基于CPABE的分布式数据访问控制与共享方案

doi:10.3778/j.issn.1002-8331.2112-0294

摘要/Abstract

摘要： 目前“区块链＋密文属性加密”数据共享方案仍通过一个或多个权威机构进行密钥生成、管理和分发工作，易造成授权机构审计难、加/解密开销大和密钥滥用的可能。针对以上问题，提出基于CPABE的分布式数据访问控制与共享方案，实现无授权机构参与下的可证明数据安全共享及其隐私保护技术。通过代理密钥封装技术对CP-ABE算法主密钥进行基于区块链的分布式管理，并采用区块链双链模型，实现了代理密钥封装机制（PKEM）与CP-ABE的算法功能安全隔离，提高系统运行效率和安全性；设计区块结构与数据格式规范，实现PKEM-CPABE算法的全过程管理和操作行为可追溯的链上监管。仿真实验分析表明，所改进的算法在保护数据隐私的同时，实现了高效率的安全共享机制。

关键词: 区块链, 属性基加密, 代理密钥封装, 数据共享, 访问控制

Abstract: At present, the data sharing scheme with blockchain & CP-ABE（ciphertext-policy attribute-based encryption） still uses one or more authority organizations to generate, manage and distribute keys, which is easy to cause single point failure of authorization agencies, high algorithm overhead and the possibility of secret keys leakage of node users. Therefore, this paper proposes a distributed data access control and sharing scheme based on decentralized CP-ABE to realize privacy protection and its provable data security. First of all, the master key（MSK） of the CPABE based on the block chain is distributed through the proxy key encapsulation mechanism, and in order to improve the efficiency and security of the system, the dual-chain model is adopted to realize the security isolation for the proxy key encapsulation mechanism（PKEM） and CP-ABE algorithm. Secondly, this paper designs the block structure and data format specification to manage the whole processes of PKEM-CPABE algorithm and the audible traceability operation behavior. Finally, the security and experimental analytics shows that the proposed algorithm not only protects data privacy, but also implements an efficient security sharing mechanism.

Key words: blockchain, attribute-based encryption, proxy key encapsulation mechanism, data sharing, access control

张晓东, 陈韬伟, 余益民. 基于CPABE的分布式数据访问控制与共享方案[J]. 计算机工程与应用, 2023, 59(23): 254-262.

ZHANG Xiaodong, CHEN Taowei, YU Yimin. Distributed Data Access Control and Sharing Scheme Based on CPABE[J]. Computer Engineering and Applications, 2023, 59(23): 254-262.

参考文献

[1] BETHENCOURT J，SAHAI A，WATERS B.Ciphertext-policy attribute-based encryption[C]//Proceedings of the 2007 IEEE Symposium on Security and Privacy，2007：321-334.
[2] SAHAI A，WATERS B.Fuzzy identity-based encryption[C]//Annual International Conference on the Theory and Applications of Cryptographic Techniques-Advances in Cryptology Advances in Cryptology，2005：457-473.
[3] BEIMEL A.Secure schemes for secret sharing and key distribution[D].Haifa：?Israel Institute of Technology，1996.
[4] WATERS B.Ciphertext-policy attribute-based encryption：an expressive，efficient，and provably secure realization[C]//Proceedings of the 14th International Conference on Practice and Theory in Public Key Cryptography Conference on Public Key Cryptography，2011：53-70.
[5] WATERS B.Dual system encryption：realizing fully secure IBE and HIBE under simple assumptions[C]//Proceedings of the Cryptology-EUROCRYPT 2009.Berlin，Heidelberg：Springer-Verlag，2009：619-636.
[6] LEWKO A，WATERS B.New techniques for dual system encryption and fully secure HIBE with short ciphertexts[C]//Proceedings of the 7th Theory of Cryptography Conf（TCC 2010）.Berlin，Heidelberg：Springer-Verlag，2009：455-479.
[7] LEWKO A，OKAMOTO T，SAHAI A，et al.Fully secure functional encryption：attribute-based encryption and （hierarchical） inner product encryption[C]//Proceedings of the Cryptology-EUROCRYPT 2010.Berlin，Heidelberg：Springer-Verlag，2010：62-91.
[8] OKAMOTO T，TAKASHIMA K.Fully secure unbounded inner-product and attribute-based encryption[C]//Proceedings of the Advances in Cryptology-ASIACRYPT，2012：349-366.
[9] GORBUNOV S，VAIKUNTANATHAN V，WEE H.Attribute-based encryption for circuits[C]//Proceedings of the Symposium on Theory of Computing-STOC，2013：545-554.
[10] HOHENBERGER S，WATERS B.Online/offline attribute-based encryption[C]//Proceedings of the Conf on the Theory and Application of Cryptology.New York：Springer-Verlag，2014：293-310.
[11] ROUSELAKIS Y，WATERS B.Practical constructions and new proof methods for large universe attribute-based encryption[C]//Proceedings of the 2013 ACM SIGSAC Conf on Computer & Communications Security，2013：463-474.
[12] DE S J，RUI S.Decentralized access control on data in the cloud with fast encryption and outsourced decryption[C]//Proceedings of the 2015 IEEE Global Communications Conf，2015：1-6.
[13] 仲红，崔杰，朱文龙，等.高效且可验证的多授权机构属性基加密方案[J].软件学报，2018，29（7）：2006-2017.
ZHONG H，CUI J，ZHU W L，et al.Efficient and verifiable multi-authority attribute based encryption scheme[J].Journal of Software，2018，29（7）：2006-2017.
[14] 苏金树，曹丹，王晓峰，等.属性基加密机制[J]软件学报，2011，22（6）：1299-1315.
SU J S，CAO D，WANG X F，et al.Attribute-based encryption schemes[J].Journal of Software，2011，22（6）：1299-1315.
[15] NAKAMOTO S.Bitcoin：a peer-to-peer electronic cash system[EB/OL].[2021-06-20].https：//bitcoin.org/bitcoin.pdf.
[16] BRAMM G，GALL M，SCHUTTE J.BDABE-blockchain-based distributed attribute based encryption[C]//Proceedings of the 15th International Joint Conference on e-Business and Telecommunications.Porto，Portugal：SciTePress，2018：99-110.
[17] FAN Y，LIN X，LIANG W，et al.TraceChain：a blockchain-based scheme to protect data confidentiality and traceability[J].Softw：Pract Exper，2019：1-15.
[18] 田有亮，杨科迪，王缵，等.基于属性加密的区块链数据溯源算法[J].通信学报，2019，40（11）：101-111.
TIAN Y L，YANG K D，WANG Z，et al.Algorithm of blockchain data provenance based on ABE[J].Journal on Communications，2019，40（11）：101-111.
[19] 闫玺玺，原笑含，汤永利，等.基于区块链且支持验证的属性基搜索加密方案[J].通信学报，2020，41（2）：187-198.
YAN X X，YUAN X H，TANG Y L，et al.Verifiable attribute-based searchable encryption scheme based on blockchain[J].Journal on Communications，2020，41（2）：187-198.
[20] GAO S，PIAO G R，ZHU J M，et al.TrustAccess：a trustworthy secure ciphertext-policy and attribute hiding access control scheme based on blockchain[J].IEEE Trans Veh Technol，2020，69：5784-5798.
[21] 郑良汉，何亨，童潜，等.云环境中的多授权机构访问控制方案[J].计算机科学与探索，2020，14（11）：1865-1871.
ZHENG L H，HE H，TONG Q，et al.Multi authority access control scheme in cloud environment[J].Journal of Frontiers of Computer Science and Technology，2020，14（11）：1865-1871.
[22] 张晓东，陈韬伟，余益民，等.基于属性基加密的区块链数据共享模型[J].计算机应用研究，2021，38（8）：2278-2283.
ZHANG X D，CHEN T W，YU Y M，et al.Model of block-chain data sharing based on ABE[J].Application Research of Computers，2021，38（8）：2278-2283.
[23] ZHANG X D.Research on blockchain access control technology based on ciphertext-policy attributes based encryption[D].Kunming：Yunnan University of Finance and Economics，2022.
[24] BEN L.PBC li-brary[EB/OL].（2013-06-14）.[2021-06-20].https：//crypto.stanford.edu/pbc/.