云存储系统中属性基加密的访问控制方案研究

发布时间：2018-05-01 22:30

本文选题：云存储 + 访问结构　；参考：《安徽大学》2017年硕士论文

【摘要】：云计算作为一种新兴的分布式计算模式,具有按需自助服务、资源共享、多种网络访问等特点,被广泛地应用于企业及机构。中小型企业通过借助云计算平台外包计算及存储企业数据,从而减少企业用于采购计算机等基础设施的成本。另外,云存储服务作为云计算中的主要服务,广泛地受到人们的青睐。随着互联网及移动网的普及,人们使用云存储服务变得非常便利,可以随时随地访问云存储系统。与此同时,云存储服务的安全性同样引起了学术界及企业界的重视。对于用户来说,云存储服务提供商并不是完全可信的;随着大量的敏感数据外包到云存储服务器,而难以确保云存储服务提供商是否会因为自身利益而泄露用户的数据。虽然可以通过对敏感的数据进行加密后再外包到云存储服务器,但是访问数据的用户可能来自不同的机构,导致密钥分配十分困难,从而不利于数据的共享。另外,近年来随着移动终端的普及,用户使用移动设备访问云存储数据变得非常流行;但是,移动设备的电力资源有限,寻求高效的密文访问控制技术迫在眉睫。因此,为了保护云存储数据的安全,高效灵活的云存储数据访问控制方案仍是云存储服务中必须关注的重要问题。密文策略属性基加密方案是传统公钥加密体制中的一种,是实现云存储服务密文访问的主要技术;其具有传统公钥加密体制中不存在的一对多访问特点,能够很好地应用于密文的云存储数据访问控制。另外,存在的多授权机构属性基加密机制可以允许不同机构的用户共享同一个数据,方便了系统规模的扩充。虽然属性基加密机制具有诸多优点,但是不能直接应用于云存储服务中,其中最主要的难题是访问结构的隐藏;当用户外包密文到云存储服务器时,密文中嵌入的访问结构是以明文的形式存在,泄露了用户的属性隐私。另外,为了使属性基加密机制能够应用于移动设备,减少其加密解密的计算代价变得非常重要。本文主要围绕了多授权机构属性基加密云存储数据访问控制中的问题展开了研究。工作主要在于:首先,描述了云计算的特点、架构及服务类型,并对云存储服务中存在的安全问题进行了介绍。另外,概述了云存储系统中的属性基加密方案研究现状,并分析了它们的优缺点,提出了进一步设想。其次,研究了多授权机构属性基加密访问控制方案中访问结构泄露及用户撤销的问题。针对云存储服务器可以利用访问结构中属性信息推断出加密数据的价值,并且能够识别用户身份的安全问题,本文结合单向匿名密钥协议及属性版本控制等技术提出了策略隐藏的多授权机构属性基加密方案。数据拥有者通过混淆访问结构中的属性值,来保证访问结构的安全,从而抵抗云存储服务器获取访问结构中的敏感信息;另外,当用户撤销时,未撤销用户需要及时更新包含用户撤销属性的私钥和密文,从而保证密文和用户私钥中属性版本一致,进而实现系统的前向安全性。第三,研究了应用于移动设备的多授权机构属性加密方案访问控制方案。针对现有多授权机构属性基加密方案中加密和解密计算代价过高,不利于部署到移动云存储系统中;通过把解密外包到云存储服务器,减少计算开销,但并不能保证解密结果正确性等问题。本文结合在线-离线和可验证外包解密技术提出了高效可验证的多授权机构属性基加密方案。方案把加密过程分为在线阶段和离线阶段,其中通过把加密过程中大量的配对操作转移到离线阶段进行处理,减少在线阶段的计算开销;另外,在解密时,通过外包大量的配对操作到云存储服务器,进而减少用户端的计算开销;并且方案支持外包解密的验证,从而验证云存储服务器解密是否正确。最后,分析并总结了云存储系统中属性基加密访问控制的问题,并指出了属性基加密下一步的研究方向。
[Abstract]:As a new distributed computing model, cloud computing has the characteristics of self-service, resource sharing and multiple network access. It is widely used in enterprises and institutions. Small and medium enterprises can reduce the cost of enterprises to purchase computer infrastructure by outsourcing the computing and storage of enterprise data by using the cloud computing platform. In addition, as the main service in cloud computing, cloud storage services are widely favored by people. With the popularity of the Internet and mobile networks, the use of cloud storage services has become very convenient and can access the cloud storage system anytime and anywhere. At the same time, the security of cloud storage services has also attracted the attention of the academia and the business community. Users, the cloud storage service provider is not completely trusted; with a large number of sensitive data outsourced to the cloud storage server, it is difficult to ensure that the cloud storage service provider will divulge the user's data for its own benefit. Although it can encrypt sensitive data to the cloud storage server, it will be able to visit the cloud storage server. Users who ask data may come from different organizations, which may lead to very difficult key distribution and disadvantageous to the sharing of data. In addition, in recent years, with the popularity of mobile terminals, users use mobile devices to access cloud storage data. However, the power resources of mobile devices are limited to seek efficient cryptographic access control technology. Therefore, in order to protect the security of the cloud storage data, the efficient and flexible cloud storage data access control scheme is still an important issue in the cloud storage service. The cryptographic policy attribute based encryption scheme is one of the traditional public key encryption systems and is the main technology to realize the cloud storage service ciphertext access. The one to many access characteristics, which are not existing in key encryption system, can be well applied to the cloud storage data access control of ciphertext. In addition, the existing multi authorization mechanism based encryption mechanism can allow users of different organizations to share the same data and facilitate the expansion of the system scale. Although the attribute based encryption mechanism has many advantages, But it can not be used directly in cloud storage services, and the most important problem is the hiding of access structure. When users outsource ciphertext to cloud storage servers, the access structure embedded in the ciphertext exists in the form of plaintext, revealing the user's property privacy. In addition, in order to apply the attribute based encryption mechanism to mobile devices, the subtraction is reduced. The computational cost of less encryption and decryption has become very important. This paper mainly focuses on the problems in the data access control of multi authorization mechanism attribute base cloud storage. The main work is: firstly, it describes the characteristics, architecture and service types of cloud computing, and introduces the security problems in the cloud storage service. In addition, the research status of attribute based encryption schemes in cloud storage system is summarized, their advantages and disadvantages are analyzed, and further ideas are put forward. Secondly, the problem of access structure disclosure and user revocation in the attribute based encryption access control scheme of multi authorization mechanism is studied. The value of encrypted data is deduced and the security problem of user identity can be identified. In this paper, an attribute based encryption scheme with policy hidden multi authorization mechanism is proposed in combination with one way anonymous key protocol and attribute version control. The data owner ensures the security of access structure by confusing the attribute values in the structure to guarantee the security of the access structure. The anti cloud storage server gets the sensitive information in the access structure; in addition, when the user revoke, the unrevoked user needs to update the private key and ciphertext which contains the user's revocation attribute in time, so as to ensure the consistency of the attribute version in the cipher and the user's private key, and then realize the forward security of the system. Third, the multi instruction applied to the mobile device is studied. The encryption and decryption calculation of the attribute based encryption scheme in the existing multi authority mechanism is too expensive to deploy to the mobile cloud storage system. By outsourcing decryption to the cloud storage server, it can reduce the computing overhead, but it can not guarantee the correctness of the decryption results. An efficient and verifiable, verifiable and verifiable attribute based encryption scheme is proposed in the online - offline and verifiable outsourced decryption technology. The scheme divides the encryption process into an online and offline phase, in which a large number of pairing operations are transferred to the off-line phase to reduce the computing cost in the online phase; in addition, it is decrypted. At the time, a large number of pairing operations are outsourced to the cloud storage server to reduce the user's computing overhead, and the scheme supports the verification of the outsourced decryption so as to verify the correctness of the decryption of the cloud storage server. Finally, the problem of the attribute based encryption access control in the cloud storage system is analyzed and summarized, and the attribute based encryption is also pointed out. The research direction of the step.

【学位授予单位】：安徽大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP309;TP333

【相似文献】