销的效率。最后,对该方案进行了安全分析,并证明了该方案在DBDH假设下是CPA,安全的。     

基于密文策略属性加密的云存储访问控制方案

针对现有方案存在的访问策略公开、密文存储开销较大的问题,提出一种支持策略隐藏且固定长度密文的云存储访问控制方案,并在安全模型下证明方案可抵抗选择明文攻击。方案中用户私钥由多个授权机构共同生成,中央授权机构不参与生成任何主密钥与属性私钥;访问结构隐藏在密文之中,恶意用户无法通过访问结构获取敏感信息。此外,方案实现了固定密文长度,并且加密时的指数运算和解密时的双线性对运算次数均是固定值。最后,理论分析和实验结果表明该方案在密文长度和加解密时间上都明显优于对比方案。