信息网络安全

信息网络安全 ›› 2026, Vol. 26 ›› Issue (2): 315-324.doi: 10.3969/j.issn.1671-1122.2026.02.011

• 技术研究 • 上一篇    下一篇

基于可信执行环境的层次角色基分级加密方案

赵佳1(), 王妍淳1, 马洪亮2, 李琪3   

  1. 1.北京交通大学智能交通数据安全与隐私保护技术实验室， 北京 100044
    2.计算智能与网络信息安全兵团重点实验室， 石河子 832003
    3.中国铁道科学研究院集团有限公司电子计算技术研究所， 北京 100081
  • 收稿日期:2025-04-23 出版日期:2026-02-10 发布日期:2026-02-23
  • 通讯作者: 赵佳 zhaojia@bjtu.edu.cn
  • 作者简介:赵佳（1980—），女，内蒙古，副教授，博士，CCF会员，主要研究方向为隐私保护、密码学|王妍淳（2001—），女，河北，硕士研究生，主要研究方向为隐私保护|马洪亮（1977—），男，新疆，副教授，博士，主要研究方向为网络安全、大数据安全、异常检测|李琪（1987—），女，北京，高级工程师，硕士，主要研究方向为网络安全测评、数据安全管理
  • 基金资助:
    国家重点研发计划(2023YFB2703702);国铁集团科技研究开发计划(P2023W001);计算智能与网络信息安全兵团重点实验室开放课题(CS24GY00010)

Hierarchical Role-Based Encryption Scheme Based on Trusted Execution Environment

ZHAO Jia1(), WANG Yanchun1, MA Hongliang2, LI Qi3   

  1. 1. Intelligent Trafic Data Security and Privacy Protection Technology Laboratory, Beijing Jiaotong University, Beijing 100044, China
    2. Xinjiang Production and Construction Corps Key Laboratory of Computing Intelligence and Network Information Security, Shihezi 832003, China
    3. Institute of Computing Technologies, China Academy of Railway Sciences Group Co., Ltd., Beijing 100081, China
  • Received:2025-04-23 Online:2026-02-10 Published:2026-02-23

RichHTML

3

PDF (PC)

13

摘要：

文章提出一种基于可信执行环境的层次角色基分级加密方案，以解决现有加密技术在数据敏感性保护和运行时的安全问题。该方案结合了层次角色基加密技术和可信计算，根据数据敏感性选择不同层次的角色公钥进行加密，实现对数据访问权限和敏感性要求的动态匹配。对于一般性数据，采用深层节点的角色密钥进行加密；对于高度敏感数据，使用靠近根节点的浅层节点的角色密钥进行加密。此外，该方案将加密操作和密钥管理操作置于可信执行环境中，可有效防止加密密钥和敏感数据被窃取或篡改，弥补了传统加密方案在系统运行时防护能力差的不足。同时，该方案结合可信执行环境的硬件隔离特性和层次角色基加密技术，不仅提升了系统的抗攻击能力，还实现了更精细的权限管理。实验结果表明，该方案在保证数据安全的同时具有较高的计算效率。

关键词: 数据加密, 身份基加密, 可信执行环境, Intel SGX

Abstract:

This paper proposed a hierarchical role-based encryption scheme based on trusted execution environment to address the shortcomings of existing encryption technologies in data sensitivity protection and runtime security. The scheme combined hierarchical role-based encryption with trusted computing, dynamically matching data access permissions and sensitivity requirements by selecting different levels of role public keys for encryption based on data sensitivity. For general data, encryption was performed using keys from deeper-level nodes, while for highly sensitive data, keys from shallow-level nodes closer to the root were used. Furthermore, encryption operations and key management were carried out within the trusted execution environment, ensuring that encryption keys and sensitive data were not compromised or tampered with during processing, effectively addressing the shortcomings of conventional encryption schemes in runtime protection. Additionally, by leveraging the hardware isolation characteristics of trusted execution environment and hierarchical role-based encryption, the system enhanced its resistance to attacks and implemented more refined access control management. Experimental results demonstrate that the proposed scheme not only ensures data security but also offers high efficiency.

Key words: data encryption, identity-based encryption, trusted execution environment, Intel SGX

中图分类号: