Privacy Preserving Enforcement of Sensitive Policies in Outsourced and Distributed Environments

摘要

The enforcement of sensitive policies in untrusted environments is still anopen challenge for policy-based systems. On the one hand, taking anyappropriate security decision requires access to these policies. On the otherhand, if such access is allowed in an untrusted environment then confidentialinformation might be leaked by the policies. The key challenge is how toenforce sensitive policies and protect content in untrusted environments. Inthe context of untrusted environments, we mainly distinguish between outsourcedand distributed environments. The most attractive paradigms concerningoutsourced and distributed environments are cloud computing and opportunisticnetworks, respectively. In this dissertation, we present the design, technical and implementationdetails of our proposed policy-based access control mechanisms for untrustedenvironments. First of all, we provide full confidentiality of access policiesin outsourced environments, where service providers do not learn privateinformation about policies. We support expressive policies and take intoaccount contextual information. The system entities do not share any encryptionkeys. For complex user management, we offer the full-fledged Role-Based AccessControl (RBAC) policies. In opportunistic networks, we protect content by specifying expressivepolicies. In our proposed approach, brokers match subscriptions againstpolicies associated with content without compromising privacy of subscribers.As a result, unauthorised brokers neither gain access to content nor learnpolicies and authorised nodes gain access only if they satisfy policiesspecified by publishers. Our proposed system provides scalable key managementin which loosely-coupled publishers and subscribers communicate without anyprior contact. Finally, we have developed a prototype of the system that runson real smartphones and analysed its performance.