通信学报 ›› 2022, Vol. 43 ›› Issue (6): 168-178.doi: 10.11959/j.issn.1000-436x.2022119

• 学术论文 • 上一篇    下一篇

基于区块链且支持数据共享的密文策略隐藏访问控制方案

杜瑞忠1,2, 张添赫1, 石朋亮1,2   

  1. 1 河北大学网络空间安全与计算机学院，河北 保定 071000
    2 河北省高可信信息系统重点实验室，河北 保定 071000
  • 修回日期:2022-05-26 出版日期:2022-06-01 发布日期:2022-06-01
  • 作者简介:杜瑞忠（1975- ），男，河北献县人，博士，河北大学教授、博士生导师，主要研究方向为可信计算、信息安全等
    张添赫（1997- ），男，河北保定人，河北大学硕士生，主要研究方向为信息安全、访问控制、区块链等
    石朋亮（1992- ），男，河北保定人，河北大学讲师，主要研究方向为分布式计算、云存储安全等
  • 基金资助:
    国家自然科学基金资助项目(61572170);河北省自然科学基金资助项目(F2019201290)

Ciphertext policy hidden access control scheme based on blockchain and supporting data sharing

Ruizhong DU1,2, Tianhe ZHANG1, Pengliang SHI1,2   

  1. 1 School of Cyber Security and Computer, Hebei University, Baoding 071000, China
    2 Key Lab on High Trusted Information System in Hebei Province, Baoding 071000, China
  • Revised:2022-05-26 Online:2022-06-01 Published:2022-06-01
  • Supported by:
    The National Natural Science Foundation of China(61572170);The Natural Science Foundation of Hebei Province(F2019201290)

在线阅读

98

PDF下载

837

摘要：

目的：传统的属性基加密方案虽然实现了一对多的访问控制，但仍存在单点故障、效率低下、不支持数据共享以及隐私泄露等挑战。为了解决这些问题，提出了一种基于区块链且支持数据共享的密文策略隐藏访问控制方案。

方法：首先使用向量压缩技术提出了一种高效的属性向量和策略向量生成算法，通过属性向量和策略向量的内积运算结果来判断用户属性是否满足访问策略。之后利用素数阶双线性群和属性加密技术，实现细粒度访问控制的同时避免了用户属性值的泄露；利用星际文件系统存储密文并通过智能合约将密文的哈希地址存储在区块链上，实现分布式且可信赖的访问控制的同时降低了区块链的存储开销；通过撤销合约维护撤销列表的方式实现了撤销功能，避免了用户私钥滥用的问题，最后结合代理重加密技术实现了数据共享。

结果：对方案进行了安全性分析和仿真实验结果分析。首先，基于非对称决策双线性假设，证明了方案在访问控制阶段以及数据共享阶段的密文不可区分性，其次将本文方案与近几年一些所用技术相近的访问控制方案分别从群的阶、访问结构、策略隐藏等方面进行了功能特性对比，从对比结果可以看出，本文方案在功能特性上有一定的优势，之后评估了在区块链上部署合约以及执行相关函数的花费，结果表明本文方案的gas花费均在合理范围之内，最后仿真实验结果表明本文方案在访问控制阶段以及数据共享阶段都具有较高的效率。根据现有论文对比实验的设计，我们将属性个数设置为0-20个。在访问控制阶段，分别从初始化时间、密钥生成时间、加密时间、解密时间与其他方案进行对比分析，结果显示，本文方案虽然在初始化阶段的计算开销较大，但是在密钥生成阶段、加密阶段、解密阶段的效率均高于其他三个方案，因此本文方案在访问控制阶段具有较高的效率。在数据共享阶段，分别从重加密时间以及重解密时间与其他方案进行对比分析，结果表明，本文方案在重加密阶段和重解密阶段都具有较高的效率。本文方案在解密阶段和重解密阶段具有恒定的配对次数，因此解密时间和重解密时间较小并且随着属性个数的增加变化不明显。

结论：本文构建的基于区块链且支持数据共享的密文策略隐藏访问控制方案解决了传统属性基加密方案中存在的单点故障、效率低下、不支持数据共享以及隐私泄露等问题。首先本文提出的属性向量和策略向量生成算法不仅支持正负号与门访问结构，而且通过拓展可以支持多属性值与门访问结构。其次利用以太坊和星际文件系统实现了密文的分布式管理，之后使用素数阶双线性群提高了双线性对的配对效率并通过结合代理重加密技术实现了数据共享。

关键词: 属性基加密, 策略隐藏, 区块链, 数据共享, 属性撤销

Abstract:

Objectives: Although the traditional attribute-based encryption scheme achieves one-to-many access control,there are still challenges such as single point of failure,low efficiency,no support for data sharing,and privacy leakage.To solve these problems,a ciphertext policy hidden access control scheme based on blockchain and supporting data sharing is proposed.

Methods:Firstly,an efficient attribute vector and policy vector generation algorithm is proposed using vector compression technology, which judges whether user attributes satisfy the access policy through the inner product operation result of attribute vector and policy vector.Afterwards, the prime order bilinear group and attribute encryption technology were used to achieve fine-grained access control while avoiding the leakage of user attribute values; using the interstellar file system to store the ciphertext and storing the hash address of the ciphertext on the blockchain through a smart contract,it realizes distributed and reliable access control and reduces the storage overhead of the blockchain. The revocation function is realized by maintaining the revocation list in the revocation contract,which avoids the abuse of the user's private key.Finally, data sharing is realized by combining the proxy re-encryption technology.

Results: Security analysis and simulation result analysis is carried out for the scheme. Firstly, based on the asymmetric decisional bilinear Diffie-Hellman,the ciphertext indistinguishability of the scheme in the access control phase and the data sharing phase is proved. Secondly, the proposed scheme is compared with some access control schemes with similar technologies in recent years in terms of group order,access structure,policy hiding and so on,it can be seen from the comparison results that the scheme in this paper has certain advantages in terms of functional characteristics.Afterwards,the cost of deploying contracts and executing related functions on the blockchain is evaluated.The results show that the gas cost of the scheme in this paper is within a reasonable range.The final simulation results show that the proposed scheme has high efficiency in both the access control stage and the data sharing stage.According to the design of the existing paper comparative experiments,we set the number of attributes to 0-20.In the access control stage, the initialization time, key generation time, encryption time and decryption time are compared with other schemes.The results show that although the computational overhead of the proposed scheme is relatively large in the initialization stage, the efficiency in the key generation stage, encryption stage and decryption stage is higher than that of the other three schemes, so the proposed scheme has higher efficiency in the access control stage.In the data sharing stage, the re-encryption time and re-decryption time are compared with other schemes, respectively. The results show that the proposed scheme has high efficiency in both the re-encryption stage and the re-decryption stage.The scheme in this paper has a constant number of pairings in the decryption stage and the re-decryption stage,so the decryption time and the re-decryption time are small and the changes are not obvious with the increase of the number of attributes.

Conclusions: The ciphertext policy hiding access control scheme based on blockchain and supporting data sharing constructed in this paper solves the problems of single point of failure, low efficiency, non-support for data sharing and privacy leakage in traditional attribute-based encryption schemes.Firstly,the attribute vector and policy vector generation algorithm proposed in this paper not only supports AND-gates on+/-,but also supports AND-gates on multi-valued attributes by extension. Secondly, the distributed management of ciphertext is realized by using Ethereum and Interstellar file system.Afterwards,the use of prime order bilinear groups improves the pairing efficiency of bilinear pairs and realizes data sharing by combining proxy re-encryption technology.

Key words: attribute-based encryption, policy hidden, blockchain, data sharing, attribute revocation

中图分类号: 

No Suggested Reading articles found!