属性加密实用化关键技术研究

Data privacy and access control mechanism are important modulo of modern information systems, as well as one of the important preconditions and guarantees. Traditional gateway-based access control systems suffer from efficiency bottleneck, inter-domain authentication, and DoS/DDoS attacks. To solve these problem attributed based encryption (ABE) was proposed as one promising technique, as it can provide data encryption and fine-grained access control simultaneously: attributes/policies are embedded into a receiver's secret key, and a sender embeds attributes/policies into ciphertexts. A receiver can only access the plaintexts in the cerphertexts only if the attributes match the policies with respect to ciphertexts / secret keys. ABE was introduced in 2005 and was called "encryption technique for the cloud", but it is not utilized in practice though many years have passed. The reason is that all known ABE schemes only provide poor efficiency and are equipped no satisfactory revocation mechanism, without which, ABE can hardly become underlying a data processing technique for a practical information system. Therefore, towards practical ABE schemes, we study these two problems, and try to solve the above two problems. First, we plan to incorporate offline outsourcing computation and re-design of the ABE schemes, improve the online data processing speed. Second, combining broadcast encryption and new key update mechanism, improve flexible attribute (user) revocation mechanism. Finally, we implement our schemes and verify our proposals.

数据隐私和访问控制机制是现代信息系统的重要组成模块，是系统安全性的重要前提和保证。传统的基于访问控制网关的访问控制机制存在效率瓶颈、跨域认证及易遭受拒绝服务攻击等缺点。为了解决这个问题，属性加密应运而生，它同时实现加密和细粒度访问控制：密文中嵌入属性集合或访问策略，解密者的私钥嵌入访问策略或属性集合。只有属性集合满足访问策略时，才能够解密访问明文。属性加密早在在2005年就被提出，被誉为面向云计算的密码技术。然而直到今天也没有得到实用。其原因主要为：已知算法效率低、属性撤销机制不完善。这些问题不得到解决，属性加密就不能成为现实系统的底层数据处理技术。因此，本项目面向属性加密技术的实用化，重点研究解决以上两个问题的方法：首先，通过离线外包计算技术和新的方案设计，提高数据处理速度；其次，结合广播加密技术和新的密钥更新机制，提出灵活有效的属性撤销机制；最后实现原型系统，验证解决方案的有效性。

数据隐私和访问控制机制是现代信息系统的重要组成模块，是系统安全性的重要前提和保证。传统的基于访问控制网关的访问控制机制存在效率瓶颈、跨域认证及易遭受拒绝服务攻击等缺点。为了解决这个问题，属性加密应运而生：它能同时实现加密和细粒度访问控制：密文中嵌入属性集合或访问策略，解密者的私钥嵌入访问策略或属性集合。只有属性集合满足访问策略时，才能够解密访问明文。属性加密早在2005年就被提出，被誉为“面向云计算的密码”。然而直到今天也没有得到实用。其原因主要为：已知属性加密算法计算量大、属性撤销机制不完善。而这些问题不得到解决，属性加密就不能成为现实系统的底层数据处理技术。因此，本项目面向属性加密技术的实用化，重点研究并提出了以上两个问题的解决方法：首先，通过离线外包计算技术和新的方案设计，大幅提高了数据处理速度；其次，结合广播加密技术和新的密钥更新机制，提出了灵活有效的属性撤销机制；最后，通过原型系统实现，验证了解决方案的有效性。