Search

In application scenarios such as cloud storage, a symmetric algorithm can be used to encrypt massive data. However, using the symmetric operation and keys in encryption and decryption, it is very difficult to realize an efficient access control system. The asymmetric encryption algorithm ciphertext-policy attribute-based encryption (CP-ABE), as a versatile one-to-many encryption algorithm, is considered an ideal access control tool to solve the user's distrust of the service provider of cloud storage. However, in a traditional CP-ABE system, the malicious users may deliberately leak their attribute keys to others or build a decryption black box (DB) to provide illegal decryption services for benefits, while no one can determine their identities. To deal with the problems, especially the problem of tracing the DB builder, CP-ABE schemes with black-box traceability have been proposed in the past few years. But in this paper, we point out that for now, the tracing algorithms in all existing schemes actually work on an impractical assumption. That is, whenever a DB receives a decryption request, it always performs the decryption algorithm honestlycorrectly. We argue that if a DB finds the decryption request comes from the tracing algorithm, it may intentionally output incorrect decryption results to counter the tracing. Thus, we present the structural defect of the tracing algorithm applied to all known traceable CP-ABE schemes. We describe the construction of an alert decryption black box (ADB) that is capable of distinguishing a tracing ciphertext from a normal one. We also show how an ADB frustrates the tracing algorithm, and furthermore, malicious users can even apply an ADB to frame innocent users. [ABSTRACT FROM AUTHOR]

Dispatching and Control Cloud (DCC) is a cloud platform constructed by State Grid Corporation with the technology of cloud computing. DCC has improved the overall operation and monitoring capabilities, the smart level and many other advantages of power grid. However, the development of DCC has been hampered by security and privacy issues. Secure unified identity authentication, access control and authorisation management are significant topics in DCC. To find out a solution for the topics above, we have employed some encryption schemes using the attribute-based encryption(ABE), as ABE can preserve users' privacy and achieve access control with fine grain over the encrypted information. SM9 is a kind of Chinese official standard in the field of cryptography, which contains the SM9 encryption algorithm (SM9-IBE). In this paper, an ABE scheme based on SM9-IBE is proposed, making SM9 support fine-grained access control which would be better applied in DCC. Our proposed scheme (SM9-ABE) has been proven to be of great security in the selective CPA model under DBDH assumption. Furthermore, we implement SM9-ABE and evaluate its practical performance. The implementation indicates our scheme performs well in the matter of security and functionality, at an additional time cost which is acceptable. [ABSTRACT FROM AUTHOR]

Storing only one unique copy of the same cloud data and guaranteeing its integrity are two main goals for cloud storage auditing and deduplication schemes. In such schemes, data owners can firmly believe the data integrity by periodically auditing and the cloud server can save lots of storage space by exploiting the duplication techniques. However, when a data owner deletes or modifies his outsourced data, he should lose the ownership for the original data and should not be able to successfully retrieve this data any more. For all we know, existing cloud storage auditing and deduplication literatures fail to support the modifications of ownership, which actually occur quite often in actual cloud storage scenarios. In this paper, we propose the first deduplicated data integrity auditing scheme supporting the ownership modification. It guarantees the integrity of the outsourced data and supports the dynamic access control over the outsourced data. We employ a re-encryption algorithm and the secure identity-based broadcast encryption technology, which prevent data from being disclosed to the revoked owners, even if they previously had prior ownership of these data. The security and efficiency of our proposed scheme have been validated by detailed analysis and experiments. [ABSTRACT FROM AUTHOR]