一种支持撤销的双策略属性基加密方案

Dual Policy Based Encryption Scheme Supporting Attribute Revocation

针对于目前云数据访问控制研究中存在单一策略属性基加密的应用局限性和属性撤销不够灵活等问题,本文提出了一种支持撤销的双策略属性基加密方案.首先对属性撤销中的密文策略和密钥策略的综合应用进行定义并给出安全模型;其次构建逻辑二叉树,利用哈希函数不可逆的性质,从每个用户对应的叶子节点开始自下往上地进行哈希运算得到父节点直到根节点,使其计算方向单一.利用每个属性对应的最大覆盖子树的根节点所生成的组密钥对密文和私钥进行更新,从而能够保证组密钥能够被合法用户获得;最后通过安全性分析和复杂性对比表明,该方案满足选择明文攻击安全且在计算复杂度方面是最优的.

This paper proposes a dual policy-attribute base encryption scheme supporting revocation according to the problems in the current research on cloud data access control i. e. the application limitation and attribute revocation inflexibility of the single policy -at- tribute base encryption. First of all ,it defines and the integrated application of ciphertext policy and key policy in the attribute revoca- tion and provides the security model; secondly, it structures the logical binary tree and makes use of the irreversibility of hash function to carry out the hash operation bottom up from the leaf node corresponded to each user to obtain the father node till the root node, so as to simplify the computing direction. The ciphertext and private key are updated with the help of the group key generated by the root node of the maximum covering sub-tree corresponded to each attribute, so as to make sure the group key can be obtained by the legal user;fmaily, according to the security analysis and complexity comparison, this scheme could not only satisfy the plaintext attack secur- ity but also remain the optimum in the computing complexity.