云存储环境下支持策略变更的CP-ABE方案

CP-ABE Scheme with Supporting Policy Elastic Updating in Cloud Storage Environment

近年来,CP-ABE作为适用于云存储环境的访问控制机制,成为研究热点。由于现有的基于CP-ABE的访问控制方案在云存储环境下不支持系统属性灵活变更,利用云存储服务提供者的存储及计算资源优势,基于AB-ACER方案提出了支持系统属性灵活撤销及恢复的云存储访问控制方案。该方案通过引入虚拟属性来支持云存储环境下访问策略属性的撤销及恢复,且仅由存储服务提供者进行少量的重加密计算。安全及性能分析表明,该方案不仅支持数据属主访问策略的灵活变更,还保持了原有方案的安全性及细粒度访问控制,同时大大降低了数据属主的计算开销。

In recent years,CP-ABE has been researched extensively as an access control mechanism in cloud storage environment.Because existing access control schemes based on CP-ABE can not support the elastic update with the system properties in cloud storage environment,this paper used the cloud storage service provider＇s（CSP＇s）storage and computing resources advantages,and proposed a cloud storage access control scheme which supports the system attributes revocation or recovery based on the attribute-based access control with efficient revocation（AB-ACER）scheme.The scheme introduces virtual attributes for the access control tree,and when system attributes have been revoked or recovered,CSP only provides small re-encryption computation.Security analysis and performance analysis show that the proposed scheme not only supports a changeable access control policy for data owner（DO）,but also ensures the confidentiality of data and the fine-grained access control,and reduces a large number of encryption calculation works for DO.