基于身份的分布式存储安全系统设计

发布时间：2018-02-13 16:58

本文关键词： 存储安全身份认证访问控制　出处：《华中科技大学》2016年硕士论文　论文类型：学位论文

【摘要】：随着物联网的发展和移动终端的普及,越来越多的数字资源被产生,数据安全的挑战也越来越大。尤其是随着云存储技术的普及,人们开始更多将自己的私有数据上传到云端备份,却对数据安全的担忧丝毫没有减少,反而更大。现有的数据安全存储方案大多采用集中式的安全管理,安全边界明显,且很难避免内部攻击,大多都留有后门。提出一种基于身份的分布式存储安全方案,无论是处于某个云存储平台还是开放的环境下,都可以很好的保证数据的安全。通过基于身份的认证方式,便于系统用户验证,同时,将安全相关信息跟数据绑定在一起,将安全操作下放到用户访问数据的终端进行,存储服务端只需保证用户的数据不丢失。在设计中,用户访问控制相关的信息用被共享用户的公钥加密,此外,数据所有者可以定制灵活的访问策略进一步保证数据的安全,不管数据流向何方。与传统的存储安全系统不同,该方案实现了完全分布式数据安全管理。在对象文件系统上对所提的方案进行了原型实现。测试分析表明,基于身份的加密算法可以很好的满足网络环境下用户的分布式身份验证需求,该方案权限和策略检查的时间开销和带来的额外空间开销是可以接受的。4K Byte大小的文件额外空间开销占比4.3%,且文件越大,额外空间占比越小。
[Abstract]:With the development of the Internet of things and the popularity of mobile terminals, more and more digital resources have been generated, and the challenges of data security have become greater and greater, especially with the popularization of cloud storage technology. People start uploading their private data to the cloud more, but not less worried about data security, but bigger. Most of the existing data security storage schemes use centralized security management, the security boundaries are clear. And it is difficult to avoid internal attacks, most of them have a backdoor. This paper proposes an identity-based distributed storage security scheme, whether in a cloud storage platform or an open environment. Through the authentication method based on identity, it is convenient for the system user to verify. At the same time, the security related information is bound together with the data, and the security operation is devolved to the terminal where the user accesses the data. The storage server only needs to ensure that the user's data is not lost. In the design, the information related to user access control is encrypted with the public key of the shared user. In addition, the data owner can customize the flexible access policy to further ensure the security of the data. Different from the traditional storage security system, this scheme realizes the security management of completely distributed data. The prototype of the proposed scheme is implemented on the object file system. The test results show that, The ID-based encryption algorithm can meet the distributed authentication requirements of users in the network environment. The time cost and extra space overhead of permission and policy checking in this scheme are 4. 3% of the acceptable. 4K Byte file. The larger the file is, the smaller the extra space is.
【学位授予单位】：华中科技大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP333;TP309

【参考文献】