1 / 21

DACC: Distributed Access Control in Clouds

DACC: Distributed Access Control in Clouds. 2011 IEEE TrustCom-11 Sushmita Ruj Amiya Nayak and Ivan Stojmenovic. 2013.04.29 Regular Seminar Tae Hoon Kim. Contents. 1. Introduction 2. Related work 3. Background A. Model and assumptions B. Formats of access policies

said
Download Presentation

DACC: Distributed Access Control in Clouds

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. DACC: Distributed Access Control in Clouds 2011 IEEE TrustCom-11 SushmitaRuj AmiyaNayak and Ivan Stojmenovic 2013.04.29 Regular Seminar Tae Hoon Kim

  2. Contents 1. Introduction 2. Related work 3. Background A. Model and assumptions B. Formats of access policies C. Mathmatical background D. Lewko-Waters ABE Scheme 4. Proposed scheme: DACC 5. Security of DACC 6. Performance 7. Conclusion and Future work

  3. Introduction • Cloud is emerging technology • User only require a terminal, a smart phone, table connected internet • User can rent the storage, computing resources of a server provided by a company • Application services • e.g) Google Apps, Microsoft online • Infrastructural support • e.g)Amazon’s EC2, Eucalyptus, Nimbus • Platform • e.g)Amazon’s S3, Windows Azure

  4. Introduction • Two important to preserve • security of data • In cloud, Users trying to access data • privacy of users • Only services are authorized user • Using public key cryptographic techniques • User should ensure that • The cloud is not tampering with user’s data and computational results

  5. Introduction • Method of not tampering user data & computational results • Hide the data from the clouds • Use of homomorphic encryption techniques[9][10] • Code obfuscation[11] • Important problem : Anonymously search data in Cloud(range, multidimensional, complex queries) • Is achieved searchable encryption[12][13] • Takes keywords in encrypted form and return results Without knowing the keyword or the retrieved records

  6. Introduction • Consider following scenarios • Patients store their medical records in cloud • Different users can access different data field • The same data fields might be accessed by a selective group of people(authorized set) • Example)the patient’s medical history and drug administration can be accessed by doctors and nurses, but not by hospital management staff • Access Control : Granting access rights to certain users and forbidding other users to access data

  7. Introduction • Method of granting access • To attach list of all valid users to data • problem : 1. Each time the list has to be checked to see if user is valid -> huge computation and storage cost • To encrypt data is by using public keys of valid users • Problem : 1. The same data then must be encryptedseveral times -> may result in huge storage cost • ABE(Attribute Based Encryption) : owners encrypted data with attributes that they possess and store the information in the clouds

  8. Introduction • KDC(Key Distributed Center) • Users are given attributes and secret keys by KDC • Set of attributes are able to decrypt the information • E.g)(A, doctor, Key), (B, doctor, Key), (A, staff, Key) (A, patient, Key)(C, doctor, Key) • Earlier work[17] : owners encrypt data with attributes(Not requried KDC) • Problem : increase the total number of secret keys given to users->increases storage and communication overhead • In this paper, proposes DACC is • Cloud has cipher text(unable to decrypt cipher text) • Owner decide on attributes that users should have and users receive decryption keys • KDC distributes secret keys to user

  9. Related work • Sahai and Waters[19] ABE • A user has a set of attributes in addition to its unique ID • Shamir[20] IBE(Identity-based-encryption) • Each user in IBE scheme has a unique identity • Bethencourt et al,. [21] Ciphertext-policy • Receiver has the access policy in the form of a tree, with attributes as leaves and monotonic access structure with AND, OR and other threshold gates.

  10. Related work • KDC(attribute authority) is assumed to be honest • May not hold; a distributed system, authorities can fail or be corrupt • Chase[23] multi-authority ABE • Distribute attribute, and secret keys to users • Wang et al[26],. Hierarchical access control mechanism • Relies on Bethencoure et al[21], and Hierarchical IBE[27]

  11. Background A. Model and assumptions KDCs which may be even servers scattered in different countries, that generate secret keys for the users Assume that the cloud is honest but curious

  12. Background :B. Format of access policies • Two format of access policies • Boolean functions of attribute • ( (a1a2 a3) (a4 a5) (a6 a7) ) • (a1, a2.. A7) : attributes • Be represented by access tree with attributes at the leaves and ANDand OR • Linear Secret Sharing Scheme(LSSS) • Let V[x] be parent’s vector, • If node x = AND then the left child is (V[x]|1), and the right child is (0,…-1). • If x= OR then both children also have unchanged vector V[x]

  13. Background : C. D. • C. Mathematical background • Use bilinear pairings on elliptic curves • D. Lewko-Waters ABE scheme • Consist of four steps • 1)System Initialization • 2)Key and attribute distribution to users by KDCs • 3)Encryption of message by sender • 4)Decryption by receiver

  14. Proposed Scheme:DACC Aj = j번째 KDC, Lj = KDC Aj가 소유한 attribute의 잡합 I[j,u]Uu가 준 attribute의 집합 • A. Sketch of DACC • 1. Initially the parameters of the scheme and the size of group are decided(232+1) • 2. KDC Ajselects the set of attributes Lj • 3. An owner Uuwho wants to store information in cloud, chooses a set of attributes Iuwhich are specific to the data it wants to encrypt’ • 4. convert the access tree to a Matrix R

  15. Proposed Scheme:DACC • An Example; professional n/w • J1:Engineering, J2(CS Research), J3(Faculty positions) • P1:Canada P2:US

  16. Security of DACC, Performance • Security of DACC • Show that only authorized users can decrypt the data in clouds • Theorem : Our access control scheme is secure, collusion resistant and allows access only to authorized users • Proof • Performance • Calculate the computation and communication overhead of DACC scheme and DACC with revocation

  17. Conclusion • In DACC, the cloud is assumed to be honest • If not possible to satisfy, care should be taken • The authenticity of the data must be verified by the user • hide the identityof the users and owners at the same time provide their authentication • Future work • Hide the access structurefrom the cloud, by scrambling the matrix in some way

  18. Thank you for listening my presentation Q/A

  19. Appendix : Method data data Sends msg Return result : Homomorphicly encrypted data : Return encrypted data http://www2.readersnews.com/sub_read.html?uid=34467&section=sc1 Method 1 : One way to hide the data from clouds Method 2 : Use of homomorphic encryption techniques(4 generation)

  20. Appendix : Method ? ? ? Code Provide result encrypted data : Obfuscation : Return data Method 3 : Code obfuscation Method 4 : Searchable encryption

  21. Appendix : DACC • Matrix R • Matrix R Cyper text c 3 C1 C2 c c 2 Owner • Access tree • User n1 • User n2 Uu Iu User n1 User n2 • posses KDC of list • (HospitalA, doctor, SK 2,1), • (HospitalB, doctor, SK 2,2), • (HospitalA, Staff, SK2,3) KDC 2 1 A2 A2 ofattribute set Lj : Using SSH • SSH:Secure Shell protocol

More Related