密文访问控制及其应用研究

摘要/Abstract

摘要： 密文访问控制是近年来密码学研究中的热门方向，具有广泛的应用前景.首先分析了传统访问控制方法在云计算环境下面临的新威胁和挑战.将密文访问控制方法分为基于对称密钥密码学和基于公钥密码学两大类，并对2类方法中的主要机制进行分析和讨论.探讨了密文访问控制在加密文件系统和安全云存储中的应用.最后，讨论了密文访问控制面临的主要问题和挑战以及未来进一步值得关注的研究方向.

关键词: 访问控制, 密文访问控制, 属性加密, 云计算, 云存储

Abstract: Cryptographic access control is a hot topic in recent years and has wide promising applications. This paper firstly analysed new threats and challenges for traditional access control methods in cloud computing. The cryptographic access control was categorized into symmetrickey cryptography based and public key cryptography based mechanisms, and main schemes of the two types were discussed later. Its application in encrypted file systems and securing cloud storage was introduced as well. Finally, this paper analysed main problems, challenges and further research directions for future discussion about cryptographic access control.

Key words: access control, cryptographic access control, attributebased encryption, cloud computing, cloud storage

李勇. 密文访问控制及其应用研究[J]. 信息安全研究, 2016, 2(8): 721-728.

参考文献

［1］Ferraiolo D F, Sandhu R, Gavrila S, et al. Proposed NIST standard for rolebased access control［J］. ACM Trans on Information & System Security, 2001, 4(3): 224274［2］Scholl M, Stine K, Lin K, et al. Security architecture design process for health information exchanges (HIEs)［R］. Gaithersburg: Unite State Department of Commerce, 2010［3］Younis Y A, Kifayat K, Merabti M. An access control model for cloud computing［J］. Journal of Information Security & Applications, 2014, 19(1): 4560［4］Jung Y, Chung M. Adaptive security management model in the cloud computing environment［C］ Proc of the 12th Int Conf on Advanced Communication Technology. Piscataway, NJ: IEEE, 2010: 16641669［5］Bertino E, Bonatti P A, Ferrari E. TRBAC: A temporal rolebased access control model［J］. ACM Trans on Information & System Security, 2001, 4(3): 191233［6］Chandran S M, Joshi J B D. Towards administration of a hybrid role hierarchy［C］ Proc of the 2005 Int Conf on Information Reuse and Integration. Piscataway, NJ: IEEE, 2005: 500505［7］冯朝胜, 秦志光, 袁丁,等. 云计算环境下访问控制关键技术［J］. 电子学报, 2015, 43(2): 312319［8］李凤华, 苏铓, 史国振,等. 访问控制模型研究进展及发展趋势［J］. 电子学报, 2012, 40(4): 805813［9］冯登国, 张敏, 张妍, 等. 云计算安全研究［J］. 软件学报, 2011, 22(1): 7183［10］Vimercati S D C D, Foresti S, Jajodia S, et al. Overencryption: Management of access control evolution on outsourced data［C］ Proc of the Int Conf on Very Large Data Bases. New York: ACM, 2007: 123134［11］Wang Weichao, Li Zhiwei, Owens R, et al. Secure and efficient access to outsourced data［C］ Proc of the 2009 ACM Workshop on Cloud Computing Security (CCSW09). New York: ACM, 2009: 5566［12］Graf S, Lang P, Hohenadel S A, et al. Versatile Key management for secure cloud storage［C］ Proc of the IEEE Symp on Reliable Distributed Systems. Piscataway. Piscataway, NJ: IEEE, 2012: 469474［13］雷蕾, 蔡权伟, 荆继武, 等. 支持策略隐藏的加密云存储访问控制机制［J］. 软件学报, 2016, 27(6): 14321450［14］Shamir A. Identitybased cryptosystems and signature schemes［G］ LNCS 196: Proc of Advances in Cryptology (CRYPTO84). Berlin: Springer, 1984: 4753［15］Sakai R, Ohgishi K, Kasahara M. Cryptosystems based on pairing［C］ Proc of the Symp on Cryptography and Information Security. Okinawa: IEICE, 2000: 135148［16］Boneh D, Franklin M. Identitybased encryption from the weil pairing［G］ LNCS 2139: Proc of Advance in Cryptology (CRYPTO 2001). Berlin: Springer, 2001: 213219［17］Cocks C. An Identity based encryption scheme based on quadratic residues［G］ LNCS 2260: Proc of the IMA Int Conf on Cryptography and Coding. Berlin: Springer, 2001: 360363［18］Sahai A, Waters B. Fuzzy identitybased encryption［G］ LNCS 3494: Proc of the 24th Annual Int Conf on Theory and Applications of Cryptographic Techniques. Berlin: Springer, 2005: 457473［19］Goyal V, Pandey O, Sahai A, et al. Attributebased encryption for finegrained access control of encrypted data［C］ Proc of the ACM Conf on Computer and Communications Security (CCS 2006). New York: ACM, 2006: 8998［20］Ostrovsky R, Sahai A, Waters B. Attributebased encryption with nonmonotonic access structures［C］ Proc of the ACM Conf on Computer and Communications Security (CCS07). New York: ACM, 2007: 195203［21］Liang Xiaohui, Cao Zhenfu, Lin Huang, et al. Provably secure and efficient bounded ciphertext policy attribute based encryption［C］ Proc of the ACM Symp on Information, Computer and Communications Security (ASIACCS 2009). New York: ACM, 2009: 343352［22］Yu Shucheng, Wang Cong, Ren Kui, et al. Achieving secure, scalable, and finegrained data access control in cloud computing［C］ Proc of the Conf on Information Communications. Piscataway, NJ: IEEE, 2010: 19［23］Li Jin, Zhao Gansen, Chen Xiaofeng, et al. Finegrained data access control systems with user accountability in cloud computing［C］ Proc of the 2nd IEEE Int Conf on Cloud Computing Technology and Science. Piscataway, NJ: IEEE, 2010: 8996［24］Wang Guojun, Liu Qin, Wu Jie. Hierarchical attributebased encryption for finegrained access control in cloud storage services［J］. Computers & Security, 2010, 30: 735737［25］洪澄, 张敏, 冯登国. ABACCS: 一种云存储密文访问控制方法［J］. 计算机研究与发展, 2010, 47(增刊): 259265［26］孙国梓, 董宇, 李云. 基于CPABE算法的云存储数据访问控制［J］. 通信学报, 2011, 32(7): 146152［27］Wang Yongtao, Chen Kefei, Long Yu, et al. Accountable authority key policy attributebased encryption［J］. Sciece China Information Sciences, 2012, 55(7): 16311638［28］Hohenberger S, Waters B. OnlineOffline attributebased encryption［G］ LNCS 8383: Proc of the PublicKey Cryptography (PKC 2014). Berlin: Springer, 2014: 293310［29］Xu Jie, Wen Qiaoyan, Li Wenmin, et al. Circuit ciphertextpolicy attributebased hybrid encryption with verifiable delegation in cloud computing［J］. IEEE Trans on Parallel & Distributed Systems, 2016, 27(1): 119129［30］Zhou Zhibin, Huang Dijiang, Wang Zhijie. Efficient privacypreserving ciphertextpolicy attribute basedencryption and broadcast encryption［C］  Proc of the ACM Conf on Computer and Communications Security (CCS 2010). New York: ACM, 2013: 753755［31］Han Jinguang, Susilo W, Mu Yi, et al. Improving privacy and security in decentralized ciphertextpolicy attributebased encryption［J］. IEEE Trans on Information Forensics & Security, 2015, 10(3): 665678［32］苏金树, 曹丹, 王小峰, 等. 属性基加密机制［J］. 软件学报, 2011, 22(6): 12991315［33］冯登国, 陈成. 属性密码学研究［J］. 密码学报, 2014, 1(1): 112［34］曹珍富. 密码学的新发展［J］. 四川大学学报(工程科学版), 2015, 47(1): 112［35］Boneh D, Sahai A, Waters B. Functional encryption: Definitions and challenges［G］ LNCS 6597: Proc of the 8th Theory of Cryptography Conf. Berlin: Springer, 2011: 253273［36］Boneh D, Sahai A, Waters B. Functional encryption: A new vision for publickey cryptography［J］. Communications of the ACM, 2012, 55(11): 5664［37］Blaze M, Bleumer G, Strauss M. Divertible protocols and atomic proxy cryptography［G］ LNCS 1403: Proc of the Advances in Cryptology—EUROCRYPT98. Berlin: Springer, 1998: 127144［38］Ateniese G, Fu K, Green M, et al. Improved proxy reencryption schemes with applications to secure distributed storage［J］. ACM Trans on Information & System Security, 2015, 9(1): 130［39］Ateniese G, Hohenberger S. Proxy resignatures: New definitions, algorithms, and applications［C］ Proc of the 12th ACM Conf on Computer and Communications Security. New York: ACM, 2005: 310319［40］Tian Miaomiao. Identitybased proxy resignatures from lattices［J］. Information Processing Letters, 2015, 115(4): 462467［41］Liang Kaitai, Chu Chengkang, Tan Xiao, et al. Chosenciphertext secure multihop identitybased conditional proxy reencryption with constantsize ciphertexts［J］. Theoretical Computer Science, 2014, 539(9): 87105［42］Wei Guiyi, Lu Rongxing, Shao Jun. EFADS: Efficient, flexible and anonymous data sharing protocol for cloud computing with proxy reencryption［J］. Journal of Computer & System Sciences, 2014, 80(8): 15491562［43］Wang Xuan, Huang Xinyi, Yang Xiaoyuan, et al. Further observation on proxy reencryption with keyword search［J］. Journal of Systems & Software, 2012, 85(3): 643654［44］Chen Xi, Li Yong. Efficient proxy reencryption with private keyword searching in untrusted storage［J］. International Journal of Computer Network & Information Security, 2011, 3(2): 5056［45］Benaloh J, Chase M, Horvitz E, et al. Patient controlled encryption: Ensuring privacy of electronic medical records［C］ Proc of the 2009 ACM Workshop on Cloud Computing Security (CCSW09). New York: ACM, 2009: 103114［46］Zhu Yan, Ahn G J, Hu Hongxin, et al. Cryptographic rolebased security mechanisms based on rolekey hierarchy［C］ Proc of the 5th ACM Symp on Information, Computer and Communications Security. New York: ACM, 2010: 314319［47］Zhu Yan, Ahn G J, Hu Hongxin, et al. Rolebased cryptosystem: A new cryptographic RBAC system based on rolekey hierarchy［J］. IEEE Trans on Information Forensics & Security, 2013, 8(12): 21382153［48］Blaze M. A cryptographic file system for Unix［C］ Proc of the 1st ACM Conf on Computer and Communications Security. New York: ACM, 1993: 916［49］Cattaneo G, Catuogno L, Sorbo A D, et al. The design and implementation of a transparent cryptographic filesystem for Unix［C］ Proc of the Annual USENIX Technical Conf. FREENIX Track, Berkeley: USENIX, 2001: 199212［50］Goh E J, Shacham H, Modadugu N, et al. Sirius: Securing remote untrusted storage［C］ Proc of the Network and Distributed Systems Security Symp. Reston: ISOC, 2003: 131145［51］Kallahalla M, Riedel E, Swaminathan R, et al. Plutus: Scalable secure file sharing on untrusted storage［C］ Proc of the 2nd USENIX Conf on File and Storage Technologies (FAST03). Berkeley: USENIX, 2003: 2942［52］Geron E, Wool A. CRUST: Cryptographic remote untrusted storage without public keys［J］. International Journal of Information Security, 2009, 8(5): 357377［53］Harrington A, Jensen C. Cryptographic access control in a distributed file system［C］ Proc of the 8th ACM Symp on Access Control Models and Technologies. New York: ACM, 2003: 158165［54］Wang Lihua, Nojima R, Moriai S. A secure automobile information sharing system［C］ Proc of the 1st ACM Workshop on IoT Privacy, Trust, and Security (IoTPTS15). New York: ACM, 2015: 1926［55］Kamara S, Lauter K. Cryptographic cloud storage［G］ LNCS 6054: Proc of the 14th Int Conf on Financial Cryptograpy and Data Security. Berlin: Springer, 2010: 136149［56］Kamara S, Papamanthou C, Roeder T. CS2: A semantic cryptographic cloud storage system［R］. Redmond: Microsoft, 2011 ［57］Zarandioon S, Yao D, Ganapathy V. K2C: Cryptographic cloud storage with lazy revocation and anonymous access［C］ Proc of the 7th Int ICST Conf on Security and Privacy in Communication Networks (SecureComm). Berlin: Springer, 2011: 5976［58］Solomon M G, Sunderam V, Xiong Li. Towards secure cloud database with fineGrained access control［G］ LNCS 8566: Proc of the 28th Annual IFIP WG 11.3 Working Conf on Data and Applications Security and Privacy XXVIII (DBSec14). Berlin: Springer, 2014: 324338［59］Zhou Lan, Varadharajan V, Hitchens M. A trust management framework for secure cloud data storage using cryptographic rolebased access control［C］ Proc of the EBusiness and Telecommunications. Berlin: Springer, 2014: 226251［60］Zhu Yan, Huang Dijiang, Hu Changjun, et al. From RBAC to ABAC: Constructing flexible data access control for cloud storage services［J］. IEEE Trans on Services Computing, 2015, 8(4): 601616［61］李丹, 薛锐, 陈驰,等. 基于透明加解密的密文云存储系统设计与实现［J］. 网络新媒体技术, 2015, 4(5): 2632［62］薛矛, 薛巍, 舒继武, 等. 一种云存储环境下的安全存储系统［J］. 计算机学报, 2015, 38(5): 987998［63］Gentry C. Fully homomorphic encryption using ideal lattices［C］ Proc of the 41st Annual ACM Symp on Theory of Computing (STOC 2009). New York: ACM, 2009: 169178［64］Matthew G, Hohenberger S, Waters B. Outsourcing the decryption of ABE Ciphertexts［C］ Proc of the USENIX Security Symp. San Francisco, Berkeley: USENIX, 2011: 523538［65］李勇, 曾振宇, 张晓菲. 支持属性撤销的外包解密方案［J］. 清华大学学报: 自然科学版, 2013(12): 16641669

[1]	单庆元南峰. 虚拟机网络接口实体化在私有云安全防护中的应用[J]. 信息安全研究, 2021, 7(3): 275-280.
[2]	胡星高郑荣锋周安民刘亮. 基于特征分析的访问控制混合模型设计与实现[J]. 信息安全研究, 2021, 7(1): 4-14.
[3]	潘洪志. 一种基于线性编码的数据完整性保护方案[J]. 信息安全研究, 2021, 7(1): 59-63.
[4]	霍成义. 云计算中属性基加密机制研究?[J]. 信息安全研究, 2020, 6(8): 733-737.
[5]	戴纯兴刘刚韩春超王传国. KVM环境下基于异常行为的恶意软件检测技术研究[J]. 信息安全研究, 2020, 6(6): 0-0.
[6]	谭剑王晓莉饶伟. 铁路云数据中心的安全架构研究[J]. 信息安全研究, 2020, 6(6): 0-0.
[7]	刘海峰荣晓燕李晨旸廖军. 一种基于安全域的云计算网络安全保障方法研究[J]. 信息安全研究, 2020, 6(4): 362-366.
[8]	李铭石磊张辉牛文强. 基于系统调用截获的虚拟机自省技术[J]. 信息安全研究, 2020, 6(4): 367-372.
[9]	林嘉涛李玉. 基于云计算的物联网安全问题探讨[J]. 信息安全研究, 2020, 6(4): 373-376.
[10]	荣晓燕刘海峰刘国伟刘凯俊. 基于风控和合规的云计算网络安全矩阵控制研究[J]. 信息安全研究, 2020, 6(3): 266-271.
[11]	雷丹丽黄相升向大为. 数字化背景下网络贩毒的特点及侦查策略研究[J]. 信息安全研究, 2020, 6(2): 159-164.
[12]	雷惊鹏. 基于云计算和深度学习的协议监测系统设计[J]. 信息安全研究, 2020, 6(12): 1127-1132.
[13]	王斯梁冯暄蔡友保陈翼. 零信任安全模型解析及应用研究[J]. 信息安全研究, 2020, 6(11): 0-0.
[14]	贺海刘海峰成金爱. 云计算平台安全能力评估体系和评估指标研究[J]. 信息安全研究, 2020, 6(11): 0-0.
[15]	刘刚徐峥崔士伟. KVM环境下内核级Rootkit检测及防护技术研究[J]. 信息安全研究, 2019, 5(7): 616-622.