CAJ | 학술논문

针对于跨域云数据访问控制中的安全性和有效性问题,提出了一种基于树访问结构的多授权机构属性加密(Attribute-Based Encryption,ABE)的跨域数据访问控制方法。通过建立分散授权模型,将属性私钥的生成与中央认证机构(Central Authority,CA)分离,由数据属主(Data Owner,DO)和授权机构分别生成并分发属性私钥组件。利用基于访问结构树的控制策略,有效预防了用户之间以及用户和授权机构之间的联合攻击。此外,用户密钥计算无需使用全球唯一标识(Global Identity,GID),支持匿名用户跨域数据访问。最后,利用双线性判定Diffie-Hellman(Decision Bilinear Diffie-Hellman,DBDH)假设理论分析了方案的安全性。研究结果表明,本方案在解密操作和加解密平均时间上具有较高的性能,能够有效地应用于多授权机构并存的云存储环境。
침대우과역운수거방문공제중적안전성화유효성문제,제출료일충기우수방문결구적다수권궤구속성가밀(Attribute-Based Encryption,ABE)적과역수거방문공제방법。통과건립분산수권모형,장속성사약적생성여중앙인증궤구(Central Authority,CA)분리,유수거속주(Data Owner,DO)화수권궤구분별생성병분발속성사약조건。이용기우방문결구수적공제책략,유효예방료용호지간이급용호화수권궤구지간적연합공격。차외,용호밀약계산무수사용전구유일표식(Global Identity,GID),지지닉명용호과역수거방문。최후,이용쌍선성판정Diffie-Hellman(Decision Bilinear Diffie-Hellman,DBDH)가설이론분석료방안적안전성。연구결과표명,본방안재해밀조작화가해밀평균시간상구유교고적성능,능구유효지응용우다수권궤구병존적운존저배경。
In order to improve the security and efficiency of data access control under multi-authority environment,an access-tree based multi-authority ABE (ATB-MAABE)has been proposed in this paper. In ATB-MAABE,CA is only used for public parameters generating and authority verification,which re-duces the security risk introduced by CA.Access control policy is defined by the DO(data owner),and the attribute-based secret key components are generated by DO and different attributes authorities.By using the access tree based control policy,this scheme can prevent the attacks from the user and authority collu-sion.Furthermore,the user's global identifier (GID)is not required in secret key generating,which can support anonymous data control and sharing.Finally,the security proof is given by using the Decisional Bilinear Diffie-Hellman (DBDH )assumption,and the experiment results show the efficiency of this scheme in encryption/decryption operations.