面向云存储服务的文档保护与组合关键技术

Based on the requirements of storage and fine-grained access control of electronic documents and composite documents in cloud computing environment, attribute-based document multilevel encryption for storage and sharing mechanism, as well as the document composition model are especially researched in this project. By combining proposed concepts of security levels classification for document attribute sets and constraint factors with new research achievements of document attribute-based encryption, novel mechanisms will be introduced to support security storage of documents in cloud service. Furthermore, applying multi-signature and aggregate signature schemes to minimize the cost of storage and communication in cloud, effective validation methods for document integrity can be realized. Moreover, by extending the area of secure multi-party computation, extended secure multi-party computation based document composition innovation models will be proposed to solve the problems of secure document composition in cloud computing. Besides, attribute based encryption mechanism of attribute set splitting and multi-authority will be studied to solve the scalable authority management issues, the one that varies with the attribute sets. By extracting the minimal attribute set, associated ciphertext and allocating distributed hash network, new self-destructing schemes for documents will be proposed to guarantee data security and privacy-preserve. This project will strengthen the security architecture of document engineering. To best of our knowledge, not only are related work at forefront of security research, but also secure document composition and scalable authorization have not been studied up to now. The research achievements will innovate the document protection, composition methodology and promote developments of secure document engineering.

本项目针对云环境中电子文档与组合文档的存储服务及细粒度访问控制需求，重点研究基于属性的文档分等级加密存储与共享机制和文档组合模式问题。通过提出文档属性集的等级划分和受限条件概念，融合到文档属性加密的新方法研究以支持文档的安全云存储服务，并应用多重签名和聚合签名减少文档在云端的存储和通信开销，实现文档完整性验证的高效性。延拓多方计算理论的领域应用，提出基于扩展的安全多方计算的文档组合模式，攻克云环境中安全文档组合难题。研究属性集拆分和多授权机构的属性加密机制，以解决随属性集变化的可伸缩文档授权管理问题。通过最小属性集提取、密文耦合和分布哈希网络分发的方法，实现文档使用后的自毁以保障数据安全与隐私保护。本项目研究将强化面向文档工程的文档安全体系架构，相关内容处于当前国际研究前沿，安全文档组合及可伸缩授权等内容未见报道，研究成果将创新文档保护、组合方法和技术。

云环境中电子文档从创建、编改、传输、使用到废弃都具有内容动态、多用户参与和安全需求多样性等特点，本项目着力于文档云存储、跨域组合、授权访问、清理销毁等四个重要阶段的信息安全理论与方法研究，包括数据加密与签名、不同等级敏感信息保护、安全多方计算、可伸缩文档授权管理和安全文档自毁等。本项目组按既定计划执行项目，完成研究目标。项目开展四个方面的研究工作：.（1）通过添加文档属性集的等级属性和等级划分，研究文档属性加密的新方法，实现文档的安全云存储服务，并应用多重签名和聚合签名减少文档在云端的存储和通信开销，实现文档完整性验证的高效性；.（2）延拓多方计算理论的领域应用，提出基于扩展的安全多方计算模式，为云环境中安全文档组合问题提供理论方法；.（3）提出属性集拆分和多授权机构的属性加密方法，解决随属性集变化的可伸缩文档授权管理问题；.（4）通过最小属性集提取、密文耦合和分布哈希网络分发的方法，实现文档使用后的自毁和副本数目控制，保障数据安全与隐私保护。.以上各方面分别取得一批论文、专利、软件著作权、人才培养等具有创新性的成果，也提高了学术交流的活跃氛围和助力了学科建设。