资源授权决策是协作信息系统面临的首要安全问题。首先结合角色、时态和环境的概念,介绍了行为的含义和基于行为的访问控制模型ABAC(action-based access control model),然后基于ABAC模型,给出了协作信息系统访问控制机制的流程;提出...资源授权决策是协作信息系统面临的首要安全问题。首先结合角色、时态和环境的概念,介绍了行为的含义和基于行为的访问控制模型ABAC(action-based access control model),然后基于ABAC模型,给出了协作信息系统访问控制机制的流程;提出了包含用户请求、用户身份、口令、角色、时态状态、环境状态、生命期等安全属性的安全关联及其产生方法;给出了一种安全认证协议,使用此协议可以实现用户与行为服务器、资源管理服务器之间交换与ABAC模型相关的安全属性,并使用UC模型证明该协议的安全性。展开更多
Despite that existing data sharing systems in online social networks （OSNs） propose to encrypt data before sharing, the multiparty access control of encrypted data has become a challenging issue. In this paper, we p...Despite that existing data sharing systems in online social networks （OSNs） propose to encrypt data before sharing, the multiparty access control of encrypted data has become a challenging issue. In this paper, we propose a secure data sharing scheme in 0SNs based on ciphertext-policy attribute- based proxy re-encryption and secret sharing. In order to protect users＇ sensitive data, our scheme allows users to customize access policies of their data and then outsource encrypted data to the OSNs service provider. Our scheme presents a multiparty access control model, which enables the disseminator to update the access policy of ciphertext if their attributes satisfy the existing access policy. Further, we present a partial decryption construction in which the computation overhead of user is largely reduced by delegating most of the decryption operations to the OSNs service provider. We also provide checkability on the results returned from the OSNs service provider to guarantee the correctness of partial decrypted ciphertext. Moreover, our scheme presents an efficient attribute revocation method that achieves both forward and backward secrecy. The security and performance analysis results indicate that the proposed scheme is secure and efficient in OSNs.展开更多
文摘资源授权决策是协作信息系统面临的首要安全问题。首先结合角色、时态和环境的概念,介绍了行为的含义和基于行为的访问控制模型ABAC(action-based access control model),然后基于ABAC模型,给出了协作信息系统访问控制机制的流程;提出了包含用户请求、用户身份、口令、角色、时态状态、环境状态、生命期等安全属性的安全关联及其产生方法;给出了一种安全认证协议,使用此协议可以实现用户与行为服务器、资源管理服务器之间交换与ABAC模型相关的安全属性,并使用UC模型证明该协议的安全性。
基金This work has been supported by the National Natural Science Foundation of China under Grant No.61272519,the Specialized Research Fund for the Doctoral Program of Higher Education under Grant No.20120005110017,and the National Key Technology R&D Program under Grant No.2012BAH06B02
文摘Despite that existing data sharing systems in online social networks （OSNs） propose to encrypt data before sharing, the multiparty access control of encrypted data has become a challenging issue. In this paper, we propose a secure data sharing scheme in 0SNs based on ciphertext-policy attribute- based proxy re-encryption and secret sharing. In order to protect users＇ sensitive data, our scheme allows users to customize access policies of their data and then outsource encrypted data to the OSNs service provider. Our scheme presents a multiparty access control model, which enables the disseminator to update the access policy of ciphertext if their attributes satisfy the existing access policy. Further, we present a partial decryption construction in which the computation overhead of user is largely reduced by delegating most of the decryption operations to the OSNs service provider. We also provide checkability on the results returned from the OSNs service provider to guarantee the correctness of partial decrypted ciphertext. Moreover, our scheme presents an efficient attribute revocation method that achieves both forward and backward secrecy. The security and performance analysis results indicate that the proposed scheme is secure and efficient in OSNs.
