云存储下多用户协同访问控制方案

发布时间：2018-03-12 20:23

本文选题：云存储　切入点：访问控制　出处：《通信学报》2016年01期 　论文类型：期刊论文

【摘要】：CP-ABE被认为是云存储下最适合的数据访问控制方法之一,但它仅适合用户分别读取或者分别修改不同数据的情况,而直接应用CP-ABE进行多用户协同数据访问时,会存在修改无序、密文文件大量冗余等问题。多用户协同访问云端数据时,应该在保证机密性、抗共谋的前提下控制合法用户有序地修改同一密文文件,同时云端尽可能减少密文文件副本。针对文件和文件逻辑分块,提出了2个多用户协同访问控制方案MCA-F和MCA-B。MCA-F满足单个数据文件作为最小控制粒度的访问控制需求,该方案采用层次加密结构,云服务器承担部分解密计算,以降低用户解密的计算代价;针对多用户同时写数据的访问控制,提出了对多个用户提交的暂存数据的管理方法。MCA-B用于文件的逻辑分块作为最小控制粒度的访问控制,该方案设计了文件的逻辑分块机制、基于索引矩阵的表示方法,提出了子数据掩码表示方法以描述多个用户对同一文件不同逻辑分块的写权限;MCA-B支持用户集合、文件逻辑分块结构的动态变化,而且数据的拥有者和修改者无需一直在线。与现有的方案相比,所提方案不仅具有云存储下多用户协同写数据的访问控制能力,而且读访问控制的用户端存储量和加解密计算量是较小的。
[Abstract]:CP-ABE is considered to be one of the most suitable data access control methods in cloud storage, but it is only suitable for users to read or modify different data separately. When multi-users cooperate to access cloud data, they should control the legitimate users to modify the same ciphertext file in an orderly manner on the premise of keeping confidentiality and resisting collusion. At the same time, the cloud reduces the copy of ciphertext file as far as possible. Aiming at file and file logic partitioning, two multi-user cooperative access control schemes, MCA-F and MCA-B.MCA-F, are proposed to meet the requirements of single data file as the minimum control granularity of access control. The scheme adopts hierarchical encryption structure, cloud server undertakes partial decryption calculation to reduce the computing cost of user decryption, and the access control of multi-user simultaneously writes data. This paper presents a management method of temporary data submitted by multiple users. MCA-B is used for file logical partitioning as minimum control granularity access control. This scheme designs a logical partitioning mechanism for files, which is based on the representation method of index matrix. A subdata mask representation method is proposed to describe the write rights of multiple users to different logical blocks of the same file. MCA-B supports the user set and the dynamic changes of the structure of the logical block of the file. Moreover, the owner and modifier of the data need not always be online. Compared with the existing scheme, the proposed scheme not only has the ability of access control of multi-user co-write data under cloud storage, And read access control client storage and encryption and decryption computation is small.
【作者单位】：武汉大学计算机学院;九江学院信息科学与技术学院;桂林电子科技大学信息与通信学院;
【基金】：国家自然科学基金资助项目(No.61373040,No.61572370) 教育部博士点基金资助项目(No.20120141110073)~~
【分类号】：TP393.08

【相似文献】