Preliminaries A bounded asynchronous Cryptographically-Enforced Hierarchical scheme An unbounded Access Control with Multiple Keys asynchronous scheme Concluding remarks Jason Crampton Questions Information Security Group Royal Holloway, University of London NordSec 2007
Hierarchical access control Preliminaries A bounded asynchronous scheme An unbounded Given asynchronous a scheme ◮ a partially ordered set of security Concluding remarks labels ( L , � ) Questions b c ◮ a function λ mapping users and protected objects to L we require that a user u can only read d o if λ ( u ) � λ ( o ) L
Cryptographic hierarchical access control Preliminaries A bounded asynchronous Useful for third-party data publishing scheme ◮ Data is made available by someone other than data owner An unbounded asynchronous scheme Concluding remarks Questions
Cryptographic hierarchical access control Preliminaries A bounded asynchronous Useful for third-party data publishing scheme ◮ Data is made available by someone other than data owner An unbounded asynchronous scheme Trivial solution Concluding ◮ Encrypt o with k ( o ) remarks Questions ◮ Send { k ( y ) : y � λ ( u ) } to u
Cryptographic hierarchical access control Preliminaries A bounded asynchronous Useful for third-party data publishing scheme ◮ Data is made available by someone other than data owner An unbounded asynchronous scheme Trivial solution Concluding ◮ Encrypt o with k ( o ) remarks Questions ◮ Send { k ( y ) : y � λ ( u ) } to u Preferably ◮ Encrypt o with k ( o ) ◮ Send k ( λ ( u )) to u
Cryptographic hierarchical access control Preliminaries A bounded asynchronous Useful for third-party data publishing scheme ◮ Data is made available by someone other than data owner An unbounded asynchronous scheme Trivial solution Concluding ◮ Encrypt o with k ( o ) remarks Questions ◮ Send { k ( y ) : y � λ ( u ) } to u Preferably ◮ Encrypt o with k ( o ) ◮ Send k ( λ ( u )) to u ◮ Publish additional (encrypted) information enabling u to derive k ( y ) for all y � k ( λ ( u ))
Iterative key assignment schemes Preliminaries A bounded asynchronous The data owner scheme ◮ chooses k ( y ) at random from the key space An unbounded asynchronous scheme Concluding remarks Questions
Iterative key assignment schemes Preliminaries A bounded asynchronous The data owner scheme ◮ chooses k ( y ) at random from the key space An unbounded asynchronous ◮ publishes { E k ( x ) ( k ( y )) : y ⋖ x , x , y ∈ L } scheme ◮ y ⋖ x denotes that y is an immediate child of x in L Concluding remarks ◮ E k ( m ) denotes the encryption of message m with key k Questions
Iterative key assignment schemes Preliminaries A bounded asynchronous The data owner scheme ◮ chooses k ( y ) at random from the key space An unbounded asynchronous ◮ publishes { E k ( x ) ( k ( y )) : y ⋖ x , x , y ∈ L } scheme ◮ y ⋖ x denotes that y is an immediate child of x in L Concluding remarks ◮ E k ( m ) denotes the encryption of message m with key k Questions ◮ Sends k ( λ ( u )) to user u
Iterative key assignment schemes Preliminaries A bounded asynchronous The data owner scheme ◮ chooses k ( y ) at random from the key space An unbounded asynchronous ◮ publishes { E k ( x ) ( k ( y )) : y ⋖ x , x , y ∈ L } scheme ◮ y ⋖ x denotes that y is an immediate child of x in L Concluding remarks ◮ E k ( m ) denotes the encryption of message m with key k Questions ◮ Sends k ( λ ( u )) to user u The user obtains ◮ k ( y ), y ⋖ λ ( u ), by decrypting the appropriate datum of public information
Iterative key assignment schemes Preliminaries A bounded asynchronous The data owner scheme ◮ chooses k ( y ) at random from the key space An unbounded asynchronous ◮ publishes { E k ( x ) ( k ( y )) : y ⋖ x , x , y ∈ L } scheme ◮ y ⋖ x denotes that y is an immediate child of x in L Concluding remarks ◮ E k ( m ) denotes the encryption of message m with key k Questions ◮ Sends k ( λ ( u )) to user u The user obtains ◮ k ( y ), y ⋖ λ ( u ), by decrypting the appropriate datum of public information ◮ k ( y ), y < λ ( u ), by iteratively decrypting keys on some path between λ ( u ) and y
Problem statement and motivation Preliminaries A bounded asynchronous scheme An unbounded Design a hierarchical key assignment scheme that supports asynchronous scheme multiple keys for each security label Concluding ◮ Minimize public storage remarks Questions ◮ Minimize number of keys distributed to users
Problem statement and motivation Preliminaries A bounded asynchronous scheme An unbounded Design a hierarchical key assignment scheme that supports asynchronous scheme multiple keys for each security label Concluding ◮ Minimize public storage remarks Questions ◮ Minimize number of keys distributed to users Such schemes are useful for ◮ supporting lazy re-encryption ◮ enforcing hierarchical access control policies
Design decisions Preliminaries A bounded asynchronous scheme An unbounded asynchronous ◮ Is the number of updates determined in advance? scheme If yes, we say the scheme is bounded (and unbounded Concluding remarks otherwise) Questions ◮ Can the key for label x be updated independently of the one for y? If yes, we say the scheme is asynchronous (and synchronous otherwise)
Preliminaries Preliminaries A bounded asynchronous scheme An unbounded asynchronous A bounded asynchronous scheme scheme Concluding remarks Questions An unbounded asynchronous scheme Concluding remarks Questions
Illustration Preliminaries A bounded asynchronous scheme Initial security lattice – one key per label An unbounded asynchronous scheme Concluding remarks Questions a b c d
Illustration Preliminaries A bounded asynchronous scheme k ( d ) is updated – two keys for d An unbounded asynchronous scheme Concluding remarks a Questions a b c b c d d
Illustration Preliminaries A bounded asynchronous scheme k ( b ) is updated – two keys for b , three for d An unbounded asynchronous scheme a Concluding remarks a Questions b c a b c d b c d d
Basic approach Preliminaries A bounded asynchronous scheme An unbounded There are two “orthogonal” dimensions to the problem asynchronous scheme ◮ The set of security labels L Concluding remarks ◮ Temporal – a chain of keys associated with each element Questions of L
Basic approach Preliminaries A bounded asynchronous scheme An unbounded There are two “orthogonal” dimensions to the problem asynchronous scheme ◮ The set of security labels L Concluding remarks ◮ Temporal – a chain of keys associated with each element Questions of L One solution is to ◮ construct an iterative key assignment scheme for L ◮ define a “key chain” for the temporal dimension
Hash chain solution For a bounded scheme there are at most m keys for each label Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions
Hash chain solution For a bounded scheme there are at most m keys for each label Preliminaries A bounded ◮ Define an iterative key assignment scheme for L asynchronous scheme ◮ For each x ∈ L An unbounded ◮ choose a key k m ( x ) from { 0 , 1 } l asynchronous scheme ◮ define k i − 1 ( x ) = h ( k i ( x )), where h : { 0 , 1 } ∗ → { 0 , 1 } l is a Concluding suitable (public) hash function remarks Questions
Hash chain solution For a bounded scheme there are at most m keys for each label Preliminaries A bounded ◮ Define an iterative key assignment scheme for L asynchronous scheme ◮ For each x ∈ L An unbounded ◮ choose a key k m ( x ) from { 0 , 1 } l asynchronous scheme ◮ define k i − 1 ( x ) = h ( k i ( x )), where h : { 0 , 1 } ∗ → { 0 , 1 } l is a Concluding suitable (public) hash function remarks ◮ When the key for label x needs to be changed Questions ◮ select the next key for each label y � x ◮ update public information for L ’s scheme
Hash chain solution For a bounded scheme there are at most m keys for each label Preliminaries A bounded ◮ Define an iterative key assignment scheme for L asynchronous scheme ◮ For each x ∈ L An unbounded ◮ choose a key k m ( x ) from { 0 , 1 } l asynchronous scheme ◮ define k i − 1 ( x ) = h ( k i ( x )), where h : { 0 , 1 } ∗ → { 0 , 1 } l is a Concluding suitable (public) hash function remarks ◮ When the key for label x needs to be changed Questions ◮ select the next key for each label y � x ◮ update public information for L ’s scheme ◮ A user with security label x can ◮ compute the current key for y < x from the public information for L ◮ iteratively compute hashes of y ’s key until the key for the desired time period is obtained
Recommend
More recommend
