支持撤销的多授权中心访问控制方案  

A Multi-Authorities Access Control Scheme Supporting Revocation

作　　者：李勇[1,2] 雷丽楠 

机构地区：[1]北京交通大学电子信息工程学院,北京100044 [2]福建师范大学福建省网络安全与密码技术重点实验室,福建福州350007

出　　处：《北京理工大学学报》2017年第10期1014-1018,共5页Transactions of Beijing Institute of Technology

基　　金：中央高校基本科研业务费专项资金资助项目(2016YJS003);国家自然科学基金资助项目(61472032);福建省网络安全与密码技术重点实验室(福建师范大学)开放课题资助项目(15007)

摘　　要：为了缓解单授权中心的计算压力,近些年提出了多授权中心的访问控制方案.这些方案对于用户及属性的撤销问题并没有有效地解决.本文提出了一种基于CP-ABE的支持用户和属性撤销的多授权中心访问控制方案.通过引入密钥加密密钥(key encryption key,KEK)树实现用户和属性层级的撤销,同时将计算压力分散给多个授权中心,并将部分解密交给云服务器,减少了用户的计算消耗.通过安全性证明和实验结果表明,方案可以抵御合谋攻击,同时有效地降低撤销过程中密文和密钥更新的消耗时间.In recent years,in order to alleviate the pressure on the calculation of a single authorization center,multi-authorities access control schemes were proposed.But these schemes are inefficient in the revocation of user and attribute level.In this paper,a scheme was proposed based on multi-authorities and the key encryption key（KEK）tree was used to achieve revocation.In the scheme,the computation load was distributed to multi-authorities center and partial decryption was transferred to the cloud server.The security proof result shows that the scheme can resist collusion attack,and experiment results show that the scheme can effectively reduce the time consumption of ciphertext and key update in revocation process.

关 键 词：访问控制 属性撤销 基于密文策略属性加密 多授权中心 密钥加密密钥 

分 类 号：TN918.91[电子电信—通信与信息系统]