CN108600171A - A kind of cloud data certainty delet method for supporting fine granularity to access - Google Patents
A kind of cloud data certainty delet method for supporting fine granularity to access Download PDFInfo
- Publication number
- CN108600171A CN108600171A CN201810241812.3A CN201810241812A CN108600171A CN 108600171 A CN108600171 A CN 108600171A CN 201810241812 A CN201810241812 A CN 201810241812A CN 108600171 A CN108600171 A CN 108600171A
- Authority
- CN
- China
- Prior art keywords
- data
- cloud
- ciphertext
- attribute
- cloud server
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 33
- 238000012217 deletion Methods 0.000 claims abstract description 80
- 230000037430 deletion Effects 0.000 claims abstract description 79
- 238000012795 verification Methods 0.000 claims description 7
- 238000004364 calculation method Methods 0.000 claims description 4
- 125000004122 cyclic group Chemical group 0.000 claims description 4
- 230000008569 process Effects 0.000 description 6
- 230000006870 function Effects 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 3
- 238000013500 data storage Methods 0.000 description 2
- 238000011161 development Methods 0.000 description 2
- 238000010586 diagram Methods 0.000 description 2
- 238000007726 management method Methods 0.000 description 2
- 238000013507 mapping Methods 0.000 description 2
- 230000005012 migration Effects 0.000 description 2
- 238000013508 migration Methods 0.000 description 2
- 230000001737 promoting effect Effects 0.000 description 2
- 230000006978 adaptation Effects 0.000 description 1
- 230000006399 behavior Effects 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 239000006229 carbon black Substances 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000001010 compromised effect Effects 0.000 description 1
- 238000011217 control strategy Methods 0.000 description 1
- 230000006378 damage Effects 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 230000014509 gene expression Effects 0.000 description 1
- 230000036541 health Effects 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
- H04L67/1097—Protocols in which an application is distributed across nodes in the network for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
- H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/06—Protocols specially adapted for file transfer, e.g. file transfer protocol [FTP]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
- H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
Abstract
The present invention relates to a kind of cloud data certainty delet methods for supporting fine granularity to access, and include the following steps：Data are encrypted in data owner, and encryption data is contracted out to Cloud Server so that the user for only meeting visiting demand just can be with ciphertext data；When data owner, which wants to delete, stores the data in Cloud Server, it sends removal request and gives trusted authority center first, the center returns to a deletion key, i.e. re-encrypted private key is to data owner, data owner will delete key and be sent to Cloud Server, and Cloud Server carries out delete operation to data.After executing delete operation, Cloud Server, which returns to one, proves that, to data owner, data owner verifies whether target data has been deleted by Merkle Hash trees.The present invention realizes the data that can verify that using attribute revocation and Merkle Hash trees and deletes, while supporting fine-grained access control, achievees the purpose that secret protection, substantially increases the utilization rate of Cloud Server.
Description
Technical Field
The invention belongs to the technical field of network security, and particularly relates to a cloud data deterministic deletion method supporting fine-grained access.
Background
Cloud computing is used as a new computing mode, so that data storage and data sharing are more convenient and more economical. The system can integrate a large number of high-quality resources, integrates different resources to provide mass storage and efficient and rapid computing service for users, and users can access shared resources anytime and anywhere, thereby greatly saving the user cost and improving the resource utilization rate. More and more users like to store data on the cloud, which contains a large amount of sensitive data such as health data, financial data, trade secrets, etc., making data privacy and other security issues a focus of public concern.
Due to the separation of ownership and administrative rights of cloud data using cloud computing technology, users lose physical control over cloud data, which leads to security issues such as data leakage, illegal cross-cloud migration of data, unauthorized access, and the like. Therefore, the data needs to be encrypted before being outsourced to the cloud server, and the requirement that the data can be accessed with fine granularity is met. In addition, when the user issues a delete instruction to the cloud server, the cloud server may maliciously retain the file. Sometimes, even if the data is deleted, certain traces may exist, some cloud computing manufacturers may restore the data, and once the cloud server obtains the data key through some illegal way or the server side obtains a stronger decryption capability, the data may be exposed to a risk of being leaked. For example, the security company Carbon Black reports a serious vulnerability of its software products, from which thousands of sensitive files are compromised. Therefore, there is a need to ensure that data stored on the server side is deleted deterministically by technical means.
The purpose of deterministic deletion of data is to clear data from the storage medium so that the data is unrecoverable, preventing an adversary from still having access to the data after it has been deleted. If the storage medium does not need to be reused, physical destruction methods such as incineration and shredding may be employed. However, secure deletion does not delete all stored data at once. In general, not all data of the system need to be deleted, and the deletion of some data cannot affect the normal operation of the system. In particular, when data is stored in the cloud server, some data needs to be deleted according to the user's request.
Currently, most file systems allow users to "delete" their files. Users believe that when they delete data, the data will become unrecoverable. However, because the data is stored in the cloud server, the deleted data may be only a certain link or index data, and is not the entire file of the bottom layer, and the deleted data can still be recovered through a related technology of data recovery, and deterministic deletion of the data cannot be achieved.
In cloud computing, a deletion method based on cryptography is to encrypt data before storage and convert the deleted data into a deletion corresponding key. Therefore, even if the cloud server retains the ciphertext, the data of the user cannot be restored. In 2005, Perlman first proposed a time-based deterministic deletion method for files, in which data could be safely deleted and would never be accessible after a predetermined time. However, the key management of the above system is too simple and does not consider that different files should have different access control policies, and thus fine-grained secure access to the files cannot be realized. On the basis, Tang and the like expand and extend the scheme, and a policy-based file deterministic deletion (FADE) scheme is provided based on the existing cloud computing infrastructure, wherein a system model of the scheme comprises 3 entities which are a data owner, a trusted key manager and a cloud storage server respectively. The FADE system uses a trusted third party server to centrally manage the distribution keys. The FADE scheme enhances the security of the system by utilizing blind encryption and blind decryption technologies while realizing an access control strategy. The main limitations of FADE are that its deletion strategy is limited to one or two-level boolean expressions, cannot achieve diversified fine-grained deterministic deletions, and requires the use of complex public key cryptosystems.
Geambasu et al put forward a novel data self-destruction scheme for the first time, and realized the Vanish prototype system, he put forward a data trusted deletion mechanism based on DHT network: the user encrypts the data before sending the mail, then divides the encryption key into n shares and stores the n shares in the DHT network, the receiver of the mail can normally decrypt the key only by taking k shares, and all the keys are automatically deleted after a specified time, so that anyone can not recover the data plaintext after a certain time. However, in the scheme of implementing data secure deletion based on the DHT network, the life cycle of data is still limited by the update cycle of the DHT node. Wang et al improve the Vanish scheme, and propose an electronic data self-destruction scheme, on the basis of Vanish, SSDD transforms the ciphertext, extracts partial ciphertext information and secret keys, shares the ciphertext information and the secret keys together, generates a secret key component and distributes the secret key component to a DHT network, thereby effectively resisting the cryptoanalysis attack and brute force attack to the cloud.
Mo et al propose a fine-grained deterministic deletion scheme in which a key modulation function of a collision-resistant hash function is designed. The scheme mainly comprises deleting a modulation tree, a modulation hash chain and a modulator adjustment algorithm. All data keys are derived from the master key, which is changed when any data key is deleted to ensure that k is not recoverable in the future, while the corresponding files for the other keys remain unchanged by running the modulator adaptation algorithm.
Karvelas and Kiayias propose a secure delete protocol with the bounded storage advantage of low-cost embedded devices. Through the update of the security code, it can safely clear all content on the device and download the new security code. In 2014, Ateniese proposed a secure deletion method, and the verifier needed to be sure that the remote device has consumed all of its memory to perform a computation. In this way, the verifier can confirm that the contents of the remote embedded device have been successfully deleted. However, the method only aims at the embedded device with limited memory space, and cannot be directly applied to the cloud storage environment.
In a cloud storage environment, although many schemes have been proposed to ensure that a user deletes data stored in the cloud deterministically, there are different levels of security issues. The key centralized management solution proposed by Perlman, Tang, etc. performs secure deletion of a data encryption key by repeatedly overwriting unrecoverable data, but fails to achieve deterministic deletion of diversified fine granularity, and has certain limitations; geambasu, wang proposed a variety of distributed deterministic deletion solutions, however, the DHT network relied on by the Vanish system is vulnerable to Sybil attacks, and if an adversary can capture enough key components before data expiration to recover the original key, the solution still has security holes. The scheme provided by Atenise is suitable for embedded equipment and cannot be applied to a cloud storage environment.
For deterministic deletion of data in a cloud storage environment, user data is considered to be deleted deterministically from the system if an adversary given some system access behavior cannot recover the deleted data from the system within the polynomial time. The scheme realizes the first-layer meaning of deterministic deletion, namely the data ciphertext is unreadable, the safe deletion of user data is realized, the aim of not revealing sensitive information is achieved, a deletion certificate cannot be returned to a data owner after the data is deleted to confirm that the data is safely deleted, and the credible guarantee is provided for the data privacy safety.
Disclosure of Invention
In order to solve the problems in the prior art, the invention provides a cloud data deterministic deletion method supporting fine-grained access, and provides a key strategy based on attribute encryption method with an attribute revocation function to realize deterministic deletion of cloud data aiming at the safety problems of data leakage, illegal cross-cloud migration of data, unauthorized access and the like possibly existing in cloud storage and the problem that data requested to be deleted by a user is difficult to verify in a cloud storage environment is really deleted. Therefore, the attribute set corresponding to the ciphertext is changed through re-encryption, so that the attribute set cannot meet the access structure of private keys of all users to realize safe data deletion, and whether the data is deleted or not can be verified by constructing a Merkle hash tree. If the evidence returned by the cloud server is valid evidence, the deleted data in the cloud server is guaranteed to be unrecoverable, and malicious users are prevented from obtaining the access right of the data after deletion, so that the privacy of the cloud users is protected. According to the method, key updating is not needed, and only the cloud server is needed to update part of the ciphertext, so that the computing complexity of the cloud user is reduced. Therefore, the achievement of the invention has important theoretical significance and practical value for promoting the sustainable development of cloud computing. The technical problem to be solved by the invention is realized by the following technical scheme: a cloud data deterministic deletion method supporting fine-grained access comprises the following steps:
s100, system establishment is carried out, and system parameters are generated: selecting a security parameter k, and generating a public parameter of the system by the trusted authority center;
s200, applying and generating a private key of a cloud user:
the cloud user provides a private key application to a trusted authority center, and the trusted authority center generates an intermediate private key SK according to the system public parameters, the access structure W of the cloud user and the random number rWand then the cloud user selects a pair of signature keys { spk, ssk } and a random number alpha, and the private key of the cloud user is SK ═ (SK)W,ssk,α)；
The access structure W of the cloud user comprises an accessibility attribute, and a data owner is contained in the cloud user;
s300, the data owner encrypts and stores the data and uploads the data to a cloud server:
s301, data encryption and storage: the data owner selects a group of attribute set gamma and random number s for the data M to be uploaded, encrypts the data M and obtains a ciphertext CT (C)1,C2,C3) Then with C3Each element in the Merkle hash tree is used as a leaf node to construct a Merkle hash tree, and the root node R of the Merkle hash tree is signed by using the signature key ssk to obtain the sigssk(R)；
Wherein, the attribute set gamma includes the attribute of accessibility, and the attribute value is accessible;
step S302, uploading data to a cloud server by a data owner: the data owner selects an identifier fname for the data M to be uploaded, and then sets ind to be the ciphertext corresponding to the accessibility attributeSetting AAI as ciphertext corresponding to accessibility attribute at position in Merkle hash treeIn the Merkle hash tree, the data owner calculates a label value sigma for the data M to be uploaded, and finally uploads { fname, ind, CT, sigma, AAI, sigssk(R) } to a cloud server;
step S400, accessing data in the cloud server by the cloud user:
different cloud users request to access data in a cloud server and obtain the ciphertext CT, and if the attribute corresponding to the ciphertext CT meets the access structure of the private key SK of the cloud user, the cloud user decrypts the ciphertext CT to access;
step S500, the data owner carries out deterministic deletion on the data stored in the cloud server:
step S501, the data owner sends a deletion request DR to the trusted authority center, and the trusted authority center returns a deletion key rk to the data owner.
S502, the data owner sends the deletion key rk to the cloud server, and the cloud server returns a ciphertext corresponding to the accessibility attributeCorresponding information is given to the data owner, and the data owner verifiesAnd ΩindWhether it is valid information; wherein omegaindAuxiliary authentication information representing ind;
step S503, the cloud server changes the attribute value contained in the data ciphertext CT to be deleted through re-encrypting the part of the data ciphertext CT to be deleted so as to delete the data, and then recalculates the root node of the new Merkle hash treeWill be provided withAs a deletion proof back to the data owner;
step S504, the data owner verifies whether the cloud server deletes the data needing to be deleted deterministically by reconstructing a new Merkle hash tree.
Further, the specific steps of step S100 are:
step S101: selecting a security parameter k, and selecting two multiplication circulation groups G with prime number p as an order by a credible authority center1And G2Selecting G as the group G1One generator of (e) G1×G1→G2Representing a bilinear map;
wherein, the attribute complete set is omega ═ { att ═ att1,att2,…attn}，Ai＝{υi,1,υi,2,…υi,niIs attribute AiAll possible values of (A), attribute AiContaining niA possible value;
the access structure of the cloud user is W ═ omega1,ω2,…ωkThe attribute set corresponding to the ciphertext is gamma ═ gamma1,γ2,…γt]H is the Hash function of collision resistance, H: {0,1}*→Zp，ZpA cyclic group modulo p;
step S102: the trusted authority center selects a random number h belonging to G1And the system private key y ∈ ZpCalculating the public parameterNumber Y ═ e (g, h)yThen the trusted authority center selects a random number ti,j∈Zp(i∈[1,n],j∈[1,ni]) Calculating common parametersGenerating a system public keyAnd a master key
Step S103: trusted authority center publishing system parameters
Further, the specific step of the step S200 is that the cloud user proposes a private key application to the trusted authority center, and the trusted authority center selects a random number r e to ZpG is calculated according to the system parameters, the access structure W of the user and the random number rrAndreturning the intermediate private Key SKW＝(gr,DwW) to the cloud user, the cloud user generating a pair of signature keys { spk, ssk }, and selecting a random number α ← Z }pCalculating attribute v-gαThe private key of the cloud user is SK ═ (SK)W,ssk,α)。
Further, the specific steps of step S301 are: the data owner selects a set of attribute sets gamma and a random number s e Z for the data M to be uploadedPCalculating C1＝M·Ys，C2＝gs，The ciphertext CT of the data M to be uploaded is (C)1,C2,C3) (ii) a Simultaneous data owner builds Merkle hash tree, its leavesThe child node is a hash value H (X)i,j) In which X isi,j∈C3Signing the root node R of the Merkle hash tree with the signing key ssk to obtain the sigssk(R)。
Further, the specific steps of step S302 are: the data owner selects an identifier fname for the data M to be uploaded and calculates a tag value for the data M to be uploadedUploading { fname, ind, CT, sigma, AAI, sigssk(R) } to a cloud server;
wherein,is represented by C3In the ciphertext corresponding to the accessibility attribute, ind represents the index of the leaf node corresponding to the accessibility attribute in the Merkle Hash Tree, and AAI representsAnd auxiliary authentication information of leaf nodes corresponding to the accessibility attribute in the Merkle hash tree.
Further, the specific steps of step S400 are:
different cloud users request to access data in the cloud server and obtain the ciphertext CT and the system public key PK, wherein the cloud user attribute setAS ═ W; using the private key SK to perform calculations if
The cloud user decrypts the ciphertext CT for access.
Further, the specific steps of step S501 are: data owner sending to trusted authority centerDelete request DR ═ (fname, att)i,vi,j,v′i,j) (ii) a Wherein, attiRepresenting accessibility attribute, vi,jDenotes accessible, v'i,jIndicating inaccessibility, DR ═ f name, atti,vi,j,v′i,j) Representing the change of the accessibility attribute in the ciphertext from accessible to inaccessible, the trusted authority center selects a random number t'i,jAnd calculateThe deletion key rk ═ (fname, att) is then assignedi,cki) And returning to the data owner.
Further, the specific steps of step S502 are:
step S502-1, the data owner will delete the key rk ═ (fname, att)i,cki) Sending the data to a cloud server, and returning att with the accessibility attribute by the cloud serveriCorresponding tupleΩindAuxiliary authentication information representing the node ind;
step S502-2 data owner verificationWhether or not, if so, thenThe ciphertext corresponding to the ciphertext accessibility attribute;
step S502-3, the data owner according toAnd ΩindGenerating new root node of Merkle Hash treeVerification equation sigssk(R)＝sigssk(R') is true, if true, ΩindIs thatValid auxiliary authentication information AAI.
Further, the specific steps of step S503 are:
step S503-1: the cloud server according to the delete request DR ═ (fname, att)i,vi,j,v′i,j) Finding the data ciphertext CT to be deleted, the accessibility attribute attiE.g. rk, cloud server computingBy usingIn place of the data ciphertext CT that needs to be deleted
Step S503-2, the cloud server outputs a new ciphertext CT ═ (C)1,C2,C′3γ'). Gamma' is set as an attribute set corresponding to the ciphertext after the re-encryption;
step S503-3 cloud server computingGenerating a new root node of a Merkle hash treeWill be provided withAs a deletion proof back to the data owner.
Further, the specific steps of step S504 are: data owner re-encrypts using the deletion key rkTo obtainThe data owner receives the new root nodeAccording toAnd Ω received from the cloud serverindGenerating new root nodes for Merkle hash treesNew root nodeA root node sent from the cloud serverMake a comparison ifThe cloud server confirms that the data has been deleted.
Compared with the prior art, the invention has the beneficial effects that:
(1) fine-grained access: files stored in the cloud server support fine-grained access control, and data owners can determine who can access and decrypt the data before uploading the data. The data owner can correspond the ciphertext to an attribute set, and when the attribute set meets the access structure of the private key of the cloud user, the cloud user can correctly decrypt the data.
(2) Verifiable data deletion: the invention realizes the deterministic deletion of cloud data. The attribute set corresponding to the ciphertext is changed by enabling the cloud server to re-encrypt part of the ciphertext, so that the ciphertext does not meet the access structures of all users any more, and data cannot be accessed. In addition, a data owner can verify whether the data in the cloud server is deleted or not by reconstructing the Merkle hash tree, so that the data of a user can not be leaked, the data privacy of the cloud user is protected, and the safety of the system is improved.
(3) The calculation cost is low: the invention does not need the user to update the ciphertext and does not need the credible authority to manage and delete the key. Only the cloud server needs to update part of the ciphertext, the cost of the user verification process is low, the system is simple to implement, and the efficiency of data deterministic deletion is improved.
Drawings
FIG. 1 is a schematic diagram of a data storage and deterministic deletion process in accordance with an embodiment of the present invention;
FIG. 2 is a diagram of a verifiable deterministic deletion process in accordance with an embodiment of the present invention.
Detailed Description
All of the features disclosed in this specification, or all of the steps in any method or process so disclosed, may be combined in any combination, except combinations of features and/or steps that are mutually exclusive.
Any feature disclosed in this specification (including any accompanying claims, abstract and drawings), may be replaced by alternative features serving equivalent or similar purposes, unless expressly stated otherwise. That is, unless expressly stated otherwise, each feature is only an example of a generic series of equivalent or similar features.
The present invention will be described in further detail with reference to specific examples, but the embodiments of the present invention are not limited thereto.
The invention provides an attribute-based cloud data deterministic deletion method of a key strategy based on the public key cryptography theory, which simultaneously supports fine-grained access control and is applied to a cloud storage environment with higher security requirements. The data is encrypted before being outsourced to the cloud, the special attribute of 'accessibility' is introduced into the ciphertext attribute set, the value of the special attribute in the ciphertext is changed through re-encryption, the ciphertext does not meet the access structures of all users any more, and data deletion is achieved. The data owner generates a root of the MHT by constructing the MHT, uploads a ciphertext and a signature of the root to the cloud server, when the ciphertext is re-encrypted, the new root of the MHT can be regarded as an evidence for deletion, and the data owner can verify the evidence to realize verifiable data certainty deletion. Any information of user data cannot be revealed in the whole process, so that the method and the system have a promoting effect on the development of cloud computing and have a plurality of theoretical meanings and practical meanings.
Firstly, the applied cryptology theory of the invention is briefly introduced:
(1) bilinear pairings
Let G1,G2Two multiplicative cyclic groups of order p, and G is the generator of group G. If mapping e to G1×G1→G2if the following three conditions are satisfied, it is called bilinear mapping1,h2∈G1,e(h1,h2) can be efficiently calculated.bilinear, for any h1,h2∈G1,a,b∈Zp,(iii) non-degradability, for G1The generator g in (1) satisfies
(2) Attribute-based encryption (ABE)
In an attribute-based encryption scheme, attributes are used to generate keys and construct access policies. Attribute-based encryption can be roughly divided into attribute-based encryption of a key policy and attribute-based encryption of a ciphertext policy. In an attribute-based encryption scheme (KP-ABE) of a key policy, the access structure is contained in the user's private key, while the ciphertext corresponds to a set of attributes. In ciphertext policy attribute-based encryption (CP-ABE), the access policy is built into the ciphertext, and the user's private key corresponds to the attribute the user possesses. The attribute-based encryption scheme of the key strategy consists of four polynomial time algorithms as follows:
setup (k) the algorithm inputs security parameters k, outputs a system public key PK and a master key MSK.
KeyGen(PK,MSK,AU-KP) The algorithm input accesses structure AU-KPAnd outputting the user private key D.
Encrypt(PK,M,ACT) The algorithm inputs a message M, a set of attributes aCTAnd outputting the ciphertext C of the M.
Decrypt (C, D). the algorithm inputs a user private key D and a ciphertext C, and if the ciphertext C meets the access structure of the private key, the user can Decrypt the ciphertext C and output M.
(3) Merkle Hash Tree
The Merkle Hash Tree (MHT) is a widely used authentication structure that can efficiently check whether elements are stored perfectly. MHT is a binary tree in which leaf nodes store hash values of authentication data, and each internal node as well as the root node is generated by its two children. The values of the internal node as well as the root node are the hash values of its two child nodes. Element aiIs aiSiblings of all nodes on the path to the root node, and thus can be according to aiAnd aiThe root node is calculated by the auxiliary authentication information.
Referring to fig. 1, the present invention is embodied as follows:
a cloud data deterministic deletion method supporting fine-grained access comprises the following steps:
s100, system establishment is carried out, and system parameters are generated: selecting a security parameter k, and generating a public parameter of the system by the trusted authority center;
step S101: selecting a security parameter k, and selecting two multiplication circulation groups G with prime number p as an order by a credible authority center1And G2Selecting G as the group G1One generator of (e) G1×G1→G2Representing a bilinear map;
wherein, the attribute complete set is omega ═ { att ═ att1,att2,…attn}，Ai＝{υi,1,υi,2,…υi,niIs attribute AiAll possible values of (A), attribute AiContaining niA possible value;
the access structure of the cloud user is W ═ omega1,ω2,…ωkThe attribute set corresponding to the ciphertext is gamma ═ gamma1,γ2,…γt]H is a Hash function of collision resistance, H: {0,1}*→Zq，ZpA cyclic group modulo p;
step S102: the trusted authority center selects a random number h belonging to G1And the system private key y ∈ ZpCalculating the common parameter Y ═ e (g, h)yThen the trusted authority center selects a random number ti,j∈Zp(i∈[1,n],j∈[1,ni]) Calculating common parametersGenerating a system public keyAnd a master key
Step S103: trusted authority center publishing system parameters
S200, applying and generating a private key of a cloud user:
the cloud user provides a private key application to a trusted authority center, and the trusted authority center generates an intermediate private key SK according to system public parameters, an access structure W of the cloud user and a random number rWreturning to the cloud user, and then selecting a pair of signature keys { spk, ssk } and a random number α by the cloud user, wherein the private key of the cloud user is SK (SK)W,ssk,α)；
The cloud user puts forward a private key application to a trusted authority center, and the trusted authority center selects a random number r E to ZpAnd calculating a parameter g according to the system parameter, the access structure W of the user and the random number rrAndreturning the intermediate private Key SKW＝(gr,DwAnd W) to the cloud user,
the cloud user generates a pair of signature keys { spk, ssk }, and selects a random number α ← Z }pCalculating the attribute v ═ gαThe private key of the cloud user is SK ═ (SK)W,ssk,α)。
The access structure W of the cloud user comprises an accessibility attribute, and a data owner is contained in the cloud user;
s300, the data owner encrypts and stores the data and uploads the data to a cloud server:
step S301. the data owner selects a random number s belonging to Z and a group of attribute sets gamma for the data M to be uploadedPCalculating C1＝M·Ys，C2＝gs，The ciphertext CT of the data M to be uploaded is (C)1,C2,C3) Wherein the attribute set gamma contains the attribute of accessibility; xi,jIs the third part of the ciphertext, which is related to the specific attributes in the attribute set, and is also the leaf node for constructing the MHT.Meanwhile, the data owner constructs a Merkle hash tree, and leaf nodes of the Merkle hash tree are hash values H (X)i,j) In which X isi,j∈C3Signing the root node R of the Merkle hash tree with the signing key ssk to obtain the sigssk(R)。
Step S302, a data owner selects an identifier fname for data M to be uploaded, and calculates a tag value for the data M to be uploadedUploading { fname, ind, CT, sigma, AAI, sigssk(R) } to a cloud server;
wherein,is represented by C3In the ciphertext corresponding to the accessibility attribute, ind represents the index of the leaf node corresponding to the accessibility attribute in the Merkle Hash Tree, and AAI representsAnd auxiliary authentication information of leaf nodes corresponding to the accessibility attribute in the Merkle hash tree.
Step S400, accessing data in the cloud server by the cloud user:
if the attribute corresponding to the ciphertext meets the access structure of the private key held by the user, the user can decrypt the data in the cloud server, different cloud users request to access the data in the cloud server and obtain the ciphertext CT and the system public key PK, wherein the cloud user attribute setAS ═ W; using the private key SK to perform calculations if
The cloud user decrypts the ciphertext CT for access.
Step S500, the data owner carries out deterministic deletion on the data stored in the cloud server:
when a data owner wants to delete data in a cloud server, the data owner first sends a deletion request to a trusted authority center. The trusted authority center returns a deletion key, i.e., a re-encryption key, to the data owner. The data owner sends the deletion key to the cloud server. After the deletion operation is performed, the cloud server will return a deletion certificate to the data owner, verifying that the data has been deleted. Referring to fig. 2, the process is specifically implemented as follows:
step S501, the data owner sends a deletion request DR ═ f name, att to the trusted authority centeri,vi,j,v′i,j) (ii) a Wherein, attiRepresenting accessibility attribute, vi,jDenotes accessible, v'i,jIndicating inaccessibility, DR ═ (fname, atti, v)i,j,v′i,j) Showing that the accessibility attribute in the ciphertext is changed from accessible to inaccessible, and the trusted authority center selects a random number t'i,jAnd calculateThe deletion key rk ═ (fname, att) is then assignedi,cki) And returning to the data owner. Accessibility has two attribute values, accessible and inaccessible.
S502, the data owner sends the deletion key rk to the cloud server, and the cloud server returns a ciphertext corresponding to the accessibility attributeCorresponding information is given to the data owner, and the data owner verifiesAnd ΩindWhether it is valid information; wherein omegaindAuxiliary authentication information representing ind;
step S502-1, the data owner will delete the key rk ═ (fname, att)i,cki) Sending the data to a cloud server, and returning att with the accessibility attribute by the cloud serveriCorresponding tupleΩindAuxiliary authentication information representing the node ind;
step S502-2 data owner verificationWhether or not, if so, thenThe ciphertext corresponding to the ciphertext accessibility attribute;
step S502-3, the data owner according toAnd ΩindGenerating new root node of Merkle Hash treeVerification equation sigssk(R)＝sigssk(R') is true, if true, ΩindIs thatValid auxiliary authentication information AAI.
And S503, the cloud server changes the attribute value contained in the ciphertext to delete the data by re-encrypting part of the ciphertext, so that the ciphertext does not meet the access structures of all users any more, and then generates a deletion certificate and returns the deletion certificate to the data owner. The specific steps of data deletion are as follows:
step S503-1: the cloud server according to the delete request DR ═ (fname, att)i,vi,j,v′i,j) The fname in the data search table corresponds to the data ciphertext CT to be deleted and can be accessedProperty attribute attiE.g. rk, cloud server computingBy usingIn place of the data ciphertext CT that needs to be deleted
Step S503-2, the cloud server outputs a new ciphertext CT ═ (C)1,C2,C′3γ'). Gamma' is set as an attribute set corresponding to the ciphertext after the re-encryption;
step S503-3 cloud server computingGenerating a new root node of a Merkle hash treeWill be provided withAs a deletion proof back to the data owner;
step S504, the data owner verifies whether the cloud server deletes the data needing to be deleted deterministically by reconstructing a new Merkle hash tree.
Data owner re-encrypts using the deletion key rkTo obtainThe data owner receives the new root nodeAccording toAnd Ω received from the cloud serverindGenerating new root nodes for Merkle hash treesNew root nodeA root node sent from the cloud serverMake a comparison ifThe cloud server confirms that the data has been deleted.
The foregoing is a more detailed description of the invention in connection with specific preferred embodiments and it is not intended that the invention be limited to these specific details. For those skilled in the art to which the invention pertains, several simple deductions or substitutions can be made without departing from the spirit of the invention, and all shall be considered as belonging to the protection scope of the invention.
Claims (10)
1. A cloud data deterministic deletion method supporting fine-grained access is characterized by comprising the following steps: comprises the following steps:
s100, system establishment is carried out, and system parameters are generated: selecting a security parameter k, and generating a public parameter of the system by the trusted authority center;
s200, applying and generating a private key of a cloud user:
the cloud user provides a private key application to a trusted authority center, and the trusted authority center generates an intermediate private key SK according to the system public parameters, the access structure W of the cloud user and the random number rWReturn toand then, the cloud user selects a pair of signature keys { spk, ssk } and a random number alpha, wherein the private key of the cloud user is SK ═ SKW,ssk,α)；
The access structure W of the cloud user comprises an accessibility attribute, and a data owner is contained in the cloud user;
s300, the data owner encrypts and stores the data and uploads the data to a cloud server:
s301, data encryption and storage: the data owner selects a group of attribute set gamma and random number s for the data M to be uploaded, encrypts the data M and obtains a ciphertext CT (C)1,C2,C3) Then with C3Each element in the Merkle hash tree is used as a leaf node to construct a Merkle hash tree, and the root node R of the Merkle hash tree is signed by using the signature key ssk to obtain the sigssk(R)；
Wherein, the attribute set gamma includes the attribute of accessibility, and the attribute value is accessible;
step S302, uploading data to a cloud server by a data owner: the data owner selects an identifier fname for the data M to be uploaded, and then sets ind to be the ciphertext corresponding to the accessibility attributeSetting AAI as ciphertext corresponding to accessibility attribute at position in Merkle hash treeIn the Merkle hash tree, the data owner calculates a label value sigma for the data M to be uploaded, and finally uploads { fname, ind, CT, sigma, AAI, sigssk(R) } to a cloud server;
step S400, accessing data in the cloud server by the cloud user:
different cloud users request to access data in a cloud server and obtain the ciphertext CT, and if the attribute corresponding to the ciphertext CT meets the access structure of the private key SK of the cloud user, the cloud user decrypts the ciphertext CT to access;
step S500, the data owner carries out deterministic deletion on the data stored in the cloud server:
step S501, the data owner sends a deletion request DR to the trusted authority center, and the trusted authority center returns a deletion key rk to the data owner.
S502, the data owner sends the deletion key rk to the cloud server, and the cloud server returns a ciphertext corresponding to the accessibility attributeCorresponding information is given to the data owner, and the data owner verifiesAnd ΩindWhether it is valid information; wherein omegaindAuxiliary authentication information representing ind;
step S503, the cloud server changes the attribute value contained in the data ciphertext CT to be deleted through re-encrypting the part of the data ciphertext CT to be deleted so as to delete the data, and then recalculates the root node of the new Merkle hash treeWill be provided withAs a deletion proof back to the data owner;
step S504, the data owner verifies whether the cloud server deletes the data needing to be deleted deterministically by reconstructing a new Merkle hash tree.
2. The cloud data deterministic deletion method supporting fine-grained access according to claim 1, characterized in that: the specific steps of step S100 are:
step S101: selecting a security parameter k, and selecting two multiplication circulation groups G with prime number p as an order by a credible authority center1And G2Selecting G as the group G1One generator of (e) G1×G1→G2Representing a bilinear map;
wherein, the attribute complete set is omega ═ { att ═ att1,att2,…attn}，Ai＝{υi,1,υi,2,…υi,niIs attribute AiAll possible values of (A), attribute AiContaining niA possible value;
the access structure of the cloud user is W ═ omega1,ω2,…ωkThe attribute set corresponding to the ciphertext is gamma ═ gamma1,γ2,…γt]H is the Hash function of collision resistance, H: {0,1}*→Zp，ZpA cyclic group modulo p;
step S102: the trusted authority center selects a random number h belonging to G1And the system private key y ∈ ZpCalculating the common parameter Y ═ e (g, h)yThen the trusted authority center selects a random number ti,j∈Zp(i∈[1,n],j∈[1,ni]) Calculating common parametersGenerating a system public keyAnd a master key
Step S103: trusted authority center publishing system parameters
3. The cloud data deterministic deletion method supporting fine-grained access according to claim 2, characterized in that: the specific step of the step S200 is that the cloud user provides a private key application to the trusted authority center, and the trusted authority center selects a random number r E to ZpAccording to the system parameters, the access structure W of the user and the random numberr calculating grAndreturning the intermediate private Key SKW＝(gr,DwW) to the cloud user, the cloud user generating a pair of signature keys { spk, ssk }, and selecting a random number α ← Z }pCalculating attribute v-gαThe private key of the cloud user is SK ═ (SK)W,ssk,α)。
4. The cloud data deterministic deletion method supporting fine-grained access according to claim 3, characterized in that: the specific steps of step S301 are: the data owner selects a set of attribute sets gamma and a random number s e Z for the data M to be uploadedPCalculating C1＝M·Ys，C2＝gs，The ciphertext CT of the data M to be uploaded is (C)1,C2,C3) (ii) a Meanwhile, the data owner constructs a Merkle hash tree, and leaf nodes of the Merkle hash tree are hash values H (X)i,j) In which X isi,j∈C3Signing the root node R of the Merkle hash tree with the signing key ssk to obtain the sigssk(R)。
5. The cloud data deterministic deletion method supporting fine-grained access according to claim 4, characterized in that: the specific steps of step S302 are: the data owner selects an identifier fname for the data M to be uploaded and calculates a tag value for the data M to be uploadedUploading { fname, ind, CT, sigma, AAI, sigssk(R) } to a cloud server;
wherein,is represented by C3In the ciphertext corresponding to the accessibility attribute, ind represents the index of the leaf node corresponding to the accessibility attribute in the Merkle Hash Tree, and AAI representsAnd auxiliary authentication information of leaf nodes corresponding to the accessibility attribute in the Merkle hash tree.
6. The method for cloud data deterministic deletion supporting fine-grained access according to claim 5, wherein: the specific steps of step S400 are:
different cloud users request to access data in the cloud server and obtain the ciphertext CT and the system public key PK, wherein the cloud user attribute setAS ═ W; using the private key SK to perform calculations if
The cloud user decrypts the ciphertext CT for access.
7. The method for cloud data deterministic deletion supporting fine-grained access according to claim 6, characterized in that: the specific steps of step S501 are: the data owner sends a delete request DR ═ (fname, att) to the trusted authority centeri,vi,j,vi′,j) (ii) a Wherein, attiRepresenting accessibility attribute, vi,jRepresentation accessible, vi′,jIndicating inaccessibility, DR ═ f name, atti,vi,j,vi′,j) Indicating that the accessibility attribute in the ciphertext is changed from accessible to inaccessible, the trusted authority center selects a random number ti′,jAnd calculateThe deletion key rk ═ (fname, att) is then assignedi,cki) And returning to the data owner.
8. The method for cloud data deterministic deletion supporting fine-grained access according to claim 7, characterized in that: the specific steps of step S502 are:
step S502-1, the data owner will delete the key rk ═ (fname, att)i,cki) Sending the data to a cloud server, and returning att with the accessibility attribute by the cloud serveriCorresponding tupleΩindAuxiliary authentication information representing the node ind;
step S502-2 data owner verificationWhether or not, if so, thenThe ciphertext corresponding to the ciphertext accessibility attribute;
step S502-3, the data owner according toAnd ΩindGenerating new root node of Merkle Hash treeVerification equation sigssk(R)＝sigssk(R') is true, if true, ΩindIs thatValid auxiliary authentication information AAI.
9. The method for cloud data deterministic deletion supporting fine-grained access according to claim 8, characterized in that: the specific steps of step S503 are:
step S503-1: the cloud server requests DR ═ (fname, atti, v) according to the deletioni,j,vi′,j) Finding the data ciphertext CT to be deleted, the accessibility attribute attiE.g. rk, cloud server computingBy usingIn place of the data ciphertext CT that needs to be deleted
Step S503-2, the cloud server outputs a new ciphertext CT ═ (C)1,C2,C3', γ'). Gamma' is set as an attribute set corresponding to the ciphertext after the re-encryption;
step S503-3 cloud server computingGenerating a new root node of a Merkle hash treeWill be provided withAs a deletion proof back to the data owner.
10. The method for cloud data deterministic deletion supporting fine-grained access according to claim 9, characterized in that: the specific steps of step S504 are: data owner re-encrypts using the deletion key rkTo obtainThe data owner receives the new root nodeAccording toAnd Ω received from the cloud serverindGenerating new root nodes for Merkle hash treesNew root nodeRoot node sent by the cloud serverMake a comparison ifThe cloud server confirms that the data has been deleted.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810241812.3A CN108600171B (en) | 2018-03-22 | 2018-03-22 | Cloud data deterministic deletion method supporting fine-grained access |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810241812.3A CN108600171B (en) | 2018-03-22 | 2018-03-22 | Cloud data deterministic deletion method supporting fine-grained access |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN108600171A true CN108600171A (en) | 2018-09-28 |
| CN108600171B CN108600171B (en) | 2021-01-19 |
Family
ID=63627117
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810241812.3A Active CN108600171B (en) | 2018-03-22 | 2018-03-22 | Cloud data deterministic deletion method supporting fine-grained access |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN108600171B (en) |
Cited By (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109347833A (en) * | 2018-10-24 | 2019-02-15 | 中国科学院信息工程研究所 | The access control method and system being used under machine learning environment based on encryption attribute |
| CN109981288A (en) * | 2019-03-26 | 2019-07-05 | 中国人民大学 | A kind of quick external method of proof of the fine granularity cloud server terminal based on aggregate signature |
| CN110868288A (en) * | 2019-11-08 | 2020-03-06 | 中国人民解放军国防科技大学 | Strategy-based outsourced data fine-grained credible deletion method in cloud storage environment |
| CN111596862A (en) * | 2020-05-20 | 2020-08-28 | 南京如般量子科技有限公司 | Independent optimization method and system for block chain historical transaction data |
| CN111737708A (en) * | 2020-05-26 | 2020-10-02 | 桂林电子科技大学 | Verifiable deletion method and system supporting efficient update of outsourced data |
| CN111832073A (en) * | 2020-07-05 | 2020-10-27 | 桂林电子科技大学 | Deterministic deletion method supporting dynamic insertion of outsourcing data in cloud environment |
| CN112612426A (en) * | 2020-12-30 | 2021-04-06 | 海尔数字科技(青岛)有限公司 | Method and device for deleting data, electronic equipment and storage medium |
| CN113704830A (en) * | 2021-07-26 | 2021-11-26 | 王旭 | Intelligent website data tamper-proof system and method |
| CN114157421A (en) * | 2021-11-30 | 2022-03-08 | 福建师范大学 | Encryption system and method for ensuring data deletion of multiple authorization centers based on attributes |
| CN114287001A (en) * | 2019-08-26 | 2022-04-05 | 皇家飞利浦有限公司 | Restricted full privacy conjunctive database queries for protecting user privacy and identity |
| CN114629661A (en) * | 2022-04-27 | 2022-06-14 | 中国科学技术大学 | Encrypted information processing method and device |
| CN116992494A (en) * | 2023-09-27 | 2023-11-03 | 四川启明芯智能科技有限公司 | Security protection method, equipment and medium for scenic spot data circulation |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104023027A (en) * | 2014-06-18 | 2014-09-03 | 西安电子科技大学 | Deterministic cloud data deleting method based on sampling and fragmenting of cryptograph |
| CN105592100A (en) * | 2016-01-26 | 2016-05-18 | 西安电子科技大学 | Government services cloud access control method based on attribute encryption |
-
2018
- 2018-03-22 CN CN201810241812.3A patent/CN108600171B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104023027A (en) * | 2014-06-18 | 2014-09-03 | 西安电子科技大学 | Deterministic cloud data deleting method based on sampling and fragmenting of cryptograph |
| CN105592100A (en) * | 2016-01-26 | 2016-05-18 | 西安电子科技大学 | Government services cloud access control method based on attribute encryption |
Non-Patent Citations (3)
| Title |
|---|
| LICHAOLING: ""A Data Assured Deletion Scheme in Cloud Storage"", 《IEEE》 * |
| 熊金波: ""基于密码学的云数据确定性删除研究进展"", 《通信学报》 * |
| 王丽娜: ""一种适于云存储的数据确定性删除方法"", 《电子学报》 * |
Cited By (21)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109347833A (en) * | 2018-10-24 | 2019-02-15 | 中国科学院信息工程研究所 | The access control method and system being used under machine learning environment based on encryption attribute |
| CN109981288A (en) * | 2019-03-26 | 2019-07-05 | 中国人民大学 | A kind of quick external method of proof of the fine granularity cloud server terminal based on aggregate signature |
| CN109981288B (en) * | 2019-03-26 | 2021-11-09 | 中国人民大学 | Fine-grained cloud server side rapid external certification method based on aggregated signature |
| CN114287001A (en) * | 2019-08-26 | 2022-04-05 | 皇家飞利浦有限公司 | Restricted full privacy conjunctive database queries for protecting user privacy and identity |
| CN110868288A (en) * | 2019-11-08 | 2020-03-06 | 中国人民解放军国防科技大学 | Strategy-based outsourced data fine-grained credible deletion method in cloud storage environment |
| CN110868288B (en) * | 2019-11-08 | 2022-05-20 | 中国人民解放军国防科技大学 | Strategy-based outsourced data fine-grained credible deletion method in cloud storage environment |
| CN111596862A (en) * | 2020-05-20 | 2020-08-28 | 南京如般量子科技有限公司 | Independent optimization method and system for block chain historical transaction data |
| CN111596862B (en) * | 2020-05-20 | 2022-11-01 | 南京如般量子科技有限公司 | Independent optimization method and system for block chain historical transaction data |
| CN111737708A (en) * | 2020-05-26 | 2020-10-02 | 桂林电子科技大学 | Verifiable deletion method and system supporting efficient update of outsourced data |
| CN111737708B (en) * | 2020-05-26 | 2024-01-12 | 桂林电子科技大学 | Verifiable deleting method and system supporting efficient update of outsourced data |
| CN111832073A (en) * | 2020-07-05 | 2020-10-27 | 桂林电子科技大学 | Deterministic deletion method supporting dynamic insertion of outsourcing data in cloud environment |
| CN111832073B (en) * | 2020-07-05 | 2023-07-18 | 桂林电子科技大学 | Deterministic deleting method for supporting dynamic insertion of outsourced data in cloud environment |
| CN112612426A (en) * | 2020-12-30 | 2021-04-06 | 海尔数字科技(青岛)有限公司 | Method and device for deleting data, electronic equipment and storage medium |
| CN113704830A (en) * | 2021-07-26 | 2021-11-26 | 王旭 | Intelligent website data tamper-proof system and method |
| CN113704830B (en) * | 2021-07-26 | 2023-08-29 | 山东赛宝电子信息工程有限责任公司 | Intelligent website data tamper-proof system and method |
| CN114157421A (en) * | 2021-11-30 | 2022-03-08 | 福建师范大学 | Encryption system and method for ensuring data deletion of multiple authorization centers based on attributes |
| CN114157421B (en) * | 2021-11-30 | 2023-06-09 | 福建师范大学 | Encryption system and method for ensuring data deletion based on attributes of multiple authorization centers |
| CN114629661A (en) * | 2022-04-27 | 2022-06-14 | 中国科学技术大学 | Encrypted information processing method and device |
| CN114629661B (en) * | 2022-04-27 | 2024-02-23 | 中国科学技术大学 | Encryption information processing method and device |
| CN116992494A (en) * | 2023-09-27 | 2023-11-03 | 四川启明芯智能科技有限公司 | Security protection method, equipment and medium for scenic spot data circulation |
| CN116992494B (en) * | 2023-09-27 | 2023-12-08 | 四川启明芯智能科技有限公司 | Security protection method, equipment and medium for scenic spot data circulation |
Also Published As
| Publication number | Publication date |
|---|---|
| CN108600171B (en) | 2021-01-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108600171B (en) | Cloud data deterministic deletion method supporting fine-grained access | |
| CN108881314B (en) | Privacy protection method and system based on CP-ABE ciphertext under fog computing environment | |
| CN114039790B (en) | Fine-grained cloud storage security access control method based on blockchain | |
| WO2018045568A1 (en) | Access control method oriented to cloud storage service platform and system thereof | |
| WO2016197770A1 (en) | Access control system and access control method thereof for cloud storage service platform | |
| CN104168108B (en) | It is a kind of to reveal the traceable attribute base mixed encryption method of key | |
| CN111130757A (en) | Multi-cloud CP-ABE access control method based on block chain | |
| CN108111540B (en) | Hierarchical access control system and method supporting data sharing in cloud storage | |
| CN107086911B (en) | CCA (clear channel assessment) safe proxy re-encryption method capable of delegating verification | |
| Saroj et al. | Threshold cryptography based data security in cloud computing | |
| CN111614680B (en) | CP-ABE-based traceable cloud storage access control method and system | |
| CN114036539A (en) | Safety auditable Internet of things data sharing system and method based on block chain | |
| Tiwari et al. | SecCloudSharing: Secure data sharing in public cloud using ciphertext‐policy attribute‐based proxy re‐encryption with revocation | |
| CN104901968A (en) | Method for managing and distributing secret keys in secure cloud storage system | |
| Imine et al. | Revocable attribute-based access control in mutli-autority systems | |
| Chaudhary et al. | RMA-CPABE: A multi-authority CPABE scheme with reduced ciphertext size for IoT devices | |
| Koe et al. | Offline privacy preserving proxy re-encryption in mobile cloud computing | |
| CN115426136A (en) | Cross-domain access control method and system based on block chain | |
| Sammy et al. | An Efficient Blockchain Based Data Access with Modified Hierarchical Attribute Access Structure with CP‐ABE Using ECC Scheme for Patient Health Record | |
| Guo et al. | Attribute-based data sharing scheme using blockchain for 6g-enabled vanets | |
| Shen et al. | Trust Mechanism Privacy Protection Scheme Combining Blockchain and Multi-Party Evaluation | |
| Fan et al. | Secure and private key management scheme in big data networking | |
| CN117200966A (en) | Trusted authorization data sharing method based on distributed identity and alliance chain | |
| Di et al. | A Novel Identity‐Based Mutual Authentication Scheme for Vehicle Ad Hoc Networks | |
| CN110225041B (en) | Data management method, system and related components |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |