基于密钥状态散列树的密钥存储管理方案  

Key storage management scheme based on keyed hash tree with state

作　　者：王祥宇 马建峰 苗银宾 张凯 伍祈应 WANG Xiangyu;MA Jianfeng;MIAO Yinbin;ZHANG Kai;WU Qiying(School of Cyber Engineering, Xidian University,Xi’an 710071, China)

机构地区：[1]西安电子科技大学网络与信息安全学院,陕西西安710071

出　　处：《通信学报》2018年第5期94-102,共9页Journal on Communications

基　　金：国家高技术研究发展计划("863"计划)基金资助项目(No.2015AA016007);国家自然科学基金资助项目(No.61702404);中央高校基本科研业务费基金资助项目(No.JB171504);中国博士后科学基金资助项目(No.2017M613080)~~

摘　　要：针对密文检索系统中多源数据加密带来的海量密钥存储管理问题,提出了以密钥状态散列树作为密钥派生结构的密钥存储管理方案。该方案借助根密钥及密钥派生树进行密钥计算,且只需要存储根密钥和树结构,大大降低了密钥存储开销;另外,该方案可以根据撤销状态值进行密钥撤销管理,解决了派生树密钥撤销及结构更新难题。安全分析表明,部分数据密钥的泄露并不会泄露其他数据机密性,且基于实际数据集的性能分析表明所提密钥管理方案在实际应用中是可行的。To solve the problem of massive keys storage caused by multi-source data encryption in ciphertext retrieval system, a key storage scheme based on keyed hash tree with state was proposed. The scheme computes encryption key according to the root key and key derivation tree, and just needs to store the root key and the tree structure, which greatly reduces the key storage costs. In addition, the scheme manages key revocation according to the revocation state value, thereby solving the problem of key revocation and structure update. Strict security analysis shows that the partial data key disclosure does not leak the data confidentiality of remaining data, and the performance analysis using real-world dataset shows that the proposed key storage management scheme is acceptable in ciphertext retrieval system.

关 键 词：密钥存储管理 密文检索 密钥状态散列树 密钥撤销 

分 类 号：TN918.4[电子电信—通信与信息系统]