云存储环境下移动终端信息隐匿方法研究

为了提高云存储环境下移动终端信息存储的安全性,需要进行信息隐匿算法设计,提出一种基于双曲椭圆线性编码加密的云存储环境下移动终端信息隐匿方法。构建移动终端信息编码数字密钥,采用双线性映射方法进行云存储环境下移动终端信息隐匿编码的统计量设计,采用比特序列分块匹配方法构建移动终端信息加密协议,结合混沌编码方案进行信息隐写过程中的块内频数检测设计,采用双曲椭圆线性编码加密方法提高云存储环境下移动终端信息隐匿的深度,根据随机性检测结果实现云存储环境下移动终端信息连续码元隐匿设计。仿真结果表明,采用该方法进行云存储环境下移动终端信息隐匿的加密性能较好,抗攻击能力较强,提高了数据存储的安全性。     

云存储完整性验证密码学技术研究进展

云存储完整性验证技术允许用户将数据存储至云端服务器,并为用户提供可验证的完整性保证。典型的云存储完整性验证方案由两个阶段组成：一是数据处理阶段,用户使用私钥处理数据、生成可验证的元数据存储于云服务器,而本地只需保存与数据相关的一些参数,如密钥和数据标签等;二是数据完整性验证阶段,验证者通过和云服务器交互执行一个挑战/证明协议,能够以极高的概率判断出云端数据当前的完整性。到目前为止,已经涌现了大量的相关密码学方案。本文对可证明安全的可公开验证的云存储完整性验证关键密码学技术研究进展进行简要回顾,主要涵盖代理数据外包技术、代理完整性验证技术、基于身份的数据外包技术以及几种计算和通信效率优化技术等。     

基于MapReduce的云存储数据审计方法研究

云存储是一种新兴的网络存储技术,它是云计算提供的一个重要服务。云存储因其快速、廉价和方便而广受云用户喜爱。然而,它也给云用户的外包数据带来了许多安全问题。其中一个重要问题就是如何确保半可信云服务器上数据的完整性。因此,云用户和云服务器亟需一个稳定、安全、可信的数据审计方法。随着大数据时代的到来,传统数据审计方案批量处理云环境下海量数据的效率不高;并且,随着移动客户端的流行,传统数据审计方案带给用户的在线负担太过繁重。因此,提出一种基于MapReduce编程框架的云数据审计方案,使用代理签名技术将用户对数据签名计算代理出去,并且并行化处理数据签名和批量审计过程。实验结果表明,所提方法明显提高了批量审计的效率,增强了云存储服务的可用性,并且减轻了用户的在线负担。     

基于TrustZone的可信移动终端云服务安全接入方案

可信云架构为云计算用户提供了安全可信的云服务执行环境,保护了用户私有数据的计算与存储安全. 然而在移动云计算高速发展的今天, 仍然没有移动终端接入可信云服务的安全解决方案. 针对上述问题, 提出了一种可信移动终端云服务安全接入方案, 方案充分考虑了移动云计算应用背景, 利用ARM TrustZone硬件隔离技术构建可信移动终端, 保护云服务客户端及安全敏感操作在移动终端的安全执行, 结合物理不可克隆函数技术, 给出了移动终端密钥与敏感数据管理机制. 在此基础之上, 借鉴可信计算技术思想, 设计了云服务安全接入协议, 协议兼容可信云架构, 提供云服务端与移动客户端间的端到端认证. 分析了方案具备的6种安全属性, 给出了基于方案的移动云存储应用实例, 实现了方案的原型系统. 实验结果表明, 可信移动终端TCB较小, 方案具有良好的可扩展性和安全可控性, 整体运行效率较高.     

隐私保护的高效可验证数据流协议

可验证数据流(verifiable data streaming, VDS)协议使得资源有限、计算能力不足的用户将爆炸式增长的数据外包到不完全可信的云服务器上,任意用户可以检索特定位置的数据并公开验证结果的正确性,不仅可以防止云端服务器篡改数据内容和对应位置,还允许数据拥有者有效更新已经外包的数据.然而,已有的可验证数据流协议没有考虑外包数据的隐私性,且用户添加新数据的复杂度与已存储数据的规模成对数关系,难以满足一些应用场景中对低延时和隐私保护的需求.本文构造了一个基于对称加密体制的新型变色龙认证树,对数据流先加密再存储,以此来保证数据的隐私性;依据通用的构造范式提出了新的支持隐私保护的高效可验证数据流协议,使得添加数据的计算开销达到了常量级,与已外包存储数据的规模无关.安全性和性能分析表明,所提出可验证数据流协议在标准模型下满足相应的安全性定义,且在隐私保护和计算开销方面具有优势.     

可验证的安全矩阵行列式计算云外包协议

云计算外包越来越流行的同时也带来了新的安全问题和挑战：输入/输出数据的隐私性和结果的可验证性。本文围绕云计算环境下的安全矩阵行列式计算外包展开研究,构建一个适用于大矩阵行列式计算的可验证的安全云外包协议,在客户端将原始矩阵盲化加密后传送到云服务器端执行计算,云服务器将计算结果和验证值返回给客户端进行解密和验证。理论分析表明,在恶意云的安全模型下协议满足正确性、输入/输出私密性、高效性和结果可验证性。     

云存储系统中数据完整性验证协议

在云存储网络环境中,数据的安全性和完整性是用户最关心的问题之一。综合考虑云存储网络环境中的安全需求,设计了云存储数据完整性验证(CS-DIV)协议。客户端把数据文件和校验标签上传到云存储服务器后随机抽查,服务器返回验证证据并由客户端判断文件的完整性。协议可以有效地验证云存储数据的完整性,并抵抗恶意服务器欺骗和恶意客户端攻击,从而提高整个云存储系统的可靠性和稳定性。仿真实验数据表明,所提协议以较低的存储、通信及时间开销实现了数据的完整性保护。     

有限空间下的自治移动云存储协议

自治移动云可以为本地区域内的移动用户提供临时的存储服务。在节点空间有限的情况下,保持数据的持久性是自治移动云存储服务的一个主要挑战。提出了一种有限空间下的自治移动云存储协议,称为SLAMS(space limited storage protocol for autonomous mobile cloud),其基本思想是通过移动节点之间周期性的信息交互,维护每个数据块在网络中的K个副本,将数据块副本按需存储在空闲空间较大的节点中。给出了SLAMS协议中的副本维护机制、数据结构和算法、SLAMS协议的详细设计。仿真实验结果表明,相对于现有的自治移动云存储协议Phoenix,SLAMS协议在节点空间有限的情况下,具有较低的数据丢失率,最大可降低50%左右;具有较短的收敛时间,最高可降低95%;具有较少的数据块存储开销,最高可降低约90%;而且SLAMS协议中数据块维持K个副本的概率明显提高,最大可提高40%左右。     

安全可验证的行列式云外包计算及其电子交易方案

针对现有的云外包计算协议中服务端可能存在的用户信息被泄露、篡改等问题,提出了一个云环境下的安全、高效、可验证的矩阵行列式外包计算协议。首先,基于矩阵模糊技术构造云外包计算协议,它能够在不需要任何困难性假设的前提下保证用户信息的安全性;其次,通过构造一类特殊的变换矩阵对明文矩阵进行处理,使用户在收到返还结果后,能有效验证所反馈的计算结果是否被篡改,性能分析表明,此协议可以有效提高云外包计算的效率;最后,给出一个行列式外包计算的电子交易框架,能够有效应用于电子商务等领域。     

移动网络中心云计算存储数据访问安全自动监测系统设计

为了提高移动网络中心云计算存储数据访问和安全监测能力,提出一种基于深度学习和交叉编译控制的移动网络中心云计算存储数据访问安全自动监测系统设计方法。采用混合属性数据模糊加权聚类方法进行移动网络中心云计算存储数据的优化访问控制模型设计,根据云计算存储数据之间的属性相似度进行离散化数值属性分解,提取移动网络中心云计算存储数据的混合属性特征量,根据最小化云存储数据访问成本为代价进行移动网络中心云计算存储数据访问的安全监测。结合深度学习方法进行数据访问的自适应控制,在交叉编译环境下实现云计算存储数据访问安全自动监测系统开发设计。测试结果表明,采用该方法进行移动网络中心云计算存储数据访问的安全性较好,自动化控制能力较强。     

A Cloud-Manager-Based Re-Encryption Scheme for Mobile Users in Cloud Environment: a Hybrid Approach

Cloud computing is an emerging computing paradigm that offers on-demand, flexible, and elastic computational and storage services for the end-users. The small and medium-sized business organization having limited budget can enjoy the scalable services of the cloud. However, the migration of the organizational data on the cloud raises security and privacy issues. To keep the data confidential, the data should be encrypted using such cryptography method that provides fine-grained and efficient access for uploaded data without affecting the scalability of the system. In mobile cloud computing environment, the selected scheme should be computationally secure and must have capability for offloading computational intensive security operations on the cloud in a trusted mode due to the resource constraint mobile devices. The existing manager-based re-encryption and cloud-based re-encryption schemes are computationally secured and capable to offload the computationally intensive data access operations on the trusted entity/cloud. Despite the offloading of the data access operations in manager-based re-encryption and cloud-based re-encryption schemes, the mobile user still performs computationally intensive paring-based encryption and decryption operations using limited capabilities of mobile device. In this paper, we proposed Cloud-Manager-based Re-encryption Scheme (CMReS) that combines the characteristics of manager-based re-encryption and cloud-based re-encryption for providing the better security services with minimum processing burden on the mobile device. The experimental results indicate that the proposed cloud-manager-based re-encryption scheme shows significant improvement in turnaround time, energy consumption, and resources utilization on the mobile device as compared to existing re-encryption schemes.     

BSS: block-based sharing scheme for secure data storage services in mobile cloud environment

For the last few years, academia and research organizations are continuously investigating and resolving the security and privacy issues of mobile cloud computing environment. The additional consideration in designing security services for mobile cloud computing environment should be the resource-constrained mobile devices. The execution of computationally intensive security services on mobile device consumes battery’s charging quickly. In this regard, the study presents a novel energy-efficient block-based sharing scheme that provides confidentiality and integrity services for mobile users in the cloud environment. The block-based sharing scheme is compared with the existing schemes on the basis of energy consumption, CPU utilization, memory utilization, encryption time, decryption time, and turnaround time. The experimental results show that the block-based sharing scheme consumes less energy, reduces the resources utilization, improves response time, and provides better security services to the mobile users in the presence of fully untrusted cloud server(s) as compared to the existing security schemes.     

Incremental proxy re-encryption scheme for mobile cloud computing environment

Due to the limited computational capability of mobile devices, the research organization and academia are working on computationally secure schemes that have capability for offloading the computational intensive data access operations on the cloud/trusted entity for execution. Most of the existing security schemes, such as proxy re-encryption, manager-based re-encryption, and cloud-based re-encryption, are based on El-Gamal cryptosystem for offloading the computational intensive data access operation on the cloud/trusted entity. However, the resource hungry pairing-based cryptographic operations, such as encryption and decryption, are executed using the limited computational power of mobile device. Similarly, if the data owner wants to modify the encrypted file uploaded on the cloud storage, after modification the data owner must encrypt and upload the entire file on the cloud storage without considering the altered portion(s) of the file. In this paper, we have proposed an incremental version of proxy re-encryption scheme for improving the file modification operation and compared with the original version of the proxy re-encryption scheme on the basis of turnaround time, energy consumption, CPU utilization, and memory consumption while executing the security operations on mobile device. The incremental version of proxy re-encryption scheme shows significant improvement in results while performing file modification operations using limited processing capability of mobile devices.     

A machine learning based intrusion detection scheme for data fusion in mobile clouds involving heterogeneous client networks

The combination of traditional cloud computing and mobile computing leads to the novel paradigm of mobile cloud computing. Due to the mobility of network nodes in mobile cloud computing, security has been a challenging problem of paramount importance. When a mobile cloud involves heterogeneous client networks, such as Wireless Sensor Networks and Vehicular Networks, the security problem becomes more challenging because the client networks often have different security requirements in terms of computational complexity, power consumption, and security levels. To securely collect and fuse the data from heterogeneous client networks in complex systems of this kind, novel security schemes need to be devised. Intrusion detection is one of the key security functions in mobile clouds involving heterogeneous client networks. A variety of different rule-based intrusion detection methods could be employed in this type of systems. However, the existing intrusion detection schemes lead to high computation complexity or require frequent rule updates, which seriously harms their effectiveness. In this paper, we propose a machine learning based intrusion detection scheme for mobile clouds involving heterogeneous client networks. The proposed scheme does not require rule updates and its complexity can be customized to suit the requirements of the client networks. Technically, the proposed scheme includes two steps: multi-layer traffic screening and decision-based Virtual Machine (VM) selection. Our experimental results indicate that the proposed scheme is highly effective in terms of intrusion detection.     

Provably secure authenticated key agreement scheme for distributed mobile cloud computing services

With the rapid development of mobile cloud computing, the security becomes a crucial part of communication systems in a distributed mobile cloud computing environment. Recently, in 2015, Tsai and Lo proposed a privacy-aware authentication scheme for distributed mobile cloud computing services. In this paper, we first analyze the Tsai–Lo’s scheme and show that their scheme is vulnerable to server impersonation attack, and thus, their scheme fails to achieve the secure mutual authentication. In addition, we also show that Tsai–Lo’s scheme does not provide the session-key security (SK-security) and strong user credentials’ privacy when ephemeral secret is unexpectedly revealed to the adversary. In order to withstand these security pitfalls found in Tsai–Lo’s scheme, we propose a provably secure authentication scheme for distributed mobile cloud computing services. Through the rigorous security analysis, we show that our scheme achieves SK-security and strong credentials’ privacy and prevents all well-known attacks including the impersonation attack and ephemeral secrets leakage attack. Furthermore, we simulate our scheme for the formal security analysis using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool, and show that our scheme is secure against passive and active attacks including the replay and man-in-the-middle attacks. More security functionalities along with reduced computational costs for the mobile users make our scheme more appropriate for the practical applications as compared to Tsai–Lo’s scheme and other related schemes. Finally, to demonstrate the practicality of the scheme, we evaluate the proposed scheme using the broadly-accepted NS-2 network simulator.     

MASHED: Security and privacy-aware mutual authentication scheme for heterogeneous and distributed mobile cloud computing services

ABSTRACT

Rapid development in mobile devices and cloud computing technologies has increased the number of mobile services from different vendors on the cloud platform. However, users of these services are facing different security and access control challenges due to the nonexistence of security solutions capable of providing secure access to these services, which are from different vendors, using a single key. An effective security solution for heterogeneous Mobile Cloud Computing (MCC) services should be able to guarantee confidentiality and integrity through single key-based authentication scheme. Meanwhile, a few of the existing authentication schemes for MCC services require different keys to access different services from different vendors on a cloud platform, thus increases complexity and overhead incurred through generation and storage of different keys for different services.

In this paper, an efficient mutual authentication scheme for accessing heterogeneous MCC services is proposed. The proposed scheme combines the user’s voice signature with cryptography operations to evolve efficient mutual authentication scheme devoid of key escrow problem and allows authorized users to use single key to access the heterogeneous MCC services at a reduced cost.     

Proofs of retrievability with tag outsourcing based on Goppa codes

In cloud storage, because the data owner loses the physical control of the data, the data may be tampered with or deleted. Although, it has been proposed to adopt provable data possession (PDP) or proofs of retrievability (POR) mechanism to ensure the integrity of cloud storage data. However, at present, most PDP/POR schemes are based on traditional cryptographic mechanisms and cannot resist quantum computer attacks. For this reason, the first POR scheme based on coding mechanism (BC-POR) is proposed in this paper. The scheme is constructed based on the difficulty assumptions of 2-regular word syndrome decoding (2-RWSD) problem and Goppa code distinguishing problem. Moreover, considering the low computing power of lightweight users, this paper adopts an audit scheme that supports the outsourcing of data tag calculation on the client side, that is, the calculation of data tag generation is outsourced to a third-party institution for execution. First of all, this scheme can prevent third-party institution from obtaining the real content of the data in the process of calculation tags and realize the privacy protection of user data. Secondly, the scheme uses a FSB hash function to generate a decodable syndrome, and this algorithm does not require iterative operations during the tagging process, thereby reducing the computational overhead of the tag. Finally, the provable security method is used to prove the security of the proposed scheme, and the performance of the proposed audit scheme is evaluated to prove the effectiveness of the scheme.     

云存储中支持数据去重的群组数据持有性证明

数据持有性证明(Provable Data Possession,简称PDP)和数据可恢复性证明 (Proofs of Retrievability,简称POR)是客户端用来验证存储在云端服务器上的数据完整性的主要技术.近几年它在学术界和工业界的应用广泛,很多PDP和POR方案相继出现,但是由于不同群组的特殊性和独特要求,使得群组PDP/POR方案多样化,并且群组应用中的许多重要功能(例如数据去重)没有被实现,如何构造高效及满足群组特定功能和安全需求的PDP/POR方案已经引起了人们的广泛关注.本文给出了一个支持数据去重的群组PDP方案(GPDP),基于矩阵计算和伪随机函数,GPDP可以在支持数据去重的基础上,高效的完成数据持有性证明,并且可以在群组中抵抗恶意方选择成员攻击.在标准模型下证明了GPDP的安全性,并且在百度云平台上实现了GPDP的原型系统.为了评估方案的性能,我们使用了10GB的数据量进行实验和分析,结果表明GPDP方案在达到群组中数据去重的目标基础上,可以高效地保证抵抗选择攻击和数据持有性,即预处理效率高于私有验证方案,而验证效率高于公开验证方案(与私有验证效率几乎相同).另外,与其他群组PDP/POR方案相比,GPDP方案将额外存储代价和通信代价都降到了最低.     

移动医疗系统中的可撤销无证书代理重签名方案

代理重签名在保证委托双方私钥安全的前提下, 通过半可信代理实现了双方签名的转换, 在本文方案中, 通过代理重签名实现了在通信过程中终端用户对于身份的隐私要求。移动医疗服务系统因为其有限的计算和存储能力, 需要借助云服务器来对医疗数据进行计算和存储。然而, 在将医疗数据外包给云服务器后, 数据便脱离了用户的控制, 这给用户隐私带来了极大地安全隐患。现有的无证书代理重签名方案大多都不具有撤销功能, 存在着密钥泄露等安全性问题。为了解决这一问题, 本文提出了一种可撤销的无证书代理重签名方案, 在不相互信任的移动医疗服务系统中, 实现了医疗数据传输过程以及云存储过程中的用户匿名性, 同时, 本文方案具有单向性和非交互性, 更适合在大规模的移动医疗系统中使用。此外, 当用户私钥泄露时, 本文利用 KUNode 算法实现了对用户的高效撤销, 并利用移动边缘计算技术将更新密钥和撤销列表的管理外包给移动边缘计算设备,降低了第三方的计算成本, 使其具有较低的延迟。最后, 在随机谕言机模型下证明了所构造的方案在自适应选择消息攻击下的不可伪造性, 并利用 JPBC 库与其他方案进行计算与通信开销的对比。其结果表明, 本方案在具备更优越的功能的同时, 具有较小的计算成本、通信成本和撤销成本。