采用属性基代理重加密机制的敏感数据安全管理关键技术研究

Nowadays, illegal copying,spreading and leakage of senstive digital assets become a difficult problem in digital security field. The traditional technologies of sensitive data security management(such as data encryption, access control,authentication, etc.) can't meet the requirements of resource sharing and processing in open network environment. My subject is devoted to the research of key technologies of sensitive data security management using attribute-based proxy re-encryption scheme in open network environment, which aims at solving some basic theoretical problems such as sensitive data ciphertext storing, cryptographic access control and distribution mechanism. The concrete content includes:(1) a CCA(chosen-ciphertext attack) secure unidirectional proxy re-encryption scheme in the standard model using bilinear pairings will be shown, and comparing with the existing system, our scheme relieves the server from intense encryption /decryption processing, and achieves reliable decentralized encryption /decryption with good scalability and efficiency;(2) an efficient and provable secure ciphertext-policy attribute-based encryption scheme with access tree structure and threshold secret sharing scheme will be designed to realize cryptographic access control; (3) in order to support the distribution mechanism of "one to more" and "ciphertext forward", a distribution protocol based on attribute-based proxy re-encryption for sensitive data will be proposed. The subject will enrich cryptographic algorithms and accumulate valuable experiences for the study of sensitive data security management. The proposal is of great theoretical and pratical significance in the field of digital security and digital rights management(DRM).

目前，防止有价值数字资产的非授权复制、扩散和泄密是数字内容安全领域的一个难题。普通的敏感数据安全管理机制（数据加密、访问控制、身份验证等基本技术）并不能满足分布式环境下资源共享和处理的需求。本课题将研究采用属性基代理重加密机制的敏感数据安全管理关键技术，解决敏感数据密文存储、密文访问控制、数据分发机制等核心基础理论问题。具体内容包括：(1)采用双线性对构造一个高效的标准模型下选择密文安全的单向代理重加密算法，降低服务端对敏感数据管理的复杂度，同时防止服务器被恶意攻击后数据泄露；(2)采用访问树结构和门限秘密共享技术设计一个标准模型下可证安全的密文策略属性基加密算法，解决敏感数据安全管理的密文访问控制问题；(3) 设计采用属性基代理重加密机制的敏感数据分发协议，实现敏感数据"一对多"、"密文转发"的分发机制。本课题对数字化资产、数据防泄密版权保护、数字内容安全保护理论和技术支撑具有重要意义。

随着计算机和云服务的发展，数据安全越来越受到人们的关注，防止有价值数字资产的非授权复制、扩散和泄密成为学者们的研究热点。普通的敏感数据安全管理机制（数据加密、访问控制、身份验证等基本技术）并不能满足分布式环境下资源共享和处理的需求。本课题针对采用属性基代理重加密机制的敏感数据安全管理关键技术展开研究，解决敏感数据密文存储、密文访问控制、数据分发机制等核心基础理论问题。具体内容包括：(1)采用双线性对构造一个高效的标准模型下选择密文安全的单向代理重加密算法，降低服务端对敏感数据管理的复杂度，同时防止服务器被恶意攻击后数据泄露；(2)采用访问树结构和门限秘密共享技术设计一个标准模型下可证安全的密文策略属性基加密算法，解决敏感数据安全管理的密文访问控制问题；(3) 设计采用属性基代理重加密机制的敏感数据分发协议，实现敏感数据“一对多”、“密文转发”的分发机制。综合上述结果，本课题对数字化资产、数据防泄密版权保护、数字内容安全保护理论和技术支撑具有重要意义。项目资助发表核心论文26篇，待发表5篇。申请专利2项。培养硕士生6名，其中3名已取得硕士学位，3名在读。项目投入经费23万，支出16.2万，各项支出基本与预算相符。剩余经费6.8万元，计划用于本项目研究后续支出。