Novel dynamic anti-collusion ciphertext policy attribute-based encryption scheme in 5G D2D environment

To share data securely with secure attribute revocation,anti-collusion,and dynamic user management in the 5G device-to-device(D2D)environment,a novel dynamic anti-collusion ciphertext policy attribute-based encryption(NDA-CP-ABE)scheme in the 5G D2D environment is proposed.On the basis of the ciphertext policy attribute-based encryption algorithm,fine-grained access control and secure attribute revocation are realized,and the confidentiality of data is guaranteed.A polynomial function is adopted in the ciphertext generation phase to realize dynamic user management.A random number is used to prevent a collusion attack among the legitimate user equipment(UE),revoked UE,and external network attackers.Finally,on the basis of the Diffie-Hellman problem,the NDA-CP-ABE scheme is formally proved,and the simulation performances are compared with those of similar schemes.The results show that data can be securely shared through a D2D channel with secure attribute revocation,anti-collusion,and dynamic user management.Moreover,compared with similar schemes,the NDA-CP-ABE scheme has higher efficiency in encryption,decryption,and storage.

Secured Access Policy in Ciphertext-Policy Attribute-Based Encryption for Cloud Environment

The cloud allows clients to store and share data.Depending on the user’s needs,it is imperative to design an effective access control plan to share the information only with approved users.The user loses control of their data when the data is outsourced to the cloud.Therefore,access control mechanisms will become a significant challenging problem.The Ciphertext-Policy Attribute-Based Encryption(CP-ABE)is an essential solution in which the user can control data access.CP-ABE encrypts the data under a limited access policy after the user sets some access policies.The user can decrypt the data if they satisfy the limited access policy.Although CP-ABE is an effective access control program,the privacy of the policy might be compromised by the attackers.Namely,the attackers can gather important information from plain text policy.To address this issue,the SHA-512 algorithm is presented to create a hash code for the user’s attributes in this paper.Depending on the created hash codes,an access policy will be formed.It leads to protecting the access policy against attacks.The effectiveness of the proposed scheme is assessed based on decryption time,private key generation time,ciphertext generation time,and data verification time.

Authorized Attribute-Based Encryption Multi-Keywords Search with Policy Updating

Attribute-based encryption is cryptographic techniques that provide flexible data access control to encrypted data content in cloud storage.Each trusted authority needs proper management and distribution of secret keys to the user’s to only authorized user’s attributes.However existing schemes cannot be applied multiple authority that supports only a single keywords search compare to multi keywords search high computational burden or inefficient attribute’s revocation.In this paper,a ciphertext policy attribute-based encryption(CP-ABE)scheme has been proposed which focuses on multi-keyword search and attribute revocation by new policy updating feathers under multiple authorities and central authority.The data owner encrypts the keywords index under the initial access policy.Moreover,this paper addresses further issues such as data access,search policy,and confidentiality against unauthorized users.Finally,we provide the correctness analysis,performance analysis and security proof for chosen keywords attack and search trapdoor in general group model using DBDH and DLIN assumption.

Ciphertext-Policy Attribute-Based Encryption for General Circuits from Bilinear Maps

In this paper, we present the first ciphertext-policy attribute-based encryption （CP-ABE） scheme for polynomial-size general circuits based on bilinear maps which is more suitable for practical use and more efficient than multilinear maps. Our scheme uses a top-down secret sharing and FANOUT gate to resist the ＂backtracking attack＂ which is the main barrier expending access tree to general circuit. In the standard model, selective security of our scheme is proved. Comparing with current scheme for general circuits from bilinear maps, our work is more efficient.

Attribute-based encryption resilient to continual auxiliary leakage with constant size ciphertexts

For leakage-resilient ciphertext-policy attribute-based encryption （CP-ABE） at present, the size of the ciphertexts in most of them relies on the number of attributes. How to overcome this shortcoming is a challenge problem. Based on the Goldreich-Levin theorem and dual system encryption, an efficient CP-ABE scheme with constant size ciphertexts is proposed in this paper. It can tolerate leakage on master secret key and attribute-based secret keys with auxiliary inputs. Furthermore, the proposed scheme can be realized as resilience against continual leakage if keys are periodically updated. Under some static assumptions instead of other strong assumptions, the introduced scheme achieves adaptively security in the standard model.

Continual auxiliary leakage-resilient attribute-based broadcast encryption with constant size ciphertexts

Attribute-based broadcast encryption(ABBE) under continual auxiliary leakage-resilient(CALR) model can enhance the security of the shared data in broadcasting system since CALR model brings the possibility of new leakage-resilient(LR) guarantees. However, there are many shortcomings in the existing works, such as relying on the strong assumptions, low computational efficiency and large size of ciphertexts, etc. How to solve the trade-off between security and efficiency is a challenging problem at present. To solve these problems, this paper gives an ABBE scheme resisting continual auxiliary leakage(CAL) attack. ABBE scheme achieves constant size ciphertexts, and the computational complexity of decryption only depends on the number of receivers instead of the maximum number of receivers of the system. Additionally, it achieves adaptive security in the standard model where the security is reduced to the general subgroup decision(GSD) assumptions(or called static assumptions in the subgroup). Furthermore, it can tolerate leakage on the master secret key and private key with continual auxiliary inputs. Performance analysis shows that the proposed scheme is more efficient and practical than the available schemes.

车载社交网中基于密文属性加密的车队车辆数据共享方案

针对车载社交网(VSN)中车队车辆数据共享过程中存在的隐私泄露问题,提出一种基于密文属性的加密方案。利用基于属性的加密技术,保证仅授权的车辆可访问数据,防止车队车辆数据共享过程中发生隐私泄露;针对车队车辆数据共享时生成访问策略时间开销大、数据共享效率低的问题,通过构造访问树实现对访问策略的设计,利用路侧单元将访问树转化为访问矩阵,实现访问策略的快速生成。仿真分析结果表明,该方案能够实现对VSN中车队车辆的数据安全共享,所构建的访问策略生成方案能够有效降低车辆的计算开销。

农产品区块链多监管差分隐私共享模型设计

当前的农产品供应链系统,常由单个部门监管,存在单点故障、数据难以实时监管等问题,此外企业节点身份无明显区分,难以保证企业节点不会泄露企业隐私数据。本研究构建了农产品区块链多监管差分隐私共享架构,提出零知识证明身份验证算法,实现隐私数据对具有特定特征的监管部门的共享,降低了传统监管部门的压力。设计隐私数据分层规范,以基于密文策略的属性加密方案技术实现企业隐私数据差异化共享,降低了隐私数据泄露风险。在此基础上设计农产品区块链多监管差分隐私共享系统,并应用在某企业番茄供应链进行测试,测试结果表明,与现有监管模型相比,监管节点查询企业隐私数据时间缩短7.1%,企业节点查询隐私数据时间缩短23.9%。结果说明,本研究提出的方法能够在保证隐私安全的前提下提高监管效率。

边缘计算中基于区块链的轻量级密文访问控制方案

密文策略属性基加密(ciphertext-policy attribute-based encryption,CP-ABE)技术可以在保证数据隐私性的同时提供细粒度访问控制.针对现有的基于CP-ABE的访问控制方案不能有效解决边缘计算环境中的关键数据安全问题,提出一种边缘计算环境中基于区块链的轻量级密文访问控制方案(blockchain-based lightweight access control scheme over ciphertext in edge computing,BLAC).在BLAC中,设计了一种基于椭圆曲线密码的轻量级CP-ABE算法,使用快速的椭圆曲线标量乘法实现算法加解密功能,并将大部分加解密操作安全地转移,使得计算能力受限的用户设备在边缘服务器的协助下能够高效地完成密文数据的细粒度访问控制;同时,设计了一种基于区块链的分布式密钥管理方法,通过区块链使得多个边缘服务器能够协同地为用户分发私钥.安全性分析和性能评估表明BLAC能够保障数据机密性,抵抗共谋攻击,支持前向安全性,具有较高的用户端计算效率,以及较低的服务器端解密开销和存储开销.

联盟链下的高效车联网数据安全共享研究

[目的/意义]旨在解决现有的车联网数据共享方案中计算开销大、共享效率低、安全性不足等问题。[方法/过程]设计了一个车联网高效数据安全共享方案,采用基于线性秘密共享(LSSS)的密文策略属性加密(CP-ABE)算法和基于联盟区块链群组技术,实现了车联网高效数据共享,减少数据冗余,并通过共识机制的优化,进一步提高时间效率,同时确保车辆实体的数据安全性和隐私性。[结果/结论]该方案能够适应车联网快速移动、动态变化的复杂特性,可实现灵活访问控制和高自由度的数据共享,满足车联网场景需求。

智慧城市下基于属性加密的隐私数据保护

智慧城市中涉及的数据涵盖了人们的个人信息、位置数据、交通数据等敏感信息。为了满足智慧城市中的数据共享和隐私保护需求,结合属性基可追踪加密技术,为智慧城市的隐私数据保护提供一种新的解决方案并详细介绍了方案的构成。根据属性来细粒度地控制不同用户对数据的访问权限,有效提高隐私数据的安全性。

基于SM9的密钥策略属性基加密及快速解密

属性基加密是一种通过指定访问策略实现数据共享的公钥加密技术,分为密钥策略属性基加密和密文策略属性基加密两种.在属性基加密中,数据拥有者通过指定一个访问策略(属性集合)对数据进行加密,被授权的接收者使用与属性集合(访问策略)相关联的解密密钥访问数据.与传统"一对一"的数据共享模式相比,属性基加密是一种更为精细的数据共享机制,可以提供"一对多"的数据共享模式,适用于区块链、云计算等信息系统中的多用户数据安全共享应用.SM9标识加密是我国设计的标识密码算法,用于保障数据的机密性,于2021年成为国际标准.但是,SM9标识加密仅提供"一对一"的数据共享模式.本文在SM9标识加密的基础上,结合经典密钥策略属性基加密的构造思路,构造了一种基于SM9的密钥策略属性基加密方案.所提方案中的密钥/密文结构与SM9标识加密算法中的密钥/密文结构相似,可与现有使用SM9的信息系统有效融合.在此基础上,提出基于SM9的密钥策略属性基加密快速解密方法.新方法具有以下特点:(1)通过增加密钥长度,将解密时使用的双线性运算数量由原来的2|I|个降低至2个,其中|I|表示解密时使用的线性秘密生成矩阵中的行数;(2)使用聚合技术,将密文中的群元素个数由原来的(2+|S|)个降低至3个,其中S表示加密时使用的属性集合;(3)新方法具有动态自适应性,用户可以根据实际需求在密钥长度和解密时间之间进行个性化权衡.这些特性使得所提新方法更适用于计算、带宽和存储资源受限的轻量级设备.最后,性能分析表明,该方案在实际应用中是可行的.

基于区块链的多授权密文策略属性基等值测试加密方案

针对云环境下密文策略属性基加密方案中存在的密文检索分类困难与依赖可信第三方等问题,本文提出了一种基于区块链的多授权密文策略属性基等值测试加密方案.利用基于属性的等值测试技术,实现了支持属性级灵活授权的云端数据检索和分类机制,降低了数据用户对重复数据解密的计算开销.结合多授权属性基加密机制和区块链技术,实现了去中心化用户密钥生成.采用多属性授权机构联合分发密钥,有效抵抗用户和属性授权机构的合谋攻击.引入区块链和智能合约技术,消除了现有密文策略属性基密文等值测试方案中等值测试、数据存储与外包解密操作对可信云服务器的依赖.利用外包服务器执行部分解密计算,降低了用户本地的计算开销.将原始数据哈希和验证参数上传至区块链,保障外包服务器解密结果正确性和云端数据完整性.在随机预言模型下,基于判定性qparallel Bilinear Diffie-Hellman Exponent困难问题证明了本文方案在选择密文攻击下的单向性.与同类方案相比较,本文方案支持更多的安全属性,并具有较低的计算开销.

基于区块链的软件定义物联网访问控制模型研究

软件定义物联网通过应用软件定义网络技术,实现了网络平面与控制平面的有效分离,从而显著提升了物联网服务的灵活性与可管理性。然而,其开放性也带来了更多的安全挑战。因此,提出将区块链技术集成到软件定义物联网架构中,利用区块链的去中心化和不可篡改的核心特性来加强网络控制与数据访问的安全性。另外,还通过智能合约来自动执行安全策略,采用基于密文策略的属性加密方案保证数据在传输和存储过程中的安全。

基于联合物联网平台的多域访问权限构建

为解决访问控制问题,提出一种基于属性访问控制逻辑的新解决方案,利用分布式多权威-密文策略-基于属性的加密算法,丰富其固有特性,包括对抗串通攻击、属性吊销和用户隐私保护。由此产生的协议能够同时满足以下要求:对等身份验证、通信对等体之间的数据保密性、基于加密算法的高级访问控制机制、用户隐私、采用有限生命周期属性、属性吊销以及抗击串通攻击。

An Attribute-Based Encryption Scheme Based on Unrecognizable Trapdoors

Attribute-Based Encryption (ABE) has been widely used for ciphertext retrieval in the cloud environment.However,bi-flexible attribute control and privacy keywords are difficult problems that have yet to be solved.In this paper,we introduce the denial of access policy and the mutual matching algorithm of a dataset used to realize bidirectional control of attributes in the cloud server.To solve the problem of keyword privacy,we construct a security trapdoor by adding random numbers that effectively resist keyword guessing attacks from cloud servers and external attackers.System security is reduced to the Deterministic Bilinear Diffie-Hellman (DBDH) hypothesis problem.We validate our scheme through theoretical security analysis and experimental verification.Experiments are conducted on a real dataset,and results show that the scheme has higher security and retrieval efficiency than previous methods.

集群式农产品供应链区块链密文策略可验多部门监管方案

集群式农产品供应链区块链上的数据逐渐采用加密存储模式,给跨企业、跨生产环节的监管带来挑战。为了适应集群式环境下的监管、减小监管带来的隐私泄露风险,该研究基于CP-ABE提出了集群式农产品供应链区块链密文策略可验多部门监管方案。明确划分监管部门的监管权限,根据链上数据的监管策略,企业用户基于CP-ABE加密数据,在保证数据隐私的同时实现数据对相关监管者的公开;设计基于CP-ABE的密文访问树验证方案,结合智能合约与监管策略,在数据上链前验证CP-ABE的访问树,以确保数据对指定监管者的公开。基于Hyperledger Fabric构建了测试原型系统,测试结果表明,监管策略中监管者数量每增加10个,系统上链时间延长约500 ms,吞吐量约为438事务数/s(transactions/s);安全性分析表明,系统具有较高的安全性。该方案实现了区块链密文条件下多部门的细粒度监管,减小了发生在监管端的隐私泄露风险,能够应对集群式农产品供应链区块链加密存储带来的监管挑战。

支持撤销属性的CP-ABE密钥更新方法

在现有云存储的密文策略属性基加密方案(CP-ABE)中,大多只考虑用户的计算开销,而忽略了属性授权中心在更新密钥的时候所消耗的大量计算资源。针对该问题提出了一种基于CP-ABE的支持细粒度属性撤销的密钥更新方法。首先属性授权中心创建用户撤销列表以及属性密钥撤销列表;然后利用区块链公开、安全、可验证等相关特性来存储撤销列表等数据;最后系统根据这些数据在用户请求密文时更新其属性密钥,即将密钥频繁变更转为按需单次变更,从而减少属性授权中心在一定时间段内大量的计算。同时,通过引入可验证外包的方法确保用户解密的正确性以及低廉的开销。理论分析验证了方案的安全性以及密文加解密的高效性,并通过仿真实验与其他方案比较验证了方案在单次系统属性撤销方面也具备着高效的性能。

Blockchain Merkle-Tree Ethereum Approach in Enterprise Multitenant Cloud Environment

This research paper puts emphasis on using cloud computing with Blockchain(BC)to improve the security and privacy in a cloud.The security of data is not guaranteed as there is always a risk of leakage of users’data.Blockchain can be used in a multi-tenant cloud environment(MTCE)to improve the security of data,as it is a decentralized approach.Data is saved in unaltered form.Also,Blockchain is not owned by a single organization.The encryption process can be done using a Homomorphic encryption(HE)algorithm along with hashing technique,hereby allowing computations on encrypted data without the need for decryption.This research paper is composed of four objectives:Analysis of cloud security using Blockchain technology;Exceptional scenario of Blockchain architecture in an enterprise-level MTCE;Implementation of cipher-text policy attribute-based encryption(CPABE)algorithm;Implementation of Merkle tree using Ethereum(MTuE)in a Multi-tenant system.Out of these four objectives,the main focus is on the implementation of CP-ABE algorithm.CP-ABE parameters are proposed for different levels of tenants.The levels include inner tenant,outer tenant,Inner-Outer-Tenant,Inner-Outer-External-Tenant,Outer-Inner-Tenant,External-Outer-Inner-Tenant and the parameters such as token,private key,public key,access tree,message,attribute set,node-level,cipher-text,salting which will help in providing better security using CP-ABE algorithm in a multitenant environment(MTE)where tenants can be provided with different levels of security and achieved 92 percentage of authenticity and access-control of the data.

基于区块链的云上数据访问控制模型研究

区块链和基于密文策略的属性加密(Ciphertext Policy Attribute Based Encryption,CP-ABE)相结合的方案已经被广泛应用于云上共享数据的访问控制,但是这些方案中数据用户的隐私保护问题并未得到妥善解决。一些研究引入分布式多属性授权中心的基于属性的签名方案(Distributed Multi-Authority Attribute Based Signature,DMA-ABS)来保护数据用户的隐私,但当数据用户多次访问数据时需要进行重复的权限验证,这会带来多余的时间消耗问题。并且,在数据用户的属性和访问控制策略保持相对稳定的情况下,数据用户无限制地重复访问共享数据,会导致系统过载,影响正常的请求处理。这可能会引起云端数据的泄露,给云端数据的安全带来隐患。为了解决这些问题,文中提出了一个基于区块链的云上个人隐私数据访问控制方案。该方案首先将智能合约和多属性授权中心的CP-ABE方案结合,实现了云上个人隐私数据的细粒度访问控制,并引入DMA-ABS方案完成了对数据用户的匿名性身份验证,保护了数据用户的身份隐私;其次,基于比特币UTXO(Unspent Transaction Output)机制,设计了一种数字令牌token,实现了一次授权、多次访问的功能,即缩短了访问时间,又限制了访问次数;最后,在Hyperledger Fabric上进一步实现了访问控制流程,并与现有方案进行了访问时间开销的比较。实验结果表明,所提方案能够有效降低访问时间开销,提高访问效率。