自定义密钥的加密去重云存储访问控制方案

谷博伦; 徐子凯; 李卫海; 俞能海

doi:10.11959/j.issn.2096-109x.2024055

您当前的位置：

首页 >

文章列表页 >

自定义密钥的加密去重云存储访问控制方案

学术论文

- 自定义密钥的加密去重云存储访问控制方案
- Key-customizable encrypted deduplication with access control for cloud storage
- 网络与信息安全学报 2024年10卷第4期页码：85-97
- 作者机构：
  
  1.中国科学技术大学网络空间安全学院，安徽合肥 230026
  2.数字安全安徽省重点实验室, 安徽合肥 230026
- 作者简介：
  
  [ "谷博伦（1999- ），男，浙江温州人，中国科学技术大学硕士生，主要研究方向为数据安全。" ]
  [ "徐子凯（1999- ），男，山东聊城人，中国科学技术大学博士生，主要研究方向为数据安全。" ]
  [ "李卫海（1975- ），男，辽宁大连人，中国科学技术大学副教授，主要研究方向为多媒体内容安全、数据安全。" ]
  [ "俞能海（1964- ），男，安徽无为人，中国科学技术大学教授、博士生导师，主要研究方向为视频处理与多媒体通信、信息检索、媒体内容安全、数据安全。" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2018YFB0804101)
- DOI：10.11959/j.issn.2096-109x.2024055
  中图分类号： TP393
- 收稿：2024-03-20，
  
  修回：2024-07-09，
  
  纸质出版：2024-08-25
- 稿件说明：
移动端阅览
谷博伦, 徐子凯, 李卫海, 等. 自定义密钥的加密去重云存储访问控制方案[J]. 网络与信息安全学报, 2024, 10(4): 85-97.

Format: GU B L, XU Z K, LI W H, et al. Key-customizable encrypted deduplication with access control for cloud storage[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 85-97.
谷博伦, 徐子凯, 李卫海, 等. 自定义密钥的加密去重云存储访问控制方案[J]. 网络与信息安全学报, 2024, 10(4): 85-97. DOI： 10.11959/j.issn.2096-109x.2024055.

Format: GU B L, XU Z K, LI W H, et al. Key-customizable encrypted deduplication with access control for cloud storage[J]. Chinese Journal of Network and Information Security, 2024, 10(4): 85-97. DOI： 10.11959/j.issn.2096-109x.2024055.

摘要

随着互联网的高速发展和应用，传统的存储资源难以满足日益增长的海量数据存储的需求，越来越多的用户尝试将他们的数据上传到第三方云服务器进行统一存储。如何在云上同时实现高效的加密重复数据删除和安全的文件共享已成为迫切需要解决的问题。并且，用户总是喜欢自己设定密码对文件进行加解密，而在有需要时才对加密文件进行共享。据此，设计了一个确定性分步加密算法，当两步加密的密钥满足一定关系时，两步加密可以等效为一次加密。在此基础上提出了一个支持动态访问控制的云存储加密重复数据删除方案，使用确定性分步加密算法对文件进行加密，使用密文策略的属性基加密算法对文件密钥进行加密。这不仅使持有相同文件的不同用户均可以灵活地自定义各自的加解密密钥，而且还可以通过动态的访问控制机制确保安全的文件共享。此外，访问控制部分能够兼容大多数现有的密文策略属性基加密方案，甚至允许在不同的属性组中使用不同的密文策略属性基加密方案。安全性分析结果显示，该方案能够达到当前加密去重范式下的最高安全性。实验和分析结果表明，该方案能够较好地满足云服务商和用户的实际需求，具有良好的算法执行效率。

Abstract

With the rapid development and application of the Internet

traditional storage resources have been found unable to meet the growing demand for massive data storage. An increasing number of users have attempted to upload their data to third-party cloud servers for unified storage. Efficient deduplication and secure file sharing in the cloud have emerged as critical concerns. Moreover

users have always preferred to customize their passwords for encrypting and decrypting files

only sharing encrypted files when necessary. Based on this preference

a deterministic stepwise encryption algorithm was first designed. It was such that when the keys for the two steps of encryption satisfied a certain relationship

the two steps of encryption could be equivalent to a single encryption process. A novel key-customizable encrypted deduplication scheme with access control for cloud storage was proposed

utilizing the deterministic stepwise encryption algorithm to encrypt files and a ciphertext-policy attribute-based encryption algorithm to encrypt file keys. This scheme not only offered the flexibility to customize encryption and decryption keys for different users with the same files

but also ensured secure file sharing through a dynamic access control mechanism. Moreover

the optional access control component was made compatible with the majority of existing ciphertext-policy attribute-based encryption (CP-ABE) schemes

even allowing for different CP-ABE schemes within different attribute groups. Security analysis results show that the proposed scheme achieves the highest level of security under the current encrypted deduplication paradigm. Experimental and analytical results indicate that it effectively meets the practical needs of cloud service providers and users

and also achieves acceptable efficiency.

关键词

Keywords

references

CHRISTEN P . A survey of indexing techniques for scalable record linkage and deduplication [J ] . IEEE Transactions on Knowledge and Data Engineering , 2012 , 24 ( 9 ): 1537 - 1555 .

MEYER D T , BOLOSKY W J . A study of practical deduplication [J ] . ACM Transactions on Storage , 2012 , 7 ( 4 ): 14 .

ALZAIN M A , PARDEDE E , SOH B , et al . Cloud computing security: from single to multi-clouds [C ] // Proceedings of the 2012 45th Hawaii International Conference on Systems Science . Piscataway : IEEE Press , 2012 : 5490 - 5499 .

DOUCEUR J R , ADYA A , BOLOSKY W J , et al . Reclaiming space from duplicate files in a serverless distributed file system [C ] // Proceedings of the 22nd International Conference on Distributed Computing Systems . Piscataway : IEEE Press , 2002 : 617 - 624 .

BELLARE M , KEELVEEDHI S , RISTENPART T . Message-locked encryption and secure deduplication [J ] . IACR Cryptology EPrint Archive , 2012 : 631 .

BELLARE M , KEELVEEDHI S , RISTENPART T . DupLESS: server-aided encryption for deduplicated storage [C ] . Proceedings of the 22nd USENIX Conference on Security . New York : ACM , 2013 : 179 - 194

LIU J , ASOKAN N , PINKAS B . Secure deduplication of encrypted data without additional independent servers [J ] . Proceedings of the ACM Conference on Computer and Communications Security , 2015 : 874 - 885

YAN Z , WANG M , LI Y , et al . Encrypted data management with deduplication in cloud computing [J ] . IEEE Cloud Computing , 2016 , 3 ( 2 ): 28 - 35 .

XIONG J , ZHANG Y , LI X , et al . RSE-PoW: a role symmetric encryption pow scheme with authorized deduplication for multimedia data [J ] . Mobile Networks and Applications , 2018 , 23 ( 3 ): 650 - 663 .

KWON H , HAHN C , KIM D , et al . Secure deduplication for multimedia data with user revocation in cloud storage [J ] . Multimedia Tools and Applications , 2017 , 76 ( 4 ): 5889 - 5903 .

SONG M , HUA Z , ZHENG Y , et al . FCDedup: A two-level deduplication system for encrypted data in fog computing [J ] . IEEE Transactions on Parallel and Distributed Systems , 2023 , 34 ( 10 ): 2642 - 2656 .

YUAN H , CHEN X , LI J , et al . Secure cloud data deduplication with efficient reencryption [J ] . IEEE Transactions on Services Computing , 2022 , 15 ( 1 ): 442 - 456 .

JIANG T , CHEN X , WU Q , et al . Secure and efficient cloud data deduplication with randomized tag [J ] . IEEE Transactions on Information Forensics and Security , 2017 , 12 ( 3 ): 532 - 543 .

POORANIAN Z , SHOJAFAR M , GARG S , et al . LEVER: secure deduplicated cloud storage with encrypted two-party interactions in cyber-physical systems [J ] . IEEE Transactions on Industrial Informatics , 2021 , 17 ( 8 ): 5759 - 5768 .

ZHANG D , LE J , MU N , et al . Secure and efficient data deduplication in JointCloud storage [J ] . IEEE Transactions on Cloud Computing , 2023 , 11 ( 1 ): 156 - 167 .

GUO C , WANG L , TANG X , et al . Two-party interactive secure deduplication with efficient data ownership management in cloud storage [J ] . Journal of Information Security and Applications , 2023 , 73 : 103426 .

BELLARE M , ROGAWAY P . Optimal asymmetric encryption [C ] // Proceedings of Advances in Cryptology—EUROCRYPT'94: Workshop on the Theory and Application of Cryptographic Techniques . Italy : Springer , 1994 : 92 - 111 .

FUJISAKI E , OKAMOTO T , POINTCHEVAL D , et al . RSA-OAEP is secure under the RSA assumption [J ] . Journal of Cryptology , 2004 , 17 ( 2 ): 81 - 104 .

KOBARA K , IMAI H . OAEP++ : a very simple way to apply OAEP to deterministic OW-CPA primitives [J ] . IACR Cryptology EPrint Archive , 2002 : 130 .

DUAN Y . Distributed key generation for encrypted deduplication: Achieving the strongest privacy [C ] // Proceedings of the 6th Edition of the ACM Workshop on Cloud Computing Security , New York : ACM , 2014 : 57 - 68 .

HAN D , PAN N , LI K . A traceable and revocable ciphertext-policy attribute-based encryption scheme based on privacy protection [J ] . IEEE Transactions on Dependable and Secure Computing , 2022 , 19 ( 1 ): 316 - 327 .

KOBLITZ N . Elliptic curve cryptosystems [J ] . Mathematics of computation , 1987 , 48 ( 177 ): 203 - 209 .

ROGAWAY P , BELLARE M , BLACK J . OCB: A block-cipher mode of operation for efficient authenticated encryption [J ] . ACM Transactions on Information and System Security , 2003 , 6 ( 3 ): 365 - 403 .

YANG X , LU R , SHAO J , et al . Achieving efficient secure deduplication with user-defined access control in cloud [J ] . IEEE Transactions on Dependable Secure Computing , 2022 , 19 ( 1 ): 591 - 606 .

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于场景感知的访问控制模型

基于区块链的电网可信分布式身份认证系统

基于区块链的访问控制技术研究进展

基于访问控制安全高效的多用户外包图像检索方案

基于权限聚类的属性值优化