A General Attribute and Rule Based Role-Based Access Control Model

Growing numbers of users and many access control policies which involve many different resource attributes in service-oriented environments bring various problems in protecting resource.This paper analyzes the relationships of resource attributes to user attributes in all policies, and propose a general attribute and rule based role-based access control(GAR-RBAC) model to meet the security needs. The model can dynamically assign users to roles via rules to meet the need of growing numbers of users. These rules use different attribute expression and permission as a part of authorization constraints, and are defined by analyzing relations of resource attributes to user attributes in many access policies that are defined by the enterprise. The model is a general access control model, and can support many access control policies, and also can be used to wider application for service. The paper also describes how to use the GAR-RBAC model in Web service environments.

General Attribute Based RBAC Model for Web Services

Growing numbers of users and many access policies that involve many different resource attributes in service-oriented environments cause various problems in protecting resource. This paper analyzes the relationships of resource attributes to user attributes based on access policies for Web services, and proposes a general attribute based role-based access control（GARBAC） model. The model introduces the notions of single attribute expression, composite attribute expression, and composition permission, defines a set of elements and relations among its elements and makes a set of rules, assigns roles to user by inputing user＇s attributes values. The model is a general access control model, can support more granularity resource information and rich access control policies, also can be used to wider application for services. The paper also describes how to use the GARBAC model in Web services environments.

Attribute-Based Secure Data Sharing with Efficient Revocation in Fog Computing

Fog computing is a concept that extends the paradigm of cloud computing to the network edge. The goal of fog computing is to situate resources in the vicinity of end users. As with cloud computing, fog computing provides storage services. The data owners can store their confidential data in many fog nodes, which could cause more challenges for data sharing security. In this paper, we present a novel architecture for data sharing in a fog environment. We explore the benefits of fog computing in addressing one-to-many data sharing applications. This architecture sought to outperform the cloud-based architecture and to ensure further enhancements to system performance, especially from the perspective of security. We will address the security challenges of data sharing, such as fine-grained access control, data confidentiality, collusion resistance, scalability, and the issue of user revocation. Keeping these issues in mind, we will secure data sharing in fog computing by combining attributebased encryption and proxy re-encryption techniques. Findings of this study indicate that our system has the response and processing time faster than classical cloud systems. Further, experimental results show that our system has an efficient user revocation mechanism, and that it provides high scalability and sharing of data in real time with low latency.

访问控制日志驱动的ABAC策略自动提取与优化增强

为解决基于属性的访问控制(ABAC)策略自动提取的低质量问题,提出一种基于访问控制日志驱动的ABAC策略自动提取与优化增强方法。首先,构建集成学习模型,将用户行为和权限分配映射为策略逻辑树,识别访问授权决策的关联性及潜在规律,初步生成策略;其次,通过单属性优化和规则二元约简两种方法深度优化策略,简化策略结构并压缩策略规模;最后,提出基于误差度量的规则冲突解决方法,以增强互斥、完备的ABAC策略,并进一步基于多目标优化的策略性能平衡算法实现不同场景需求的最优模型选择。分别在平衡数据集和稀疏数据集上进行测试和验证,实验结果表明,该方法在平衡数据集上的准确性最高可达96.69%,可将策略规模压缩至原来的19.7%。在稀疏数据集上的准确性最高可达87.74%,可将策略规模压缩至原来的23%。此方法兼顾策略的预测精度与结构的简洁性,同时适用于平衡日志和稀疏日志,确保访问控制系统在实际应用中能够实现高效、安全的访问授权管理。

Hybrid Cloud Security by Revocable KUNodes-Storage with Identity-Based Encryption

Cloud storage is a service involving cloud service providers providingstorage space to customers. Cloud storage services have numerous advantages,including convenience, high computation, and capacity, thereby attracting usersto outsource data in the cloud. However, users outsource data directly via cloudstage services that are unsafe when outsourcing data is sensitive for users. Therefore, cipher text-policy attribute-based encryption is a promising cryptographicsolution in a cloud environment, and can be drawn up for access control by dataowners (DO) to define access policy. Unfortunately, an outsourced architectureapplied with attribute-based encryption introduces numerous challenges, including revocation. This issue is a threat to the data security of DO. Furthermore,highly secure and flexible cipher text-based attribute access control with role hierarchy user grouping in cloud storage is implemented by extending the KUNodes(revocation) storage identity-based encryption. Result is evaluated using Cloudsim, and our algorithm outperforms in terms of computational cost by consuming32 MB for 150-MB files.

一种ABAC静态策略冲突检测算法

在分布式计算环境下,传统基于属性的静态访问控制策略多存在扩展性差、难以实现等问题。针对上述问题,提出一种基于策略属性分解的冲突检测算法。该算法对策略属性进行分解,构造策略属性分解图,判断策略属性值之间的相交关系,根据静态策略冲突的定义进行策略冲突检测,从而提高策略冲突检测算法的可扩展性和易实现性。实验结果表明,该算法对静态策略冲突的检测率接近85%。

基于改进CP-ABE算法的ABAC机制研究

为解决基于属性的访问控制(ABAC)机制下的数据安全问题,从访问体系结构和形式化定义两方面对ABAC机制进行研究,并进行了仿真和性能分析。通过与传统CP-ABE算法进行比较,提出一种适用于ABAC环境的改进CP-ABE算法,给出了改进算法的形式化定义。与传统CP-ABE算法相比,该算法在ABAC环境下具有更低的存储消耗和更高的效率。

基于日志的富语义ABAC 策略挖掘

为了解决大规模环境下的细粒度访问控制问题,挖掘出易于人工阅读、契合主体行为模式、精确完备的基于属性的访问控制(ABAC)策略,从而为安全管理员进行策略构建、维护和优化提供有力支撑,提出基于日志的富语义ABAC策略挖掘方法.该方法基于频繁模式挖掘算法,从访问日志和属性数据中挖掘契合主体行为模式的ABAC策略.对策略进行正确性和语义质量分析获得富语义ABAC策略集.通过交叉验证方法对策略集的精确性和完备性进行验证,算法在公开数据集上的F1得分为0.8375,在手写数据集上的F1得分为0.9394.在手写数据集上的验证表明,算法可以在较小训练集上得到比现有算法更高质量的策略集,所得授权规则在易读性方面有所提升.

ABAC策略语义表示和决策方法

为解决开放式系统环境中基于属性的访问控制(Attribute-Based Access Control,ABAC)策略语义层次上的表示和决策问题,提出了ABAC策略的本体表示方法。该方法基于ABAC策略模型到描述逻辑定义的映射,使用语义Web规则语言(SWRL)处理系统内部关系定义。在此基础上,提出了基于封闭世界和实例实现推理的策略决策框架。最后从可靠性和完备性两方面说明了决策方法的正确性,验证实验表明了方法在实际应用中的适用性。

基于多优化技术的ABAC模型

为应对开放网络环境以及跨域访问的需求,提出一种基于属性的访问控制概念。针对此概念设计一种多优化技术的ABAC(Attribute Based Access Control)模型。采用XACML(extensible access control markup language)标准实现了ABAC模型,在进行属性检索和策略检索时引入业务逻辑,以业务为索引值建立索引机制,加快属性和策略检索的匹配效率,并在策略评估时加入了缓存机制,进一步提高评估效率。仿真实验的结果表明该模型的效率与传统ABAC模型相比具有优势。

一种ABAC中合理属性值指派计算方法

为实体(如用户、主体、客体等)指派合理的属性值是基于属性的访问控制模型实施与安全性的关键.针对现有属性管理权限委派中在属性值划分上缺乏相应客观依据及方法,提出一个基于有向图的属性值计算方法.该方法把来自一个属性内或多个属性之间的关系定义为前提关系,构造得到一个以属性为顶点、前提关系为有向边的有向图.该方法计算属性值的过程分为三步,首先,搜索有向图中与目标属性相关的所有前提关系;第二步,代入属性值确定各个前提关系对目标属性的函数约束;第三步,按照目标属性的函数约束形式分为三种分别聚合,计算得到属性值满足的函数.实验结果验证其与一般的计算方法相比,平均时间加速比可达到3倍以上.

一种ABAC中属性有向图冲突最优化消解方法

提出了一种优化算法来处理ABAC中属性有向图冲突消解问题。首先形式化描述了属性有向图冲突最优化消解问题,一是属性关系参与冲突数越多越可能被删除,二是越重要的属性关系越应该得以保留;然后建立冲突与权重之间的代价函数,选择并删除代价最大的属性关系,直到消解所有的冲突才停止,得到无冲突状态下有向图上的最大权重和。仿真结果表明,算法能够有效地得到权重和最优的属性有向图。

Generic attribute revocation systems for attribute-based encryption in cloud storage

Attribute-based encryption(ABE) has been a preferred encryption technology to solve the problems of data protection and access control, especially when the cloud storage is provided by third-party service providers.ABE can put data access under control at each data item level. However, ABE schemes have practical limitations on dynamic attribute revocation. We propose a generic attribute revocation system for ABE with user privacy protection. The attribute revocation ABE(AR-ABE) system can work with any type of ABE scheme to dynamically revoke any number of attributes.

Flexible CP-ABE Based Access Control on Encrypted Data for Mobile Users in Hybrid Cloud System

In hybrid cloud computing, encrypted data access control can provide a fine-grained access method for organizations to enact policies closer to organizational policies. This paper presents an improved CP-ABE (ciphertext-policy attribute-based encryption) scheme to construct an encrypted data access control solution that is suitable for mobile users in hybrid cloud system. In our improvement, we split the original decryption keys into a control key, a secret key and a set of transformation keys. The private cloud managed by the organization administrator takes charge of updating the transformation keys using the control key. It helps to handle the situation of flexible access management and attribute alteration. Meanwhile, the mobile user's single secret key remains unchanged as well as the ciphertext even if the data user's attribute has been revoked. In addition, we modify the access control list through adding the attributes with corresponding control key and transformation keys so as to manage user privileges depending upon the system version. Finally, the analysis shows that our scheme is secure, flexible and efficient to be applied in mobile hybrid cloud computing.

Generic user revocation systems for attribute-based encryption in cloud storage

Cloud-based storage is a service model for businesses and individual users that involves paid or free storage resources. This service model enables on-demand storage capacity and management to users anywhere via the Internet. Because most cloud storage is provided by third-party service providers, the trust required for the cloud storage providers and the shared multi-tenant environment present special challenges for data protection and access control. Attribute-based encryption(ABE) not only protects data secrecy, but also has ciphertexts or decryption keys associated with fine-grained access policies that are automatically enforced during the decryption process. This enforcement puts data access under control at each data item level. However, ABE schemes have practical limitations on dynamic user revocation. In this paper, we propose two generic user revocation systems for ABE with user privacy protection, user revocation via ciphertext re-encryption(UR-CRE) and user revocation via cloud storage providers(UR-CSP), which work with any type of ABE scheme to dynamically revoke users.

Attribute-Based Signature with Policy-and-Endorsement Mechanism

In this paper a new signature scheme,called Policy-Endorsing Attribute-Based Signature,is developed to correspond with the existing Ciphertext-Policy Attribute-Based Encryption.This signature provides a policy-and-endorsement mechanism.In this mechanism a single user,whose attributes satisfy the predicate,endorses the message.This signature allows the signer to announce his endorsement using an access policy without having to reveal the identity of the signer.The security of this signature,selfless anonymity and existential unforgeability,is based on the Strong Diffie-Hellman assumption and the Decision Linear assumption in bilinear map groups.

支持动态策略变化的ABAC决策回收

基于属性的访问控制(Attribute-Based Access Control,ABAC)因其灵活、表达能力丰富等特性,成为最常见的访问控制模型之一。然而,ABAC的策略决策点(Policy Decision Point,PDP)繁琐的策略查询任务以及PDP与策略执行点(Policy Enforcement Point,PEP)之间的网络通信影响其访问控制决策的效率。访问控制决策结果的回收利用是解决以上问题的有效方法之一。本文提出一种支持访问控制策略动态变化的、带策略的ABAC访问控制决策结果的回收利用方案。方案针对ABAC的3种变体模型给出如何创建和更新访问控制决策结果的缓存、如何由缓存内容进行精确和近似的访问控制决策。最终,通过原型系统对方案的可行性和有效性进行实验验证,实验结果显示本文提出的方法一定程度上能降低系统的访问控制决策时间并减少PDP的工作负荷。

可撤销属性加密的区块链数据访问控制方法

针对区块链数据共享中存在的粗粒度访问控制问题,提出一种基于属性撤销密文策略属性基加密的区块链数据访问控制方法。在现有方案基础上进行改造,引入预解密过程,结合属性撤销列表实现属性实时撤销;基于非对称群下的DBDH困难问题假设进行安全性证明;基于超级账本Fabric进行系统设计,结合星际文件系统采用链上链下存储方式解决区块链容量不足和系统效率问题。实验结果表明,所提方案撤销属性时无需更新密钥密文重复上链,仅需要6次Pairing操作进行预解密和解密,且在大规模属性集下,预解密时间和解密时间平均保持在百毫秒左右的常量级上,实现区块链数据高效、细粒度的访问控制。

面向物联网的基于智能合约与CP-ABE的访问控制方案

随着物联网设备数量激增,传统的集中式访问控制方案在面对当前大规模物联网环境时显得力不从心,现有的分布式访问控制方案存在高货币成本和处理访问请求的低吞吐量等问题。针对这些问题提出一种区块链智能合约结合密文策略属性基加密(ciphertext policy attribute based encryption,CP-ABE)实现对物联网资源的访问控制方案。以超级账本(Hyperledger Fabric)为底层网络,对功能令牌执行属性基加密,利用星际文件系统(interplanetary file system,IPFS)保存令牌密文,通过智能合约公开令牌获取地址实现一对多授权。进一步设计合约部署到区块链实现对令牌请求的去中心化权限评估,维护主体在特定资源对象上允许的操作,实现更为细粒度的属性访问控制。仿真实验及性能分析表明,所提方案与现有方案相比能够使数据所有者在更短的时间内完成对大量请求主体的安全访问授权,压力测试表明链码具有较好性能。

支持策略检索的属性基可搜索加密方案

为解决现有属性基可搜索加密方案仅支持单关键词检索或联合多关键词检索的问题,提升用户检索的灵活性,提出一种支持策略检索的属性基可搜索加密方案。使用LSSS(linear secret sharing schemes)技术构造用户检索陷门,支持任意单调布尔公式表示的搜索策略。结合属性加密实现对密文细粒度的访问控制。通过与现有方案进行计算和存储效率的对比分析,并进行实验仿真,结果表明,提出的方案在效率和安全性方面均有显著提升。