基于覆写验证的云数据确定性删除方案

doi:10.11959/j.issn.1000-436x.2019012

通信学报 ›› 2019, Vol. 40 ›› Issue (1): 130-140.doi: 10.11959/j.issn.1000-436x.2019012

基于覆写验证的云数据确定性删除方案

杜瑞忠¹,石朋亮¹,何欣枫¹

¹ 河北大学网络空间安全与计算机学院，河北保定 071002
² 河北省高可信信息系统重点实验室，河北保定 071002

修回日期:2018-10-31 出版日期:2019-01-01 发布日期:2019-02-03
作者简介:杜瑞忠（1975- ），男，河北献县人，博士，河北大学教授，主要研究方向为可信计算与信息安全等。|石朋亮（1992- ），男，河北唐县人，河北大学硕士生，主要研究方向为可信计算与信息安全等。|何欣枫（1976- ），男，天津人，河北大学副教授，主要研究方向为云计算安全与可信计算等。
基金资助:
国家自然科学基金资助项目(61572170);河北省自然科学基金资助项目(F2018201153);河北省自然科学基金资助项目(2016205023);北省高等学校科学技术研究基金资助项目(ZD2016043);河北省物联网监控工程技术研究中心基金资助项目(3142016020)

Cloud data assured deletion scheme based on overwrite verification

Ruizhong DU¹,Pengliang SHI¹,Xinfeng HE¹

¹ Cyberspace Security and Computer College,Hebei University,Baoding 071002,China
² Key Lab on High Trusted Information System in Hebei Province,Baoding 071002,China

Revised:2018-10-31 Online:2019-01-01 Published:2019-02-03
Supported by:
The National Natural Science Foundation of China(61572170);The Natural Science Foundation of Hebei Province(F2018201153);The Natural Science Foundation of Hebei Province(2016205023);The Science and Technology Research Project in Colleges and Universities of Hebei Province(ZD2016043);Hebei IoT Monitoring Engineering Technology Research Center(3142016020)

摘要/Abstract

摘要：

云存储中的数据在生命周期结束删除时，大多是采用删除密钥的逻辑删除方式进行处理，数据仍存在泄露风险，为此提出了一种基于密文重加密与覆写验证结合的云数据确定性删除方案（WV-CP-ABE）。当数据拥有者想删除外包数据时，通过重新加密密文改变密文对应的访问控制策略来实现数据细粒度删除操作；其次构建基于脏数据块覆写的可搜索路径散列二叉树（DSMHT），对要删除的数据进行覆写后正确性验证；最终采用更改密文访问控制策略和数据覆写双重机制保障数据确定性删除。实验分析证明，所提方案在数据确定性删除方面比以前的逻辑删除方法细粒度控制更好，安全性更可靠。

关键词: 云存储, 密文属性加密, 确定性删除, 散列二叉树, 覆写验证

Abstract:

At the end of data life cycle,there is still a risk of data leakage,because mostly data which was stored in cloud is removed by logical deletion of the key.Therefore,a cloud data assured deletion scheme (WV-CP-ABE) based on ciphertext re-encrypt and overwrite verification was proposed.When data owner wants to delete the outsourced data,the data fine-grained deletion operation was realized by re-encrypting the ciphertext to change the access control policy.Secondly,a searchable path hash binary tree (DSMHT) based on dirty data block overwrite was built to verify the correctness of the data to be deletion.Finally,the dual mechanism of changing the ciphertext access control policy and data overwriting guarantees the data assured deletion.The experimental analysis proves that the fine-grained control is better and the security is more reliable than the previous logical delete method in the assured deletion of data.

Key words: cloud storage, CP-ABE, assured deletion, Hash binary tree, overwrite and verify

中图分类号:

TP393.08

杜瑞忠,石朋亮,何欣枫. 基于覆写验证的云数据确定性删除方案[J]. 通信学报, 2019, 40(1): 130-140.

Ruizhong DU,Pengliang SHI,Xinfeng HE. Cloud data assured deletion scheme based on overwrite verification[J]. Journal on Communications, 2019, 40(1): 130-140.

图/表 13

图1

表1

图2

图3

图4

图5

表2

图6

图7

图8

图9

图10

表3

参考文献 21

[1]	王国峰, 刘川意, 潘鹤中, 方滨兴 . 云计算模式内部威胁综述[J]. 计算机学报, 2017,40(02): 296-316.
	WANG G F , LIU C Y , PAN H Z , FANG B X . Survey on Insider to Cloud Computing[J]. Chinese Journal of Computers, 2017,40(02): 296-316.
[2]	KAUSPADIENE L , RAMANAUSKAITE S , CENYS A ,et al. Modeling of enterprise management structure for data Leakage evaluation[J]. Information Security Journal:A Global Perspective, 2018,27(1): 1-13.
[3]	RAMOKAPANE K M , RASHID A , SUCH J M . Assured deletion in the cloud:requirements,challenges and future directions[C]// ACM On Cloud Computing Security Workshop. 2011: 97-108.
[4]	熊金波, 李凤华, 王彦超, 马建峰, 姚志强 . 基于密码学的云数据确定性删除研究进展[J]. 通信学报, 2016,37(08): 167-184.
	XIONG J B , LI F H , WANG Y C . Research progress on cloud data assured deletion based on cryptography[J]. Journal on Communication, 2016,37(8): 168-184.
[5]	GEAMBASU R , KOHNO T , LEVY A ,et al. Vanish:increasing data privacy with self-destructing data[C]// ACM Conference on USENIX Security Symposium. 2009: 299-316.
[6]	ZENG L , SHI Z , XU S ,et al. SafeVanish:an improved data self-destruction for protecting data privacy[C]// IEEE International Conference on Cloud Computing Technology and Science. 2010: 521-528.
[7]	LI C L , CHEN Y , ZHOU Y D . A data assued deletion scheme in cloud storage[J]. China Communication, 2014,11(04): 98-110.
[8]	YAO W B , CHEN Y J , WANG D B . Cloud multimedia files assured deletion based on bit stream transformation with chaos sequence[J]. Algorithms and Architectures for Parallel Processing.ICA3PP, 2017: 441-451.
[9]	XUE L , YU Y , LI Y ,et al. Efficient attribute-based encryption with attribute revocation for assured data deletion[J]. Information Sciences, 2018: 1-11.
[10]	张坤, 杨超, 马建峰 ,等. 基于密文采样分片的云端数据确定性删除方法[J]. 通信学报, 2015,36(11): 108-117.
	ZHANG K , YANG C , MA J F ,et al. Novel cloud data assured deletion approach based on ciphertext sample slice[J]. Journal on Communications, 2015,36(11): 108-117.
[11]	MO Z , XIAO Q J , ZHOU Y . On deletion of outsourced data in cloud computing[C]// International Conference on Cloud Computing,IEEE, 2014: 344-351.
[12]	XIONG J , YAO Z , MA J ,et al. A secure document self-destruction scheme with identity based encryption[C]// The International Conference on Intelligent Networking and Collaborative Systems. 2013: 239-243.
[13]	MO Z , QIAO Y , CHEN S . Two-party fine-grained assured deletion of outsourced data in cloud systems[C]// International Conference on Computing System.. 2014: 308-317.
[14]	YU Y , XUE L , LI Y ,et al. Assured data deletion with fine-grained access control for fog-based industrial applications[J]. IEEE Transactions on Industrial Informatics, 2018,PP(99): 1-1.
[15]	曹来成, 刘宇飞, 董晓晔, 郭显 . 基于属性加密的用户隐私保护云存储方案[J]. 清华大学学报(自然科学版), 2018,58(02): 150-156.
	CAO L C , LIU Y F , DONG X Y , GUO X . User privacy-preserving cloud storage scheme on CP-ABE[J]. Journal of Tsinghua University (Science and Technology), 2018,58(02): 150-156.
[16]	GEAMBASU R , KOHNO T , LEVY A ,et al. Vanish:increasing data privacy with self-destructing data[C]// The USENIX Security Symposium. 2009: 299-315.
[17]	XIONG J B , YAO Z Q , MA J F ,et al. A secure self-destruction scheme with IBE for the internet content privacy[J]. Chinese Journal of Computers, 2014,37(1): 139-150.
[18]	YAO Z Q , XIONG J B , MA J F ,et al. A secure electronic document self-destructing scheme in cloud computing[J]. Journal of Computer Research and Development, 2014,51(7): 1417-1423.
[19]	XIONG J B , YAO Z Q , MA J F ,et al. A secure self-destruction scheme for composite documents with attribute based encryption[J]. ACTA Electronica Sinica, 2013,42(2): 366-376.
[20]	ISOIT I , DAVID S , GUSTSVO A . Active pages 20 years Later:active storage for the cloud[J]. IEEE Internet Computing, 2018,22(4): 6-14.
[21]	JUNG T , LI X Y , WAN Z ,et al. Privacy preserving cloud data access with multi-authorities[C]// INFOCOM. IEEE, 2013: 2625-2633.

符号	含义
PK	系统的公钥
MSK	系统的主密钥
SK_u	授权用户私钥
M	原始密文
C	加密密文
NC	重新加密后的密文
DC	脏数据覆写后的密文
Ω	系统属性集合
A_u	授权用户所拥有的属性集合
AC	基于策略属性的访问控制策略
a_j	系统属性集合里的属性元素
G_T	阶为P的乘法循环群
G_V	阶为p的乘法循环群
g	群G₀的生成元
n	系统属性集合中属性的个数
Z_p	阶为P的整数域
D_o	用户私钥的公共数值
D_j	用户私钥的属性值
H(.)	单向散列函数

方案	加密方式	删除机制	细粒度安全访问	删除验证
Vanish^[16]	对称密钥	删除密钥	无	无
ISS^[17]	IBE	删除密钥	身份控制访问粒度	无
ESITE^[18]	IB-TRE	删除密钥	身份+时间控制访问粒度	无
SelfDOC^[19]	ABE	删除密钥+抽样密文	多安全等级+访问控制策略	无
WV-CP-ABE	CP-ABE	重加密访问策略+数据覆写	基于属性访问控制策略	有

文件大小/MB	覆写时间/s	覆写验证时间/s
1	0.060	0.175
2	0.144	0.42
4	0.260	0.9
8	0.450	1.61
16	0.630	3.34
32	1.421	5.14
64	2.786	9.45

基于覆写验证的云数据确定性删除方案

Cloud data assured deletion scheme based on overwrite verification

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 13

参考文献 21

相关文章 15

Metrics

推荐阅读 0

[1]	哈冠雄, 贾巧雯, 陈杭, 贾春福. 无第三方服务器的基于数据流行度的加密去重方案[J]. 通信学报, 2022, 43(8): 17-29.
[2]	冯涛, 孔繁琪, 柳春岩, 马蓉, Maher Albettar. 基于区块链的双重可验证云存储方案[J]. 通信学报, 2021, 42(12): 192-201.
[3]	贾春福, 哈冠雄, 武少强, 陈杭, 李瑞琪. 加密去重场景下基于AONT和NTRU的密钥更新方案[J]. 通信学报, 2021, 42(10): 67-80.
[4]	田俊峰,王彦骉,何欣枫,张俊涛,杨万贺,庞亚南. 数据因果一致性研究综述[J]. 通信学报, 2020, 41(3): 154-167.
[5]	柯文龙,王勇,叶苗,陈俊奇. Ceph云存储网络中一种业务优先级区分的多播流调度方法[J]. 通信学报, 2020, 41(11): 40-51.
[6]	孙磊,赵志远,王建华,朱智强. 云存储环境下支持属性撤销的属性基加密方案[J]. 通信学报, 2019, 40(5): 47-56.
[7]	张襄松,李晨,刘振华. 抗密钥泄露的支持密态数据去重的完整性审计方案[J]. 通信学报, 2019, 40(4): 95-106.
[8]	田苗苗,高闯,陈洁. 格上基于身份的云存储完整性检测方案[J]. 通信学报, 2019, 40(4): 128-139.
[9]	田俊峰,柴梦佳,齐鎏岭. 基于公有验证和私有验证的数据持有性验证方案[J]. 通信学报, 2019, 40(3): 48-59.
[10]	严新成,陈越,贾洪勇,陈彦如,张馨月. 支持高效密文密钥同步演化的安全数据共享方案[J]. 通信学报, 2018, 39(5): 123-133.
[11]	陈越,王龙江,严新成,张馨月. 基于再生码的拟态数据存储方案[J]. 通信学报, 2018, 39(4): 21-34.
[12]	王少辉,潘笑笑,王志伟,肖甫,王汝传. 对基于身份云数据完整性验证方案的分析与改进[J]. 通信学报, 2018, 39(11): 98-105.
[13]	王斌,李伟民,盛津芳,肖斯诺. TCCL：安全高效的拓展云桌面架构[J]. 通信学报, 2017, 38(Z1): 9-18.
[14]	宋衍,韩臻,李建军,韩磊. 支持安全共享的云存储系统研究[J]. 通信学报, 2017, 38(Z1): 88-96.
[15]	杜瑞忠,王少泫,田俊峰. 基于封闭环境加密的云存储方案[J]. 通信学报, 2017, 38(7): 1-10.