Research On Several Key Techiques In Attribute Based Cryptosystem

The developments of several new computing techoniques such as distributed computing,cloud computing have made data sharing more and more convenient among users.However,while users are enjoying the convenience brought by these techiniques,they are also faced with a series of issues related to information security.These issues arise from the fact that most computing resseaurces providers are operated by commercial institutes which are very likely to be outside of the trusted domain of data owners.Although traditional “one-to-one” data encryption techniques can preserve the confidentiality and integrity of the sensitive data,they are not able satisfy a series of new demands emerging in these scenarios,such as high efficient data encryption,fine-grained access control,etc.To be a new type of public key cryptosystem,attribute based cryptosystem provides a good method to tackle the above problems.In attribute based cryptosystem,a data owner does not have to know the exact identity of each receiver,he can realize fine-grained data access control by describing the ciphertexts or target users using attributes.Consequently,attribute based cryptosystem is especially suitable for data protection in distribute network scenarios.So far,researches domestic and abroad have proposed many schemes on attribute based croptosystems,including attribute based encryption schemes,attribute based signature schemes,attribute based signcryption schemes and attribute based proxy schemes,etc.These schemes are equipped with rich functionalities and favorable security properties.However,in the practical application scenarios,there still exist some issues remaining to be tackled,for example,key abuse and key refreshing in attribute based encryption schemes,proxy key being long term valid in attribute based proxy schemes,considerable computation consumption in attribute based signcryption schemes and considerable amount of bilinear pairing operations in attribute based cryptograpy,etc.This dissertation researches on several key techniques in attribute based cryptosystem,designs schemes referring to attribute based encryption,attribute based signature,and attribute based signcryption.It expands several functions in attribute based cryptosystem and the following are the main achievesments:(1)Research on key accountability and key updating in attribute based encryption:To tackle the problems of key abuse and key exposure in attribute based encryption,it designs a key key-insulated ciphertext policy based attribute based encryption with key exposure accountability.We differentiate users' private keys by embedding a unique identifier into each user's private key he owns.The encryption process still exploits the advantages of attribute based cryptosystem to the full,that is to say a file encryptor only need to consider the attribute set of data receivers,rather than their identities.What's more,it introduces key insulation mechanism into our scheme by dividing the system's lifespan into several discrete time slices.The system public parameters keep unchanged throughout the system's lifespan,while users' private keys are refreshed when a new time slice arrives,thus providing high efficient key updating.(2)Research on attribute based proxy schemes:To tackle the problem of proxy key being long term valid in attribute based proxy schemes,it presents a key insulated attribute based proxy re-encryption scheme.During a certain time slice,a delegator can generate the re-encryption key for the current time slice according to the delegatee's attribute set and the private key he owns.Then the delegator sends the re-encryption key to the semitrusted server.The server can re-encrypt the original ciphertexts and transform them into proxy ciphertexts which are encrypted by the delegatee's attribute set.In the presented scheme,the proxy authority of server is well insulated and using the re-encryption key from past time slice cannot generate a valid proxy ciphertext in the current time slice.To be a parallel research direction,it presents a key insulated attribute based proxy signature scheme.It allows a semi-trusted proxy server generates a valid signature for a file using the proxy key generated by a delegator.It also gives the unforgeability proof of the scheme.(3)Research on attribute based signcryption with computing delegation:To tackle the problem of considerable calculation cost in data encryption and authentication in attribute based cryptosystem,it proposes an attribute based signcryption with computing delegation.The private keys of a user consist of two parts: one is decryption key while the other is delegation key.A user can sends the delegation key he owns to the server.The server can de-signcrypt the ciphertexts using the delegation key and sends the proxy ciphertext to the user after calculation,then the user de-signcrypts the proxy ciphertexts using the decryption key he owns.Due to the fact that server has undertaken a large proportion of work of de-signcryption,thus the computation cost on the client side is rather low.Meanwhile,the server will not gain any useful information of plaintext during computing delegation,which provides effective preservation for the sensitive data.(4)Research on attribute based cryptosystem without bilinear pairings:To tackle the problem of bilinear pairings being involved in most of the attribute based cryptographic schemes,it starts from the mathematical principles of attribute based cryptosystem and designs the access control mechanism which accords with the attribute based cryptosystem on condition that no bilinear pairings are involved.Then it presents key policy attribute based encryption without pairings,key policy attribute based signature without pairings and ciphertext policy attribute based signcryption without pairings respectively.In the proposed schemes,bilinear pairings are total eliminated thus the whole efficiency of the algorithms is improved to a large extent.Meanwhile,the proposed scheme supports flexible key updating and can provide secure data sharing for terminals with restricted computation capabilities.