2017年 ProvSec：第11届可证明安全国际会议论文集

需积分: 10 109 浏览量更新于2024-07-18 1 收藏 9.47MB PDF 举报

"第11届可证明安全国际会议论文集是2017年在中国西安举办的 ProvSec 会议的成果，由陕西师范大学、西安电子科技大学和西安邮电大学联合主办。该会议聚焦信息安全、密码学和可验证性等领域，展示了最新的研究进展和技术成果。论文集收录了多篇由知名专家如 Tatsuaki Okamoto、Yong Yu、Man Ho Au 和 Yannan Li 等编辑和贡献的学术文章，属于 Lecture Notes in Computer Science 系列，编号为 LNCS 10592。该系列自1973年开始出版，汇集了全球顶尖学者的智慧，包括 David Hutchison、Josef Kittler、John C. Mitchell 等在内的编委会成员均为计算机科学领域的权威专家。" 在本次会议中，与会者深入探讨了可证明安全的概念，这是信息安全领域的一个关键分支，它旨在通过数学证明确保加密算法、安全协议等在理论上是无懈可击的。可证明安全的研究涵盖了各种密码学技术，如公钥加密、数字签名、认证码、零知识证明等，这些技术在保障数据隐私、网络安全以及区块链等新兴技术中发挥着核心作用。密码学是实现可证明安全的基础，它研究如何在不安全的通信环境中保护信息的机密性、完整性和身份验证。会议中的论文可能涉及了新的密码算法设计、密码分析方法、抗量子计算的安全方案，以及密码学在物联网、云计算等领域的应用。此外，可验证性在密码学中尤为重要，它涉及到验证一个系统或协议是否按照预期工作，而不会被恶意攻击者利用。这通常需要构造形式化的模型和证明，以确保安全属性的正确性。会议可能讨论了形式化方法、自动化验证工具和实际系统的安全性评估。通过这个国际平台，学者们交流了最新的研究成果，推动了可证明安全理论的发展，同时也为实际应用中的安全挑战提供了理论支持和解决方案。这些论文不仅对学术界具有重要意义，也为业界提供了解决信息安全问题的新思路和新技术。

4 Z. Liang et al.

videos, or other documents on cloud storage providers such as Dropbox, iCloud,

so that they can be remotely accessed and shared when necessary.

Most challenging obstacles for the wide usage of cloud storage systems may

be the concerns about data privacy and secrecy. Users often hesitate to use cloud

storage systems because of the worries of losing control on the outsourced data.

Typical method to protect data security is to encrypt them before outsourcing.

Encryption is a standard approach to protect the data outsourced to clouds.

However, traditional encryption systems cannot enforce ﬁne-grained access con-

trol, which brings diﬃculties for ﬂexible data sharing. To address this problem,

advanced encryption primitives, e.g., Identity-Based Encryption [8], Attribute-

Based Encryption [35] have been proposed and extensively employed in many

cloud storage systems. In these systems, a data owner can specify data attributes

for the outsourced data. Each data owner has its own secret key that is associ-

ated with key attributes. Access can be done only if the key attributes match

the data attributes.

A subtle problem arises when such advanced encryption primitive is used

to secure data in cloud. In all existing schemes, there exists a Trusted Keying

Authority (TKA) responsible for secret key distribution. The schemes require

all data users to be authorized by TKA to get their secret keys. Data owners

are not required to be authorized by TKA. They can directly encrypt the data

using the public keys. However, after encrypting the data, the data owner herself

cannot extract the data hidden in the ciphertext since she does not have any

secret keys. In a cloud storage setting, the encrypted ﬁles will be outsourced to

some cloud server and there is no local copy of the ﬁles in the clear, except some

meta-data of the ﬁle or ﬁle identiﬁers. These meta-data or ﬁle identiﬁers can

only used to check the integrity of the ﬁles or as clues to retrieve the outsourced

ﬁles, instead of recovering the encrypted ﬁles. Consequently, the outsourced ﬁles

are no longer accessible to their owners, although the data owners authorized

peers can access the ﬁles. Clearly, this is undesirable in practice.

At the ﬁrst glance, this problem may be trivially addressed. One trivial solu-

tion is asking the data owner to simultaneously encrypt to herself a copy of the

ﬁle. However, this would incur signiﬁcant computation and storage cost if the

ﬁle is large. Another trivial solution is to let the data owner also specify herself

as a data user of the encrypted ﬁle. This is diﬃcult in practice. First, advanced

encryption primitive is a closed encryption system, i.e., before the data users

hold a secret key they must ﬁrst register to TKA. This implies that each pos-

sible data owner has to ﬁrst register to TKA as an authorized data user, which

badly makes the maximal number of data users in such system unnecessarily

large. Note that the complexity of most existing systems rely on the scale of

the data users. Second, some advanced encryption instantiations, e.g., Identity-

Based Encryption (IBE), only allow one receiver in an encryption, which makes

it impossible to allow the data owner as an extra receiver.

We investigate how to enable a data owner to access his/her own encrypted

data with a cost as low as possible. To achieve this goal, we formalize a new

framework, referred to as Self-EXtractable Encryption (SEXE). In addition to

Provably Secure Self-Extractable Encryption 5

the normal functionalities of a regular advanced encryption primitive, SEXE is

equipped with a useful self-extractability. Roughly speaking, the data owner can

always access her encrypted data in SEXE. We propose a generic SEXE construc-

tion from any advanced encryption scheme. The construction only additionally

requires a pseudo random function, a symmetric encryption cipher, and some

hash functions, all of which are eﬃcient in terms of computation. The desirable

self-extractability only incurs a marginal cost, while posing little extra cost on

regular receivers. Following the generic construction, we instantiate several typi-

cal SEXE schemes, including Self-Extractable Identity-Based Encryption (SEX-

IBE), Self-Extractable Attribute-Based Encryption (SXABE) in Key-Policy set-

ting and in Ciphertext-Policy setting.

2 Related Work

Cloud storage follows the area of “database-as-a-service” paradigm, which is

a classic data storage topic that has been studied since 2000s. The intended

purpose of cloud storage is to enable data owners to outsource their data on the

Internet to service providers [20,21]. The basic idea to protect data privacy and

secrecy in cloud storage is to enforce data access control by encrypting the data

before outsourcing. Only the authorized data users can have access [2]. Classic

schemes employ traditional symmetric key/asymmetric cryptosystems to realize

access control [16,27]. As the number of data users increases, especially for cloud-

based data storage systems that potentially allow a vast number of data users,

the systems suﬀer from complicated entity and key managements.

Researches have been devoted to entity and key management problems.

In 2001, Boneh and Franklin [8] proposed a new encryption primitive, named

Identity-Based Encryption (IBE), the concept of which was ﬁrst introduced by

Shamir [36]. Compared with the traditional asymmetric encryption system, the

public keys in IBE can be arbitrary strings, such as social security numbers, email

addresses, and phone numbers. Instead of generating the secret key by the data

owner itself, a Trusted Key Authority (TKA) is employed in IBE for user authen-

tication and key distribution. Since IBE brings ﬂexibilities for user authentica-

tion and entity management, many advanced data access control schemes started

to leverage IBE as the basic encryption primitive [12,19]. Schemes exploiting IBE

and various other cryptographic primitives have been proposed to achieve more

ﬂexible data sharing functionalities, including cross-domain [38] and emergency

sharing [39] for speciﬁc data outsourcing applications.

The IBE primitive only allows to assign one receiver in an encryption, which

brings diﬃculties for multi-entity data sharing application scenarios. Brieﬂy

speaking, the access policy in IBE is “exact string match”, which is a limited data

access control mechanism. Although several encryption primitives and schemes,

e.g., Hierarchical IBE [15,24], (Identity-Based) Broadcast Encryption [9,14],

Proxy Re-Encryption [4], were proposed and/or applied to partially support one-

to-many data sharing mechanism in cloud storage applications [3], access policies

in all of which are somewhat restricted. How to support expressive access pol-

icy in encryption primitives remained as an open problem. In 2005, Sahai and

6 Z. Liang et al.

Waters introduced the concept of Attribute-Based Encryption (ABE) [35], in

which the access policy can be expressed as a monotonic boolean formula. For

example, the access policy for an outsourced data from an university can be “CS

AND (Ph.D OR Masters)”. The Ph.D or masters in the department of Computer

Science can have access to the data. Later, the concept of ABE was extended to

be Key-Policy ABE (KP-ABE) [18] (in which the boolean formula is assigned to

the secret key) and Ciphertext-Policy ABE (CP-ABE) [6] (in which the boolean

formula is assigned to the encrypted data).

With the capability to provide ﬁne-grained access control over encrypted

data, ABE is suitable for cloud storage applications. In 2010, Yu et al. proposed

a KP-ABE based access control scheme for cloud storage [43]. Works [25,42]have

also been done to enforce data access control with multi-authority cloud storage

systems. To further support search mechanism over encrypted data, Zheng et al.

[45] and Sun et al. [40] respectively proposed two ABE schemes that allow key-

word search. Most recently, Zhang et al. [44] leverages multiple cryptographic

primitives, including CP-ABE [6], Homomorphic Encryption [32], and Oblivious

Transfer [11] to construct an outsourced photo sharing and searching scheme.

All above schemes neglect the situation where the data owners, very likely,

need to access his/her own encrypted data. We are interested in practical solu-

tions for achieving the desirable self-extractability property.

3 Techniques Preliminaries

3.1 Syntax

We denote [a, b] as the set {a, a +1, ··· ,b} containing consecutive integers, and

[a] as shorthand for [1,a]. The cardinality of a set S is denoted by |S|. We write

← S to denote the action of choosing s from a uniform random distribution

over the set S,ands

, ··· ,s

← S with n ∈ N as shorthand for s

←

S, ··· ,s

← S.WeuseZ

m×n

to denote the m × n matrices with entries in Z

Foravectorv (row vector or column vector), we denote by v

the i-th element

of the vector v.

3.2 Pseudo Random Functions

Our construction exploits a classical cryptographic primitive named pseudo ran-

dom function (PRF), which was introduced by Goldreich, Goldwasser and Micali

[17]. A PRF system consists of a keyed function PRF and a key space K

PRF

such

that for a randomly chosen key κ ∈K

PRF

, the outputs of the function PRF(κ, χ)

for any given input χ ∈{0, 1}

∗

look like random numbers [22].

In practice, such PRF is eﬃcient and easy to be implemented. A general

approach is to treat the key κ as the password, the given input χ as the salt, and

runs classical key derivation technique to produce the output. We recommend

following PKCS #5 Version 2.0 Scheme 1, PKCS #5 Version 2.0 Scheme 2, or

PKCS #12 Version 1.0 speciﬁcations (all of which are standardized in RFC 2898)

to implement such PRF.

Provably Secure Self-Extractable Encryption 7

3.3 Bilinear Groups

Our instantiation demonstrations for self-extractable encryption are based on

bilinear groups. Here we review its deﬁnition and requirements following the

notation of [13]. The bilinear groups can be deﬁned by a group generator G

that takes the security parameter λ ∈ N as input and outputs a quad-tuple

(p, G, G

,e), in which G, G

are two cyclic groups of prime order p,ande is an

eﬃcient map e : G × G → G

satisfying the following properties.

– Bilinearity: for all g,h ∈ G and a, b ∈ Z

,wehavethate(g

)=e(g, h)

– Non-degeneracy: there exists at least an element g ∈ G such that e(g,g)isa

generator for the group G

3.4 Access Structures and Linear Secret Sharing Schemes

We next review the formal deﬁnitions of access structures and linear secret shar-

ing schemes (LSSS), which will be used in our self-extractable ABE instantia-

tions. Here we follow the deﬁnition given by Beimel [5].

Deﬁnition 1 (Access Structure [5]). Consider a set of parties U. A collection

A⊆2

is monotone if for all B,C, we have that if B ∈ A and B ⊆ C, then

C ∈ A. An access structure (monotone access structure) on U is a collection

(monotone collection) A ⊆ 2

\ {∅}. The sets in A are called the authorized sets,

and the sets not in A are called the unauthorized sets.

In most of previous works [6,18,25], the access structure is described with

a tree called access tree. Each non-leaf node of the access tree is a threshold

gate, while each leaf node is described by an attribute. One data user’s access

capability matches the access structure if there is a sub-tree containing the root

node such that all threshold gates in the sub-tree are satisﬁed. In recent ABE

schemes, the access structure is represented by linear secret sharing schemes

(LSSS) [33,37] that can be deﬁned as follows.

Deﬁnition 2 (Linear Secret Sharing Schemes (LSSS) [5,33]). Let p be a prime

number and let U be a set of parties. Let M ∈ Z

l×n

be an l × n matrix with

entries in Z

.Letρ :[l] →U be a function that labels the row of M with parties

in U. A secret sharing scheme Π for access structure A over a set of parties U

is a linear secret sharing scheme (LSSS) in Z

if:

– The shares of a secret s ∈ Z

for each party comprise of a vector over Z

– For each access structure A, there exists an corresponding matrix M ∈ Z

l×n

andafunctionρ :[l] →U to represent the access structure. One can compute

the shares of s by ﬁrst constructing a column vector v =(s, r

, ··· ,r

),where

, ··· ,r

← Z

, and then outputting M · v ∈ Z

l×1

as the vector of l shares.

The share λ

=(Mv)

belongs to the party ρ(i),where(Mv)

denotes the i-th

column element in M v.

8 Z. Liang et al.

Lewko and Waters [29] showed that any access structures represented as

boolean formulas can be eﬃciently converted to be an LSSS policy (M,ρ). Later,

Liu et al. [31] proposed an eﬃcient LSSS matrix generation algorithm from

any threshold access trees. Therefore, access tree and LSSS are identical access

structure representations both in theory and in practice. In our self-extractable

ABE instantiations, we describe the access policy using LSSS.

4 System Overview

4.1 System Model for Cryptography-Based Cloud Storage

We follow the generic cryptography-based cloud storage system model [37,43].

The typical cloud storage system architecture is shown in Fig. 1. There mainly

exist four kinds of parties: Trusted Key Authority (TKA), Data Owner, Cloud

Storage Server, and Data User.

TKA is responsible for initializing the system and issuing/managing secret

keys for data users according to their access capabilities. Data owners share

their data to data users via the cloud storage server. To achieve privacy and

secrecy of the shared data, data owners encrypt the data with on-demand access

policies before uploading. Cloud storage server maintains well-encrypted data

and responses to retrieval requests from data users. Each data user requests the

secret key associated with its access capability from TKA, retrieves encrypted

data from the cloud storage server, and accesses the data that its access capa-

bility matches the access policies assigned to.

The basic cloud storage systems can be described using four procedures,

namely:

– Setup: performed by TKA to initialize the system.

– KeyGen: performed by TKA to generate secret keys with speciﬁed access

capabilities for data users.

– Encrypt: performed by data owners to encrypt data with on-demand access

policy.

– Access: performed by data users to access data with their secret keys.

The above system model captures basic functionalities for cryptography-

based cloud storage systems [37,43]. Such model can be further extended to

meet additional mechanisms and security requirements for speciﬁc application

scenarios, e.g., multi-authority, data user revocation, encrypted search.

Multi-authority [25,34,42]: The basic system architecture has only one single

TKA to distribute secret keys. This brings security and eﬃciency challenges.

On one hand, the single TKA has root access capability thus it is easily to be

the main target for malicious adversaries. On the other hand, the single TKA

would be diﬃcult to maintain since there may be a large number of data users to

request their secret keys. It is recommended that the cloud should employ multi-

authorities to distribute secret keys [34]. The basic system architecture can cover

the multi-authority extension by replacing the single TKA with multiple TKAs.

剩余507页未读，继续阅读

jidexiaolimingyue

粉丝: 0
资源: 2

2017年 ProvSec：第11届可证明安全国际会议论文集

密码学中的可证明安全性-杨波-扫描版

IEEE Symposium on Security & Privacy 2011年论文集

IEEE Symposium on Security and Privacy 2011 论文集

SS 2011-USENIX Security Symposium 2011年论文集

写1000字关于安全的论文

网络安全的论文开题报告

endnote会议论文参考文献

基于威胁分析的无人机数据安全传输系统本科论文怎么写

参考文献至少包含近五年的在CCF指定列表中的国际顶级会议和期刊论文10篇以上

写一篇关于劳动安全的论文800字

最新资源