Provable data possession scheme with authentication

To satisfy the requirements of identity authentication and data possession proven in the cloud application scenarios,a provable data possession scheme with authentication was proposed.Based on data tag signature and randomness reusing,the proposed scheme could accomplish several issues with three interactions,including the possession proof of cloud data,the mutual authentication between user and cloud computing server,the session key agreement and confirmation.Compared to the simple combination of authentication key agreement and provable data possession schemes,the proposed scheme has less computation and interactions,and better provable securities.In the random oracle model,the security proof of the proposed scheme is given under the computational Diffie-Hellman assumption.     

基于多分支认证树的多用户多副本数据持有性证明方案

在云存储环境下,如何高效、动态地完成对多用户多副本数据的完整性验证是一个挑战性问题。基于双线性代数映射的签名机制和多分支认证树特性,提出了一种新的多用户多副本数据持有性证明方案。该方案通过使用随机掩码技术对密文进行处理确保数据隐私性,采用多分支认证树来提高数据分块的签名效率,能够支持数据动态更新操作。此外,引入第三方审计者对多用户多副本数据进行批量审计以减少计算开销。最后,分析表明本方案具有较高的安全性和效率。     

An integrity verification scheme of completeness and zero‐knowledge for multi‐Cloud storage

To resist the attacks from the malicious Cloud service providers and the organizer, an integrality verification of completeness and zero‐knowledge property (IVCZKP) scheme for multi‐Cloud environment is proposed. First, the bilinear pairing maps are adopted as a basis of theoretical support for IVCZKP scheme. Second, the change of file blocks is recorded, and the hash value of each block is generated through the index‐hash table in the verification process. Finally, the hash value of each block is updated through this index‐hash table to support the dynamic updates to user's data, such as data modification, data insertion, and data deletion. Compared with the original scheme, IVCZKP scheme can resist the forgery attacks and has the completeness and zero‐knowledge property. Theory analysis and the experimental results show that this scheme can reduce the computation time and has more performance on integrity verification in multi‐Cloud environment.     

云存储中的数据持有性证明研究综述

数据的持有性证明允许用户随时知道其数据是否仍然有效地保存在云存储平台中,以及是否可以随时、随地获取到该数据,这是云存储安全中的一个重要的挑战性问题。介绍了数据持有性证明的模型和衡量指标体系,分析了3种证明方案,并全面比较了6种常见的方法,最后给出了未来需要注意的研究方向。     

降低可证明存储的计算和通信复杂度

Nowadays , an increasing number of persons choose to outsource their computing demands and storage demands to the Cloud. In order to ensure the integrity of the data in the untrusted Cloud, especially the dynamic files which can be updated online, we propose an improved dynamic provable data possession model. We use some homomorphic tags to verify the integrity of the file and use some hash values generated by some secret values and tags to prevent replay attack and forgery attack. Compared with previous works , our proposal reduces the computational and communication complexity from O (logn ) to O (1). We did some experiments to ensure this improvement and extended the model to file sharing situation.     

支持动态更新的多副本持有性证明方案

考虑多副本数据安全和数据动态更新的应用需求,提出一个支持数据动态更新的多副本数据持有性证明方案。本方案中原数据文件采用动态认证结构进行动态更新与管理,其他多个副本采用追加日志记录的方式记录数据的动态更新,支持公开聚合验证。若原数据文件或副本数据损坏或丢失,可恢复到最新状态。由此分析了方案的安全性、通信性能、存储性能,结果表明新方案是高效的、安全的。     

Lightweight integrity verification scheme for cloud based group data

In order to protect the security of the data stored in the cloud by group users,a data integrity verification scheme was designed which can protect the privacy of the group users.The scheme can efficiently detect the shared data in the cloud and support the dynamic updating of the data,and use the characteristic of the ring signature to hide the iden-tity of the signer corresponding to the data block.That is,the third-party verifier can not spy on the users identity and other private information when validating.The aggregated approach is used to generate data labels,which reduces the storage cost of labels and supports the dynamic operation of group data,so that the users in the group can easily modify the cloud group data.     

Analysis and improvement on identity-based cloud data integrity verification scheme

Many individuals or businesses outsource their data to remote cloud.Cloud storage provides users the advantages of economic convenience,but data owners no longer physically control over the stored data,which introduces new security challenges,such as no security guarantees of integrity and privacy.The security of two identity-based cloud data integrity verification schemes by Zhang et al and Xu et al respectively are analysed.It shows that Zhang et al.’s scheme is subjected to secret key recovery attack for the cloud servers can recover user’s private key only utilizing stored data.And Xu et al.’s scheme cannot satisfy security requirements of soundness.Based on Xu et al.'s scheme,a modified identity-based cloud data integrity verification scheme is proposed.A comprehensive analysis shows the new scheme can provide the security requirements of soundness and privacy,and has the same communication overhead and computational cost as Xu et al.’s scheme.     

Cloud data assured deletion scheme based on overwrite verification

At the end of data life cycle,there is still a risk of data leakage,because mostly data which was stored in cloud is removed by logical deletion of the key.Therefore,a cloud data assured deletion scheme (WV-CP-ABE) based on ciphertext re-encrypt and overwrite verification was proposed.When data owner wants to delete the outsourced data,the data fine-grained deletion operation was realized by re-encrypting the ciphertext to change the access control policy.Secondly,a searchable path hash binary tree (DSMHT) based on dirty data block overwrite was built to verify the correctness of the data to be deletion.Finally,the dual mechanism of changing the ciphertext access control policy and data overwriting guarantees the data assured deletion.The experimental analysis proves that the fine-grained control is better and the security is more reliable than the previous logical delete method in the assured deletion of data.     

基于分布式代理的云资源调度中可信数据获取机制

Nowadays , an increasing number of persons choose to outsource their computing demands and storage demands to the Cloud. In order to ensure the integrity of the data in the untrusted Cloud, especially the dynamic files which can be updated online, we propose an improved dynamic provable data possession model. We use some homomorphic tags to verify the integrity of the file and use some hash values generated by some secret values and tags to prevent replay attack and forgery attack. Compared with previous works , our proposal reduces the computational and communication complexity from O (logn ) to O (1). We did some experiments to ensure this improvement and extended the model to file sharing situation.     

Provable security signcryption scheme based on RLWE without trapdoor

In view of the existing efficiency and security problems of lattice based signcryption,with the ABB16’s signature scheme ring-TESLA,a signcryption scheme without trapdoor named RLWE-SC was constructed,which achieved indistinguish ability against adaptive chosen cipher text attack (IND-CCA2) security and strongly existential unforgeability against chosen message attack (SUF-CMA) security respectively in terms of confidentiality and authentication based on the problem of learning with errors on ring.The size of the public and private keys was optimized by the construction on the ring.The complex trapdoor generation and preimage sample calculation was avoided by the structure without trapdoor.Efficiency analysis and experiment shows that RLWE-SC has better computational and communication performance than other similar lattice-based signcryption schemes with the same security strength.     

ACDAS: Authenticated controlled data access and sharing scheme for cloud storage

Cloud storage services require cost‐effective, scalable, and self‐managed secure data management functionality. Public cloud storage always enforces users to adopt the restricted generic security consideration provided by the cloud service provider. On the contrary, private cloud storage gives users the opportunity to configure a self‐managed and controlled authenticated data security model to control the accessing and sharing of data in a private cloud. However, this introduces several new challenges to data security. One critical issue is how to enable a secure, authenticated data storage model for data access with controlled data accessibility. In this paper, we propose an authenticated controlled data access and sharing scheme called ACDAS to address this issue. In our proposed scheme, we employ a biometric‐based authentication model for secure access to data storage and sharing. To provide flexible data sharing under the control of a data owner, we propose a variant of a proxy reencryption scheme where the cloud server uses a proxy reencryption key and the data owner generates a credential token during decryption to control the accessibility of the users. The security analysis shows that our proposed scheme is resistant to various attacks, including a stolen verifier attack, a replay attack, a password guessing attack, and a stolen mobile device attack. Further, our proposed scheme satisfies the considered security requirements of a data storage and sharing system. The experimental results demonstrate that ACDAS can achieve the security goals together with the practical efficiency of storage, computation, and communication compared with other related schemes.     

基于PaaS云平台的数据存储方案设计与应用

当前的云平台数据存储方案忽略了数据的重复性,易产生大量冗余数据,为优化数据存储性能,基于PaaS云平台设计数据存储方案并实现应用.分区删减云平台冗余数据,计算各分区剩余数据权重因子,基于权重因子设计PaaS云平台数据存储顺序,动态生成数据存储方案,将Proxmox VE的虚拟环境模拟系统作为虚拟节点,通过底层服务器实现...     

一种有效率的方法用于检测云中数据的完整性(英文)

Cloud computing and storage services allow clients to move their data center and applications to centralized large data centers and thus avoid the burden of local data storage and maintenance.However,this poses new challenges related to creating secure and reliable data storage over unreliable service providers.In this study,we address the problem of ensuring the integrity of data storage in cloud computing.In particular,we consider methods for reducing the burden of generating a constant amount of metadata at the client side.By exploiting some good attributes of the bilinear group,we can devise a simple and efficient audit service for public verification of untrusted and outsourced storage,which can be important for achieving widespread deployment of cloud computing.Whereas many prior studies on ensuring remote data integrity did not consider the burden of generating verification metadata at the client side,the objective of this study is to resolve this issue.Moreover,our scheme also supports data dynamics and public verifiability.Extensive security and performance analysis shows that the proposed scheme is highly efficient and provably secure.     

An Efficient Method for Checking the Integrity of Data in the Cloud

Cloud computing and storage services allow clients to move their data center and applications to centralized large data centers and thus avoid the burden of local data storage and maintenance. However, this poses new challenges related to creating secure and reliable data storage over unreliable service providers. In this study, we address the problem of ensuring the integrity of data storage in cloud computing. In particular, we consider methods for reducing the burden of generating a constant amount of metadata at the client side. By exploiting some good attributes of the bilinear group, we can devise a simple and efficient audit service for public verification of untrusted and outsourced storage, which can be important for achieving widespread deployment of cloud computing. Whereas many prior studies on ensuring remote data integrity did not consider the burden of generating verification metadata at the client side, the objective of this study is to resolve this issue. Moreover, our scheme also supports data dynamics and public verifiability. Extensive security and performance analysis shows that the proposed scheme is highly efficient and provably secure.     

Differential data update scheme on network-coding-based cloud storage system

In order to solve the problem that the communication overhead of date update was too large on network-coding-based cloud storage system,a new differential data update scheme was proposed.By encoding and compressing the updated part of file,the communication overhead was reduced significantly.A network-coding-based storage prototype system was designed and implemented,and update scheme was deployed in the real network settings.Experimental results show that the proposed scheme has less communication overhead and better scalability than the existing schemes.     

云计算中抗共谋攻击的数据位置验证协议

针对云计算中数据位置验证存在的共谋攻击,本文提出了抗共谋攻击的数据位置验证协议.首先给出了数据位置验证的系统模型,分析了安全威胁,并给出了数据位置验证的安全定义.随后,将安全定位协议与数据持有性证明协议相结合,设计了一维空间下的数据位置验证协议,并证明了所提协议满足安全定义且能抵御共谋攻击.在一维协议基础之上,构建了三维空间下的数据位置验证协议.最后,在三维空间下将本文所提协议与Lost协议和Geoproof协议进行了性能的测试和比较.结果表明所提协议能够验证服务器具体位置且能抵御共谋攻击.     

基于云计算的作战数据存储系统研究

为了解决部队战斗时产生的海量数据的存储问题,做了一种基于云计算的作战数据存储系统的实验。通过实际的应用,该方案可以很好地克服现行的存储方式存在的不足,有效提高部队战斗效率。     

云存储环境下的密文安全共享机制

With the convenient of storing and sharing data in cloud storage environment,the concerns about data security arised as well.To achieve data security on untrusted servers,user usually stored the encrypted data on the cloud storage environment.How to build a cipertext-based access control scheme became a pot issue.For the access control problems of ciphertext in cloud storage environment,a CP-ABE based data sharing scheme was proposed.Novel key generation and distribution strategies were proposed to reduce the reliance on a trusted third party.Personal information was added in decryption key to resistant conclusion attacks at the same time.Moreover,key revocation scheme was proposed to provide the data backward secrecy.The security and implement analysis proves that proposed scheme is suit for the real application environment.     

一种基于ORAM的数据可恢复性证明与访问模式的隐藏

随着云计算的发展与应用,越来越多的客户选择云存储作为存储媒质,因此,数据的完整性和私密性成为客户关心的主要问题。基于无关RAM模型机提出一种新的结构,将客户文件分割成大小相等的数据块,每个数据块在云存储中有两个备份,且随机地存储在不同的文件中,以保证数据的完整性。利用同态散列算法验证数据的可持有性,通过无关RAM隐藏客户对服务器的访问模式,敌手无法从客户的数据访问模式中获取有用的信息,从而实现了数据的私密性。