云外包數據安全共享的等級密鑰管理與屬性基加密方法研究
發(fā)布時間：2018-08-05 09:58
【摘要】：隨著數據量的爆炸性增長,數據存儲問題變得愈加獨立與棘手。云計算中的存儲服務正是迎合了這一市場契機,向資源有限的多租戶提供數據的外包存儲解決方案。在云存儲中,用戶將數據存儲在遠程云服務器上,并由云服務提供商對其進行操作處理。然而,云服務提供商受利益的驅使會在半可信模式或者惡意模式下工作。這就使得用戶在外包存儲時迫切希望云存儲系統能夠具有隱私保護的功能,以防止外包數據的非授權共享。因此,如何實現多個用戶在云存儲模式下進行高效靈活的數據安全共享變成了一個亟待解決的問題。本文從密文域訪問控制中的等級密鑰管理和屬性基加密兩種方法對上述問題展開研究,主要取得了如下研究成果:(1)針對用戶共享權限動態(tài)變化的云外包數據細粒度共享問題,多權利群組密鑰管理和等級密鑰管理都需要數據擁有者自己更新系統中的某些公開參數。除此之外,基于等級密鑰管理的解決方案還要求數據擁有者通過安全信道與涉及到的各個訪問群組中用戶進行一對一通信。一旦訪問群組的等級結構較為復雜且涉及到的用戶數目較多,這一更新過程會有單點失敗的風險。為了避免這一缺陷,我們提出了一個面向外包數據共享的自主型等級密鑰管理方案。該方案融合了多權利群組密鑰管理和等級密鑰管理各自設計上的優(yōu)勢。其主要特征是數據擁有者只通過系統公開參數對各個訪問群組的等級結構進行管理。而各個訪問群組中的用戶以基于多線性映射的群組密鑰協商方式獲得所在群組對應的對稱加密密鑰。一旦發(fā)生用戶共享權限的動態(tài)變化,數據擁有者和相應的高等級訪問群組中用戶均可以為涉及到的低等級訪問群組中用戶發(fā)布更新信息。獲得這更新信息后,這些低等級訪問群組中用戶可以自主計算所在群組對應的新的對稱加密密鑰。(2)目前,安全且具有直接密鑰派生的等級密鑰管理方案需要對系統中的公開信息進行加密處理。這會增加系統建立與動態(tài)密鑰管理的計算開銷。通過使用線性幾何中向量內積處理群組間的等級結構,我們給出了一個基于等級密鑰管理的云外包數據安全共享解決方案。在該方案中,數據擁有者為每個訪問群組公開一個向量,且所有向量組成的矩陣是系統的主要公開參數。與此同時,數據擁有者為各個用戶分配所在群組對應的私有信息。通過該私有信息,訪問群組中的用戶能夠計算出所在群組對應的私有向量。再計算這個私鑰向量與所在群組對應的公開向量的內積,訪問群組中的用戶便可獲得所在群組對應的對稱加密密鑰。如果兩個訪問群組不具有等級關系,則與它們相關聯的向量會存在正交性,也就是向量內積為零。如果這兩個訪問群組具有等級關系,則高等級訪問群組的私有向量與低等級訪問群組的公開向量的內積對應一個間接密鑰。利用該間接密鑰,高等級訪問群組中的用戶可以獲得低等級訪問群組對應的對稱加密密鑰。在動態(tài)共享權限對應的密鑰管理方面,數據擁有者只需要更新系統中的公開矩陣即可。通過安全性分析和仿真實驗結果,我們可以看出該方案是安全且高效的。(3)面對多授權中心的云存儲系統,我們提出了一個雙因素的外包數據共享解決方案。該方案集成了身份基加密與密文策略的屬性基加密兩種技術。一個用戶能夠獲取到數據擁有者的共享數據,除了其擁有的屬性集合滿足密文中的訪問控制策略以外,還要求該用戶從數據擁有者那里獲得了授權密鑰。另外,我們提出的方案還具有固定密文長度這一性質。利用云服務器輔助性重加密技術,該方案實現了雙層撤銷機制:屬性授權中心對應的屬性層撤銷和數據擁有者對應的用戶層撤銷。并且,撤銷過程是在公開信道下完成的,能夠抵抗撤銷用戶的信道竊聽攻擊。安全性分析、性能對比以及仿真結果表明該方案在解決多授權中心下的云外包數據安全共享問題上是有效的。
[Abstract]:With the explosive growth of data, the problem of data storage becomes more and more independent and difficult. The storage service in the cloud computing is just to cater to this market opportunity to provide an outsourced storage solution to a resource limited multi tenant. In the cloud storage, the user stores the data on a remote cloud server and is provided by a cloud service provider. However, the benefit of cloud service providers is driven to work in a semi trusted or malicious mode, which makes it urgent for the user to have the privacy protection function of the cloud storage system to prevent unauthorized sharing of outsourced data in the outsourced storage. Efficient and flexible data security sharing has become an urgent problem to be solved. This paper studies the above problems from two methods of hierarchical key management and attribute based encryption in cipher domain access control. The main achievements are as follows: (1) the fine granularity of cloud outsourced data for the dynamic changes of the user shared privileges. In addition, the hierarchical key management solution also requires the data owner to communicate one to one communication with the users involved in the various access groups through the secure channel. Once access to the group, the data owner is required to access the group. In order to avoid this defect, we propose an autonomous hierarchical key management scheme for outsourced data sharing. This scheme combines multiple rights group key management and hierarchical key management in each design. The main feature is that the data owner manages the hierarchical structure of each access group only through the public parameters of the system, and the users in each of the access groups obtain the symmetric encryption key corresponding to the group by the group key negotiation based on the multilinear mapping. Users and users of the corresponding high level access groups can publish update information for users in the low level access group involved. After obtaining this update, these low-level access groups can independently compute the new symmetric encryption keys corresponding to their groups. (2) currently, it is safe and has a direct key derivative. The hierarchical key management scheme needs to encrypt the public information in the system. This will increase the computing overhead of the system establishment and dynamic key management. By using the vector product in linear geometry to process the hierarchical structure between groups, we give a solution for the security sharing of cloud outsourced data based on the hierarchical key management. In this scheme, the data owner exposes a vector for each access group, and the matrix of all the vectors is the main public parameter of the system. At the same time, the data owner assigns the corresponding private information to the group for each user. Through the private information, the users in the group can calculate the corresponding privacy of the group. There is a vector. Then we calculate the inner product of the private key vector and the public vector corresponding to the group. The users in the group can get the symmetric encryption keys corresponding to the group. If two groups of access groups do not have a hierarchical relationship, the vectors associated with them will have orthogonality, that is, the inner product of the vectors is zero. If the two The access group has a hierarchical relationship, and the private vector of the high level access group and the inner product of the public vector of the low level access group correspond to an indirect key. Using this indirect key, the users in the high level access group can obtain the symmetric plus secret key of the low level access group corresponding to the key pipe of the dynamic sharing rights. On the other hand, the data owner only needs to update the public matrix in the system. Through the security analysis and simulation results, we can see that the scheme is safe and efficient. (3) in the face of the cloud storage system in the multi authorization center, we propose a dual factor outsourcing data sharing solution. This scheme integrates the identity base. Two techniques of encryption and cipher based attribute based encryption. One user can obtain the shared data of the owner of the data. Besides the access control strategy in the ciphertext, the user also requires that the user obtain the authorization key from the data owner. Furthermore, the proposed scheme also has a fixed cipher length. By using cloud server aided re encryption technology, the scheme implements a double decker revocation mechanism: attribute layer revocation corresponding to attribute authorization center and user layer cancellation corresponding to data owner. And the revocation process is completed under the open channel, and can resist the channel eavesdropping attack of the revocation user. Security analysis, performance The comparison and simulation results show that the scheme is effective in solving the problem of cloud outsourcing data security sharing under multiple authorization centers.
【學位授予單位】：華南理工大學
【學位級別】：博士
【學位授予年份】：2016
【分類號】：TN918.4
[Abstract]:With the explosive growth of data, the problem of data storage becomes more and more independent and difficult. The storage service in the cloud computing is just to cater to this market opportunity to provide an outsourced storage solution to a resource limited multi tenant. In the cloud storage, the user stores the data on a remote cloud server and is provided by a cloud service provider. However, the benefit of cloud service providers is driven to work in a semi trusted or malicious mode, which makes it urgent for the user to have the privacy protection function of the cloud storage system to prevent unauthorized sharing of outsourced data in the outsourced storage. Efficient and flexible data security sharing has become an urgent problem to be solved. This paper studies the above problems from two methods of hierarchical key management and attribute based encryption in cipher domain access control. The main achievements are as follows: (1) the fine granularity of cloud outsourced data for the dynamic changes of the user shared privileges. In addition, the hierarchical key management solution also requires the data owner to communicate one to one communication with the users involved in the various access groups through the secure channel. Once access to the group, the data owner is required to access the group. In order to avoid this defect, we propose an autonomous hierarchical key management scheme for outsourced data sharing. This scheme combines multiple rights group key management and hierarchical key management in each design. The main feature is that the data owner manages the hierarchical structure of each access group only through the public parameters of the system, and the users in each of the access groups obtain the symmetric encryption key corresponding to the group by the group key negotiation based on the multilinear mapping. Users and users of the corresponding high level access groups can publish update information for users in the low level access group involved. After obtaining this update, these low-level access groups can independently compute the new symmetric encryption keys corresponding to their groups. (2) currently, it is safe and has a direct key derivative. The hierarchical key management scheme needs to encrypt the public information in the system. This will increase the computing overhead of the system establishment and dynamic key management. By using the vector product in linear geometry to process the hierarchical structure between groups, we give a solution for the security sharing of cloud outsourced data based on the hierarchical key management. In this scheme, the data owner exposes a vector for each access group, and the matrix of all the vectors is the main public parameter of the system. At the same time, the data owner assigns the corresponding private information to the group for each user. Through the private information, the users in the group can calculate the corresponding privacy of the group. There is a vector. Then we calculate the inner product of the private key vector and the public vector corresponding to the group. The users in the group can get the symmetric encryption keys corresponding to the group. If two groups of access groups do not have a hierarchical relationship, the vectors associated with them will have orthogonality, that is, the inner product of the vectors is zero. If the two The access group has a hierarchical relationship, and the private vector of the high level access group and the inner product of the public vector of the low level access group correspond to an indirect key. Using this indirect key, the users in the high level access group can obtain the symmetric plus secret key of the low level access group corresponding to the key pipe of the dynamic sharing rights. On the other hand, the data owner only needs to update the public matrix in the system. Through the security analysis and simulation results, we can see that the scheme is safe and efficient. (3) in the face of the cloud storage system in the multi authorization center, we propose a dual factor outsourcing data sharing solution. This scheme integrates the identity base. Two techniques of encryption and cipher based attribute based encryption. One user can obtain the shared data of the owner of the data. Besides the access control strategy in the ciphertext, the user also requires that the user obtain the authorization key from the data owner. Furthermore, the proposed scheme also has a fixed cipher length. By using cloud server aided re encryption technology, the scheme implements a double decker revocation mechanism: attribute layer revocation corresponding to attribute authorization center and user layer cancellation corresponding to data owner. And the revocation process is completed under the open channel, and can resist the channel eavesdropping attack of the revocation user. Security analysis, performance The comparison and simulation results show that the scheme is effective in solving the problem of cloud outsourcing data security sharing under multiple authorization centers.
【學位授予單位】：華南理工大學
【學位級別】：博士
【學位授予年份】：2016
【分類號】：TN918.4
【相似文獻】
相關期刊論文 前10條
1 劉曉艷;;一種基于身份認證的多智體密鑰管理方法[J];山西財經大學學報;2007年S2期
2 王燕;陳燕俐;曹曉梅;楊庚;;無線網絡中一種新型密鑰管理[J];信息網絡安全;2009年11期
3 石強;張欣;;可信存儲的密鑰管理[J];中國科技信息;2011年09期
4 趙華偉;郭強;舒明雷;呂家亮;黃太波;;軀感網密鑰管理特征及研究現狀分析[J];計算機應用與軟件;2012年07期
5 黃江憑,張克騫;單密鑰算法中的密鑰管理問題[J];中國金融電腦;1999年06期
6 戴瓊海,覃毅力,張瑩;組播通信的訪問控制和密鑰管理[J];電子學報;2002年S1期
7 王國明;侯整風;;信息隱藏技術在密鑰管理中的應用研究[J];計算機工程與設計;2008年18期
8 孫磊;戴紫珊;郭錦娣;;云計算密鑰管理框架研究[J];電信科學;2010年09期
9 龔敏;陸萍;;基于城市通卡的發(fā)卡與密鑰管理研究[J];福建電腦;2012年05期
10 顧冠群 ,朱艷琴 ,徐永南;密鑰管理的設計與實現[J];電信科學;1992年02期
相關會議論文 前7條
1 劉鵬;趙戰(zhàn)生;荊繼武;戴英俠;;批發(fā)銀行業(yè)環(huán)境中的密鑰管理[A];第十次全國計算機安全學術交流會論文集[C];1995年
2 王潮;張振華;應仲平;徐拾義;牛志華;;WSN中基于身份的分散密鑰管理研究[A];第六屆中國測試學術會議論文集[C];2010年
3 馬春光;戴膺贊;;無線傳感器網絡動態(tài)密鑰管理方案綜述[A];黑龍江省計算機學會2009年學術交流年會論文集[C];2010年
4 劉文遠;裴繼輝;王永栓;;PKI密鑰管理系統的研究與設計[A];2007年全國第十一屆企業(yè)信息化與工業(yè)工程學術會議論文集[C];2007年
5 王繪麗;李冰;張曉慧;孫斌;;Ad Hoc虛擬骨干網中密鑰管理的研究[A];2006通信理論與技術新進展——第十一屆全國青年通信學術會議論文集[C];2006年
6 徐瑩;徐福緣;李生琦;;層級結構中基于一元hash函數的存取控制方法研究[A];全國第十屆企業(yè)信息化與工業(yè)工程學術年會論文集[C];2006年
7 張軼北;高寶成;;基于簇結構分布式認證的Shamir機制研究[A];中國電子學會第十五屆信息論學術年會暨第一屆全國網絡編碼學術年會論文集（上冊）[C];2008年
相關重要報紙文章 前3條
1 ;眾多存儲企業(yè)關注密鑰管理[N];人民郵電;2007年
2 宋家雨;密鑰管理之秘訣[N];網絡世界;2007年
3 江信q，
本文編號：2165439
本文鏈接：http://sikaile.net/shoufeilunwen/xxkjbs/2165439.html
最近更新
教材專著
