On Key Assignment for Hierarchical Access Control Jason Crampton · Keith Martin · Peter Wild Information Security Group · Royal Holloway · University of London 19th Computer Security Foundations Workshop
Introduction
On Key Assignment for Hierarchical Access Control · Introduction What is hierarchical access control? We assume the existence of a set of users U and a set of objects O , a partially ordered set ( X, � ), and a function λ : U ∪ O → X • λ associates each entity e with a security label λ ( e ) • u ∈ U may access o ∈ O if λ ( u ) � λ ( o ) – Sometimes known as the simple security property – Cornerstone of many military security policies CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Introduction Example X = { unclassified , classified , secret , top secret } unclassified < classified < secret < top secret peter − → t top secret • λ ( peter ) = top secret , λ ( jason ) = classified • peter can read any object secret file . txt − → t secret (including secret file.txt ) • jason can read any unclassified jason − → t classified or classified object (but not secret file.txt ) t unclassified CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Introduction What is a key assignment scheme? Encrypt objects and supply users peter − → t top secret with appropriate keys • Give peter k u , k c , k s and k t secret file . txt − → t secret • Give jason k u and k c Users have to maintain a number jason − → of different keys t classified • Can we do better? t unclassified CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Introduction A simple scheme Use some form of top-down encryption to generate keys from a security label and the key associated with the parent label • Choose k t and define – k s = E k t (“ secret ”) – k c = E k s (“ classified ”) – k u = E k c (“ unclassified ”) • Give peter k t and jason k c One implementation is to hash concatenation of parent key and junior security label Can be extended to a key assignment scheme for trees CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Introduction General problem • How do we handle arbitrary x 1 s � ❅ posets? � ❅ � ❅ • There is not a unique path � ❅ x 2 x 3 s s � ❅ � ❅ from x 1 to x 5 � ❅ � ❅ � ❅ � ❅ � ❅ � ❅ s s s x 4 x 5 x 6 CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Introduction Our motivation There are (too) many schemes in the literature • Rely on specific cryptographic primitives • Do not consider basic requirements and features of key assignment schemes We want to develop an abstract approach to key assignment schemes • Classify existing schemes • Evaluate the respective merits of different types of scheme CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
Key assignment schemes
On Key Assignment for Hierarchical Access Control · Key assignment schemes Basic concepts We assume the existence of a scheme administrator (trusted centre) A key assignment scheme comprises (up to) four algorithms • makeKeys returns a labelled set of encryption keys ( κ ( x ) : x ∈ X ) • makeSecrets returns a labelled set of secret values ( σ ( x ) : x ∈ X ) • makePublicData returns a set of data Pub that is made public by the trusted centre • getKey takes x, y ∈ X , σ ( x ) and Pub and returns κ ( y ) whenever y � x A scheme has independent keys if the keys can be chosen independently of each other and of Pub CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Evaluation criteria • Amount of secret data that needs to be distributed to and stored by end users • Amount of data that needs to be made public • Complexity of key derivation • Complexity of key update (if user leaves or key is compromised) – How much secret data needs to be re-distributed? – How much public data needs to be re-computed? • Resistance to collusion attacks CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Trivial key assignment scheme ✗ High private storage • Independent keys κ ( X ) costs • σ ( x ) = ( κ ( y ) : y � x ) ✓ No public storage • Pub = ∅ ✗ High update costs for • κ ( y ) ∈ σ ( x ) so key derivation is private data trivial ✓ Direct key derivation CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Trivial key encrypting key assignment scheme ✗ High private storage • Independent keys κ ( X ) and set of key encrypting keys K ( X ) costs ✗ High public storage costs • σ ( x ) = ( K ( y ) : y � x ) ✓ Very low costs for • Pub = ( E K ( x ) ( κ ( x )) : x ∈ X ) update of κ ( y ) • κ ( y ) is obtained by decrypting ✗ High costs for update of E K ( y ) ( κ ( y )) ∈ Pub using K ( y ) ∈ σ ( x ) K ( y ) ✓ Direct key derivation CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Direct key encrypting key assignment scheme ✓ Minimizes private • Independent keys κ ( X ) storage costs • σ ( x ) = κ ( x ) ✗ High public storage • Pub = ( E κ ( x ) ( κ ( y )) : y < x ) costs • κ ( y ) is obtained by decrypting • Moderate costs for E κ ( x ) ( κ ( y )) ∈ Pub using κ ( x ) update of private and public data ✓ Direct key derivation CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Iterative key encrypting key assignment scheme ✓ Minimizes private • Independent keys κ ( X ) storage costs • σ ( x ) = κ ( x ) ✓ Minimizes public • Pub = ( E κ ( x ) ( κ ( y )) : y ⋖ x ) storage costs • κ ( y ) is obtained by decrypting • Moderate costs for κ ( z ) for all z on a path from x update of private and to y public data ✗ Iterative key derivation CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Example • TKAS – σ ( x 1 ) = { κ 1 , . . . , κ 6 } x 1 r � ❅ � ❅ • TKEKAS � ❅ x 2 x 3 r r � ❅ � ❅ – σ ( x 1 ) = { K 1 , . . . , K 1 } � ❅ � ❅ � ❅ � ❅ – Pub = { E K 1 ( κ 1 ) , . . . , E K 6 ( κ 6 ) } r r r x 4 x 5 x 6 • DKEKAS – Pub = { E κ 1 ( κ 2 ) , E κ 1 ( κ 3 ) , E κ 1 ( κ 4 ) , . . . } • IKEKAS – Pub = { E κ 1 ( κ 2 ) , E κ 1 ( κ 3 ) , E κ 2 ( κ 4 ) , . . . } CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes IKEKAS example Atallah, Frikken and Blanton ( CCS 2005) • Pub = { κ ( y ) − h ( κ ( x ) , y ) : y ⋖ x } , h is a hash function • User with security label x can recover κ ( y ) by computing h ( κ ( x ) , y ) CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Node-based key assignment scheme • Pub ⊇ ( e ( x ) : x ∈ X ) • κ ( x ) = f ( e ( x )) – f is a secret function – There exists a public algorithm g such that g ( f ( e ( x )) , e ( x ) , e ( y )) = g ( κ ( x ) , e ( x ) , e ( y )) = κ ( y ) is feasible to compute if and only y � x • By construction κ ( y ) can be derived (directly) from κ ( x ) (using g ) • Dependent keys ( κ ( x ) = f ( e ( x ))) CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Example Akl and Taylor ( ACM Trans. Comp. Sys. , 1983) • Pub = { n } ∪ ( e ( x ) : x ∈ X ) – n = pq , p and q are large primes – e : X → N such that e ( x ) | e ( y ) if and only if y � x • κ ( x ) = s e ( x ) mod n , where s ∈ Z ∗ n is a system secret e ( y ) e ( x ) = s e ( y ) – Note that ( s e ( x ) ) e ( y ) – Hence κ ( y ) = ( κ ( x )) e ( x ) – It is only feasible to compute κ ( y ) if y � x (on the assumption that it is difficult to compute integral roots modulo n ) • Usual to choose e ( x ) = � y � � x p ( x ), where p ( x ) is a prime CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
On Key Assignment for Hierarchical Access Control · Key assignment schemes Characteristics of (simplified) Akl-Taylor scheme ✓ Low private storage • Moderate public storage ✓ Update of public information is very simple ✗ Update of secret information worse than IKEKAS ✓ Direct key derivation ✗ Exponentiation required CSFW · 5 July 2006 · Venice Jason Crampton · Keith Martin · Peter Wild
Conclusion
Recommend
More recommend
