Abstract: Cloud computing offers efficient data storage and management, facilitating convenient data sharing and access. However, ensuring data security and user privacy in open cloud environments remains a critical challenge. Ciphertext-policy attribute-based encryption (CP-ABE) has been widely adopted to enforce fine-grained access control over data stored in cloud servers. Nevertheless, existing schemes still face limitations in handling hierarchical data and tracing malicious ciphertexts, making it difficult to simultaneously achieve efficient multilevel access and data provenance assurance. To address these challenges, this paper proposes a hierarchical attribute-based access control scheme with traceability over ciphertext. First, a hierarchical CP-ABE framework is employed to construct an efficient multilevel access mechanism. By integrating multiple hierarchical access trees into a unified structure, the scheme enables encryption and decryption of data at different levels under a single policy, significantly reducing computational overhead. Second, a zero-knowledge proof-based signature mechanism is introduced to securely bind ciphertexts with their creators while preserving data owner anonymity, enabling accurate tracing of malicious ciphertext sources. Finally, security analysis demonstrates that the proposed scheme can effectively resist chosen-plaintext attacks. Experimental evaluation shows that, compared with existing approaches, the scheme achieves lower encryption and decryption overhead, making it well suited for secure, efficient, and traceable data sharing in cloud environments.

摘要： 云计算因其高效的数据存储与管理能力，使数据共享和访问变得更加便捷，而如何在开放的云环境中保障数据安全与用户隐私成为关键问题。为了对存储在云服务器上的数据进行细粒度的访问控制，密文策略属性基加密（CP-ABE）得到了广泛的应用。然而，现有方案在处理层次化数据和追溯恶意密文方面仍存在不足，难以同时满足高效分级访问和数据来源可信性的需求。为解决这一问题，本文提出一种支持密文可追溯的分层属性基访问控制方案。首先，基于分层CP-ABE框架构建高效的分级访问机制，通过统一具有层次关系的访问策略树，实现不同级别数据在统一访问结构下的加密与解密，显著降低加解密过程中的计算开销。其次，引入基于零知识证明的签名机制，在保障数据拥有者匿名性的前提下，保证密文与其生成者身份进行安全绑定，从而能够准确恢复恶意密文的真实来源。最后，安全性分析表明本方案能有效抵抗选择明文攻击。实验评估表明本方案与现有方案相比具有较低的加解密计算开销，更适用于云环境下安全、高效且可追溯的数据共享场景。