支持快速撤销及外包计算的服务器辅助属性加密研究

Attribute based encryption (ABE) can provide fine-grained access control over encrypted data, it has potential to be applied in many cloud computing applications and is called “encryption for cloud computing”. However, there are several drawbacks that essentially impede ABE from wide-range deployment in practical systems. 1） The cryptographic algorithm in the practical system must have an efficient and robust user revocation mechanism, but the existing revocation mechanisms in ABE cannot achieve high efficiency and robustness simultaneously. 2) The existing ABE schemes suffer poor computational efficiency. 3) The known research on efficiency optimization techniques and user revocation mechanisms is relatively independent, and few work can take into account both of them. Though the cloud server has powerful storage, management and computing capabilities, most of ABE schemes only utilize the storage service. Taking advantage of the cloud server’s all the powerful services, we study server-aided outsourced attribute based encryption with immediate user revocation, which not only achieves the efficient, secure and robust user revocation mechanism, but also achieves high computational efficiency. First, we study the robust direct revocation mechanism. Second, with the help of outsource computation, we continue to optimize the computational efficiency of key generation, encryption and decryption algorithms in the proposed scheme. Moreover, we study the verification mechanisms to check the correctness of computation results. At last, we implement the proposed scheme to verify the practicality.

属性密码学能够在加密的同时实现细粒度、非交互的访问控制，在云计算中有着广泛的应用前景，被誉为“云计算的加密”。面向实际应用，属性加密方案存在以下不足：1）任何实际系统中的密码算法必须具有高效、健壮的撤销机制，而大多数高效的属性加密撤销机制的健壮性不足；2）属性加密核心算法的计算效率较低；3）目前，针对效率优化和用户撤销技术的研究相对独立，能够兼顾二者的工作不多。虽然云服务器具有强大的存储、管理和计算能力，然而大部分属性加密方案仅用到存储功能。本项目计划利用云服务器的上述所有功能，研究支持快速撤销及外包计算的服务器辅助属性加密方案，使其既能实现快速、安全、健壮的用户撤销，又具有较高的计算效率。首先，研究直接撤销机制的健壮性优化技术；其次，结合外包计算技术，继续优化上述方案中密钥生成、加密和解密算法的计算效率；再次，研究能够检查返回结果正确性的可验证机制。最后，实现原型系统，验证方案的实用性。

属性密码学能够在加密的同时实现细粒度、非交互的访问控制，在云计算中有着广泛的应用前景，被誉为“云计算的加密”。然而，属性加密方案存在效率和功能上的不足。本项目充分利用服务器的存储、计算和管理等功能，融合多种优化技术，不但完成了有服务器辅助的直接撤销机制健壮性优化技术、有服务器辅助的可撤销属性加密方案的效率优化技术、支持全方位审计的属性加密方案等既定研究内容的设计工作，还提出了支持快速权限代理的属性加密方案、高安全的属性加密外包解密机制等，从功能和效率两方面提高属性加密方案的实用性。此外，完成可移植性强的属性加密方案软件函数库研制工作，提供包括C语言、Java Native Interface（JNI）、JavaScript等服务接口，并基于上述函数库实现提出的属性加密方案，在服务器和移动终端上搭建原型系统，验证方案的正确性和实用性。综上所述，项目团队超额完成既定研究目标。