Xu Zhigang, Zhou Wan, Han Hongmu, Dong Xinhua, Zhang Shiguang, Hu Ziping
School of Computer Science, Hubei University of Technology, 28 Nanli Road, Wuhan, 430068, China.
Jiangmen Industrial Technology Research Institute of Guangdong Academy of Sciences Ltd, 6 Chaolian Avenue, Guangdong, 529095, China.
Sci Rep. 2025 Apr 7;15(1):11913. doi: 10.1038/s41598-024-80307-3.
With the rapid rise of Internet of Things (IoT) technology, cloud computing and attribute-based encryption (ABE) are often employed to safeguard the privacy and security of IoT data. However, most blockchain based access control methods are one-way, and user access policies are public, which cannot simultaneously meet the needs of dynamic attribute updates, two-way verification of users and data, and secure data transmission. To handle such challenges, we propose an attribute-based encryption scheme that satisfies real-time and secure sharing requirements through attribute updates and policy hiding. First, we designed a new dynamic update and policy hiding bidirectional attribute access control (DUPH-BAAC) scheme. In addition, a strategy hiding technique was adopted. The data owner sends encrypted addresses with hidden access policies to the blockchain network for verification through transactions. Then, the user locally matches attributes, the smart contract verifies user permissions, and generates access transactions for users who meet access policies. Moreover, the cloud server receives user identity keys and matches the user attribute set with the ciphertext attribute set. Besides, blockchain networks replace traditional IoT centralized servers for identity authentication, authorization, key management, and attribute updates, reducing information leakage risk. Finally, we demonstrate that the DUPH-BAAC scheme can resist indistinguishable choice access structures and selective plaintext attacks, achieving IND-sAS-CPA security.
随着物联网（IoT）技术的迅速崛起，云计算和基于属性的加密（ABE）常被用于保障物联网数据的隐私和安全。然而，大多数基于区块链的访问控制方法都是单向的，且用户访问策略是公开的，无法同时满足动态属性更新、用户与数据的双向验证以及安全数据传输的需求。为应对此类挑战，我们提出一种基于属性的加密方案，该方案通过属性更新和策略隐藏来满足实时且安全的共享需求。首先，我们设计了一种新的动态更新和策略隐藏双向属性访问控制（DUPH-BAAC）方案。此外，采用了一种策略隐藏技术。数据所有者将带有隐藏访问策略的加密地址发送到区块链网络，通过交易进行验证。然后，用户在本地匹配属性，智能合约验证用户权限，并为符合访问策略的用户生成访问交易。此外，云服务器接收用户身份密钥，并将用户属性集与密文属性集进行匹配。另外，区块链网络取代传统的物联网集中式服务器进行身份认证、授权、密钥管理和属性更新，降低信息泄露风险。最后，我们证明DUPH-BAAC方案能够抵御不可区分选择访问结构和选择性明文攻击，实现IND-sAS-CPA安全性。
