基于属性加密的雾协同云数据共享方案

为解决现有的属性加密数据共享方案粗粒度和开销大等问题,提出一种能保证数据隐私且访问控制灵活的雾协同云数据共享方案(FAC-ABE)。设计属性加密机制,将数据的访问控制策略分为个性化和专业化两种。通过个性化的访问策略,根据用户的经验和偏好,将数据共享给相应的云端。利用雾节点对数据分类,将共享的数据分流,保障数据共享给专业的云服务器。安全分析结果表明,该方案能保障数据机密性,实现更细粒度的访问控制。实验结果表明,用户能将加密开销转移到雾节点上,降低了云端用户开销。     

Efficient revocation in ciphertext-policy attribute-based encryption based cryptographic cloud storage

It is secure for customers to store and share their sensitive data in the cryptographic cloud storage.However,the revocation operation is a sure performance killer in the cryptographic access control system.To optimize the revocation procedure,we present a new efficient revocation scheme which is efficient,secure,and unassisted.In this scheme,the original data are first divided into a number of slices,and then published to the cloud storage.When a revocation occurs,the data owner needs only to retrieve one slice,and re-encrypt and re-publish it.Thus,the revocation process is accelerated by affecting only one slice instead of the whole data.We have applied the efficient revocation scheme to the ciphertext-policy attribute-based encryption(CP-ABE) based cryptographic cloud storage.The security analysis shows that our scheme is computationally secure.The theoretically evaluated and experimentally measured performance results show that the efficient revocation scheme can reduce the data owner’s workload if the revocation occurs frequently.     

改进的属性撤销权重属性基加密方案

在PHR（Personal Health Records,个人健康记录）系统中,用户会动态地加入或离开,及时撤销细粒度的属性更加适用于实际应用系统。为此,提出一种改进的基于仲裁者的密文策略的属性基加密方案,使其能够在具有外包解密的同时可以实现细粒度属性及时撤销。该方案通过构造KEK树及时更新密钥和密文以此来及时撤销细粒度属性。此外,针对现有的密文策略属性基加密方案较少考虑到属性重要性,将属性权重的概念引入该方案中,使其更加适合PHR系统。安全性分析和仿真实验表明,与已有方案相比,所提方案可以抵抗合谋攻击,保证数据机密性以及前向安全和后向安全。此外,该方案具有更低的计算复杂度。     

一种用于云存储的可撤销的属性加密方案

由于云存储用户数量大,成分复杂,云存储中数据的安全防护问题成为其发展的一大制约,近年来,基于属性加密技术解决云存储中数据安全存储问题成为研究热点,但传统的属性加密方案存在密文长度相对较大且属性撤销复杂等问题。引入代理重加密技术,针对以上问题提出一种可撤销的密文属性基加密方案,在缩短密文长度的同时实现属性撤销操作,并证明该方案在DBDH假设下CPA是安全的。     

一种基于策略控制的可撤销属性基代理加密方案

在分析现有一些可撤销属性基加密方案的基础上,提出了一种基于策略控制的可撤销属性基代理加密方案,该方案的仲裁者通过两个策略控制表(属性撤销表和属性代理表)灵活控制属性撤销和解密权利代理.通过查看属性撤销表,仲裁者拒绝对已撤销属性的用户进行解密操作,达到属性即时撤销的目的;当被代理者将解密权利代理出去时,将发送代理转换密钥给仲裁者,仲裁者利用属性代理表判定被代理用户是否具有密钥代理的权利,以达到属性灵活代理的目的.方案采用了线性秘密分享矩阵构造访问策略,以支持灵活的访问控制结构,同时利用了密钥分割技术为用户分发密钥.最后证明了方案的正确性和安全性.     

Generic user revocation systems for attribute-based encryption in cloud storage

Cloud-based storage is a service model for businesses and individual users that involves paid or free storage resources. This service model enables on-demand storage capacity and management to users anywhere via the Internet. Because most cloud storage is provided by third-party service providers, the trust required for the cloud storage providers and the shared multi-tenant environment present special challenges for data protection and access control. Attribute-based encryption (ABE) not only protects data secrecy, but also has ciphertexts or decryption keys associated with fine-grained access policies that are automatically enforced during the decryption process. This enforcement puts data access under control at each data item level. However, ABE schemes have practical limitations on dynamic user revocation. In this paper, we propose two generic user revocation systems for ABE with user privacy protection, user revocation via ciphertext re-encryption (UR-CRE) and user revocation via cloud storage providers (UR-CSP), which work with any type of ABE scheme to dynamically revoke users.     

支持带权属性撤销的密文策略属性基加密方案

针对目前大部分密文策略属性基加密（CP-ABE）方案都不支持属性的多状态表示,加密、解密阶段计算开销庞大的问题,提出一种支持带权属性撤销的CP-ABE方案（CPABEWAR）。一方面,通过引入带权属性的概念,增强了属性的表达能力;另一方面,为了降低计算开销,在保证数据安全的情况下将部分计算过程外包给云服务提供商（CSP）。分析结果表明,所提方案基于判定双线性DH （DBDH）假设是选择明文安全的（CPS）。所提方案以增加少量存储空间为代价简化了访问树结构,提高了系统效率和访问控制的灵活性,适合计算能力受限的云用户。     

一种用于云存储的密文策略属性基加密方案

云存储的应用环境中存在缺乏细粒度访问控制、密钥管理难度大、难以抵御合谋攻击等问题,为此提出了一种新的用于云存储的密文策略属性基加密(ciphertext-policy attribute-based encryption,CP-ABE)方案。通过引入由数据属主独立控制的许可属性,构建不同属性域的CP-ABE方案,能够防止云存储系统特权用户的内部攻击,使数据属主能完全控制其他共享用户对其云数据的访问。实验结果表明,该方案在提供安全性的同时能极大地提高用户属性撤销的效率。最后,对该方案进行了安全分析,并证明了该方案在DBDH假设下是CPA,安全的。     

面向移动终端的密文可验证属性基可搜索加密方案

轻量级设备的数据大多都存储在云服务器上。由于云服务不完全可信,且传统的单关键词可搜索加密会产生许多与检索内容无关的信息,因此提出一个面向移动终端的密文可验证属性基可搜索加密方案。该方案结合CP-ABE技术控制访问细粒度,引入可信第三方进行数据完整性验证,同时帮助用户进行部分解密工作。该方案在困难问题假设下被证明是选择性不可区分的密文策略和选择明文攻击IND-sCP-CPA及不可区分的选择关键词攻击IND-CKA。理论分析和数值模拟实验表明,该方案具有更高的效率。     

云环境下的基于属性和重加密的密钥管理

在云计算环境中如何安全地存储数据是云计算面临的挑战之一。加密是解决云计算中数据存储安全问题最主要的方法,而加密的一个保密性问题是密钥管理。提出了云环境下的基于属性和重加密的密钥管理方案。云服务提供商对不同用户进行重加密时,可以一次为一组用户重加密,从而减少了重加密的个数。数据拥有者可以对组用户生成和发送重加密密钥,而数据请求者可以使用属性集对应的一个密钥解密多个数据拥有者的数据,从而能减少两者的密钥发送量,降低密钥管理的难度,提高方案的效率。最后,对方案的安全性和性能进行了分析     

可追踪并撤销叛徒的属性基加密方案

属性基加密(ABE)是一种有效地对加密数据实现细粒度访问控制的密码学体制.在ABE系统中,存在恶意用户(或叛徒)泄露私钥生成盗版解码器,并将其分发给非法用户的问题.现有的解决方案仅能追查到密钥泄漏者的身份,但不能将其从ABE系统中撤销.文中提出了一种既可追踪又可撤销叛徒的属性基加密方案(ABTR).首先,给出一个具有扩展通配符的属性基加密方案(GWABE),基于3个3素数子群判定假设,采用双系统加密方法证明该GWABE方案是完全安全的.然后,利用完全子树构架将GWABE转化成ABTR方案,并证明该ABTR方案是完全安全的,且用户私钥长度是固定的.而此前的可追踪叛徒的ABE方案仅满足选择安全性.     

Secure administration of cryptographic role-based access control for large-scale cloud storage systems

Cloud systems provide significant benefits by allowing users to store massive amount of data on demand in a cost-effective manner. Role-based access control (RBAC) is a well-known access control model which can be used to protect the security of cloud data storage. Although cryptographic RBAC schemes have been developed recently to secure data outsourcing, these schemes assume the existence of a trusted administrator managing all the users and roles, which is not realistic in large-scale systems. In this paper, we introduce a cryptographic administrative model AdC-RBAC for managing and enforcing access policies for cryptographic RBAC schemes. The AdC-RBAC model uses cryptographic techniques to ensure that the administrative tasks are performed only by authorised administrative roles. Then we propose a role-based encryption (RBE) scheme and show how the AdC-RBAC model decentralises the administrative tasks in the RBE scheme thereby making it practical for security policy management in large-scale cloud systems.     

支持用户追溯和轻量的共享云数据审计方案

在云计算中,数据通常由一组用户共享。由于第三方审计可以通过数据块的签名获取组成员的身份,为了保护群组成员的身份,现有对共享数据的公共审计方案都隐藏了组成员的身份。然而,身份的匿名性将导致一个组的成员可以恶意修改共享数据而不被发现,而且对于资源受限的设备,用户在产生签名的过程中计算量大。因此现有公共审计方案存在数据块身份的不可追溯、用户产生共享数据块签名的计算量大等问题。针对上述问题,提出了一种支持用户追溯和轻量的共享云数据审计方案（ASDA）。该方案利用安全中介者代替用户签名,保护了群组成员的身份,在签名的同时保存用户的信息,通过这些信息,可以追溯到数据块是由哪一个组成员修改,从而保证数据块身份可追溯性;而且利用新的数据块致盲技术,减少用户端计算量。实验结果表明,所提方案与利用第三方媒介存储共享云数据（SDVS）方案相比,减少了用户端计算时间,并且能够实现共享数据块身份的可追溯性。     

云存储环境下可撤销属性加密

属性加密方案在云存储中得到了越来越广泛的应用,它能够实现细粒度的访问控制.但是在原始的属性加密方案中,解决动态的用户与属性撤销,是当前面临的重要挑战.为了解决这一问题,提出了一个密文策略的属性加密方案,该方案能够实现属性级的用户撤销,即若用户的某个属性被撤销,不会影响该用户其他合法属性的正常访问.在该方案中,若用户的某个属性被撤销,那么将基于设计的广播属性加密方案对被撤销属性对应的密文进行更新,只有属性集合满足密文访问策略且未被撤销的用户才能够成功地进行密钥更新而解密密文.该方案基于q-Parallel Bilinear Diffie-Hellman Exponent假设实现了标准模型下的可证明安全性,安全性较高.另外,该方案将属性撤销的相关操作托管给云存储中心执行,大大减轻了属性授权的计算负载.最后对方案进行了性能分析与实验验证,实验结果表明：与已有相关方案相比,虽然为了实现属性撤销,增加了云存储中心的计算负载,但是不需要属性授权的参与,因此降低了属性授权的计算负载,而且用户除了密钥外不需要其他额外参数来实现属性撤销,因此大大节省了存储空间.     

A hybrid approach for scalable sub-tree anonymization over big data using MapReduce on cloud

In big data applications, data privacy is one of the most concerned issues because processing large-scale privacy-sensitive data sets often requires computation resources provisioned by public cloud services. Sub-tree data anonymization is a widely adopted scheme to anonymize data sets for privacy preservation. Top–Down Specialization (TDS) and Bottom–Up Generalization (BUG) are two ways to fulfill sub-tree anonymization. However, existing approaches for sub-tree anonymization fall short of parallelization capability, thereby lacking scalability in handling big data in cloud. Still, either TDS or BUG individually suffers from poor performance for certain valuing of k-anonymity parameter. In this paper, we propose a hybrid approach that combines TDS and BUG together for efficient sub-tree anonymization over big data. Further, we design MapReduce algorithms for the two components (TDS and BUG) to gain high scalability. Experiment evaluation demonstrates that the hybrid approach significantly improves the scalability and efficiency of sub-tree anonymization scheme over existing approaches.     

云环境下一种基于数据分割的CP-ABE隐私保护方案

针对云计算隐私安全保护,提出了一种基于数据分割的CP-ABE(密文策略的基于属性的加密方案)隐私保护方案,克服了云环境下不可信第三方、安全性和性能开销的三大难题。本方案利用数据分割思想将数据分为大数据块和小数据块,通过分割策略对大数据块再进行分块,并用CP-ABE算法对小数据块进行加密。经理论分析及实验仿真表明,在云环境下,此方案在安全问题、开销问题及扩展问题上都有很大优势。     

EFADS: Efficient,flexible and anonymous data sharing protocol for cloud computing with proxy re-encryption

The concept of cloud computing has emerged as the next generation of computing infrastructure to reduce the costs associated with the management of hardware and software resources. It is vital to its success that cloud computing is featured efficient, flexible and secure characteristics. In this paper, we propose an efficient and anonymous data sharing protocol with flexible sharing style, named EFADS, for outsourcing data onto the cloud. Through formal security analysis, we demonstrate that EFADS provides data confidentiality and data sharer's anonymity without requiring any fully-trusted party. From experimental results, we show that EFADS is more efficient than existing competing approaches. Furthermore, the proxy re-encryption scheme we propose in this paper may be independent of interests, i.e., compared to those previously reported proxy re-encryption schemes, the proposed scheme is the first pairing-free, anonymous and unidirectional proxy re-encryption scheme in the standard model.     

Efficient multi-keyword ranked query over encrypted data in cloud computing

Cloud computing infrastructure is a promising new technology and greatly accelerates the development of large scale data storage, processing and distribution. However, security and privacy become major concerns when data owners outsource their private data onto public cloud servers that are not within their trusted management domains. To avoid information leakage, sensitive data have to be encrypted before uploading onto the cloud servers, which makes it a big challenge to support efficient keyword-based queries and rank the matching results on the encrypted data. Most current works only consider single keyword queries without appropriate ranking schemes. In the current multi-keyword ranked search approach, the keyword dictionary is static and cannot be extended easily when the number of keywords increases. Furthermore, it does not take the user behavior and keyword access frequency into account. For the query matching result which contains a large number of documents, the out-of-order ranking problem may occur. This makes it hard for the data consumer to find the subset that is most likely satisfying its requirements. In this paper, we propose a flexible multi-keyword query scheme, called MKQE to address the aforementioned drawbacks. MKQE greatly reduces the maintenance overhead during the keyword dictionary expansion. It takes keyword weights and user access history into consideration when generating the query result. Therefore, the documents that have higher access frequencies and that match closer to the users’ access history get higher rankings in the matching result set. Our experiments show that MKQE presents superior performance over the current solutions.