The dissociation between data management and data ownership makes it difficult to protect data security and privacy in cloud storage systems.Traditional encryption technologies are not suitable for data protection in ...The dissociation between data management and data ownership makes it difficult to protect data security and privacy in cloud storage systems.Traditional encryption technologies are not suitable for data protection in cloud storage systems.A novel multi-authority proxy re-encryption mechanism based on ciphertext-policy attribute-based encryption（MPRE-CPABE） is proposed for cloud storage systems.MPRE-CPABE requires data owner to split each file into two blocks,one big block and one small block.The small block is used to encrypt the big one as the private key,and then the encrypted big block will be uploaded to the cloud storage system.Even if the uploaded big block of file is stolen,illegal users cannot get the complete information of the file easily.Ciphertext-policy attribute-based encryption（CPABE）is always criticized for its heavy overload and insecure issues when distributing keys or revoking user＇s access right.MPRE-CPABE applies CPABE to the multi-authority cloud storage system,and solves the above issues.The weighted access structure（WAS） is proposed to support a variety of fine-grained threshold access control policy in multi-authority environments,and reduce the computational cost of key distribution.Meanwhile,MPRE-CPABE uses proxy re-encryption to reduce the computational cost of access revocation.Experiments are implemented on platforms of Ubuntu and CloudSim.Experimental results show that MPRE-CPABE can greatly reduce the computational cost of the generation of key components and the revocation of user＇s access right.MPRE-CPABE is also proved secure under the security model of decisional bilinear Diffie-Hellman（DBDH）.展开更多
格上属性基加密具有抗量子攻击的特性,并且将访问控制策略嵌入密文或者密钥,可实现属性的细粒度访问控制。但是由于属性基加密固有的弱点,相同属性的用户可能会泄露密钥。为避免密钥泄露,属性基加密方案需实现追踪并撤销特定用户解密权...格上属性基加密具有抗量子攻击的特性,并且将访问控制策略嵌入密文或者密钥,可实现属性的细粒度访问控制。但是由于属性基加密固有的弱点,相同属性的用户可能会泄露密钥。为避免密钥泄露,属性基加密方案需实现追踪并撤销特定用户解密权限的功能。然而,非法用户仍可能通过收集大量密文数据,试图恢复过去会话的密钥。为有效抵御这种攻击,方案必须实现前向安全。针对当前格密码领域的需求与挑战,提出基于判定性误差学习问题(Decisional Learning with Error,DLWE)可证明安全的格上具有多功能的属性基加密(Multi-functional Attribute based Encryption from Lattices)方案。使用完全二叉树追踪解密密钥中与用户相关的身份矩阵(即完全二叉树叶子节点的值),以便追踪恶意用户;引入用户撤销机制,允许属性权威在不重新为用户生成密钥的情况下,及时且有效地撤销用户的权限;采用标签穿刺的方法,确保即使当前密钥泄漏,过去密文仍然保持安全,实现前向安全。此外,由于格上采样算法的不确定性,目前格上的属性基加密实验难以实现,因此通过理论分析验证所提方案的安全性和正确性。该方案不仅优化了空间存储效率,还弥补了格密码中属性基加密方案功能单一导致的不足。展开更多
属性撤销是基于属性的加密(attribute based encryption,简称ABE)在实际应用中所必须解决的问题.在直接撤销模式下,已有的支持属性撤销的ABE方案只能以撤销用户身份的方式对用户所拥有的全部属性进行撤销,而无法做到针对属性的细粒度撤...属性撤销是基于属性的加密(attribute based encryption,简称ABE)在实际应用中所必须解决的问题.在直接撤销模式下,已有的支持属性撤销的ABE方案只能以撤销用户身份的方式对用户所拥有的全部属性进行撤销,而无法做到针对属性的细粒度撤销.提出了直接模式下支持完全细粒度属性撤销的CP-ABE(cipher policy ABE)模型,在合数阶双线性群上,基于双系统加密的思想构造了具体的方案,并在标准模型下给出了严格的安全性证明.该方案能够对用户所拥有的任意数量的属性进行撤销,解决了已有方案中属性撤销粒度过粗的问题.展开更多
基金supported by the National Natural Science Foundation of China(6120200461472192)+1 种基金the Special Fund for Fast Sharing of Science Paper in Net Era by CSTD(2013116)the Natural Science Fund of Higher Education of Jiangsu Province(14KJB520014)
文摘The dissociation between data management and data ownership makes it difficult to protect data security and privacy in cloud storage systems.Traditional encryption technologies are not suitable for data protection in cloud storage systems.A novel multi-authority proxy re-encryption mechanism based on ciphertext-policy attribute-based encryption（MPRE-CPABE） is proposed for cloud storage systems.MPRE-CPABE requires data owner to split each file into two blocks,one big block and one small block.The small block is used to encrypt the big one as the private key,and then the encrypted big block will be uploaded to the cloud storage system.Even if the uploaded big block of file is stolen,illegal users cannot get the complete information of the file easily.Ciphertext-policy attribute-based encryption（CPABE）is always criticized for its heavy overload and insecure issues when distributing keys or revoking user＇s access right.MPRE-CPABE applies CPABE to the multi-authority cloud storage system,and solves the above issues.The weighted access structure（WAS） is proposed to support a variety of fine-grained threshold access control policy in multi-authority environments,and reduce the computational cost of key distribution.Meanwhile,MPRE-CPABE uses proxy re-encryption to reduce the computational cost of access revocation.Experiments are implemented on platforms of Ubuntu and CloudSim.Experimental results show that MPRE-CPABE can greatly reduce the computational cost of the generation of key components and the revocation of user＇s access right.MPRE-CPABE is also proved secure under the security model of decisional bilinear Diffie-Hellman（DBDH）.
文摘格上属性基加密具有抗量子攻击的特性,并且将访问控制策略嵌入密文或者密钥,可实现属性的细粒度访问控制。但是由于属性基加密固有的弱点,相同属性的用户可能会泄露密钥。为避免密钥泄露,属性基加密方案需实现追踪并撤销特定用户解密权限的功能。然而,非法用户仍可能通过收集大量密文数据,试图恢复过去会话的密钥。为有效抵御这种攻击,方案必须实现前向安全。针对当前格密码领域的需求与挑战,提出基于判定性误差学习问题(Decisional Learning with Error,DLWE)可证明安全的格上具有多功能的属性基加密(Multi-functional Attribute based Encryption from Lattices)方案。使用完全二叉树追踪解密密钥中与用户相关的身份矩阵(即完全二叉树叶子节点的值),以便追踪恶意用户;引入用户撤销机制,允许属性权威在不重新为用户生成密钥的情况下,及时且有效地撤销用户的权限;采用标签穿刺的方法,确保即使当前密钥泄漏,过去密文仍然保持安全,实现前向安全。此外,由于格上采样算法的不确定性,目前格上的属性基加密实验难以实现,因此通过理论分析验证所提方案的安全性和正确性。该方案不仅优化了空间存储效率,还弥补了格密码中属性基加密方案功能单一导致的不足。
文摘属性撤销是基于属性的加密(attribute based encryption,简称ABE)在实际应用中所必须解决的问题.在直接撤销模式下,已有的支持属性撤销的ABE方案只能以撤销用户身份的方式对用户所拥有的全部属性进行撤销,而无法做到针对属性的细粒度撤销.提出了直接模式下支持完全细粒度属性撤销的CP-ABE(cipher policy ABE)模型,在合数阶双线性群上,基于双系统加密的思想构造了具体的方案,并在标准模型下给出了严格的安全性证明.该方案能够对用户所拥有的任意数量的属性进行撤销,解决了已有方案中属性撤销粒度过粗的问题.
