【作者】 刘媛；

【导师】 李丽香；

【作者基本信息】 北京邮电大学 ， 网络空间安全， 2022， 博士

【摘要】 随着云计算技术的蓬勃发展和数据资产可控共享需求的快速增长,越来越多的用户倾向于将自己的数据加密后存储至云端,并通过云端服务器进行数据的监管或分享等。为实现开放云环境下用户数据安全高效共享,支持多对多通信和细粒度访问控制的属性基加密(Attribute-based Encryption,ABE)技术也得到了迅速发展。传统基于椭圆曲线双线性配对的ABE技术已取得了长足发展,并被广泛应用于各个行业,但是却面临未来量子计算攻击的威胁。近10年来,学者们提出了一系列可抵抗量子计算攻击的格基属性加密方案,并不断得到优化。然而,格基属性加密在拥有格密码抗量子计算攻击的优势的同时,也继承了格密码自身所固有的安全性噪声依赖所带来的密文膨胀率过高的问题。因此,寻找降低格基属性加密密文膨胀率的有效方法是一个值得研究的密码学挑战。此外,现有格基属性加密方案的访问策略灵活性较低,仅支持单一“与”门或单一“门限”操作,或支持由系统所有属性组成的电路型访问策略,而且属性空间受限、对属性所涉及的用户隐私保护力度不足,探索表达能力更加丰富、隐私保护能力更强的属性组织结构和访问策略也是一个有意义的密码学研究主题。基于上述研究动机,本文主要研究内容和创新点总结如下:(1)提出一种格上身份基对偶接收者加密的新构造。已有的格上身份基对偶接收者加密方案中,系统公共参数中的矩阵个数与用户身份比特长度呈线性增长,而密钥生成、加密和解密过程中均需这些公共参数参与计算,这将导致较大的存储开销和计算开销,为解决这一问题,方案引入单射函数和同态陷门计算技术对用户的身份信息进行压缩,公共参数由原来的O(n)个矩阵减少为O((?))个矩阵,其中,n为任意身份的比特长度,p(p≥2)为一常数,p和n越大,所提方案的优势越明显。与相关方案对比,所提方案的系统公共参数尺寸至少缩短了 88%;此外,该方案在标准模型下满足自适应选择身份与选择明文攻击安全。(2)提出一种格上支持二维属性和隐私保护的属性基加密方案。针对格基属性加密中的属性空间受限和属性隐私泄露问题,方案将传统的一维属性结构扩展到二维属性结构,使得方案可以随时动态的添加新的属性值而不需要重新构建系统;另外,属性标签用来设置访问策略,具体属性值利用编码函数进行编码并隐藏,能够有效防止属性隐私泄露;此外,引入了一种新的陷门生成算法,消除了系统主私钥对系统属性总数的依赖,解决了使用线性秘密共享技术不当导致的系统主私钥泄漏的安全问题。最后,该方案在空间开销上非常高效,并在标准模型下被证明是安全的。(3)提出一种格上支持灵活访问策略和多机构的属性基加密方案。针对格基属性加密中的访问策略单一和系统压力过大问题,方案利用Shamir门限秘密共享机制和树形访问结构共同构成访问策略,能够同时支持属性之间的“与”门、“或”门和“门限”三种操作;另外,构造了一个优化的采样算法来生成可逆矩阵,并在该优化算法的基础上,设计了多个属性结构可以独立管理不同的属性集,并负责为用户生成私钥,显著降低了系统的采样时间,解决了系统压力过大的问题;与现有的相关方案相比,该方案能显著提高访问策略的灵活性,并具有较小的格维数、陷门存储占用率和密文尺寸。(4)提出一种短密文尺寸的格基全同态属性基加密方案。针对格基全同态属性加密中密文尺寸过大的问题,方案使用二维属性结构和带标签的特殊结构矩阵,消除了密文尺寸对系统属性的依赖性,使得密文尺寸不再随着系统属性总数的增加而增加;另外,密文的同态计算引入改锥矩阵G逆函数,可以对新密文中的噪声重新随机化,G逆函数的亚高斯性使得方案中参数设置和误差分析更加紧凑;此外,性能分析表明,所提方案的密文尺寸至少减少了 73.3%;最后,该方案在标准模型中被证明是安全的。更多还原

【Abstract】 With the vigorous development of cloud computing technology and the rapid growth of the demand for controllable sharing of data assets,more and more users tend to store their encrypted data to the cloud,and supervise or share the data through the cloud server.In order to realize safe and efficient sharing of users’ data in the open cloud environment,attribute based encryption(ABE)technology,which support many to many communication mode and fine-grained access control,has also developed rapidly.Traditional ABE technology which is based on the elliptic curve has made great progress and is widely used in various industries,but it is facing the threat of quantum computing attack in the future.In the past ten years,scholars have proposed a series of lattice-based ABE schemes and its optimized proposal that can resist the attack of quantum computing.However,lattice-base ABE not only has the advantage of against quantum computing attack,but also has the problem of high ciphertext expansion rate of the lattice-based cryptography.Therefore,it is a cryptographic challenge to find an effective method to reduce the expansion rate of lattice-based encryption.In addition,the access policy of the existing lattice-based ABE schemes is less flexible,and only supports a single "and" gate or a single "threshold" operation,or supports the circuit type access policy composed of all the attributes of the system.Besides,the space of attributes is bounded and the user privacy protection involved in attributes is insufficient.Therefore,it is also a meaningful topic to explore the attribute organization structure and access policy with richer expressive ability and stronger privacy protection ability.Based on the above research motivation,the main research contents and constructions of this paper are as follows:(1)New construction of identity based dual receiver encryption scheme from lattice is proposed.In the previous identity based dual receiver encryption scheme scheme from lattices,the number of matrices in public parameters increases linearly with the bit-length of user’s identity,and these public parameters are required to participate in the computation in the process of key generation,encryption and decryption which will lead to a large storage overhead and a computation overhead.In order to solve this problem,we introduce an injective function and homomorphic notch gate computing technology to compress the user’s identity information.By doing this,the matrices of the same dimensions in the public parameters is reduced from O(n)to O((?)),where n is the bit length of arbitrary identity and p(p≥2)is a flexible constant.The larger the n and p,the more observable of our proposal.Typically,comparing to the related scheme,the size of public parameters in our proposal is reduced by at least 88%.Finally,our lattice-based IB-DRE scheme is proved to be secure indistinguishable against adaptively chosen identity and plaintext attacks(IND-ID-CPA).(2)An attribute based encryption scheme with two-dimensional attributes and privacy protection from lattice is proposed.In order to solve the problem of attribute space limitation and attribute privacy disclosure in lattice-based attribute encryption scheme,we extend the traditional onedimensional attribute structure to two-dimensional attribute structure.It can add new attribute values at any time without reconstructing the system.The attribute space is no longer bounded.In addition,by doing that the attribute labels are used to set the access policy while the actual values are hidden.It can protect the attribute privacy.Besides,a new trapdoor generation algorithm is introduced to generate the master secret key and remove the dependency of the master secret key on the total number of system’s attributes,and solves the security problem of the leakage of the master secret key.Finally,the space cost in our scheme is remarkably reduced and it is proved to be secure in the standard model.(3)An attribute based encryption scheme with flexible access policy and multi-authority from lattice is proposed.In order to improve the flexibility of access policy and solve the problem of single point bottleneck,Shamir’s secret sharing mechanism and monotonic access tree structure are used to express a clearer and flexible access policy,which can support the"and","or" and "threshold" operations between attributes at the same time.Besides,we construct an optimized sampling algorithm to generate an invertible matrix with a lower runtime.Based on it,we designed multiple attribute authorities which can manage different attribute sets and generate private keys for the user independently.Compared with the existing related schemes,the proposed scheme can improve the functional agility and flexibility of the access policy prominently,and it also can achieve a better performance with less lattice dimension and trapdoor storage cost and ciphertext size.(4)An attribute based fully homomorphic encryption scheme with short ciphertext from lattice is proposed.To reduce the ciphertext size which leads to a high communication overhead and a long running time of encryption and decryption,we use the same two-dimensional attribute structure and the special structure matrix with tag to remove the dependency of ciphertext size on system’s attributes and the ciphertext size is no longer increased with the total number of system’s attributes.In addition,the gadget matrix G’s inverse function is introduced into the homomorphic operations on the ciphertext to re-randomize the noise in the new ciphertext.The sub-Gaussian nature of the G’s inverse function makes the parameters setting and error analysis in the scheme more compact.Besides,performance analysis shows that the size of ciphertext in our scheme is reduced by at least 73.3%.Finally,our scheme is proved to be secure in the standard model.更多还原