云存储环境下支持属性撤销的属性基加密方案

doi:10.11959/j.issn.1000-436x.2019116

通信学报 ›› 2019, Vol. 40 ›› Issue (5): 47-56.doi: 10.11959/j.issn.1000-436x.2019116

云存储环境下支持属性撤销的属性基加密方案

孙磊¹,赵志远²,王建华¹,朱智强¹

¹ 战略支援部队信息工程大学三院，河南郑州 450001
² 61516部队，北京 100062

修回日期:2019-04-22 出版日期:2019-05-25 发布日期:2019-05-30
作者简介:孙磊（1973- ），男，江苏靖江人，博士，战略支援部队信息工程大学教授，主要研究方向为云计算、计算机网络、信息安全等。|赵志远（1989- ），男，吉林磐石人，61516部队工程师，主要研究方向为云计算、信息安全和公钥密码等。|王建华（1962- ），男，北京人，博士，战略支援部队信息工程大学教授，主要研究方向为密码学、信息安全、计算机网络等。|朱智强（1961- ），男，吉林长春人，博士，战略支援部队信息工程大学教授，主要研究方向为云计算、网络与信息安全、密码学等。
基金资助:
国家重点基础研究发展计划（“973”计划）基金资助项目(2013CB338000);国家重点研发计划基金资助项目(2016YFB0501900)

Attribute-based encryption scheme supporting attribute revocation in cloud storage environment

Lei SUN¹,Zhiyuan ZHAO²,Jianhua WANG¹,Zhiqiang ZHU¹

¹ The Third Institute,Strategic Support Force Information Engineering University,Zhengzhou 450001,China
² Troops 61516,Beijing 100062,China

Revised:2019-04-22 Online:2019-05-25 Published:2019-05-30
Supported by:
The National Basic Research Program of China (973 Program)(2013CB338000);The National Key Research and Development Program of China(2016YFB0501900)

摘要/Abstract

摘要：

属性基加密因其细粒度访问控制在云存储中得到了广泛应用。在属性基加密方案中，每个属性可能同时被多个用户共享，因此如何实现属性级用户撤销且能够抵抗用户合谋攻击是当前面临的重要挑战。针对上述问题，提出了一种支持属性撤销的属性基加密方案，所提方案可以有效地抵抗撤销用户与未撤销用户的合谋攻击，同时，将复杂的解密计算外包给具有强大计算能力的云服务商，减轻了数据用户的计算负担。在标准模型下，基于计算性Diffie-Hellman假设完成安全证明。最后从理论和实验2个方面对所提方案的效率与功能进行分析，结果表明所提方案可以安全地实现属性级用户撤销，并具有快速解密的能力。

关键词: 云存储, 属性基加密, 合谋攻击, 属性撤销, 解密外包

Abstract:

Attribute-based encryption (ABE) scheme is widely used in the cloud storage due to its fine-grained access control.Each attribute in ABE may be shared by multiple users at the same time.Therefore,how to achieve attribute-level user revocation is currently facing an important challenge.Through research,it has been found that some attribute-level user revocation schemes currently can’t resist the collusion attack between the revoked user and the existing user.To solve this problem,an attribute-based encryption scheme that supported the immediate attribute revocation was proposed.The scheme could achieve attribute-level user revocation and could effectively resist collusion attacks between the revoked users and the existing users.At the same time,this scheme outsourced complex decryption calculations to cloud service providers with powerful computing ability,which reduced the computational burden of the data user.The scheme was proved secure based on computational Diffie-Hellman assumption in the standard model.Finally,the functionality and efficiency of the proposed scheme were analyzed and verified.The experimental results show that the proposed scheme can safely implement attribute-level user revocation and has the ability to quickly decrypt,which greatly improves the system efficiency.

Key words: cloud storage, attribute-based encryption, collusion attack, attribute revocation, outsourced decryption

中图分类号:

TP309

孙磊,赵志远,王建华,朱智强. 云存储环境下支持属性撤销的属性基加密方案[J]. 通信学报, 2019, 40(5): 47-56.

Lei SUN,Zhiyuan ZHAO,Jianhua WANG,Zhiqiang ZHU. Attribute-based encryption scheme supporting attribute revocation in cloud storage environment[J]. Journal on Communications, 2019, 40(5): 47-56.

图/表 5

图1

表1

参考文献 19

[1]	SUBASHINI S , KAVITHA V . A survey on security issues in service delivery models of cloud computing[J]. Journal of Network and Computer Applications, 2011,34(1): 1-11.
[2]	SAHAI A , WATERS B . Fuzzy identity-based encryption[C]// The 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques. 2005: 457-473.
[3]	姚亮, 杨超, 马建峰 ,等. 云端数据访问控制中基于中间代理的用户撤销新方法[J]. 通信学报, 2015,36(11): 92-101.
	YAO L , YANG C , MA J F ,et al. New user revocation approach based on intermediate agency for cloud data access control[J]. Journal on Communications, 2015,36(11): 92-101.
[4]	GOYAL V , PANDEY O , SAHAI A ,et al. Attribute-based encryption for fine-grained access control of encrypted data[C]// The 13th ACM Conference on Computer and Communications Security. ACM, 2006: 89-98.
[5]	BETHENCOURT J , SAHAI A , WATERS B . Ciphertext-policy attribute-based encryption[C]// IEEE Symposium on Security and Privacy. IEEE, 2007: 321-334.
[6]	SOOKHAK M , YU F R , KHAN M K ,et al. Attribute-based data access control in mobile cloud computing:Taxonomy and open issues[J]. Future Generation Computer Systems, 2017,72(C): 273-287.
[7]	李勇, 曾振宇, 张晓菲 . 支持属性撤销的外包解密方案[J]. 清华大学学报:自然科学版, 2013,53(12): 1664-1669.
	LI Y , ZENG Z Y , ZHANG X F . Outsourced decryption scheme supporting attribute revocation[J]. Journal of Tsinghua University (Science ＆ Technology), 2013,53(12): 1664-1669.
[8]	PIRRETTI M , TRAYNOR P , MCDANIEL P ,et al. Secure attribute-based systems[C]// The 13th AMC conference on Computer and Communications Security. AMC, 2006: 99-112.
[9]	RAFAELI S , HUTCHISON D . A survey of key management for secure group communication[J]. ACM Computing Surveys, 2003,35(3): 309-329.
[10]	IBRAIMI L , PETKOVIC M , NIKOVA S ,et al. Mediated ciphertext-policy attribute-based encryption and its application[C]// The 10th International Workshop on Information Security Applications. 2009: 309-323.
[11]	YU S , WANG C , REN K ,et al. Attribute based data sharing with attribute revocation[C]// The 5th ACM Symposium on Information,Computer and Communications Security. ACM, 2010: 261-270.
[12]	HUR J , NOH D K . Attribute-based access control with efficient revocation in data outsourcing systems[J]. IEEE Transactions on Parallel and Distributed Systems, 2011,22(7): 1214-1221.
[13]	YANG K , JIA X , REN K . Attribute-based fine-grained access control with efficient revocation in cloud storage systems[C]// The 8th ACM SIGSAC Symposium on Information,Computer and Communications Security. ACM, 2013: 523-528.
[14]	YANG K , JIA X . Security for cloud storage systems[M]. Berlin: SpringerPress, 2014.
[15]	马华, 白翠翠, 李宾 ,等. 支持属性撤销和解密外包的属性基加密方案[J]. 西安电子科技大学学报 (自然科学版), 2015,42(6): 6-10.
	MA H , BAI C C , LI B ,et al. Attribute-based encryption scheme supporting attribute revocation and decryption outsourcing[J]. Journal of Xidian University (Science ＆ Technology), 2015,42(6): 6-10.
[16]	SHIRAISHI Y , NOMURA K , MOHRI M ,et al. Attribute revocable attribute-based encryption with forward secrecy for fine-grained access control of shared data[J]. IEICE Transactions on Information and Systems, 2017,100(10): 2432-2439.
[17]	GREEN M , HOHENBERGER S , WATERS B . Outsourcing the decryption of ABE ciphertexts[C]// The 20th USENIX Conference on Security. USENIX, 2011:34.
[18]	LAI J , DENG R H , GUAN C ,et al. Attribute-based encryption with verifiable outsourced decryption[J]. IEEE Transactions on Information Forensics and Security, 2013,8(8): 1343-1354.
[19]	LI J , SHA F , ZHANG Y ,et al. Verifiable outsourced decryption of attribute-based encryption with constant ciphertext length[J]. Security and Communication Networks, 2017,2017(2): 1-11.

符号	含义
S	数据用户的属性集合
(M,ρ)	数据拥有者定义的LSSS访问结构
m	明文消息
PK,MSK	系统公钥和系统主私钥
DPK,DSK	DSM公钥和主私钥
RK	数据用户私钥
SK	数据用户转换密钥
KEK′	属性群初始密钥
KEK	属性群密钥
$\bar{KEK}$	属性撤销后的属性群密钥
CT′	中间密文
CT	密文
$\bar{C} \bar{T}$	转换密文
$\bar{CT}$	属性撤销后的密文
Hdr	密文头
$\bar{Hdr}$	属性撤销后的密文头

对比方案	访问结构	安全假设	安全模型	撤销粒度	外包解密
文献[12]方案	Tree	—	一般群模型	属性级用户撤销	不支持
文献[13]方案	LSSS	q-parallel BDHE	随机预言机模型	属性级用户撤销	不支持
文献[15]方案	LSSS	—	一般群模型	属性级用户撤销	支持
文献[16]方案	LSSS	q-parallel BDHE	标准模型	属性级用户撤销	不支持
本文方案	LSSS	CDH	标准模型	属性级用户撤销	支持

对比方案	AA与DU	AA与DO	CSP与DU	CSP与DO
文献[12]方案	(2n_k+1)\|g\|	2\|g\|+\|g_T\|	$(2 n_{c} + 1) \| g \| + \| g_{T} \| + (\frac{n_{c} n_{u}}{2} + l b (n_{u} + 1)) \| C_{k} \|$	(2n_c+1)\|g\|+\|g_T\|
文献[13]方案	(n_a+4)\|p\|	(2n_a+4)\|g\|+\|g_T\|	$(3 n_{c} + 1) \| g \| + \| g_{T} \|$	(3n_c+1)\|g\|+\|g_T\|
文献[15]方案	(n_k+2)\|g\|+\|p\|	(n_a+2)\|g\|+\|g_T\|	$(n_{c} + n_{k} + 5) \| g \| + \| g_{T} \| + (\frac{n_{c} n_{u}}{2} + l b (n_{u} + 1)) \| C_{k} \|$	(n_c+3)\|g\|+\|g_T\|
文献[16]方案	(n_k+2)\|g\|	(n_a+2)\|g\|+\|g_T\|	$(2 n_{c} + 1) \| g \| + \| g_{T} \|$	(2n_c+1)\|g\|+\|g_T\|
本文方案	(2n_k+2)\|g\|+\|p\|	(n_a+2)\|g\|+\|g_T\|	$(n_{c} + \frac{n_{c} n_{u}}{2} + 4 n_{k} + 2) \| g \| + \| g_{T} \| + (n_{k} + \frac{n_{u}}{2}) \| p \|$	(n_c+1)\|g\|+\|g_T\|

云存储环境下支持属性撤销的属性基加密方案

Attribute-based encryption scheme supporting attribute revocation in cloud storage environment

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 5

参考文献 19

相关文章 15

Metrics

推荐阅读 0

[1]	刘雪娇, 曹天聪, 夏莹杰. 区块链架构下高效的车联网跨域数据安全共享研究[J]. 通信学报, 2023, 44(3): 186-197.
[2]	哈冠雄, 贾巧雯, 陈杭, 贾春福. 无第三方服务器的基于数据流行度的加密去重方案[J]. 通信学报, 2022, 43(8): 17-29.
[3]	杜瑞忠, 张添赫, 石朋亮. 基于区块链且支持数据共享的密文策略隐藏访问控制方案[J]. 通信学报, 2022, 43(6): 168-178.
[4]	殷新春, 王梦宇, 宁建廷. 轻量级可搜索医疗数据共享方案[J]. 通信学报, 2022, 43(5): 110-122.
[5]	冯涛, 孔繁琪, 柳春岩, 马蓉, Maher Albettar. 基于区块链的双重可验证云存储方案[J]. 通信学报, 2021, 42(12): 192-201.
[6]	贾春福, 哈冠雄, 武少强, 陈杭, 李瑞琪. 加密去重场景下基于AONT和NTRU的密钥更新方案[J]. 通信学报, 2021, 42(10): 67-80.
[7]	张嘉伟, 马建峰, 马卓, 李腾. 云计算中基于时间和隐私保护的可撤销可追踪的数据共享方案[J]. 通信学报, 2021, 42(10): 81-94.
[8]	闫玺玺,何旭,刘涛,叶青,于金霞,汤永利. 抗密钥委托滥用的可追踪属性基加密方案[J]. 通信学报, 2020, 41(4): 150-161.
[9]	田俊峰,王彦骉,何欣枫,张俊涛,杨万贺,庞亚南. 数据因果一致性研究综述[J]. 通信学报, 2020, 41(3): 154-167.
[10]	闫玺玺,原笑含,汤永利,陈艳丽. 基于区块链且支持验证的属性基搜索加密方案[J]. 通信学报, 2020, 41(2): 187-198.
[11]	柯文龙,王勇,叶苗,陈俊奇. Ceph云存储网络中一种业务优先级区分的多播流调度方法[J]. 通信学报, 2020, 41(11): 40-51.
[12]	李学俊,张丹,李晖. 可高效撤销的属性基加密方案[J]. 通信学报, 2019, 40(6): 32-39.
[13]	张襄松,李晨,刘振华. 抗密钥泄露的支持密态数据去重的完整性审计方案[J]. 通信学报, 2019, 40(4): 95-106.
[14]	田苗苗,高闯,陈洁. 格上基于身份的云存储完整性检测方案[J]. 通信学报, 2019, 40(4): 128-139.
[15]	田俊峰,柴梦佳,齐鎏岭. 基于公有验证和私有验证的数据持有性验证方案[J]. 通信学报, 2019, 40(3): 48-59.