基于代理重加密的云存储密文访问控制方案  

Cryptographic access control scheme for cloud storage based on proxy re-encryption

作　　者：郎讯 魏立线[1] 王绪安[1] 吴旭光[1] 

机构地区：[1]武警工程大学网络与信息安全武警部队重点实验室,西安710086

出　　处：《计算机应用》2014年第3期724-727,741,共5页journal of Computer Applications

基　　金：国家自然科学基金资助项目(61103230)

摘　　要：针对在不可信的云存储中,数据的机密性得不到保证的情况,提出一种新的代理重加密(PRE)算法,并将其应用于云存储访问控制方案中,该方案将一部分密文存储云中共享,另一部分密文直接发送给用户。证明了该访问控制方案在第三方的不可信任的开放环境下云存储中敏感数据的机密性。通过分析对比,结果表明:发送方对密文的传递可控,该方案利用代理重加密的性质,在一对多的云存储访问控制方案中,密文运算量和存储不会随着用户的增长而呈线性增长,显著降低了通信过程中数据运算量和交互量,有效减少数据的存储空间。该方案实现了云存储中敏感数据的安全高效共享。Concerning the data＇s confidentiality when being stored in the untrnsted cloud storage, a new encryption algorithm based on the Proxy Re-Encryption （PRE） was proposed, and applied in the access control scheme for the cloud storage. The scheme had partial ciphertexts stored in the cloud storage for sharing, and the others sent to users directly. It was proven that the scheme can ensure the confidentiality of the sensitive data stored in the cloud storage under the third untrnsted open environment. By contrast, the experimental results show the transmission of ciphertexts can be controlled by the sender. The scheme used the properties of the proxy re-encryption. The number of ciphertexts＇ operation and storage did not increase linearly with the increase of the users. It decreased the data computation cost, interactive cost, and the space of the data storage effectively. The scheme achieves sharing securely and efficiently when the sensitive data is stored in the cloud.

关 键 词：云存储安全 公钥密码体制 代理重加密 数据机密性 访问控制 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]