Efficient Multi-Authority Attribute-Based Searchable Encryption Scheme with Blockchain Assistance for Cloud-Edge Coordination

Cloud storage and edge computing are utilized to address the storage and computational challenges arising from the exponential data growth in IoT.However,data privacy is potentially risky when data is outsourced to cloud servers or edge services.While data encryption ensures data confidentiality,it can impede data sharing and retrieval.Attribute-based searchable encryption(ABSE)is proposed as an effective technique for enhancing data security and privacy.Nevertheless,ABSE has its limitations,such as single attribute authorization failure,privacy leakage during the search process,and high decryption overhead.This paper presents a novel approach called the blockchain-assisted efficientmulti-authority attribute-based searchable encryption scheme(BEM-ABSE)for cloudedge collaboration scenarios to address these issues.BEM-ABSE leverages a consortium blockchain to replace the central authentication center for global public parameter management.It incorporates smart contracts to facilitate reliable and fair ciphertext keyword search and decryption result verification.To minimize the computing burden on resource-constrained devices,BEM-ABSE adopts an online/offline hybrid mechanism during the encryption process and a verifiable edge-assisted decryption mechanism.This ensures both low computation cost and reliable ciphertext.Security analysis conducted under the random oracle model demonstrates that BEM-ABSE is resistant to indistinguishable chosen keyword attacks(IND-CKA)and indistinguishable chosen plaintext attacks(INDCPA).Theoretical analysis and simulation results confirm that BEM-ABSE significantly improves computational efficiency compared to existing solutions.

NC-MACPABE: Non-centered multi-authority proxy re-encryption based on CP-ABE for cloud storage systems

The cloud storage service cannot be completely trusted because of the separation of data management and ownership, leading to the difficulty of data privacy protection. In order to protect the privacy of data on untrusted servers of cloud storage, a novel multi-authority access control scheme without a trustworthy central authority has been proposed based on CP-ABE for cloud storage systems, called non-centered multi-authority proxy re-encryption based on the cipher-text policy attribute-based encryption(NC-MACPABE). NC-MACPABE optimizes the weighted access structure(WAS) allowing different levels of operation on the same file in cloud storage system. The concept of identity dyeing is introduced to improve the users' information privacy further. The re-encryption algorithm is improved in the scheme so that the data owner can revoke user's access right in a more flexible way. The scheme is proved to be secure. And the experimental results also show that removing the central authority can resolve the existing performance bottleneck in the multi-authority architecture with a central authority, which significantly improves user experience when a large number of users apply for accesses to the cloud storage system at the same time.

Attribute-Based Access Control for Multi-Authority Systems with Constant Size Ciphertext in Cloud Computing

In most existing CP-ABE schemes, there is only one authority in the system and all the public keys and private keys are issued by this authority, which incurs ciphertext size and computation costs in the encryption and decryption operations that depend at least linearly on the number of attributes involved in the access policy. We propose an efficient multi-authority CP-ABE scheme in which the authorities need not interact to generate public information during the system initialization phase. Our scheme has constant ciphertext length and a constant number of pairing computations. Our scheme can be proven CPA-secure in random oracle model under the decision q-BDHE assumption. When user's attributes revocation occurs, the scheme transfers most re-encryption work to the cloud service provider, reducing the data owner's computational cost on the premise of security. Finally the analysis and simulation result show that the schemes proposed in this thesis ensure the privacy and secure access of sensitive data stored in the cloud server, and be able to cope with the dynamic changes of users' access privileges in large-scale systems. Besides, the multi-authority ABE eliminates the key escrow problem, achieves the length of ciphertext optimization and enhances the effi ciency of the encryption and decryption operations.

Research on Multi-Authority CP-ABE Access Control Model in Multicloud

In order to solve the problems of data sharing security and policy conflict in multicloud storage systems(MCSS), this work designs an attribute mapping mechanism that extends ciphertext policy attribute-based encryption(CP-ABE), and proposes a multi-authority CP-ABE access control model that satisfies the need for multicloud storage access control. The mapping mechanism mainly involves the tree structure of CP-ABE and provides support for the types of attribute values. The framework and workflow of the model are described in detail. The effectiveness of the model is verified by building a simple prototype system, and the performance of the prototype system is analyzed. The results suggest that the proposed model is of theoretical and practical significance for access control research in MCSS. The CP-ABE has better performance in terms of computation time overhead than other models.

Multi-authority proxy re-encryption based on CPABE for cloud storage systems

The dissociation between data management and data ownership makes it difficult to protect data security and privacy in cloud storage systems.Traditional encryption technologies are not suitable for data protection in cloud storage systems.A novel multi-authority proxy re-encryption mechanism based on ciphertext-policy attribute-based encryption（MPRE-CPABE） is proposed for cloud storage systems.MPRE-CPABE requires data owner to split each file into two blocks,one big block and one small block.The small block is used to encrypt the big one as the private key,and then the encrypted big block will be uploaded to the cloud storage system.Even if the uploaded big block of file is stolen,illegal users cannot get the complete information of the file easily.Ciphertext-policy attribute-based encryption（CPABE）is always criticized for its heavy overload and insecure issues when distributing keys or revoking user＇s access right.MPRE-CPABE applies CPABE to the multi-authority cloud storage system,and solves the above issues.The weighted access structure（WAS） is proposed to support a variety of fine-grained threshold access control policy in multi-authority environments,and reduce the computational cost of key distribution.Meanwhile,MPRE-CPABE uses proxy re-encryption to reduce the computational cost of access revocation.Experiments are implemented on platforms of Ubuntu and CloudSim.Experimental results show that MPRE-CPABE can greatly reduce the computational cost of the generation of key components and the revocation of user＇s access right.MPRE-CPABE is also proved secure under the security model of decisional bilinear Diffie-Hellman（DBDH）.

基于区块链的轻量级物联网医疗数据访问控制方案

基于物联网的智慧医疗系统,给患者和医务工作者带来极大的便利,但是物联网医疗设备产生的海量医疗数据包含着患者的个人隐私,一旦泄露会造成重大损失,以往的访问控制方案存在不灵活,中心化,加密效率较低等问题。针对这些问题,提出了一种基于区块链的轻量级物联网医疗数据访问控制方案。提出了一种改进的多中心属性基加密(multi-authority attribute-based encryption, MA-ABE)方案为患者提供细粒度的安全数据共享,并且利用IPFS技术存储患者数据。结合雾计算技术,利用雾节点承担属性基加解密过程中大部分的计算开销,减轻了物联网设备负担。进行安全性分析和仿真实验,结果表明,提出的方案在保证安全的情况下为物联网医疗数据提供了高效并且轻量级的访问控制。

毒蛇咬伤后相关并发症的研究进展

毒蛇咬伤是一种常见的临床急症,具有发病急、病情变化迅速、致残率及死亡率高等特点。蛇毒中毒除出现常见的全身性和局部组织损伤外,还会引起显著的毒蛇咬伤并发症,包括即时性和延迟性。这些并发症也是导致毒蛇咬伤致残甚至死亡的主要原因,严重影响患者的远期预后及生活质量。该文综合新近的研究成果,重点从血液系统、神经系统、运动系统、内分泌系统、生殖系统及其他方面对毒蛇咬伤并发症的症状、诊断及治疗进行综述,以期在临床上为毒蛇咬伤有效、精准治疗提供参考。

密文长度固定的策略部分隐藏多授权机构CP-ABE方案

针对现有访问策略隐藏的密文策略属性加密(CP-ABE)方案存在的安全性低、资源开销大的问题,提出了一种密文长度固定的策略部分隐藏多授权机构CP-ABE方案。首先,通过隐藏访问策略中的属性值,降低隐私数据泄露的风险;其次,通过固定密文长度和使用外包解密技术,减少用户的资源开销;最后,采用多授权机构管理机制,避免部署单一授权机构易产生的密钥托管问题。通过安全分析证明了方案在标准模型中满足选择明文攻击下的密文不可区分性,以及方案隐藏的访问策略和产生的外包密钥能够抵抗属性值猜测攻击。通过与已有方案的性能对比,证明了所提方案的总体资源开销更小。

基于区块链的多授权密文策略属性基等值测试加密方案

针对云环境下密文策略属性基加密方案中存在的密文检索分类困难与依赖可信第三方等问题,本文提出了一种基于区块链的多授权密文策略属性基等值测试加密方案.利用基于属性的等值测试技术,实现了支持属性级灵活授权的云端数据检索和分类机制,降低了数据用户对重复数据解密的计算开销.结合多授权属性基加密机制和区块链技术,实现了去中心化用户密钥生成.采用多属性授权机构联合分发密钥,有效抵抗用户和属性授权机构的合谋攻击.引入区块链和智能合约技术,消除了现有密文策略属性基密文等值测试方案中等值测试、数据存储与外包解密操作对可信云服务器的依赖.利用外包服务器执行部分解密计算,降低了用户本地的计算开销.将原始数据哈希和验证参数上传至区块链,保障外包服务器解密结果正确性和云端数据完整性.在随机预言模型下,基于判定性qparallel Bilinear Diffie-Hellman Exponent困难问题证明了本文方案在选择密文攻击下的单向性.与同类方案相比较,本文方案支持更多的安全属性,并具有较低的计算开销.

基于多机构属性加密的云数据确定性删除方案

云存储服务的使用越来越普遍,但是将大量数据存储在第三方云服务器中,给用户带来便利的同时也提出了更高的安全要求。由于云存储服务是半可信的,使得如何确定性删除云存储数据成为需要解决的问题。目前,云存储数据的确定性删除的相关研究大多基于单机构管理属性的属性基加密,该类方案虽然满足云数据的细粒度访问控制,但容易引起单点故障等问题。因此,提出一种基于多机构属性基加密的云存储数据确定性删除方案。将多机构属性基加密应用于该方案,不仅支持有多个机构管理属性时对云存储数据的安全删除,并实现了云数据的细粒度访问。此外,该方案通过利用策略隐藏保护存储在云服务器中的访问策略的隐私。最后,通过撤销属性改变密文实现云数据删除,并通过区块链存储删除证明实现删除结果公开可验证和责任可追溯。实验仿真和对比分析表明,该方案在云存储数据删除方面具有较高的安全性,为云储存数据的删除提供一种实用方案。

基于区块链的多源网络大数据安全访问权限认证仿真

多源网络大数据的频繁交互与存储打破了传统数据“孤岛”,实现了跨区域与跨组织的数据访问,为数据的安全和隐私保护带来巨大挑战。访问认证作为保护数据与资源安全的技术之一,在获取所有数据节点信任的同时,面临巨大的通信负载,会造成数据丢失和破坏,为此,提出一种基于区块链研究多源网络大数据安全访问权限认证方法。以相似关系度量数据在网络传输中的变化状态,根据相似矩阵计算多源网络数据访问概率。通过区块链技术建立数据安全访问合约,标定数据的访问属性以及交易密文,并将数据压缩在对应属性内。根据访问目的分析其访问信度,以信度作为标准对应安全等级,在不同信度下定制访问规则,认证数据安全访问的具体权限,实现方法设计。实验结果表明,以不同数据属性含量作为测试条件,在常规模式和攻击模式下对数据进行加密和解密处理,新方法可以实现较快的认证响应,实现网络数据的安全访问。

基于联合物联网平台的多域访问权限构建

为解决访问控制问题,提出一种基于属性访问控制逻辑的新解决方案,利用分布式多权威-密文策略-基于属性的加密算法,丰富其固有特性,包括对抗串通攻击、属性吊销和用户隐私保护。由此产生的协议能够同时满足以下要求:对等身份验证、通信对等体之间的数据保密性、基于加密算法的高级访问控制机制、用户隐私、采用有限生命周期属性、属性吊销以及抗击串通攻击。

基于区块链的私有数据多域访问权限控制方法

为了提高私有数据的安全性,提出区块链技术下私有数据多域访问权限控制方法。引入区块链技术,将访问权限控制划分为数据预处理、准备和执行三个阶段,在数据预处理阶段对数据展开降维处理,提高控制效率,通过基于引力搜索的数据聚类算法挖掘数据中的私有数据,以此实现针对性的访问控制;并在准备阶段中针对区块链事务中存在的访问控制策略,结合属性权限与属性之间的关系,对其展开形式化描述与管理;执行阶段的主要目的是对请求访问展开判断,根据判断结果执行相应的控制策略,同时对区块链中存在的多域访问权限控制策略展开更新,以此保证控制效果。仿真结果表明,所提方法可有效分类不同数据类型,其数据泄露风险较低,能够有效保障私有数据的安全性。

Blockchain Access Control Scheme Based on Multi-authority Attribute-Based Encryption

Blockchain has been widely used in many fields because it can solve the problem of information asymmetry and enable users who do not trust each other to collaborate without the participation of third-party intermediaries.Existing blockchain access control schemes usually use attribute-based encryption,but most of them adopt traditional single-attribute authority for attribute authorization,which has the problem that the authority is overburdened and must be fully credible.This paper proposes a blockchain access control scheme based on multiauthority attribute-based encryption by improving the existing blockchain privacy protection method.Autonomous identity management is performed through the blockchain to complete the initialization of user identity and the issuance of attribute certificates.Attribute authorities are selected using the reputation proof consensusmechanism.The distributed key generation protocol is used to generate keys,and the linear secret sharing scheme is improved.The hierarchical relationship of the access structure is used to encrypt and access control the private data that need to be uploaded to the blockchain.According to the comparison with other blockchain access control schemes,the scheme proposed in this paper has been improved in terms of security and efficiency.

农村空巢老年糖尿病患者健康管理现状及对策研究

目的了解泰安农村空巢老年糖尿病患者的健康管理现状及影响因素,并提出改进对策,为提高慢性病健康管理质量提供参考。方法采用一般资料问卷、日常生活能力评定量表及成年人健康自我管理能力评定量表对泰安地区200名农村空巢老年糖尿病患者进行调查。结果农村空巢老年糖尿病患者日常生活能力属于轻度功能障碍,基本能够自理;自觉焦虑的占94.1%,健康管理的知晓率为41.4%;健康自我管理能力总分为(152.74±16.59)分。结论针对泰安农村空巢老年糖尿病患者的健康管理问题,应将赋能授权理论与健康管理相结合,建立SMG多级健康管理模式。

郭强生小说中的鬼魅书写

《惑乡之人》与《断代》是台湾作家郭强生近年来最负盛名的小说,作家通过鬼魅书写展现了台湾性少数群体的生存境况,并表现出与传统鬼魅书写不同的特质。作家笔下的鬼魂与传统文本中的鬼魂相比,承载了更多的历史记忆。除精心设计鬼魂形象外,郭强生在小说中还使用了多视角与多线叙事的手法,打破故事叙事的“一元论”,呈现出驳杂与多义的叙事形态。同时,戏曲、电影、照片等异质媒介被引入叙事,使文本中真与假的界限模糊,充满了梦魇之感。死者以鬼魂方式返场,而生者则以变装方式介入,揭露同性恋群体诡异的情色关系。

策略隐藏的高效多授权机构CP-ABE物联网数据共享方案

物联网环境下的数据共享存在效率低下、隐私泄露等问题,以及基于密文策略的属性基加密(ciphertext policy attribute-based encryption,CP-ABE)数据共享方案因采用单授权机构,需要承担繁重的计算工作而成为系统运行效率的瓶颈.为解决上述问题,提出一种策略完全隐藏的高效多授权机构CP-ABE物联网数据共享方案.该方案利用多授权机构CP-ABE实现数据的细粒度访问控制,利用联盟链不可篡改的特性保证密文哈希值和密钥集合密文的安全,采用MurmurHash3算法实现策略的完全隐藏,避免访问策略泄露用户隐私信息;并结合多秘密共享算法改进多授权机构CP-ABE,进而提升数据共享的效率.理论分析证明该方案能够保证访问策略和秘密共享过程的安全性.仿真实验结果表明,所提方案在策略隐藏和秘密分发过程中都具有较好的性能.

云环境下支持多授权机构的医疗数据安全共享方案

在当前的云环境下,医疗数据存储的研究中存在着隐私信息外泄、机构之间数据共享效率较低等问题。因此,针对云环境下电子医疗数据的安全共享需求,提出了一种支持多属性机构的基于属性的密文策略加密方案,实现了加密医疗数据的细粒度访问控制。通过在加密阶段引入离线计算和在解密阶段引入外包计算,该方案显著降低了加解密延时,提高了医疗数据访问控制的效率。安全性分析和性能分析表明,该方案满足可重放适应性选择密文攻击安全性,且在性能上优于已有的方案,提高了云环境下医疗数据共享的安全性和效率。

面向小麦区块链追溯系统的分级监管模型设计与实现

针对现有的农产品溯源系统中数据监管存在的监管单一、权限集中,以及监管过程中隐私泄露等问题,通过研究小麦制粉行业全业务流程特性,设计并构建了面向小麦区块链追溯系统的分级监管模型。该模型以联盟链Hyperledger Fabric为基础构建多链架构,提出了基于密文策略属性加密(CP-ABE)技术的加密隐私密钥传输方法,通过一对多的加密属性设计多个数据监管部门,并在密文中嵌入访问结构实现权限管控。通过理论分析,所提出的分级监管模型能够在满足消费者追溯需求的基础上,实现企业隐私保护、分级授权管控、全流程穿透式实时监管的功能。在安全方面,该模型在控制策略保持不变的情况下,改变需加密密钥的任意一位,生成密文平均变化率为95.5%;在保持密钥不变的前提下,通过改变企业授权访问策略,引起解密私钥平均变化率为75.5%,具有较高的混淆性和安全性。在效率方面,所设计的分级监管模型公开溯源数据平均查询时延为6.67 ms,隐私数据平均解密查询时延为34.45 ms,数据监管平均查询时延为37.78 ms。

基于边缘计算的多授权属性加密方案

传统云存储下属性加密通常在云端与用户直接交流,并且由单一授权机构处理密钥与数据信息,为此提出一种应用在边缘环境下的多授权属性加密方案。方案中的访问矩阵由线性秘密共享构建,将边缘平台作为中间节点,用椭圆曲线密码体制下的简单标量乘法替代属性加密中的双线性计算,通过多授权中心分摊属性管理,直接减少单个授权机构的密钥托管与局部失控问题。理论功能分析与实验结果表明,该方案在可行性与安全性上均优于传统同类算法,有效降低了用户在访问控制中的计算开销。