CAJ | 학술논문

隐私保护问题是当前访问控制研究领域的一个热点问题.为此提出一种可信分散式访问控制机制,以实现面向客户端上下文隐私保护的访问控制.可信分散式访问控制中包含了私有可信引用监视器和主引用监视器.私有可信引用监视器在安装了可信计算环境的客户端运行,用于评估客户端的访问控制请求,签署临时访问控制凭证;主引用监视器在服务端运行,用于评估临时访问控制凭证,决定客户端的访问是否被授权.由于具体的客户端上下文数据不会发送到服务器端,因此应用可信分散式访问控制,实现如简单位置相关的基于角色的访问控制,可以在客户端上下文相关的访问控制中很好地保护客户端的上下文数据隐私;此外,由于在该机制中客户端上下文是在客户端获取和处理的,因此可信分散式访问控制也可以减轻服务器端获取访问端的上下文的负担.安全性分析和性能实验表明,文中的访问控制机制可以有效地保护客户端上下文数据隐私.
은사보호문제시당전방문공제연구영역적일개열점문제.위차제출일충가신분산식방문공제궤제,이실현면향객호단상하문은사보호적방문공제.가신분산식방문공제중포함료사유가신인용감시기화주인용감시기.사유가신인용감시기재안장료가신계산배경적객호단운행,용우평고객호단적방문공제청구,첨서림시방문공제빙증;주인용감시기재복무단운행,용우평고림시방문공제빙증,결정객호단적방문시부피수권.유우구체적객호단상하문수거불회발송도복무기단,인차응용가신분산식방문공제,실현여간단위치상관적기우각색적방문공제,가이재객호단상하문상관적방문공제중흔호지보호객호단적상하문수거은사;차외,유우재해궤제중객호단상하문시재객호단획취화처리적,인차가신분산식방문공제야가이감경복무기단획취방문단적상하문적부담.안전성분석화성능실험표명,문중적방문공제궤제가이유효지보호객호단상하문수거은사.
Privacy preservation is a hotspot in the access control research field.This paper proposes a novel access control mechanism,named trusted decentralized access control(TDAC).TDAC includes two reference monitors:private trusted reference monitor and master reference monitor.The former leverages trusted computing technologies at the client side,credibly evaluates access control requests and signs temporary access control credentials.The latter runs at the server side.evaluates the access control requests according to temporary access control credentials only.TDAC can solve the issue of privacy preservation in client-context aware access control,because no locaI private context data except for temporary access control credentials leak from the client side to the server side during the access control evaluation.In addition.TDAC can reduce the burden of a server to fetch subject-context data.The paper also proposes an architecture to implement TDAC for client-context aware access control,and applies TDAC to simple location aware role based access control.Finally,the security analysis and the performance evaluation show that TDAC can effectively implement privacy preservation.