支持直接撤销的密文策略属性基加密方案

提出一种支持直接撤销的属性基加密方案,首先给出支持直接撤销的属性基加密定义和安全模型,其次给出具体的支持撤销的密文策略——属性基加密方案并对安全性进行证明,最后,与其他方案对比显示,该方案在密文和密钥长度方面都有所减少。该方案可以实现对用户进行即时撤销,当且仅当用户所拥有的属性满足密文的访问结构且不在用户撤销列表内时,才能使用自己的私钥解密出明文。     

Multi-authority attribute-based encryption scheme with policy dynamic updating

Attribute-based encryption (ABE) is a new cryptographic technique which guarantees fine-grained access control of outsourced encrypted data in the cloud environment.However,a key limitation remains,namely policy updating.Thus,a multi-authority attribute-based encryption scheme with policy dynamic updating was proposed.In the scheme,an anonymous key issuing protocol was introduced to protect users’ privacy and resist collusion attack of attribute authority.The scheme with dynamic policy updating technique was secure against chosen plaintext attack under the standard model and can support any types of policy updating.Compared to the existing related schemes,the size of ciphertext and users’ secret key is reduced and can significantly reduce the computation and communication costs of updating ciphertext.It is more effective in the practical application.     

基于R-LWE的公钥加密方案

根据一个更紧凑的均匀性定理提出了一种改进的理想格上陷门生成方法;然后结合R-LWE加密算法和理想格上强不可伪造一次签名工具,在标准模型下设计了一个适应性选择密文攻击(CCA)安全的公钥加密方案。新方案可实现块加密,可支持公开的密文完整性验证,具有加解密速度快、密文扩展率低的优势,其安全性可以高效地归约为判定性R-LWE困难性假设。新方案是第一个完全基于理想格上困难问题构造的CCA安全公钥加密方案。     

基于区块链且支持验证的属性基搜索加密方案

针对一对多搜索模型下共享解密密钥缺乏细粒度访问控制且搜索结果缺乏正确性验证的问题,提出了一种基于区块链且支持验证的属性基搜索加密方案。通过对共享密钥采用密文策略属性加密机制,实现细粒度访问控制。结合以太坊区块链技术,解决半诚实且好奇的云服务器模型下返回搜索结果不正确的问题,在按需付费的云环境下,实现用户和云服务器之间服务-支付公平,使各方诚实地按照合约规则执行。另外,依据区块链的不可篡改性,保证云服务器得到服务费,用户得到正确的检索结果,而不需要额外验证,减少用户计算开销。安全性分析表明,所提方案满足自适应选择关键词语义安全,能很好地保护用户的隐私以及数据的安全。性能对比及实验结果表明,所提方案在安全索引产生、搜索令牌生成、检索效率以及交易数量方面有一定的优化,更加适用于智慧医疗等一对多搜索场景。     

权限分离的属性基加密数据共享方案

属性基加密(ABE, attribute-based encryption)用于提供细粒度访问控制及一对多加密,现已被广泛应用于分布式环境下数据共享方案以提供隐私保护。然而,现有的属性基加密数据共享方案均允许数据拥有者任意修改数据,导致数据真实性无法保证,经常难以满足一些实际应用需求,如个人电子病例、审核系统、考勤系统等。为此,提出一种能保证数据真实可靠且访问控制灵活的数据共享方案。首先,基于RSA代理加密技术实现读写权限分离机制以保证数据真实可靠;其次,使用属性基加密机制提供灵活的访问控制策略;最后,利用关键字检索技术实现支持密钥更新的高效撤销机制。详细的安全性分析表明本方案能提供数据机密性以实现隐私保护,且性能分析和仿真表明本方案具有较高效率,能有效满足实际应用需求。     

前向安全的密文策略基于属性加密方案

为降低密文策略基于属性加密（ABE, ciphertext-policyattribute-based encryption）体制中私钥泄漏带来的损害,首先给出了前向安全CP-ABE体制的形式化定义和安全模型,然后构造了一个前向安全的CP-ABE方案。基于判定性l-BDHE假设,给出了所提方案在标准模型下的安全性证明。从效率和安全性2个方面讨论了所提方案的性能,表明所提方案在增强CP-ABE体制安全性的同时,并没有过多地增加计算开销和存储开销,更适合在实际中应用。     

支持同态算术运算的数据加密方案算法研究

针对在计算服务中,对用户信息加密以保护隐私时,无法对密文进行计算的问题,提出一种高效的支持密文四则算术运算的同态加密方案CESIL, 包括密钥生成、加密、解密及密文运算4个算法。该方案首先借助多项式环重新定义向量的加法和乘法运算,构建多项式系数向量环;然后利用理想格在向量环上划分剩余类,建立商环及其代表元集合;最后,将整数明文映射为代表元,并用代表元所在剩余类的其他元素替换该代表元,以对明文进行加密。商环的运算特性保证CESIL方案支持对密文的加法和乘法运算。在实现CESIL方案时,利用快速傅里叶变换(FFT)算法进一步提高运算效率、减少密钥长度。理论分析及实验结果表明,CESIL是语义安全的,且相比已有的一些同态加密方案,CESIL支持更多的运算类型,拥有较高的运行效率和较小的密钥及密文长度,能更好地满足实际应用需求。     

Efficient revocable attribute-based encryption scheme

In the existing solutions,the time-based scheme is difficult to achieve immediate revocation,and the third-party-based scheme often requires re-encryption,which needs large amount of calculation and doesn’t apply to mas-sive data.To solve the problem,an efficient and immediate CP-ABE scheme was proposed to support user and attribute lev-els revocation.The scheme was based on the classic LSSS access structure,introducing RSA key management mechanism and attribute authentication.By means of a semi-trusted third party,the user could be authenticated before decryption.Com-pared with the existing revocation schemes,The proposed scheme didn’t need the user to update the key or re-encrypt the ciphertext.The semi-trusted third party wasn’t required to update the RSA attribute authentication key.The scheme greatly reduced the amount of computation and traffic caused by revocation,while ensuring anti-collusion attacks and forward and backward security.Finally,the security analysis and experimental simulation show that the scheme has higher revocation ef-ficiency.     

面向社交网络的隐私保护方案

针对社交网络的隐私安全问题,提出了一种新的社交网络隐私保护方案。首先设计了带陷门的属性加密算法,由属性权威机构与数据属主协同完成用户私钥的生成与分发,有效降低了数据属主的密钥管理代价。然后,通过令牌树机制控制用户对属性陷门的获取,实现了高效的属性撤销。安全性分析表明,该方案能够避免社交网络服务提供商与系统内部非授权用户的合谋攻击,且不泄漏用户的任何属性信息。实验结果证实,该方案在计算代价、存储代价等方面比现有方案更有优越性。     

新型自适应安全的密钥策略ABE方案

基于3维对偶正交基的技术,提出了一种新的密钥策略的基于属性的加密方案。该方案在素数阶群上构造,支持单调访问结构,具有自适应安全性。方案利用双重系统加密的证明方法将方案的自适应安全性归约到判定线性假设。与同样是自适应安全的密钥策略ABE方案相比,提出的方案在同等安全性上具有更高的效率。     

抗密钥委托滥用的可追踪属性基加密方案

针对可追踪属性基加密方案利用追踪功能解决密钥委托滥用问题的不完备性,提出了一种抗密钥委托滥用的可追踪属性基加密方案。将秘密参数分享给用户私钥中关联属性的全部组件,使解密过程必须由全部组件共同参与完成,仅由用户私钥的一部分不能进行解密操作,从而实现真正的抗密钥委托滥用。利用一种短签名技术保护用户私钥中的追踪参数,防止追踪参数被伪造,从而获得对用户的追踪能力。同时支持抗密钥委托滥用和可追踪增强了所提方案的安全性。与相关方案的对比分析表明,所提方案在参数尺寸和计算代价上具有更好的性能优势。     

云环境下基于属性加密体制算法加速方案

云计算为租户提供存储、计算和网络服务,数据安全保护和租户间的数据共享与访问控制是其必不可少的能力。基于属性的加密体制是一种一对多的加密体制,可以根据用户属性实现细粒度访问控制,适用于云计算环境多租户数据共享。但现有的基于属性加密体制的算法效率较低,难以在实际环境中应用。分析了基于属性的加密体制的两种类型及其应用场景,提出一个基于属性加密体制算法的加速方案。通过实验表明,提出的方案可提高基于属性加密体制的密钥生成算法、加密算法和解密算法的效率。     

数据外包环境下一种支持撤销的属性基加密方案

In order to support fine-grained attribute revocation in data outsourcing systems,an attribute-based encryption scheme with efficient revocation in indirect revocation model was proposed.The model of ABE supporting attribute revocation was given,and a concrete scheme was constructed which proved its security under the standard model.Compared to the existing related schemes,the size of ciphertext and private/secret key is reduced,and the new scheme achieves fine-grained and immediate attribute revocation which is more suitable for the practical applications.     

Multi-authority attribute-based encryption with efficient revocation

Multi-authority attribute-based encryption was very suitable for data access control in a cloud storage environment.However,efficient user revocation in multi-authority attribute-based encryption remains a challenging problem that prevents it from practical applications.A multi-authority ciphertext-policy attribute-based encryption scheme with efficient revocation was proposed in prime order bilinear groups,and was further proved statically secure and revocable in the random oracle model.Extensive efficiency analysis results indicate that the proposed scheme significantly reduce the computation cost for the users.In addition,the proposed scheme supports large universe and any monotone access structures,which makes it more flexible for practical applications.     

云环境下关键词搜索加密算法研究

现有方案将关键词搜索加密和属性基加密相结合,解决了云环境下访问控制问题,但是未充分考虑信道安全以及关键词猜测攻击等安全问题。针对上述问题,提出了一种指派搜索服务器的关键词搜索属性加密方案,实现了关键词搜索访问权限控制,且检索不需要安全信道,可抵抗离线/在线关键词猜测攻击。实验结果表明,方案性能方面可取得较好结果,可应用于云环境。     

基于隐含格结构 ABE 算法的移动存储介质情境访问控制

摘 要：研究了如何增强可信终端对移动存储介质的访问控制能力,以有效避免通过移动存储介质的敏感信息泄露。首先在隐含密文策略的属性加密方法的基础上,提出了基于格结构的属性策略描述方法。将每个属性构成线性格或子集格,属性集构造成一个乘积格,并利用基于格的多级信息流控制模型制定访问策略。证明了新方法的正确性和安全性。新方法在保持已有隐藏访问策略属性加密算法优点的同时,还能有效简化访问策略的表达,更符合多级安全中敏感信息的共享,能够实现细粒度的访问控制。进一步地,通过将移动存储设备和用户的使用情境作为属性构建访问策略,实现了动态的、细粒度的情境访问控制。最终设计了对移动存储介质进行接入认证、情境访问控制的分层安全管理方案。分析了方案的安全性和灵活性,并通过比较实验说明了应用情境访问控制的方案仍具有较好的处理效率。该方案同样适用于泛在环境下敏感信息的安全管理。     

Privacy-preserving real-time road conditions monitoring scheme based on intelligent traffic

To alleviate the traffic pressure on roads,reduce the appearance of road congestion,and avoid the occurrence of traffic accidents,a privacy-preserving intelligent monitoring (PPIM) scheme based on intelligent traffic was proposed in combination with the safe and k-nearest neighbor (KNN) algorithm.To ensure the security of traffic data,the data content was randomly divided into independent parts via the secure multi-party computing strategy,and the data components were stored and encrypted separately by non-colluding multi-servers.To improve the accuracy of road condition monitoring,an improved KNN traffic monitoring algorithm was proposed.By virtue of the similarity calculation of data,the correlation value to measure the degree of traffic condition relationship between roads was obtained.And it was integrated with the KNN as the weight coefficient.To speed up the processing of dense data,a series of data security computing protocols were designed,and the data security processing was realized.In addition,real traffic data were used to verify the algorithm.The results show that the improved KNN algorithm is helpful to improve the accuracy of traffic monitoring.The analysis shows that the algorithm can not only guarantee the safety of data but improve the accuracy of traffic monitoring.     

Attribute-based encryption scheme supporting attribute revocation in cloud storage environment

Attribute-based encryption (ABE) scheme is widely used in the cloud storage due to its fine-grained access control.Each attribute in ABE may be shared by multiple users at the same time.Therefore,how to achieve attribute-level user revocation is currently facing an important challenge.Through research,it has been found that some attribute-level user revocation schemes currently can’t resist the collusion attack between the revoked user and the existing user.To solve this problem,an attribute-based encryption scheme that supported the immediate attribute revocation was proposed.The scheme could achieve attribute-level user revocation and could effectively resist collusion attacks between the revoked users and the existing users.At the same time,this scheme outsourced complex decryption calculations to cloud service providers with powerful computing ability,which reduced the computational burden of the data user.The scheme was proved secure based on computational Diffie-Hellman assumption in the standard model.Finally,the functionality and efficiency of the proposed scheme were analyzed and verified.The experimental results show that the proposed scheme can safely implement attribute-level user revocation and has the ability to quickly decrypt,which greatly improves the system efficiency.     

传感器网络加密方案的探讨

提出了一种传感器网络中的加密方案,该方案不需要基站的参与,认证密钥和加密密钥可由通信双方根据共享的会话密钥自主地计算,因而具有良好的可扩展性;方案在加密过程中使用了计数器和消息认证码,从而较好地满足了传感器网络的安全需求.     

基于区块链的公钥可搜索加密方案

针对公钥加密方案的陷门安全问题,引入随机数构造陷门与索引,用于抵御来自服务器内部的关键字猜测攻击,避免因服务器好奇行为带来的数据泄露。对第三方的可信问题进行研究,将区块链技术与可搜索加密方案相结合,使用智能合约作为可信第三方进行检索工作,既可以防止服务器内部的关键字猜测攻击,又可以保证检索结果的正确性,从而限制服务器在下发数据时的恶意行为。通过安全性分析,验证了所提方案满足IND-KGA安全性。经过与其他方案进行实验对比,证明了所提方案在时间开销上具有一定的优势。