支持属性立即撤销的可复用属性基签名及其密钥协商方案

张智烁; 杨会喜; 黄文; 廖永建; 周世杰

doi:10.11959/j.issn.2096-109x.2024023

您当前的位置：

首页 >

文章列表页 >

支持属性立即撤销的可复用属性基签名及其密钥协商方案

学术论文 | 更新时间：2024-08-14

- 支持属性立即撤销的可复用属性基签名及其密钥协商方案
- Reusable attribute-based signature with attribute revocation and authenticated key agreement
- 网络与信息安全学报 2024年10卷第2期页码：81-94
- 作者机构：
  
  1.电子科技大学信息与软件工程学院, 四川成都 610057
  2.沧州市职业技术学院机电工程系, 河北沧州 061001
  3.四川大学计算机学院, 四川成都 610065
- 作者简介：
  
  [ "张智烁（1995- ），男，天津静海人，电子科技大学博士生，主要研究方向为新一代公钥密码学。" ]
  [ "杨会喜（1970- ），女，河北沧州人，沧州市职业技术学院副教授，主要研究方向为数字工业物联网系统。" ]
  [ "黄文（1991- ），男，四川成都人，四川大学博士后，主要研究方向为差分隐私、隐私计算和离散对数困难问题高效求解算法。" ]
  [ "廖永建（1976- ），男，四川成都人，电子科技大学副教授、硕士生导师，主要研究方向为传统密码学与格密码学。" ]
  [ "周世杰（1970- ），男，四川成都人，电子科技大学教授、博士生导师，主要研究方向为人工智能安全、信息安全。" ]
- 基金信息：
  
  中央高校国产移动终端操作系统高安全性关键技术研究及方案设计(ZYGX2020ZB019)
- DOI：10.11959/j.issn.2096-109x.2024023
  中图分类号： TP393
- 收稿：2023-02-09，
  
  修回：2024-03-10，
  
  纸质出版：2024-04-15
- 稿件说明：
移动端阅览
张智烁, 杨会喜, 黄文, 等. 支持属性立即撤销的可复用属性基签名及其密钥协商方案[J]. 网络与信息安全学报, 2024, 10(02): 81-94.

Format: ZHANG Z S, YANG H X, HUANG W, et al. Reusable attribute-based signature with attribute revocation and authenticated key agreement[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 81-94.
张智烁, 杨会喜, 黄文, 等. 支持属性立即撤销的可复用属性基签名及其密钥协商方案[J]. 网络与信息安全学报, 2024, 10(02): 81-94. DOI： 10.11959/j.issn.2096-109x.2024023.

Format: ZHANG Z S, YANG H X, HUANG W, et al. Reusable attribute-based signature with attribute revocation and authenticated key agreement[J]. Chinese Journal of Network and Information Security, 2024, 10(02): 81-94. DOI： 10.11959/j.issn.2096-109x.2024023.

摘要

为了解决后台分布式微服务－前端反向代理网络架构中统一细粒度访问控制和数据安全通信的问题，提出了可撤销属性的认证方策略属性基签名，基于Type-3配对的属性基签名及其互认证密钥协商方案。在所提方案签名算法中，无须关联访问策略，生成的签名只和用户部分属性有关，访问策略在验证算法中输入，来校验与签名相关联的用户属性是否真实合法并满足访问策略，所以签名与访问策略实现了解耦，使得一个签名可复用于多个访问策略的认证过程。另外，提出了属性哈希过滤算法，并基于该算法实现了属性的立即撤销机制，使得签名者不能用过期无效的属性继续用于策略认证。并在选择策略模型下严格地验证了所提属性基签名方案的存在不可伪造性。进一步地，为了实现数据的安全通信，提出了与所提属性基签名方案配套的满足扩展Canetti-Krawczyk安全模型的认证密钥协商方案。最后，通过理论和实验对比分析得知，在安全级别为128 bit高级加密标准的要求下，所提方案中的微服务器端的认证算法比其他属性认证算法消耗更少的时间，因此所提方案更加适用于复合微服务请求的场景。

Abstract

In the pursuit of establishing a unified model for fine-grained access control and secure data communication within a distributed microservices architecture

a verifier-policy attributed-based signature (VP-ABS) scheme

augmented with attribute revocation and an authenticated key agreement protocol

was proposed. This scheme was underpinned by Type-3 pairing. In this scheme

signatures generated by signers were linked solely to a subset of the signer's attributes and were disassociated from the access policy. This decoupling allowed for the reusability of the signer's signature across multiple access policies. Additionally

an attribute-Hash filter algorithm was introduced to facilitate a direct attribute revocation mechanism within the proposed VP-ABS scheme. This mechanism was designed to prevent users from authenticating with expired attributes. To further secure data communication

a mutually authenticated key agreement protocol was also proposed. This protocol was secure within the framework of the extended Canetti-Krawczyk (eCK) model and was built upon the foundation of the VP-ABS scheme. A rigorous unforgeability proof for the VP-ABS scheme was provided. Ultimately

theoretical comparisons and simulation experiments conducted at a 128-bit advanced encryption standard (AES) security level demonstrated that the proposed attribute-based authentication and secure communication scheme outperforms other contemporary schemes in terms of efficiency.

关键词

Keywords

references

冯志勇 , 徐砚伟 , 薛霄 , 等 . 微服务技术发展的现状与展望 [J ] . 计算机研究与发展 , 2020 , 57 ( 5 ): 1103 - 1122 .

FENG Z Y , XU Y W , XUE X , et al . Review on the development of micro-service architecture [J ] . Journal of Computer Research and Development , 2020 , 57 ( 5 ): 1103 - 1122 .

LEE H , KIM D , KWON Y . TLS 1.3 in practice: how TLS 1.3 contributes to the Internet [C ] // Proceedings of the Web Conference 2021 . New York : ACM , 2021 : 70 - 79 .

FELT A P , BARNES R , KING A , et al . Measuring HTTPS adoption on the web [C ] // Proceedings of the 26th USENIX Security Symposium (USENIX Security 17) . Vancouver : 2017 : 1323 - 1338 .

OBERKO P S K , OBENG V H K S , XIONG H , et al . A survey on attribute-based signatures [J ] . Journal of Systems Architecture , 2022 (124): Article No. 102396 .

GOYAL V , PANDEY O , SAHAI A , et al . Attribute-based encryption for fine-grained access control of encrypted data [C ] // Proceedings of the 13th ACM Conference on Computer and Communications Security . New York : ACM press , 2006 : 89 - 98 .

GUO S Q , ZENG Y P . Attribute-based signature scheme [C ] // Proceedings of the International Conference on Information Security and Assurance . Piscataway : IEEE Press , 2008 : 509 - 511 .

TAN S Y , HENG S H , GOI B M . On the security of an attribute-based signature scheme [C ] // Proceedings of the International Conference on U-and E-Service, Science and Technology . Berlin : Springer , 2009 : 161 - 168 .

LI J , AU M H , SUSILO W , et al . Attribute-based signature and its applications [C ] // Proceedings of the 5th ACM Symposium on Information, Computer and Communications Security . New York : ACM , 2010 : 60 - 69 .

LI J , KIM K . Hidden attribute-based signatures without anonymity revocation [J ] . Information Sciences , 2010 , 180 ( 9 ): 1681 - 1689 .

REN Y L , JIANG T J . Verifiable outsourced attribute-based signature scheme [J ] . Multimedia Tools and Applications , 2018 , 77 ( 14 ): 18105 - 18115 .

UZUNKOL O . Comments on 'verifiable outsourced attribute-based signature scheme' [J ] . Multimedia Tools and Applications , 2019 , 78 ( 9 ): 11735 - 11742 .

CUI H , DENG R H , LIU J K , et al . Server-aided attribute-based signature with revocation for resource-constrained industrial-internet-of-things devices [J ] . IEEE Transactions on Industrial Informatics , 2018 , 14 ( 8 ): 3724 - 3732 .

XIONG H , BAO Y Y , NIE X Y , et al . Server-aided attribute-based signature supporting expressive access structures for industrial internet of things [J ] . IEEE Transactions on Industrial Informatics , 2020 , 16 ( 2 ): 1013 - 1023 .

RAO Y S , DUTTA R . Efficient attribute-based signature and signcryption realizing expressive access structures [J ] . International Journal of Information Security , 2016 , 15 ( 1 ): 81 - 109 .

MAJI H K , PRABHAKARAN M , ROSULEK M . Attribute-based signatures [C ] // Proceedings of the Cryptographers Track at the RSA Conference . Berlin : Springer , 2011 : 376 - 392 .

CUI H , WANG G L , DENG R H , et al . Escrow free attribute-based signature with self-revealability [J ] . Information Sciences: An International Journal , 2016 , 367 ( C ): 660 - 672 .

LIU J H , HUANG X Y , LIU J K . Secure sharing of personal health records in cloud computing: ciphertext-policy attribute-based signcryption [J ] . Future Generation Computer Systems , 2015 ( 52 ): 67 - 76 .

ZHANG Y , FENG D G , ZHANG Z F , et al . On the security of an efficient attribute-based signature [C ] // Proceedings of the International Conference on Network and System Security . Berlin : Springer , 2013 : 381 - 392 .

DING S L , ZHAO Y M , LIU Y Y . Efficient traceable attribute-based signature [C ] // Proceedings of the 2014 IEEE 13th International Conference on Trust, Security and Privacy in Computing and Communications . Piscataway : IEEE Press , 2014 : 582 - 589 .

RAO Y S . A secure and efficient ciphertext-policy attribute-based signcryption for personal health records sharing in cloud computing [J ] . Future Generation Computer Systems , 2017 ( 67 ): 133 - 151 .

YU J G , LIU S H , WANG S L , et al . LH-ABSC: a lightweight hybrid attribute-based signcryption scheme for cloud-fog-assisted IoT [J ] . IEEE Internet of Things Journal , 2020 , 7 ( 9 ): 7949 - 7966 .

ZHANG Z S , ZHOU S J . A decentralized strongly secure attribute-based encryption and authentication scheme for distributed internet of mobile things [J ] . Computer Networks , 2021 (201): Article No. 108553 .

ZHANG Z S , HUANG W , CAI S Y , et al . An efficient reusable attribute-based signature scheme for mobile services with multi access policies in fog computing [J ] . Computer Communications , 2022 , 196 ( C ): 9 - 22 .

CHEN L , CHENG Z , SMART N P . Identity-based key agreement protocols from pairings [J ] . International Journal of Information Security , 2007 , 6 ( 4 ): 213 - 241 .

LAMACCHIA B , LAUTER K , MITYAGIN A . Stronger security of authenticated key exchange [C ] // Proceedings of the International Conference on Provable Security . Berlin, Heidelberg : Springer , 2007 : 1 - 16 .

BEIMEL A . Secure schemes for secret sharing and key distribution [M ] . Technion-Israel Institute of Technology , Faculty of Computer Science , 1996 .

LEWKO A , WATERS B . Decentralizing attribute-based encryption [C ] // Proceedings of the Annual International Conference on the Theory and Applications of Cryptographic Techniques . Berling : Springer , 2011 : 568 - 588 .

李高磊 , 李建华 , 周志洪 , 等 . 面向新型关键基础设施的密码应用安全性评估技术综述 [J ] . 网络与信息安全学报 , 2023 , 9 ( 6 ): 1 - 19 .

LI G L , LI J H , ZHOU Z H , et al . Overview of cryptographic application security assessment technology for new key infrastructure [J ] . Chinese Journal of Network and Information Security , 2023 , 9 ( 6 ): 1 - 19 .

POINTCHEVAL D , STERN J . Security arguments for digital signatures and blind signatures [J ] . Journal of Cryptology , 2000 , 13 ( 3 ): 361 - 396 .

ZHANG Z S , HUANG W , ZHOU S J , et al . A revocable multi-authority fine-grained access control architecture against ciphertext rollback attack for mobile edge computing [J ] . Journal of Systems Architecture , 2022 (129): Article No. 102589 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据