Secured Access Policy in Ciphertext-Policy Attribute-Based Encryption for Cloud Environment

The cloud allows clients to store and share data.Depending on the user’s needs,it is imperative to design an effective access control plan to share the information only with approved users.The user loses control of their data when the data is outsourced to the cloud.Therefore,access control mechanisms will become a significant challenging problem.The Ciphertext-Policy Attribute-Based Encryption(CP-ABE)is an essential solution in which the user can control data access.CP-ABE encrypts the data under a limited access policy after the user sets some access policies.The user can decrypt the data if they satisfy the limited access policy.Although CP-ABE is an effective access control program,the privacy of the policy might be compromised by the attackers.Namely,the attackers can gather important information from plain text policy.To address this issue,the SHA-512 algorithm is presented to create a hash code for the user’s attributes in this paper.Depending on the created hash codes,an access policy will be formed.It leads to protecting the access policy against attacks.The effectiveness of the proposed scheme is assessed based on decryption time,private key generation time,ciphertext generation time,and data verification time.

Novel dynamic anti-collusion ciphertext policy attribute-based encryption scheme in 5G D2D environment

To share data securely with secure attribute revocation,anti-collusion,and dynamic user management in the 5G device-to-device(D2D)environment,a novel dynamic anti-collusion ciphertext policy attribute-based encryption(NDA-CP-ABE)scheme in the 5G D2D environment is proposed.On the basis of the ciphertext policy attribute-based encryption algorithm,fine-grained access control and secure attribute revocation are realized,and the confidentiality of data is guaranteed.A polynomial function is adopted in the ciphertext generation phase to realize dynamic user management.A random number is used to prevent a collusion attack among the legitimate user equipment(UE),revoked UE,and external network attackers.Finally,on the basis of the Diffie-Hellman problem,the NDA-CP-ABE scheme is formally proved,and the simulation performances are compared with those of similar schemes.The results show that data can be securely shared through a D2D channel with secure attribute revocation,anti-collusion,and dynamic user management.Moreover,compared with similar schemes,the NDA-CP-ABE scheme has higher efficiency in encryption,decryption,and storage.

基于区块链与CP-ABE策略隐藏的众包测试任务隐私保护方案

为完善云环境下众测(众包测试)数据共享体系,解决众测领域存在的数据安全与隐私保护问题,提出基于区块链与基于密文策略的属性加密(CP-ABE)策略隐藏的众测任务隐私保护(CTTPP)方案。将区块链和属性基加密相结合,以提高众测数据共享的隐私性。首先,利用末端内部节点构造访问树表达访问策略,配合CP-ABE中的指数运算和双线性配对运算实现策略隐藏,以提高众测场景下数据共享的隐私保护能力;其次,调用区块链智能合约自动化验证数据访问者的合法性,与云服务器共同完成对任务密文访问权限的验证,进一步提高众测任务的安全性。性能测试结果表明,与同类型访问树策略隐藏算法相比,平均加密解密时间更短,加解密的计算开销更小;另外,当解密请求频率达到每秒1000笔时,区块链的处理能力开始逐渐饱和,数据上链和数据查询的最大处理时延为0.80 s和0.12 s,适用于轻量级的商业化众测应用场景。

An Improved Pairing-Free Ciphertext Policy Framework for IoT

Internet of Things(IoT)enables devices to get connected to the internet.Once they are connected,they behave as smart devices thereby releasing sensitive data periodically.There is a necessity to preserve the confidentiality and integrity of this data during transmission in public communication channels and also permitting only legitimate users to access their data A key challenge of smart networks is to establish a secure end-to-end data communication architecture by addressing the security vulnerabilities of data users and smart devices.The objective of this research work is to create a framework encompassing Ciphertext policy Attribute-based Encryption scheme using block encryption and BLAKE hashing technique.An improved Pairing-Free-Ciphertext policy Attribute-based encryption algorithm has been developed to overcome the aforementioned challenges.Further,a comparative study has been performed between the proposed scheme and the different encryption algorithms.It is found that the proposed scheme scores well over the already existing schemes.The scheme is evaluated in terms of execution time and communication overhead.The robustness of the proposed scheme is also analyzed from the perspective of several security goals.

Ciphertext-Policy Attribute-Based Encryption for General Circuits from Bilinear Maps

In this paper, we present the first ciphertext-policy attribute-based encryption （CP-ABE） scheme for polynomial-size general circuits based on bilinear maps which is more suitable for practical use and more efficient than multilinear maps. Our scheme uses a top-down secret sharing and FANOUT gate to resist the ＂backtracking attack＂ which is the main barrier expending access tree to general circuit. In the standard model, selective security of our scheme is proved. Comparing with current scheme for general circuits from bilinear maps, our work is more efficient.

Attribute-based encryption resilient to continual auxiliary leakage with constant size ciphertexts

For leakage-resilient ciphertext-policy attribute-based encryption （CP-ABE） at present, the size of the ciphertexts in most of them relies on the number of attributes. How to overcome this shortcoming is a challenge problem. Based on the Goldreich-Levin theorem and dual system encryption, an efficient CP-ABE scheme with constant size ciphertexts is proposed in this paper. It can tolerate leakage on master secret key and attribute-based secret keys with auxiliary inputs. Furthermore, the proposed scheme can be realized as resilience against continual leakage if keys are periodically updated. Under some static assumptions instead of other strong assumptions, the introduced scheme achieves adaptively security in the standard model.

支持撤销属性的CP-ABE密钥更新方法

在现有云存储的密文策略属性基加密方案(CP-ABE)中,大多只考虑用户的计算开销,而忽略了属性授权中心在更新密钥的时候所消耗的大量计算资源。针对该问题提出了一种基于CP-ABE的支持细粒度属性撤销的密钥更新方法。首先属性授权中心创建用户撤销列表以及属性密钥撤销列表;然后利用区块链公开、安全、可验证等相关特性来存储撤销列表等数据;最后系统根据这些数据在用户请求密文时更新其属性密钥,即将密钥频繁变更转为按需单次变更,从而减少属性授权中心在一定时间段内大量的计算。同时,通过引入可验证外包的方法确保用户解密的正确性以及低廉的开销。理论分析验证了方案的安全性以及密文加解密的高效性,并通过仿真实验与其他方案比较验证了方案在单次系统属性撤销方面也具备着高效的性能。

An Attribute-Based Encryption Scheme Based on Unrecognizable Trapdoors

Attribute-Based Encryption (ABE) has been widely used for ciphertext retrieval in the cloud environment.However,bi-flexible attribute control and privacy keywords are difficult problems that have yet to be solved.In this paper,we introduce the denial of access policy and the mutual matching algorithm of a dataset used to realize bidirectional control of attributes in the cloud server.To solve the problem of keyword privacy,we construct a security trapdoor by adding random numbers that effectively resist keyword guessing attacks from cloud servers and external attackers.System security is reduced to the Deterministic Bilinear Diffie-Hellman (DBDH) hypothesis problem.We validate our scheme through theoretical security analysis and experimental verification.Experiments are conducted on a real dataset,and results show that the scheme has higher security and retrieval efficiency than previous methods.

Fog-Based Secure Framework for Personal Health Records Systems

The rapid development of personal health records(PHR)systems enables an individual to collect,create,store and share his PHR to authorized entities.Health care systems within the smart city environment require a patient to share his PRH data with a multitude of institutions’repositories located in the cloud.The cloud computing paradigm cannot meet such a massive transformative healthcare systems due to drawbacks including network latency,scalability and bandwidth.Fog computing relieves the load of conventional cloud computing by availing intermediate fog nodes between the end users and the remote servers.Assuming a massive demand of PHR data within a ubiquitous smart city,we propose a secure and fog assisted framework for PHR systems to address security,access control and privacy concerns.Built under a fog-based architecture,the proposed framework makes use of efficient key exchange protocol coupled with ciphertext attribute based encryption(CP-ABE)to guarantee confidentiality and fine-grained access control within the system respectively.We also make use of digital signature combined with CP-ABE to ensure the system authentication and users privacy.We provide the analysis of the proposed framework in terms of security and performance.

基于区块链与改进CP-ABE算法的知识产权数据防篡改方法

针对现有防篡改方法存在被篡改数据量过大、无法确保知识产权数据安全性的问题,引入区块链与改进密文策略属性基加密(Ciphertext Policy Attribute Based Encryption,CP-ABE)算法,开展对知识产权数据防篡改方法的设计研究。首先,利用区块链技术创建知识产权数据智能合约,避免非法攻击者对其进行篡改;其次,利用改进CP-ABE算法控制知识产权数据细粒度访问,实现知识产权数据加密防篡改与授权访问;最后,进行实验分析。实验结果表明,应用该方法能够有效控制知识产权数据被篡改量,有利于保障知识产权拥有者的个人权益。

基于区块链免密钥托管的可追踪可撤销属性基加密方案

针对密文策略属性基加密(CP-ABE)方案难以高效地同时满足免密钥托管、策略隐藏、用户追踪和撤销问题,提出一种基于区块链免密钥托管的可追踪可撤销属性基加密方案(BETRABE)。首先,区块链网络中的节点为属性机构,用户只需与区块链网络通过公开信道进行少量通信即可获得解密密钥;其次,融合公钥加密对区块链中存储的用户解密密钥进行加密,用户本地只需存储公钥加密的公私钥;另外,追踪系统中泄露密钥的恶意用户,通过将该用户加入撤销列表和云服务器对密文更新实现恶意用户撤销。此外,使用单向匿名密钥协商协议实现密文访问策略全隐藏,进而更好地保护存储在云服务器上密文的隐私性。基于l-SDH(l-Strong Diffie-Hellman)假设在标准模型下进行安全性验证。实验结果表明,BETRABE极大地减少了密钥生成阶段的通信成本和用户的密钥存储开销,加密和解密时间随着用户属性数增加线性增长,且相较于其他方案拥有较高的解密效率。

一种素数阶群上构造的自适应安全的多授权机构CP-ABE方案

目前自适应安全的多授权机构基于属性的加密(Attribute-Based Encryption,ABE)方案都是在合数阶群上构造,针对其计算开销较大的问题,利用对偶配对向量空间技术,在素数阶群上构造了一种支持单调的访问结构且自适应安全的多授权机构密文策略ABE(Multi-Authority Ciphertext Policy ABE,MA-CP-ABE)方案.在标准模型下将该方案的安全性归约到判定性线性假设.性能分析表明,该方案在达到自适应安全的同时,具有更高的计算效率.

支持细粒度属性直接撤销的CP-ABE方案

为了解决用户属性变化带来的权限访问控制问题,支持属性撤销的基于属性加密方案被提出.然而,现有的属性撤销机制大多存在撤销代价大、撤销粒度粗等问题,且已有的方案均存在安全隐患,即属性授权中心可以伪装成任意用户解密密文.为弥补上述不足,提出一种支持细粒度属性直接撤销的密文策略的基于属性加密方案(CP-ABE),并给出该方案的形式化定义与安全模型.所提方案中,用于生成用户密钥的秘密参数由系统中心和属性授权机构分别产生,可避免属性授权中心解密密文的安全隐患.同时,通过引入多属性授权中心进一步降低了安全风险.在属性撤销方面,通过设计高效的重加密算法并引入属性撤销列表,实现细粒度的属性直接撤销.安全证明和性能分析表明:所提方案在适应性选择密文攻击下具有不可区分性并能抵抗不可信授权中心的破译攻击,较同类方案具有更高的计算效率以及更细的属性撤销粒度.

一种支持完全细粒度属性撤销的CP-ABE方案

属性撤销是基于属性的加密(attribute based encryption,简称ABE)在实际应用中所必须解决的问题.在直接撤销模式下,已有的支持属性撤销的ABE方案只能以撤销用户身份的方式对用户所拥有的全部属性进行撤销,而无法做到针对属性的细粒度撤销.提出了直接模式下支持完全细粒度属性撤销的CP-ABE(cipher policy ABE)模型,在合数阶双线性群上,基于双系统加密的思想构造了具体的方案,并在标准模型下给出了严格的安全性证明.该方案能够对用户所拥有的任意数量的属性进行撤销,解决了已有方案中属性撤销粒度过粗的问题.

基于CP-ABE的云存储数据访问控制方案

结合云存储的应用环境,构造了一种基于密文策略属性的加密(ciphertext policy attribute based encryption,CP-ABE)技术和收敛加密技术的混合加密数据访问控制方案.该方案包括密钥发布中心、用户和云服务器三方实体,能高效、灵活、细粒度地进行数据的访问控制,可提高云存储服务器的空间利用率,并使用签名技术支持数据源认证和数据完整性认证.理论分析与实验验证了该方案具有较高的实际应用价值.

农产品区块链多监管差分隐私共享模型设计

当前的农产品供应链系统,常由单个部门监管,存在单点故障、数据难以实时监管等问题,此外企业节点身份无明显区分,难以保证企业节点不会泄露企业隐私数据。本研究构建了农产品区块链多监管差分隐私共享架构,提出零知识证明身份验证算法,实现隐私数据对具有特定特征的监管部门的共享,降低了传统监管部门的压力。设计隐私数据分层规范,以基于密文策略的属性加密方案技术实现企业隐私数据差异化共享,降低了隐私数据泄露风险。在此基础上设计农产品区块链多监管差分隐私共享系统,并应用在某企业番茄供应链进行测试,测试结果表明,与现有监管模型相比,监管节点查询企业隐私数据时间缩短7.1%,企业节点查询隐私数据时间缩短23.9%。结果说明,本研究提出的方法能够在保证隐私安全的前提下提高监管效率。

mHealth中细粒度策略隐藏和可追踪去中心访问控制方案

基于属性基加密的访问控制协议在个人健康档案共享中发挥着越来越重要的作用.但传统的基于密文策略属性基加密的访问控制方案存在着些许问题.首先,中心化的属性授权机构的抗风险能力低.其次,随密文发送未隐藏的访问策略可能会泄露患者的隐私.此外,传统方案难以追踪恶意泄露密钥的用户.为解决上述问题,提出一种适用于mHealth中细粒度策略隐藏和可追踪去中心访问控制方案.实现了去中心化的属性授权机构.属性由属性名称和属性值2部分构成,在加密阶段属性值隐藏在密文中,只对外公开通用的属性名称.当密钥遭到恶意泄露时,监管机构利用身份映射表可以追踪到恶意的用户.经过实验模拟和对比分析,所提方案在安全性方面和性能上适用于实际的mHealth环境.

基于多授权中心的CP-ABE属性撤销方案

直接将密文属性基加密(CP-ABE)运用于云环境中,将造成云访问控制的安全和计算开销问题。为此,提出一种支持多授权中心的属性撤销方案(RMCP-ABE),通过采用逻辑二叉树和每属性代理重加密等方法,保证了属性撤销过程中的安全性,属性撤销的即时性、灵活性和细粒度,降低了数据属主的计算开销。方案引入了多授权中心模型,避免授权中心被攻破或者合谋的威胁,并提高了运行效率。安全性和实验分析表明,该算法安全性与传统CP-ABE算法一致,同时与其他属性撤销方案相比开销更低。

可搜索加密及其驱动的SQL隐私数据库设计

隐私数据库是促进国家大数据战略与数据要素市场发展中构建数据开放、共享及治理体系的重要手段,而可搜索加密作为实现隐私数据库的重要密码技术,仍存在缺乏灵活检索机制及抗量子安全等问题,也难以适配关系数据库中的结构化查询语言(SQL)查询机制.在对可搜索加密技术现状分析基础上,本文设计了可适配关系数据库SQL查询语言的隐私数据库架构,客户端引入隐私SQL引擎将索引和数据字段转变为密文状态;用户发起查询请求时,该引擎可依据查询策略生成查询凭证,隐私数据库进而依据凭证对密态索引进行密码化检索,匹配成功的密态数据字段可由用户私钥进行解密.进一步,本文在格密码体制下利用理想格上短整数解(R-SIS)和带误差学习(R-LWE)困难问题,设计了检索策略的属性基可搜索加密(RPABSE)方案用以支持上述隐私数据库密码系统的构建.该方案将查询策略与查询凭证相绑定,确保密文数据的索引可依据查询策略进行细粒度密码化检索;同时,引入小策略矩阵(SPM)来优化安全查询策略生成,降低索引匹配过程中累积误差.由安全性证明可知,查询凭证满足在选择策略攻击下的不可伪造性(EU-CPA),所提系统满足在带有策略和标识查询的选择明文攻击下的语义安全性(IND-PIQ-CPA).

一种支持属性重用的DCP-ABE方案研究

属性基加密(ABE)机制以属性为公钥,将密文和用户私钥与属性关联,能够灵活地表示访问控制策略,从而极大地降低数据共享细粒度访问控制带来的网络带宽和发送节点的处理开销。作为单授权机构ABE机制的推广,多授权机构ABE机制减轻了单一机构的工作负担,降低了风险,同时也更容易满足分布式系统的需求。文章针对目前多授权机构ABE方案中属性不能重用的问题,提出一个分权密文策略属性基加密(DCP-ABE)方案。该方案引入授权机构全局标识符,在加密阶段通过将属性(该属性满足密文的访问结构)相关的密文构件与该属性所属的授权机构的全局标识符进行绑定,使得不同授权机构所管理的属性能够重复使用,扩展了方案的实用性。此外,该方案中任何授权机构都可以动态加入或者离开该加密系统,不再需要中央授权机构对授权机构进行管理。