面向发布-订阅系统的多级安全访问控制方案

Multi-Level Security Access Control Scheme for Publish-Subscribe Systems

当前的访问控制方案难以满足发布-订阅系统的多级安全需求.一方面存在高安全级数据泄露给低安全级订阅者的风险;另一方面,由于密钥总数随着用户数的增长而迅速增加,密钥管理面临更大的挑战.为此,本文提出了一个面向发布-订阅系统的多级安全访问控制方案.首先,结合EMDK和HKAS设计了多级密钥分配机制,基于该机制实现了对发布数据的多级安全访问控制以及灵活且可扩展的密钥管理.其次,采用签密算法批量分发同一安全级的授权信息和加密密钥,保证安全性的同时提高分发效率.最后,对所提出的方案进行安全性和性能分析,结果表明所提方案能够实现静态敌手下的密钥不可区分性,并且有效降低了密钥分发的计算开销.

Existing access control schemes can hardly meet the multi-level security requirements of publish-subscribe systems.On the one hand,there is a leakage risk of data with high level security to subscribers with low level security.On the other hand,as the total number of keys increases rapidly when the number of security levels increases,key management faces even greater challenges,and hierarchical key assignment scheme provides a viable solution for solving this problem.This paper proposes a multi-level security access control scheme for publish-subscribe systems.Firstly,combining EMDK and HKAS,a multi-level key assignment mechanism is designed,which enables multi-level security access control of published data with flexible and scalable key management.Secondly,a signcryption algorithm is used to distribute the authorization information and encryption key of the same security class in batches,which ensures the security and improves the distribution efficiency.The security and performance analysis of the proposed scheme show that,the proposed scheme can achieve key indistinguishability under static adversaries,and effectively reduce the computational cost of key assignment.