CN103227789B - The fine-grained access control method of lightweight under a kind of cloud environment - Google Patents

Abstract

A kind of fine-grained access control method of lightweight under the present invention relates to cloud storage environment, belongs to secure cloud field of storage, comprises the following steps: 1. data upload; 2. the mandate of data; 3. the access of data; 4. authorize and cancel; 5. Data Update; The invention provides a kind of lightweight, fine-grained access control method, build data image and control of authority layer, effectively can realize sharing without copy data and the control of fine-grained data access, and guarantee the fail safe of data encryption key.

Description

A lightweight fine-grained access control method in cloud environment

technical field

The invention belongs to the field of secure cloud storage, and in particular relates to a lightweight, fine-grained and flexible data access control method for private data.

Background technique

As a new network computing model, cloud computing has attracted great attention from academia and industry as soon as it was proposed. Cloud storage service has developed rapidly with its unique good scalability, convenient deployment and low cost, and both academia and industry have achieved remarkable results.

Although cloud storage services have achieved so many remarkable results in such a short period of time, the problems they face in the development process still restrict the further development of cloud storage, and the currently recognized bottleneck restricting the development of cloud storage services is data security. The problem is that although there are many security technologies to ensure data security, most of the technologies pay more attention to external threats, while internal threats to cloud storage providers have not received effective attention.

At present, the internal attacks from the cloud storage provider are mainly defended by the local encryption and decryption technology of the data. Although the current local encryption and decryption technology effectively resists attacks from within the cloud service provider and in the network, it greatly affects the sharing of data among different users. Although the key agreement mechanism can solve the sharing of ciphertext data, this mechanism will lead to high computing costs for each data authorization, and cannot effectively revoke or update the authorization, but can only revoke the authorization by re-encrypting the data or update.

According to the analysis of the current ciphertext data access control method, it is found that the current ciphertext data access control method has the following main problems:

1. On the premise of ensuring data security, there is no effective mechanism to solve the ciphertext data sharing without copy.

2. Most of the current data authorization is based on static role or attribute division, and it is impossible to perform flexible and fine-grained data authorization for data.

3. Once the ciphertext is authorized for data, especially after multiple authorizations for the same data, the authorization cannot be effectively revoked for the data. At present, most of the data are re-encrypted, which greatly increases the calculation cost and will lead to Key replacement for other accessible users.

Contents of the invention

In order to solve the above problems, the present invention provides a lightweight fine-grained access control method in a cloud environment, comprising the following steps:

Step 1: Upload data and initialize, the implementation method is:

On the one hand, the data owner locally encrypts the plaintext data to be uploaded with his own public key to obtain the ciphertext data; then uploads the ciphertext data to the cloud;

On the other hand, according to the access control requirements of the data owner, construct the corresponding authority control node layer;

Step 2: Authorization of data, the implementation method includes the following steps:

Step 2.1: Determine the authorization data, and generate a corresponding data image for each data to be authorized. If the data needs to be authorized multiple times, generate multiple images accordingly. The data owner is the Each image generates a public-private key pair;

Step 2.2: Calculate the proxy re-encryption key between the data and its image, and store it in the cloud;

Step 2.3: Calculate the session key. For each authorized user, the data owner constructs a session key through his private key, public key and public parameters of the authorized user, and the user refers to A single user or a user group;

Step 2.4: Encrypt the private key of the image with the session key, store the encrypted ciphertext in the authority control node, and update the authorized user in the authority control node at the same time information;

Step 3: Reading of data:

The user requests to read the certain data, the system first judges whether the current user has the data access authority according to the authority control node, and if so, mirrors the data requested by the user The re-encryption and the encrypted mirror private key in its authority control node are sent to the user, and the user obtains the mirror private key through the first round of decryption on the client side, and then uses the private key for the second Rounds of decryption and finally obtain the plaintext data; otherwise, reject the user request;

Step 4: Authorization revocation:

The authorized user is requested to revoke the authorization, the system judges whether there is an access path between the authorized user and the data, if not, rejects the request; if exists, the system judges the permission Whether the user information exists in the control node, if so:

If the data described only corresponds to one image, delete the data image directly from the cloud, and clear its authority control node information;

If the data described only corresponds to one image, but authorization revoking is only performed for some users, first clear the corresponding user information in the authority control node, and then regenerate the public-private key pair for the current image, and generate the public-private key pair as the target The re-encryption key and its private key are encrypted and processed, and finally the user authorization information in the authority control node is updated to the encrypted mirror private key;

If the data corresponds to multiple images, and authorization revocation needs to be performed on all images, then delete the corresponding image, and update the authorized user information in the authority control node;

If the data described corresponds to multiple images, but the authorization revoking of some users in the multiple images is performed, then for each relevant image, first clear the corresponding user information in the authority control node, and then regenerate the public-private key pair for the current image , and generate a re-encryption key targeting the public-private key pair, and encrypt its private key, and finally update the user authorization information in the authority control node to the encrypted mirror private key;

Otherwise, deny said request;

Step 5: data update, after updating some of the data in the cloud,

If its access authorization remains unchanged, do nothing;

If it is necessary to revoke some of the above-mentioned authorizations, follow the authorization revocation in step 4;

If new access authorization is required, execute according to the data authorization in step 2 described above.

Preferably, the corresponding authority control node layer is constructed in step 1, and each node is endowed with relevant information of authorized users.

Preferably, with the operation of the system and the change of the authority, the authority control node can be dynamically updated.

Compared with the existing authorized access control, the present invention has the following advantages:

1. Realize multi-authorization of data without copies through data mirroring, and lightweight data sharing;

2. Flexible data authorization according to needs. Users can be divided not only according to groups, but also according to different roles in the group, and temporary authorization can be performed for temporary users;

3. Convenient authorization revocation. According to the requirements, the recovery of access rights is performed by adjusting the value of data mirroring and authority control nodes.

Description of drawings

Figure 1: A hierarchical structure diagram of the present invention supporting lightweight and fine-grained data access control.

Fig. 2: Data upload and initialization flow chart of the present invention.

Fig. 3: a data structure diagram of a fine-grained authority control node according to a specific embodiment of the present invention.

Fig. 4: Data authorization flow chart of the present invention.

Fig. 5: Data reading flow chart of the present invention.

Fig. 6: Flowchart of authorization revocation in the present invention.

Detailed ways

The present invention will be further described below in conjunction with specific examples and accompanying drawings.

The present invention provides a lightweight fine-grained access control method in a cloud environment, comprising the following steps:

Step 1: Upload data and initialize, the implementation method is:

On the one hand, the data owner locally encrypts the plaintext data to be uploaded with his own public key to obtain the ciphertext data; then uploads the ciphertext data to the cloud;

On the other hand, according to the access control requirements of the data owner, the corresponding authority control node layer is constructed, and each node is given the relevant information of the authorized user. With the operation of the system and the change of authority, the authority control node can be controlled dynamic update;

Step 2: Authorization of data, the implementation method includes the following steps:

Step 2.1: Determine the authorization data, and generate a corresponding data image for each data to be authorized. If the data needs to be authorized multiple times, generate multiple images accordingly, and the data owner generates a public-private key pair for each image;

Step 2.2: Calculate the proxy re-encryption key between the data and its mirror image, and store it in the cloud;

Step 2.3: Calculate the session key. For each authorized user, the data owner constructs a session key through his own private key, the authorized user's public key and public parameters. A user refers to a single user or a user group;

Step 2.4: Encrypt the mirrored private key with the session key, store the encrypted ciphertext in the authority control node, and update the authorized user information in the authority control node;

Step 3: Reading of data:

When a user requests to read a certain data, the system first judges whether the current user has access to the data according to the authority control node. If so, the data requested by the user is re-encrypted by the mirror and the mirror private key encrypted in the authority control node is sent to For the user, the user obtains the image private key through the first round of decryption on the client side, and then uses the private key to perform the second round of decryption and finally obtains the plaintext data; otherwise, reject the user's request;

Step 4: Authorization revocation:

When an authorized user is requested to revoke the authorization, the system judges whether there is an access path between the authorized user and the data, and if not, rejects the request; if it exists, the system judges whether the user information exists in the authority control node, and if so:

If the data corresponds to only one mirror, delete the data mirror directly from the cloud, and clear its authority control node information;

If the data only corresponds to one image, but authorization revocation is only performed for some users, first clear the corresponding user information in the authority control node, and then regenerate the public-private key pair for the current image, and generate re-encryption targeting the public-private key pair key, and encrypt its private key, and finally update the user authorization information in the authority control node to the encrypted mirror private key;

If the data corresponds to multiple images, and authorization revocation needs to be performed on all images, delete the corresponding image, and update the authorized user information in the authority control node;

If the data corresponds to multiple images, but the authorization revocation of some users in the multiple images is performed, for each relevant image, first clear the corresponding user information in the authority control node, and then regenerate the public-private key pair for the current image, and generate Re-encrypt the key with the public-private key pair as the target, and encrypt and process its private key, and finally update the user authorization information in the authority control node to the encrypted mirror private key;

Otherwise, deny the request;

Step 5: Data update, when some data in the cloud is updated,

If its access authorization remains unchanged, do nothing;

If some authorization needs to be revoked, follow the authorization revocation in step 4;

If new access authorization is required, follow the data authorization in step 2.

Please refer to FIG. 1 , which is a hierarchical structure diagram supporting lightweight and fine-grained data access control in the present invention, including a physical layer, a data mirroring layer, an authority control layer, and a user layer.

Please see Figure 2, which is a flow chart of the data submission and initialization process. The data owner (data owner) first encrypts the data f1~f6 locally with his own public key. Specifically, the asymmetric RSA encryption algorithm is used here to encrypt Data is encrypted. First, determine the system parameter SP:={p,q,n} according to the system security parameter λ, where n=pq, and p,q are two large prime numbers that satisfy the system security parameter λ. When a user registers, the system assigns each user a pair of public and private keys (ek,dk)=(<e,n>,<d,n>), where e is randomly selected from among Then calculate the corresponding Where <e,n> is the public key, and <d,n> is the private key. Assuming that the plaintext is m, the encrypted ciphertext is c=m ^e · mod · n.

Then upload the encrypted data to the cloud. According to system requirements, the access rights are divided, that is, the authority control nodes in the authority control layer in Fig. 1 are constructed. Please see Figure 3, which is a specific data structure diagram of the authority control node, and records relevant user authorization information. With the operation of the system and the change of permissions, the permission control nodes can be dynamically updated to achieve fine-grained data access control.

Please refer to FIG. 4 , which is a flow chart of the data authorization process. Here, the authorization of data f1 to U1 and U3 is taken as an example. First, the data owner determines that the data to be authorized is f1, and the system generates a corresponding image for f1. The data owner generates a public-private key pair (ek1, dk1) for each image. After the generation is completed, the data image layer in Figure 1 corresponds to f1 After the mirror image of is generated, then calculate the proxy re-encryption key from f1 to its corresponding mirror image. The specific calculation is as follows: Here, the user key pair is (eu _i , du _i )=(<eu _i , n>,<du _i , n>), the corresponding image key pair is (eu _j , du _j )=(<eu _j ,n>,<du _j ,n>), then the corresponding re-encryption key is And the corresponding re-encryption key rk _ij is uploaded to the cloud and stored in the mirror node. Then, according to the public keys eu ₁ and eu ₂ of the authorized users U1 and U3 respectively, as the session key, use the session key to encrypt the image private key du _j , the specific calculation is as follows: $c_{{\mathrm{eu}}_1}={\left({\mathrm{du}}_j\right)}^{{\mathrm{eu}}_1}\mathrm{mod}\mathrm{no},$ $c_{{\mathrm{eu}}_3}={\left({\mathrm{du}}_j\right)}^{{\mathrm{eu}}_3}\mathrm{mod}\mathrm{no}.$ and the encrypted private key Stored in the corresponding authority control node.

Please see Figure 5, which is the flow chart of the data reading process. First, the user U1 sends a request to access data f1, and the system judges whether there is an access path between U1 and f1. If it exists, it searches for the authority control node on the current path and judges U1 Do you have authorized access to f1. If so, the cloud uses the re-encryption key in the image to re-encrypt the data f1 to obtain F1, together with the corresponding encrypted private key of U1 in the authority control node sent to user U1. User U1 uses its own private key to first decrypt the ciphertext corresponding to the private key of the f1 image , and then use the decrypted image private key du _j to decrypt the data F1 to obtain the data plaintext f1. Otherwise, access is denied.

Please see Figure 6, which is the flow chart of the specific process of authorization revocation. Referring to Figure 1, if we revoke the authorization of f1 to U1, we first clear the relevant authorization information of U1 in the authority control node on the path from f1 to U1, and then create a mirror image of f1 Generate a new public-private key pair, and use it to calculate a new proxy re-encryption key, and finally encrypt the mirrored new private key with the session key calculated by the data owner and authorized user, and update the information of other users in the authority control node. So far, the authorization for U1 has been revoked without any impact on other users. If the authorization of f7 for U8 is revoked, we delete the image corresponding to f7 and clear the corresponding authorization information of U8 in the authority control node on the path.

The above content is a further detailed description of the present invention in combination with the best embodiments, and it cannot be assumed that the specific implementation of the present invention is limited to these descriptions. Those skilled in the art should understand that without departing from the conditions defined by the appended claims, various modifications can be made in the details, which should be regarded as belonging to the protection scope of the present invention.

Claims (3)

1. A lightweight fine-grained access control method in a cloud environment, characterized in that it comprises the following steps: Step 1: Upload data and initialize, the implementation method is: On the one hand, the data owner locally encrypts the plaintext data to be uploaded with his own public key to obtain the ciphertext data; then uploads the ciphertext data to the cloud; On the other hand, according to the access control requirements of the data owner, construct the corresponding authority control node layer; Step 2: Authorization of data, the implementation method includes the following steps: Step 2.1: Determine the authorization data, and generate a corresponding data image for each data to be authorized. If the data needs to be authorized multiple times, generate multiple images accordingly. The data owner is the Each image generates a public-private key pair; Step 2.2: Calculate the proxy re-encryption key between the data and its image, and store it in the cloud; Step 2.3: Calculate the session key. For each authorized user, the data owner constructs a session key through his private key, public key and public parameters of the authorized user, and the user refers to A single user or a user group; Step 2.4: Encrypt the private key of the image with the session key, store the encrypted ciphertext in the authority control node, and update the authorized user in the authority control node at the same time information; Step 3: Reading of data: When the user requests to read certain data, the system first judges whether the current user has the data access authority according to the authority control node, and if so, re-encrypts the data requested by the user and its authority The encrypted image private key in the control node is sent to the user, and the user obtains the image private key through the first round of decryption on the client side, and then uses the private key to perform the second round of decryption and finally obtains the the above plaintext data; otherwise, reject the user request; Step 4: Authorization revocation: The authorized user is requested to revoke the authorization, the system judges whether there is an access path between the authorized user and the data, if not, rejects the request; if exists, the system judges the permission Whether the user information exists in the control node, if so: If the data described only corresponds to one image, delete the data image directly from the cloud, and clear its authority control node information; If the data described only corresponds to one image, but authorization revoking is only performed for some users, first clear the corresponding user information in the authority control node, and then regenerate the public-private key pair for the current image, and generate the public-private key pair as the target The re-encryption key and its private key are encrypted and processed, and finally the user authorization information in the authority control node is updated to the encrypted mirror private key; If the data corresponds to multiple images, and authorization revocation needs to be performed on all images, then delete the corresponding image, and update the authorized user information in the authority control node; If the data described corresponds to multiple images, but the authorization revoking of some users in the multiple images is performed, then for each relevant image, first clear the corresponding user information in the authority control node, and then regenerate the public-private key pair for the current image , and generate a re-encryption key targeting the public-private key pair, and encrypt its private key, and finally update the user authorization information in the authority control node to the encrypted mirror private key; Otherwise, deny said request; Step 5: data update, after updating some of the data in the cloud, If its access authorization remains unchanged, do nothing; If it is necessary to revoke some of the above-mentioned authorizations, follow the authorization revocation in step 4; If new access authorization is required, execute according to the data authorization in step 2 described above. 2. The light-weight fine-grained access control method under the cloud environment according to claim 1, characterized in that: the corresponding authority control node layer is constructed as described in step 1, and each node is given authorized Information about the user. 3. The light-weight fine-grained access control method in the cloud environment according to claim 1, characterized in that: along with the operation of the system and the change of authority, the authority control node can be dynamically updated.