云存储中基于代理重加密的CP-ABE访问控制方案  

CP-ABE access control scheme based on proxy re-encryption in cloud storage

作　　者：王海勇[1] 彭垚 郭凯璇 WANG Haiyong;PENG Yao;GUO Kaixuan(College of Computer Science,Nanjing University of Posts and Telecommunications,Nanjing Jiangsu 210023,China;College of Internet of Things,Nanjing University of Posts and Telecommunications,Nanjing Jiangsu 210003,China)

机构地区：[1]南京邮电大学计算机学院,南京210023 [2]南京邮电大学物联网学院,南京210003

出　　处：《计算机应用》2019年第9期2611-2616,共6页journal of Computer Applications

基　　金：国家自然科学基金面上项目(GZ215045);江苏省教育信息化研究资助项目(20172105);南京邮电大学教学研究改革项目(JG06717JX66)~~

摘　　要：针对云存储中基于密文策略的属性加密(CP-ABE)访问控制方案存在用户解密开销较大的问题,提出了一种基于代理重加密的CP-ABE(CP-ABE-BPRE)方案,并对密钥的生成方法进行了改进。此方案包含五个组成部分,分别是可信任密钥授权、数据属主、云服务提供商、代理解密服务器和数据访问者,其中云服务器对数据进行重加密,代理解密服务器完成大部分的解密计算。方案能够有效地降低用户的解密开销,在保证数据细粒度访问控制的同时还支持用户属性的直接撤销,并解决了传统CP-ABE方案中因用户私钥被非法盗取带来的数据泄露问题。与其他CP-ABE方案比较,此方案对访问云数据的用户在解密性能方面具有较好的优势。Focused on the large user’s decryption overhead of the Ciphertext Policy Attribute-Based Encryption(CP-ABE)access control scheme in cloud storage,a CP-ABE Access Control Scheme Based on Proxy Re-Encryption(CP-ABE-BPRE)was proposed,and the key generation method was improved.Five components were included in this scheme:trusted key authority,data owner,cloud service provider,proxy decryption server and data visitor.The cloud server re-encrypted the data,and the proxy decryption server performed most of the decryption calculation.The proposed scheme reduces the user’s decryption overhead effectively,and solves the data leakage problem caused by illegal stealing of the user’s private key in the traditional CP-ABE scheme,and the direct revocation of user attributes is provided while the fine-grained access control is ensured in the scheme.A comparison with other CP-ABE schemes demonstrates that this scheme has better decryption performance for users when accessing cloud data.

关 键 词：云存储 属性加密 代理重加密 访问控制 可信任密钥 

分 类 号：TP302.1[自动化与计算机技术—计算机系统结构]