Secured Access Policy in Ciphertext-Policy Attribute-Based Encryption for Cloud Environment

The cloud allows clients to store and share data.Depending on the user’s needs,it is imperative to design an effective access control plan to share the information only with approved users.The user loses control of their data when the data is outsourced to the cloud.Therefore,access control mechanisms will become a significant challenging problem.The Ciphertext-Policy Attribute-Based Encryption(CP-ABE)is an essential solution in which the user can control data access.CP-ABE encrypts the data under a limited access policy after the user sets some access policies.The user can decrypt the data if they satisfy the limited access policy.Although CP-ABE is an effective access control program,the privacy of the policy might be compromised by the attackers.Namely,the attackers can gather important information from plain text policy.To address this issue,the SHA-512 algorithm is presented to create a hash code for the user’s attributes in this paper.Depending on the created hash codes,an access policy will be formed.It leads to protecting the access policy against attacks.The effectiveness of the proposed scheme is assessed based on decryption time,private key generation time,ciphertext generation time,and data verification time.

Authorized Attribute-Based Encryption Multi-Keywords Search with Policy Updating

Attribute-based encryption is cryptographic techniques that provide flexible data access control to encrypted data content in cloud storage.Each trusted authority needs proper management and distribution of secret keys to the user’s to only authorized user’s attributes.However existing schemes cannot be applied multiple authority that supports only a single keywords search compare to multi keywords search high computational burden or inefficient attribute’s revocation.In this paper,a ciphertext policy attribute-based encryption(CP-ABE)scheme has been proposed which focuses on multi-keyword search and attribute revocation by new policy updating feathers under multiple authorities and central authority.The data owner encrypts the keywords index under the initial access policy.Moreover,this paper addresses further issues such as data access,search policy,and confidentiality against unauthorized users.Finally,we provide the correctness analysis,performance analysis and security proof for chosen keywords attack and search trapdoor in general group model using DBDH and DLIN assumption.

Ciphertext-Policy Attribute-Based Encryption for General Circuits from Bilinear Maps

In this paper, we present the first ciphertext-policy attribute-based encryption （CP-ABE） scheme for polynomial-size general circuits based on bilinear maps which is more suitable for practical use and more efficient than multilinear maps. Our scheme uses a top-down secret sharing and FANOUT gate to resist the ＂backtracking attack＂ which is the main barrier expending access tree to general circuit. In the standard model, selective security of our scheme is proved. Comparing with current scheme for general circuits from bilinear maps, our work is more efficient.

Attribute-based encryption resilient to continual auxiliary leakage with constant size ciphertexts

For leakage-resilient ciphertext-policy attribute-based encryption （CP-ABE） at present, the size of the ciphertexts in most of them relies on the number of attributes. How to overcome this shortcoming is a challenge problem. Based on the Goldreich-Levin theorem and dual system encryption, an efficient CP-ABE scheme with constant size ciphertexts is proposed in this paper. It can tolerate leakage on master secret key and attribute-based secret keys with auxiliary inputs. Furthermore, the proposed scheme can be realized as resilience against continual leakage if keys are periodically updated. Under some static assumptions instead of other strong assumptions, the introduced scheme achieves adaptively security in the standard model.

Continual auxiliary leakage-resilient attribute-based broadcast encryption with constant size ciphertexts

Attribute-based broadcast encryption(ABBE) under continual auxiliary leakage-resilient(CALR) model can enhance the security of the shared data in broadcasting system since CALR model brings the possibility of new leakage-resilient(LR) guarantees. However, there are many shortcomings in the existing works, such as relying on the strong assumptions, low computational efficiency and large size of ciphertexts, etc. How to solve the trade-off between security and efficiency is a challenging problem at present. To solve these problems, this paper gives an ABBE scheme resisting continual auxiliary leakage(CAL) attack. ABBE scheme achieves constant size ciphertexts, and the computational complexity of decryption only depends on the number of receivers instead of the maximum number of receivers of the system. Additionally, it achieves adaptive security in the standard model where the security is reduced to the general subgroup decision(GSD) assumptions(or called static assumptions in the subgroup). Furthermore, it can tolerate leakage on the master secret key and private key with continual auxiliary inputs. Performance analysis shows that the proposed scheme is more efficient and practical than the available schemes.

农产品区块链多监管差分隐私共享模型设计

当前的农产品供应链系统,常由单个部门监管,存在单点故障、数据难以实时监管等问题,此外企业节点身份无明显区分,难以保证企业节点不会泄露企业隐私数据。本研究构建了农产品区块链多监管差分隐私共享架构,提出零知识证明身份验证算法,实现隐私数据对具有特定特征的监管部门的共享,降低了传统监管部门的压力。设计隐私数据分层规范,以基于密文策略的属性加密方案技术实现企业隐私数据差异化共享,降低了隐私数据泄露风险。在此基础上设计农产品区块链多监管差分隐私共享系统,并应用在某企业番茄供应链进行测试,测试结果表明,与现有监管模型相比,监管节点查询企业隐私数据时间缩短7.1%,企业节点查询隐私数据时间缩短23.9%。结果说明,本研究提出的方法能够在保证隐私安全的前提下提高监管效率。

边缘计算中基于区块链的轻量级密文访问控制方案

密文策略属性基加密(ciphertext-policy attribute-based encryption,CP-ABE)技术可以在保证数据隐私性的同时提供细粒度访问控制.针对现有的基于CP-ABE的访问控制方案不能有效解决边缘计算环境中的关键数据安全问题,提出一种边缘计算环境中基于区块链的轻量级密文访问控制方案(blockchain-based lightweight access control scheme over ciphertext in edge computing,BLAC).在BLAC中,设计了一种基于椭圆曲线密码的轻量级CP-ABE算法,使用快速的椭圆曲线标量乘法实现算法加解密功能,并将大部分加解密操作安全地转移,使得计算能力受限的用户设备在边缘服务器的协助下能够高效地完成密文数据的细粒度访问控制;同时,设计了一种基于区块链的分布式密钥管理方法,通过区块链使得多个边缘服务器能够协同地为用户分发私钥.安全性分析和性能评估表明BLAC能够保障数据机密性,抵抗共谋攻击,支持前向安全性,具有较高的用户端计算效率,以及较低的服务器端解密开销和存储开销.

智慧城市下基于属性加密的隐私数据保护

智慧城市中涉及的数据涵盖了人们的个人信息、位置数据、交通数据等敏感信息。为了满足智慧城市中的数据共享和隐私保护需求,结合属性基可追踪加密技术,为智慧城市的隐私数据保护提供一种新的解决方案并详细介绍了方案的构成。根据属性来细粒度地控制不同用户对数据的访问权限,有效提高隐私数据的安全性。

基于区块链的多授权密文策略属性基等值测试加密方案

针对云环境下密文策略属性基加密方案中存在的密文检索分类困难与依赖可信第三方等问题,本文提出了一种基于区块链的多授权密文策略属性基等值测试加密方案.利用基于属性的等值测试技术,实现了支持属性级灵活授权的云端数据检索和分类机制,降低了数据用户对重复数据解密的计算开销.结合多授权属性基加密机制和区块链技术,实现了去中心化用户密钥生成.采用多属性授权机构联合分发密钥,有效抵抗用户和属性授权机构的合谋攻击.引入区块链和智能合约技术,消除了现有密文策略属性基密文等值测试方案中等值测试、数据存储与外包解密操作对可信云服务器的依赖.利用外包服务器执行部分解密计算,降低了用户本地的计算开销.将原始数据哈希和验证参数上传至区块链,保障外包服务器解密结果正确性和云端数据完整性.在随机预言模型下,基于判定性qparallel Bilinear Diffie-Hellman Exponent困难问题证明了本文方案在选择密文攻击下的单向性.与同类方案相比较,本文方案支持更多的安全属性,并具有较低的计算开销.

An Attribute-Based Encryption Scheme Based on Unrecognizable Trapdoors

Attribute-Based Encryption (ABE) has been widely used for ciphertext retrieval in the cloud environment.However,bi-flexible attribute control and privacy keywords are difficult problems that have yet to be solved.In this paper,we introduce the denial of access policy and the mutual matching algorithm of a dataset used to realize bidirectional control of attributes in the cloud server.To solve the problem of keyword privacy,we construct a security trapdoor by adding random numbers that effectively resist keyword guessing attacks from cloud servers and external attackers.System security is reduced to the Deterministic Bilinear Diffie-Hellman (DBDH) hypothesis problem.We validate our scheme through theoretical security analysis and experimental verification.Experiments are conducted on a real dataset,and results show that the scheme has higher security and retrieval efficiency than previous methods.

集群式农产品供应链区块链密文策略可验多部门监管方案

集群式农产品供应链区块链上的数据逐渐采用加密存储模式,给跨企业、跨生产环节的监管带来挑战。为了适应集群式环境下的监管、减小监管带来的隐私泄露风险,该研究基于CP-ABE提出了集群式农产品供应链区块链密文策略可验多部门监管方案。明确划分监管部门的监管权限,根据链上数据的监管策略,企业用户基于CP-ABE加密数据,在保证数据隐私的同时实现数据对相关监管者的公开;设计基于CP-ABE的密文访问树验证方案,结合智能合约与监管策略,在数据上链前验证CP-ABE的访问树,以确保数据对指定监管者的公开。基于Hyperledger Fabric构建了测试原型系统,测试结果表明,监管策略中监管者数量每增加10个,系统上链时间延长约500 ms,吞吐量约为438事务数/s(transactions/s);安全性分析表明,系统具有较高的安全性。该方案实现了区块链密文条件下多部门的细粒度监管,减小了发生在监管端的隐私泄露风险,能够应对集群式农产品供应链区块链加密存储带来的监管挑战。

支持撤销属性的CP-ABE密钥更新方法

在现有云存储的密文策略属性基加密方案(CP-ABE)中,大多只考虑用户的计算开销,而忽略了属性授权中心在更新密钥的时候所消耗的大量计算资源。针对该问题提出了一种基于CP-ABE的支持细粒度属性撤销的密钥更新方法。首先属性授权中心创建用户撤销列表以及属性密钥撤销列表;然后利用区块链公开、安全、可验证等相关特性来存储撤销列表等数据;最后系统根据这些数据在用户请求密文时更新其属性密钥,即将密钥频繁变更转为按需单次变更,从而减少属性授权中心在一定时间段内大量的计算。同时,通过引入可验证外包的方法确保用户解密的正确性以及低廉的开销。理论分析验证了方案的安全性以及密文加解密的高效性,并通过仿真实验与其他方案比较验证了方案在单次系统属性撤销方面也具备着高效的性能。

Blockchain Merkle-Tree Ethereum Approach in Enterprise Multitenant Cloud Environment

This research paper puts emphasis on using cloud computing with Blockchain(BC)to improve the security and privacy in a cloud.The security of data is not guaranteed as there is always a risk of leakage of users’data.Blockchain can be used in a multi-tenant cloud environment(MTCE)to improve the security of data,as it is a decentralized approach.Data is saved in unaltered form.Also,Blockchain is not owned by a single organization.The encryption process can be done using a Homomorphic encryption(HE)algorithm along with hashing technique,hereby allowing computations on encrypted data without the need for decryption.This research paper is composed of four objectives:Analysis of cloud security using Blockchain technology;Exceptional scenario of Blockchain architecture in an enterprise-level MTCE;Implementation of cipher-text policy attribute-based encryption(CPABE)algorithm;Implementation of Merkle tree using Ethereum(MTuE)in a Multi-tenant system.Out of these four objectives,the main focus is on the implementation of CP-ABE algorithm.CP-ABE parameters are proposed for different levels of tenants.The levels include inner tenant,outer tenant,Inner-Outer-Tenant,Inner-Outer-External-Tenant,Outer-Inner-Tenant,External-Outer-Inner-Tenant and the parameters such as token,private key,public key,access tree,message,attribute set,node-level,cipher-text,salting which will help in providing better security using CP-ABE algorithm in a multitenant environment(MTE)where tenants can be provided with different levels of security and achieved 92 percentage of authenticity and access-control of the data.

云环境中基于联盟链的多中心数据共享系统

云存储数据共享服务面临着用户数据泄露和篡改的安全威胁,属性加密算法适用于云环境中的数据共享。然而,传统的属性加密方案依赖可信第三方,属性服务器存在被恶意攻击的风险。针对这一问题,设计了一种基于联盟区块链和密文策略属性加密的数据共享系统。该系统采用具有多中心的属性授权机构提供稳定的属性私钥生成服务,结合混合加密技术实现原始数据和密钥的分区管理;同时利用联盟区块链能在不完全可信的环境中管理数据的特点,实现隐私数据密钥上链和属性授权溯源,对用户数据的安全和隐私提供有效保护。对系统的安全分析和实验评估表明,该系统能有效抵抗共谋攻击,实现用户数据访问的细粒度控制。

云雾环境下可追责可撤销的属性基加密方案研究

随着物联网设备产生的数据激增,一种称为雾计算的新范式已经发展起来,其可以在边缘处理和分析数据。云计算和雾计算一起被用于巨大的存储和处理资源。而现有的CP-ABE方案不太适合云雾物联网环境,因为不能同时提供以下功能:抗密钥托管、属性撤销、恶意用户追责和复杂操作的外包。因此,本文提出了一种云雾环境下可追责可撤销的数据安全共享方案,该方案支持密钥抗托管、属性撤销和恶意用户追责功能。通过将复杂的加解密、属性撤销和恶意用户追责的任务外包给第三方,为物联网设备留下恒定且少量的计算量。同时,所提方案只更新那些与撤销属性相关联的关键组件和密文,实现多层次撤销,提高其撤销效率。该方案与现有的CP-ABE方案不同,用户持有一个恒定大小的密钥,该密钥在整个过程中保持不变。该方案性能分析表明,所提方案是安全高效的,适用于资源受限的物联网设备。

基于区块链的云上数据访问控制模型研究

区块链和基于密文策略的属性加密(Ciphertext Policy Attribute Based Encryption,CP-ABE)相结合的方案已经被广泛应用于云上共享数据的访问控制,但是这些方案中数据用户的隐私保护问题并未得到妥善解决。一些研究引入分布式多属性授权中心的基于属性的签名方案(Distributed Multi-Authority Attribute Based Signature,DMA-ABS)来保护数据用户的隐私,但当数据用户多次访问数据时需要进行重复的权限验证,这会带来多余的时间消耗问题。并且,在数据用户的属性和访问控制策略保持相对稳定的情况下,数据用户无限制地重复访问共享数据,会导致系统过载,影响正常的请求处理。这可能会引起云端数据的泄露,给云端数据的安全带来隐患。为了解决这些问题,文中提出了一个基于区块链的云上个人隐私数据访问控制方案。该方案首先将智能合约和多属性授权中心的CP-ABE方案结合,实现了云上个人隐私数据的细粒度访问控制,并引入DMA-ABS方案完成了对数据用户的匿名性身份验证,保护了数据用户的身份隐私;其次,基于比特币UTXO(Unspent Transaction Output)机制,设计了一种数字令牌token,实现了一次授权、多次访问的功能,即缩短了访问时间,又限制了访问次数;最后,在Hyperledger Fabric上进一步实现了访问控制流程,并与现有方案进行了访问时间开销的比较。实验结果表明,所提方案能够有效降低访问时间开销,提高访问效率。

基于格上密文策略属性基加密的联盟链数据共享方案

数据共享过程中存在数据泄漏、信任危机等问题,且量子计算机的出现对传统加密算法带来了较大威胁。为此,提出一种基于格上密文策略属性基加密(CP-ABE)的联盟链数据共享方案。利用联盟链的准入机制以及允许存在可信第三方的特性解决在分布式网络中数据共享双方相互不信任的问题。引入基于环上容错学习的CP-ABE技术来抵御量子攻击,同时改进访问树的生成方式,将属性分为高敏感、低敏感两类,实现对数据的分级加密以保证数据的安全性。基于演化博弈论构建数据共享模型,对共享双方在联盟链数据共享体系中的选择策略进行求解和分析,并探究不同参数对演化结果的影响。实验结果表明,当属性数量呈指数级增长时,该方案的启动算法、加密算法以及解密算法的效率比基于合数阶双线群的CP-ABE方案分别提高81.6%、43.8%和56.0%,每增加一个背书节点能够使系统在执行增加用户与查询用户函数时效率分别提高36.8%与6.4%。此外,对演化模型进行模拟,结果表明,当数据固有收益、损失概率与损失收益的乘积都提高时,参与联盟链带来的收益提高,用户更倾向于参与联盟链。

基于时间因子的可撤销可追踪属性基加密方案

现有的属性基加密方案访问策略中较少涉及时间因子,用户为自己的数据设置访问策略时,无法对访问数据的用户拥有属性的时间进行限定,针对恶意泄露密钥的用户进行追踪并撤销也是属性基加密中的挑战性问题,现有的可撤销方案存在计算量太大、效率过低等缺陷。针对这些问题,提出一种基于时间因子的可撤销可追踪属性基加密方案,在用户密钥中分别标记用户获取属性的时间,访问策略中对用户获取属性最早/最迟时间进行限定,解密时对用户属性时间进行验证,丰富了系统的访问策略并实现了方案的后向安全,通过时间验证服务器对用户解密阶段进行管理,用户属性撤销时仅需要更新用户时间标记因子,用户撤销时仅需要删除时间因子,实现方案高效撤销和前向安全。最后,在DBDH假设下,所提方案是IND-CPA安全的。性能分析和实验结果表明,所提方案有较丰富的功能和较高的性能。

云环境下基于属性策略隐藏的细粒度高效可搜索加密方案

基于属性的加密为存储在云中的外包数据提供了灵活且细粒度的访问控制。传统的基于属性的密文策略加密方案(CP-ABE)的访问策略常以明文形式出现,极易暴露用户的隐私敏感信息。另外,由于属性的加入,在加解密以及搜索阶段的相关计算和存储开销与属性数量呈线性关系,而且策略隐藏也会增加后续的计算开销。这些都难以满足云环境下具有隐私保护的安全高效可搜索加密的实际需求。针对上述问题,提出了一种同时支持策略隐藏与密文长度恒定的可搜索加密方案。该方案基于多值通配符与门策略,实现了密文长度恒定,并且具有固定的加解密和搜索开销,减少了用户的计算开销和云端对密文的存储开销。将访问策略中的属性通过加密完全隐藏,在搜索时使用布隆过滤器判断用户是否拥有访问策略中的相关属性,保护了用户隐私,也提高了计算效率。所提方案在q-BDHE假设下满足IND-CPA安全。安全性分析与实验结果表明了所提方案的安全性、高效性和可行性,其是一个高效的关键词搜索方案,在云环境与物联网中具有较好的应用前景。