面向云存储的属性基双边访问控制方案

doi:10.11959/j.issn.1000-436x.2024062

通信学报 ›› 2024, Vol. 45 ›› Issue (4): 128-136.doi: 10.11959/j.issn.1000-436x.2024062

• 学术论文 • 上一篇

面向云存储的属性基双边访问控制方案

李琦¹^,²^,³, 樊昊源¹, 陈伟¹, 熊金波⁴(), 韩立东², 李瑞⁵

^1.南京邮电大学计算机学院, 江苏南京 210023
^2.杭州师范大学浙江省密码技术重点实验室, 浙江杭州 311121
^3.南京邮电大学通达学院, 江苏扬州 225127
^4.福建师范大学计算机与网络空间安全学院, 福建福州 350117
^5.西安电子科技大学计算机科学与技术学院, 陕西西安 710071

收稿日期:2023-10-25 修回日期:2024-02-20 出版日期:2024-04-30 发布日期:2024-05-27
通讯作者: 熊金波 E-mail:jinbo810@163.com
作者简介:李琦（1989- ），男，江苏淮安人，博士，南京邮电大学副教授，主要研究方向为属性基密码学、访问控制、物联网安全等。
樊昊源（2000- ），男，山西晋城人，南京邮电大学硕士生，主要研究方向为属性基密码学。
陈伟（1979- ），男，江苏淮安人，博士，南京邮电大学教授，主要研究方向为网络安全、人工智能安全等。
熊金波（1981- ），男，湖南益阳人，博士，福建师范大学教授、博士生导师，主要研究方向为安全深度学习、数据安全与隐私保护。
韩立东（1982- ），男，山东济南人，博士，杭州师范大学副教授，主要研究方向为公钥密码学、云计算安全、网络安全等。
李瑞（1983- ），男，陕西西安人，博士，西安电子科技大学教授，主要研究方向为智能感知、物联网与智能化系统等。
基金资助:
国家自然科学基金资助项目(62272102);江苏省高等学校基础科学（自然科学）研究基金资助项目(22KJB520029);浙江省密码技术重点实验室基金资助项目(ZCL21015);南京邮电大学校级自然科学基金资助项目(NY222141)

Attribute-based bilateral access control scheme for cloud storage

Qi LI¹^,²^,³, Haoyuan FAN¹, Wei CHEN¹, Jinbo XIONG⁴(), Lidong HAN², Rui LI⁵

^1.School of Computer Science, Nanjing University of Posts and Telecommunications, Nanjing 210023, China
^2.Key Laboratory of Cryptography of Zhejiang Province, Hangzhou Normal University, Hangzhou 311121, China
^3.Tongda College of Nanjing University of Posts and Telecommunications, Yangzhou 225127, China
^4.College of Computer and Cyber Security, Fujian Normal University, Fuzhou 350117, China
^5.The School of Computer Science and Technology, Xidian University, Xi’an 710071, China

Received:2023-10-25 Revised:2024-02-20 Online:2024-04-30 Published:2024-05-27
Contact: Jinbo XIONG E-mail:jinbo810@163.com
Supported by:
The National Natural Science Foundation of China(62272102);The Natural Science Foundation of Jiangsu Higher Education Institutions of China(22KJB520029);The Open Research Fund of Key Laboratory of Cryptography of Zhejiang Province(ZCL21015);The Natural Science Foundation of Nanjing University of Posts and Telecommunications(NY222141)

摘要/Abstract

摘要：

针对目前云存储中细粒度双边访问控制机制安全模型较弱且外包解密结果缺乏验证的问题，提出了一种面向云存储数据的属性基双边访问控制方案。首先，提出了自适应安全可验证外包双边CP-ABE的形式化定义和安全模型；其次，以此为基础并结合批量可验证技术在合数阶群上设计了双边访问控制方案，支持数据拥有者与数据使用者同时为对方定义访问策略；最后，安全性分析表明，所提方案在自适应安全模型下针对选择明文攻击与选择消息攻击是不可区分的和存在性不可伪造的。实验结果显示，所提方案减轻了用户端的匹配、解密以及验证阶段的计算开销。

关键词: 云存储, 双边访问控制, 自适应安全, 批量可验证, 外包解密

Abstract:

In the existing cloud storage systems, the fine grained and bilateral access control schemes suffer from weak security model and unverifiable outsourced decryption result. To address this problem, an attribute-based bilateral access control scheme for cloud storage was proposed. Firstly, the formal definition and secure model of adaptively secure and verifiable outsourced bilateral CP-ABE was given. Secondly, combining with the batch verification technology, the attribute based bilateral access control scheme was constructed on the composite order groups, which enabled both the data owner and data user to simultaneously define the access policies for each other. Finally, the security analysis showed that the proposed scheme was indistinguishable and existential unforgeable under adaptive security models against chosen plaintext attacks and chosen message attacks, respectively. The experimental results show that the proposed scheme achieves high performance on the user side, where the computational overhead of matching, decryption, and verification is reduced.

Key words: cloud storage, bilateral access control, adaptively secure, batch verification, outsourced decryption

中图分类号:

TN92

李琦, 樊昊源, 陈伟, 熊金波, 韩立东, 李瑞. 面向云存储的属性基双边访问控制方案[J]. 通信学报, 2024, 45(4): 128-136.

Qi LI, Haoyuan FAN, Wei CHEN, Jinbo XIONG, Lidong HAN, Rui LI. Attribute-based bilateral access control scheme for cloud storage[J]. Journal on Communications, 2024, 45(4): 128-136.

图/表 4

参考文献 21

1	ZHANG Y H, DENG R H, XU S M, et al. Attribute-based encryption for cloud computing access control: a survey[J]. ACM Computing Surveys, 2021, 53(4): 1-41.
2	SAHAI A, WATERS B. Fuzzy identity-based encryption[C]//Advances in Cryptology. Berlin: Springer, 2005: 457-473.
3	BETHENCOURT J, SAHAI A, WATERS B. Ciphertext-policy attribute-based encryption[C]//Proceedings of the 2007 IEEE Symposium on Security and Privacy. Piscataway: IEEE Press, 2007: 321-334.
4	YU S C, WANG C, REN K, et al. Achieving secure, scalable, and fine-grained data access control in cloud computing[C]//Proceedings of IEEE INFOCOM. Piscataway: IEEE Press, 2010: 1-9.
5	张嘉伟, 马建峰, 马卓, 等. 云计算中基于时间和隐私保护的可撤销可追踪的数据共享方案[J]. 通信学报, 2021, 42(10): 81-94.
	ZHANG J W, MA J F, MA Z, et al. Time-based and privacy protection revocable and traceable data sharing scheme in cloud computing[J]. Journal on Communications, 2021, 42(10): 81-94.
6	郭丽峰, 邢晓敏, 郭慧. 云存储中高效可追踪可撤销的属性基加密方案[J]. 密码学报, 2023, 10(1): 131-145.
	GUO L F, XING X M, GUO H. An efficient traceable and revocable attribute-based encryption scheme in cloud storage[J]. Journal of Cryptologic Research, 2023, 10(1): 131-145.
7	宁建廷, 黄欣沂, 魏立斐, 等. 支持恶意用户追踪的属性基云数据共享方案[J]. 计算机学报, 2022, 45(7): 1431-1445.
	NING J T, HUANG X Y, WEI L F, et al. Tracing malicious insider in attribute-based cloud data sharing[J]. Chinese Journal of Computers, 2022, 45(7): 1431-1445.
8	罗王平, 冯朝胜, 邹莉萍, 等. 一种支持快速加密的基于属性加密方案[J]. 软件学报, 2020, 31(12): 3923-3936.
	LUO W P, FENG C S, ZOU L P, et al. Attribute-based encryption scheme with fast encryption[J]. Journal of Software, 2020, 31(12): 3923-3936.
9	冯涛, 陈李秋, 方君丽, 等. 基于本地化差分隐私和属性基可搜索加密的区块链数据共享方案[J]. 通信学报, 2023, 44(5): 224-233.
	FENG T, CHEN L Q, FANG J L, et al. Blockchain data sharing scheme based on localized difference privacy and attribute-based searchable encryption[J]. Journal on Communications, 2023, 44(5): 224-233.
10	MIAO Y B, TONG Q Y, CHOO K K R, et al. Secure online/offline data sharing framework for cloud-assisted industrial Internet of things[J]. IEEE Internet of Things Journal, 2019, 6(5): 8681-8691.
11	NING J T, CAO Z F, DONG X L, et al. Auditable $\sigma $-time outsourced attribute-based encryption for access control in cloud computing[J]. IEEE Transactions on Information Forensics and Security, 2018, 13(1): 94-105.
12	DAMG?RD I, HAAGH H, ORLANDI C. Access control encryption: enforcing information flow with cryptography[C]//Theory of Cryptography Conference. Berlin: Springer, 2016: 547-576.
13	KIM S, WU D J. Access control encryption for general policies from standard assumptions[J]. IACR Cryptology EPrint Archive, 2017, 2017: 467.
14	CUI J, LI B, ZHONG H, et al. A practical and efficient bidirectional access control scheme for cloud-edge data sharing[J]. IEEE Transactions on Parallel and Distributed Systems, 2022, 33(2): 476-488.
15	ATENIESE G, FRANCATI D, NU?EZ D, et al. Match me if you can: matchmaking encryption and its applications[J]. Journal of Cryptology, 2021, 34(3): 16.
16	XU S M, NING J T, LI Y J, et al. Match in my way: fine-grained bilateral access control for secure cloud-fog computing[J]. IEEE Transactions on Dependable and Secure Computing, 2022, 19(2): 1064-1077.
17	GOYAL V, PANDEY O, SAHAI A, et al. Attribute-based encryption for fine-grained access control of encrypted data[C]//Proceedings of the 13th ACM Conference on Computer and Communications Security. New York: ACM Press, 2006: 89-98.
18	XU S M, NING J T, HUANG X Y, et al. Server-aided bilateral access control for secure data sharing with dynamic user groups[J]. IEEE Transactions on Information Forensics and Security, 2021, 16: 4746-4761.
19	SUN J F, YUAN Y, TANG M J, et al. Privacy-preserving bilateral fine-grained access control for cloud-enabled industrial IoT healthcare[J]. IEEE Transactions on Industrial Informatics, 2022, 18(9): 6483-6493.
20	LEWKO A, OKAMOTO T, SAHAI A, et al. Fully secure functional encryption: attribute-based encryption and (hierarchical) inner product encryption[C]//Advances in Cryptology. Berlin: Springer, 2010: 62-91.
21	CARO A D, IOVINO V. jPBC: Java pairing based cryptography[C]//Proceedings of the 2011 IEEE Symposium on Computers and Communications (ISCC). Piscataway: IEEE Press, 2011: 850-855.

方案	LSSS访问策略	IND-CPA	EU-CMA	双边访问控制	外包解密	可验证
文献[16]	√	选择性	选择性	√	×	×
文献[18]	√	选择性	选择性	√	√	×
文献[19]	√	选择性	选择性	√	×	×
文献[20]	√	自适应	×	×	×	×
本文方案	√	自适应	自适应	√	√	√

[1]	陈晶, 李瀚星, 何琨, 加梦, 李雨晴, 杜瑞颖. 基于分层结构的匹配量隐藏加密多重映射方案[J]. 通信学报, 2024, 45(1): 94-105.
[2]	陈建伟, 王姝妤, 张美平, 张桢萍. 基于区块链且可验证的智能电网多维数据聚合与分享方案[J]. 通信学报, 2024, 45(1): 167-179.
[3]	哈冠雄, 贾巧雯, 陈杭, 贾春福. 无第三方服务器的基于数据流行度的加密去重方案[J]. 通信学报, 2022, 43(8): 17-29.
[4]	冯涛, 孔繁琪, 柳春岩, 马蓉, Maher Albettar. 基于区块链的双重可验证云存储方案[J]. 通信学报, 2021, 42(12): 192-201.
[5]	贾春福, 哈冠雄, 武少强, 陈杭, 李瑞琪. 加密去重场景下基于AONT和NTRU的密钥更新方案[J]. 通信学报, 2021, 42(10): 67-80.
[6]	田俊峰,王彦骉,何欣枫,张俊涛,杨万贺,庞亚南. 数据因果一致性研究综述[J]. 通信学报, 2020, 41(3): 154-167.
[7]	柯文龙,王勇,叶苗,陈俊奇. Ceph云存储网络中一种业务优先级区分的多播流调度方法[J]. 通信学报, 2020, 41(11): 40-51.
[8]	冯朝胜,罗王平,秦志光,袁丁,邹莉萍. 支持多种特性的基于属性代理重加密方案[J]. 通信学报, 2019, 40(6): 177-189.
[9]	孙磊,赵志远,王建华,朱智强. 云存储环境下支持属性撤销的属性基加密方案[J]. 通信学报, 2019, 40(5): 47-56.
[10]	田苗苗,高闯,陈洁. 格上基于身份的云存储完整性检测方案[J]. 通信学报, 2019, 40(4): 128-139.
[11]	张襄松,李晨,刘振华. 抗密钥泄露的支持密态数据去重的完整性审计方案[J]. 通信学报, 2019, 40(4): 95-106.
[12]	田俊峰,柴梦佳,齐鎏岭. 基于公有验证和私有验证的数据持有性验证方案[J]. 通信学报, 2019, 40(3): 48-59.
[13]	杜瑞忠,石朋亮,何欣枫. 基于覆写验证的云数据确定性删除方案[J]. 通信学报, 2019, 40(1): 130-140.
[14]	严新成,陈越,贾洪勇,陈彦如,张馨月. 支持高效密文密钥同步演化的安全数据共享方案[J]. 通信学报, 2018, 39(5): 123-133.
[15]	陈越,王龙江,严新成,张馨月. 基于再生码的拟态数据存储方案[J]. 通信学报, 2018, 39(4): 21-34.

面向云存储的属性基双边访问控制方案

Attribute-based bilateral access control scheme for cloud storage

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 4

参考文献 21

相关文章 15

Metrics

推荐阅读 0