云计算中改进概率公钥加密的移动设备数据隐私保护方法

基于云计算的服务具有许多优势,但外包数据隐私保护一直以来都有待优化解决。针对云计算中资源受限的移动设备外包数据安全问题,提出一种基于改进概率公钥加密的隐私保护方法。使用概率公钥加密算法加密数据;在云中数据通过搜索其空间关键词进行文件检索;在确保数据准确性和隐私安全性的前提下,实现云计算中移动设备外包数据安全有效加密后的隐私保护。仿真实验结果表明,该方案不仅可以确保数据隐私和计算速度,同时能够减少通信开销。相比于双轮可搜索加密(TRSE)方案、可排序多关键词检索加密(MRSE)方案和实时循环移位加密(RRSE)等方案,该方案在可行性和计算效率方面都有所提升。     

面向混合云的可并行多关键词Top-k密文检索技术

随着云计算技术的迅猛发展,越来越多的企业和个人青睐使用私有云和公有云相结合的混合云环境,用于外包存储和管理其私有数据。为了保护外包数据的私密性,数据加密是一种常用的隐私保护手段,但这同时也使得针对加密数据的搜索成为一个具有挑战性的问题。文中提出了面向混合云的可并行的多关键词Top-k密文检索方案。该方案通过对文档、关键词分组进行向量化处理,并引入对称加密和同态矩阵加密机制,保护外包数据的私密性,同时支持多关键词密文检索;通过引入MapReduce计算模式,使得公有云和私有云合作完成的密文检索过程能够按照并行化方式执行,从而能够支持针对大规模加密数据的并行化检索。安全分析和实验结果表明,提出的检索方案能够保护外包数据的隐私,且其检索效率优于现有的同类方案。     

移动云计算中基于身份的轻量级加密方案

针对移动云计算中数据安全和移动用户的隐私保护问题,结合在线离线和外包解密技术,对基于身份加密机制（IBE）中加密和解密算法进行扩展,提出了一种可外包解密的基于身份在线离线加密方案,并证明其安全性,构造出适合于移动云计算环境中轻量级设备保护隐私数据的方案。为了减少移动终端运行IBE的加密和解密开销,利用在线离线技术将IBE的加密分解为离线和在线两个阶段,使得移动设备仅需执行少量简单计算即可生成密文;在此基础上,利用外包解密技术,修改IBE的密钥生成算法和解密算法,增加一个密文转化算法,将解密的大部分复杂计算外包给云服务器,移动设备仅计算一个幂乘运算即可获得明文。与现有IBE方案的性能相比,该方案具有较少的加解密开销,适合于轻量级移动设备。     

支持区间查询的基于位置服务外包数据隐私保护方案

随着云计算技术的迅猛发展,越来越多的LBS服务被外包到云上运行以减少本地的计算和存储成本。然而,外包环境下的云服务器通常被认为是一个半可信的实体,LBS提供商的数据安全和用户的个人隐私将会面临新的安全挑战。针对现有基于位置服务数据外包方案中不支持区间查询和隐私保护不足等问题,文章提出一种支持区间查询的LBS外包数据隐私保护方案,利用非对称向量积保值加密和公钥可搜索加密对LBS坐标和关键词进行加密,实现LBS数据的机密性和用户查询模式的隐私性;利用轻量级的矩阵运算使用户在不泄露查询区间的前提下准确获得所需LBS数据。在新用户注册方面,采用基于双线性配对运算实现用户身份认证。安全性和性能分析表明,文章方案较同类方案具有一定优势。     

工业物联网环境下可外包的策略隐藏属性基加密方案

针对工业物联网环境下数据访问控制方案存在解密设备计算负担过重,无法保护解密设备隐私信息,以及不能追踪恶意设备等问题,文章提出一种工业物联网环境下可外包的策略隐藏属性基加密方案。该方案借助边缘计算技术将海量工业数据的大部分解密操作外包给边缘计算节点,极大减轻了解密设备的计算负担。该方案将属性基加密中的访问结构进行拆分,引入策略隐藏技术,在实现工业数据机密性的同时保护解密设备的隐私信息。此外,文章利用区块链技术对系统内设备进行监管和审计。安全性分析表明,该方案在选择明文攻击下是安全的。文章在PBC密码库和Hyperledger Fabric区块链平台上将该方案与同类方案进行模拟仿真,结果表明,该方案具有较高的计算效率,适用于工业物联网环境。     

云环境下一种隐私文件分类存储与保护方案*

针对云计算环境下存储的隐私文件会造成隐私泄漏、信息量过载,使用传统加密算法对隐私文件进行加密后再外包给云的方法严重影响了隐私文件的可检索性问题进行研究,提出了一种既能够有效减少云环境中信息存储量过载,同时又能够满足隐私文件的加密保护和检索的方案。该方案首先对隐私文件进行分类,将直接隐私文件存储在数据拥有者本地存储器,非直接隐私文件则加密后上传云环境中存储,实现了隐私文件的分类存储和安全保护。然后基于改进的哈希列表建立了一个包含文件属性描述的文件检索索引、生成了文件检索陷门,实现了使用关键词在密文状态下完成文件检索。最后,通过详细的理论分析和实验对比分析证明了方案的可行性和实用性。     

基于可验证秘密共享的多关键词可搜索加密方案北大核心CSCD

可搜索加密技术在云存储技术快速发展的环境下已经被广泛应用于数据安全与个人信息保护的实施办法中,并作为研究热点被国内外众多学者关注。密码体制的安全性依赖密钥的保密,然而目前大多可搜索加密方案都需要用户自行管理密钥,存在密钥泄露和遗失的风险,影响加密方案的安全性,同时也限制了需要使用不同设备的用户。文章针对可搜索加密的密钥管理问题,基于可验证秘密共享提出了一种密钥可重构的多关键词可搜索加密方案,用户只需依赖自己的生物特征和预设口令即可完成数据的外包和检索,摆脱了自行管理密钥的困扰。方案满足选择关键词不可区分和身份认证两个安全属性,确保只有口令正确且生物特征与模板足够接近的情况下才能完成数据的外包和检索,用户特征的正确性由服务器端计算并验证,且无法得到关于用户的原始生物特征、密钥和关键词等隐私信息。     

云环境下基于秘密共享的安全外包主成分分析方案北大核心CSCD

主成分分析技术的计算开销较大,本地设备一般无法负担,常需要将计算任务进行外包,而外包计算的数据安全问题已成为云计算安全领域的一个研究热点。文章提出一种云环境下基于秘密共享的安全外包主成分分析方案,该方案基于加法秘密共享技术,设计了安全除法和安全平方根计算协议。通过两台云服务器协同执行协方差矩阵、Lanczos、Householder等安全协议计算,实现了主成分分析安全外包计算。与其他安全外包计算方案相比,文章所提方案可以更好地支持客户端离线和多方数据聚合,其计算开销更小,并通过实验验证了方案的有效性。     

云计算下基于特殊差分方程的(m+1,t+1)门限秘密共享方案

针对非可信云计算服务提供商窃取用户隐私数据的问题,以齐次常系数线性差分方程为工具,将秘密共享技术应用到云计算环境中,提出一种新的(m+1,t+1)门限秘密共享方案。通过对用户隐私数据的解密密钥进行管理,利用齐次常系数线性差分方程为用户与云服务提供商分别分配特殊秘密份额与普通秘密份额,在没有用户参与的情况下,云服务提供商不能恢复用户隐私数据。分析结果表明,该方案能较好地保障用户隐私数据的存储安全,并且通过优化秘密份额减少了存储开销。     

强制数据隐私和用户隐私的外包数据库服务研究*

外包数据库中的数据隐私和用户隐私保护是现代外包数据库服务面临的新挑战,针对目前外包数据库服务中单方面考虑数据隐私保护或用户隐私保护技术难以同时满足外包数据库安全需求的不足,提出一种可同时强制数据隐私和用户隐私保护的外包数据库服务模型,采用属性分解和部分属性加密技术,基于结合准标志集自动检测技术的近似算法实现外包数据的最小加密属性分解,同时把密码学应用于辅助随机服务器协议,以实现数据库访问时的用户隐私保护。理论分析和实验结果表明,该模型可以提供有效的数据隐私保护和查询处理,以及较好的用户隐私保护计算复杂度。     

Privacy preserving security using biometrics in cloud computing

Cloud computing and the efficient storage provide new paradigms and approaches designed at efficiently utilization of resources through computation and many alternatives to guarantee the privacy preservation of individual user. It also ensures the integrity of stored cloud data, and processing of stored data in the various data centers. However, to provide better protection and management of sensitive information (data) are big challenge to maintain the confidentiality and integrity of data in the cloud computation. Thus, there is an urgent need for storing and processing the data in the cloud environment without any information leakage. The sensitive data require the storing and processing mechanism and techniques to assurance the privacy preservation of individual user, to maintain the data integrity, and preserve confidentiality. Face recognition has recently achieved advancements in the unobtrusive recognition of individuals to maintain the privacy-preservation in the cloud computing. This paper emphasizes on cloud security and privacy issues and provides the solution using biometric face recognition. We propose a biometrics face recognition approach for security and privacy preservation of cloud users during their access to cloud resources. The proposed approach has three steps: (1) acquisition of face images (2) preprocessing and extraction of facial feature (3) recognition of individual using encrypted biometric feature. The experimental results establish that our proposed recognition approach can ensure the privacy and security of biometrics data.

     

A hybrid scheme for securing fingerprint templates

In a fingerprint recognition system, templates are stored in the server database. To avoid the privacy concerns in case the database is compromised, many approaches of securing biometrics templates such as biometric encryption, salting, and noninvertible transformation are proposed to enhance privacy and security. However, a single approach may not meet all application requirements including security, diversity, and revocability. In this paper, we present a hybrid scheme for securing fingerprint templates, which integrates our novel algorithms of biometric encryption and noninvertible transformation. During biometric encryption, we perform the implementation of fingerprint fuzzy vault using a linear equation and chaff points. During noninvertible transformation, we perform a regional transformation for every minutia-centered circular region. The hybrid scheme can provide high security, diversity, and revocability. Experimental results show the comparative performance of those approaches. We also present strength analysis and threats on our scheme.     

Provably secure authenticated key agreement scheme for distributed mobile cloud computing services

With the rapid development of mobile cloud computing, the security becomes a crucial part of communication systems in a distributed mobile cloud computing environment. Recently, in 2015, Tsai and Lo proposed a privacy-aware authentication scheme for distributed mobile cloud computing services. In this paper, we first analyze the Tsai–Lo’s scheme and show that their scheme is vulnerable to server impersonation attack, and thus, their scheme fails to achieve the secure mutual authentication. In addition, we also show that Tsai–Lo’s scheme does not provide the session-key security (SK-security) and strong user credentials’ privacy when ephemeral secret is unexpectedly revealed to the adversary. In order to withstand these security pitfalls found in Tsai–Lo’s scheme, we propose a provably secure authentication scheme for distributed mobile cloud computing services. Through the rigorous security analysis, we show that our scheme achieves SK-security and strong credentials’ privacy and prevents all well-known attacks including the impersonation attack and ephemeral secrets leakage attack. Furthermore, we simulate our scheme for the formal security analysis using the widely-accepted AVISPA (Automated Validation of Internet Security Protocols and Applications) tool, and show that our scheme is secure against passive and active attacks including the replay and man-in-the-middle attacks. More security functionalities along with reduced computational costs for the mobile users make our scheme more appropriate for the practical applications as compared to Tsai–Lo’s scheme and other related schemes. Finally, to demonstrate the practicality of the scheme, we evaluate the proposed scheme using the broadly-accepted NS-2 network simulator.     

A secure re‐encryption scheme for data services in a cloud computing environment

Cloud computing as a promising technology and paradigm can provide various data services, such as data sharing and distribution, which allows users to derive benefits without the need for deep knowledge about them. However, the popular cloud data services also bring forth many new data security and privacy challenges. Cloud service provider untrusted, outsourced data security, hence collusion attacks from cloud service providers and data users become extremely challenging issues. To resolve these issues, we design the basic parts of secure re‐encryption scheme for data services in a cloud computing environment, and further propose an efficient and secure re‐encryption algorithm based on the EIGamal algorithm, to satisfy basic security requirements. The proposed scheme not only makes full use of the powerful processing ability of cloud computing but also can effectively ensure cloud data security. Extensive analysis shows that our proposed scheme is highly efficient and provably secure under existing security model. Copyright © 2015 John Wiley & Sons, Ltd.     

A privacy-preserving multi-keyword ranked retrieval scheme in cloud computing

ABSTRACT

Big data and cloud computing could bring security problems. In order to ensure data security and user privacy, people would choose to store data in the cloud with ciphertext. How to search data efficiently and comprehensively without decryption has become the focus of this paper. In this paper, we propose an efficient privacy protection scheme. In this scheme, Elliptic Curve Cryptography (ECC) is adopted to encrypt the data. It can reduce the computing cost of encryption and decryption uploading the encrypted files and indexes to the cloud server. Then it can authorize users to generate trap door using hash conflict function, and send it to Cloud Service Provider (CSP) for searching for matched ciphertext. The CSP uses the Apriori algorithm to extend keywords and search index to match the ciphertext. In this paper, we will use the Apriori algorithm to extend the keywords’ semantics, match the index list based on these keywords, and return the requested file-set which is more consistent with the user’s search. Experiments show that compared with traditional methods, files can be encrypted, decrypted, and recovered more quickly when we use this method. It can also ensure the privacy of data and reduce the communication overhead.     

多用户通信机制中支持隐私保护的属性基动态广播加密

云计算和物联网的快速发展使多用户信息共享机制备受关注,然而当用户将个人数据上传到云服务器与不同用户共享时,未经授权的用户和不可信的第三方云服务提供商会窥探这些隐私数据,对数据安全和用户隐私构成严重威胁。此外,多用户共享机制还存在访问控制不灵活、用户撤销和动态管理等问题。为了解决这些问题,文章结合属性基加密与广播加密技术提出一种动态广播加密机制。该方案在保证数据安全的同时,利用不经意传输协议,实现了接收者的匿名,保护了用户隐私。此外,该方案还支持新用户随时动态加入系统,且不影响原用户在系统中的解密能力,并实现了用户撤销和快速解密。性能分析表明,该方案较已有方案在安全性和效率方面有明显优势。     

A reliable recommendation and privacy-preserving based cross-layer reputation mechanism for mobile cloud computing

Mobile cloud computing (MCC) is gaining popularity due to anywhere anytime data access. However, at the same time it also introduces the new privacy and security threats that have become an obstacle to the widespread use and popularity of MCC. In this paper, we propose a reliable recommendation and privacy preserving based cross-layer reputation mechanism (RP-CRM) to provide secure and privacy-aware communication process in wireless mesh networks (WMNs) based MCC (WM-MCC). RP-CRM integrates the cross-layer design with recommendation reputation reliability evaluation mechanism and the privacy preserving scheme to identify and manage the internal malicious nodes and protect the security and privacy against internal multi-layer attack, bad mouthing attack and information disclosure attack. Simulation results and performance analysis demonstrate that RP-CRM can provide rapid and accurate malicious node identification and management, and provide security and privacy protection against aforementioned attacks more effectively and efficiently.     

云计算中基于TPM的多银行电子现金系统

针对云计算的虚拟化技术可以解决传统网络中电子现金系统存在的隐私泄露、交易不规范和高成本投入问题, 在已有的工作中, 考虑商家和用户使用同一银行在一定程度上限制了电子现金广泛使用的情况, 提出了一种基于TPM(trusted platform module)的可信云平台多银行电子现金方案。该方案从电子现金支付的效率和安全性方面考虑, 利用群签名和椭圆曲线算法ECC提高协议的执行效率, 运用可信平台模块提供的隐私保护和远程证明功能加强支付协议的安全性。最后, 对方案的安全性和效率进行分析。     

基于OAuth的开放授权技术及在云计算中的应用

在云计算中,传统应用系统中使用的基于单一安全域的身份认证和资源授权模式已无法适应复杂环境中的管理要求,需要制定跨域访问的安全控制策略.在重点分析了云计算中数据安全和隐私保护所遇到的挑战的基础上,有针对性地介绍了OAuth2.0协议的原理和功能特点,提出了开放授权技术在云计算中的应用优势,并通过一个工程应用实例讨论了具体的实现方法和思路.