Cryptographically-Enforced Hierarchical scheme An unbounded Access - - PowerPoint PPT Presentation

▶
cryptographically enforced hierarchical
SMART_READER_LITE
LIVE PREVIEW

Cryptographically-Enforced Hierarchical scheme An unbounded Access - - PowerPoint PPT Presentation

Jan 08, 2023 235 likes •677 views

Preliminaries A bounded asynchronous Cryptographically-Enforced Hierarchical scheme An unbounded Access Control with Multiple Keys asynchronous scheme Concluding remarks Jason Crampton Questions Information Security Group Royal

slide-1
SLIDE 1

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Cryptographically-Enforced Hierarchical Access Control with Multiple Keys

Jason Crampton

Information Security Group Royal Holloway, University of London

NordSec 2007

slide-2
SLIDE 2

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Hierarchical access control

Given

◮ a partially ordered set of security

labels (L, )

◮ a function λ mapping users and

protected objects to L we require that a user u can only read

  • if λ(u) λ(o)

a d c b

L

slide-3
SLIDE 3

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Cryptographic hierarchical access control

Useful for third-party data publishing

◮ Data is made available by someone other than data owner

slide-4
SLIDE 4

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Cryptographic hierarchical access control

Useful for third-party data publishing

◮ Data is made available by someone other than data owner

Trivial solution

◮ Encrypt o with k(o) ◮ Send {k(y) : y λ(u)} to u

slide-5
SLIDE 5

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Cryptographic hierarchical access control

Useful for third-party data publishing

◮ Data is made available by someone other than data owner

Trivial solution

◮ Encrypt o with k(o) ◮ Send {k(y) : y λ(u)} to u

Preferably

◮ Encrypt o with k(o) ◮ Send k(λ(u)) to u

slide-6
SLIDE 6

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Cryptographic hierarchical access control

Useful for third-party data publishing

◮ Data is made available by someone other than data owner

Trivial solution

◮ Encrypt o with k(o) ◮ Send {k(y) : y λ(u)} to u

Preferably

◮ Encrypt o with k(o) ◮ Send k(λ(u)) to u ◮ Publish additional (encrypted) information enabling u to

derive k(y) for all y k(λ(u))

slide-7
SLIDE 7

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Iterative key assignment schemes

The data owner

◮ chooses k(y) at random from the key space

slide-8
SLIDE 8

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Iterative key assignment schemes

The data owner

◮ chooses k(y) at random from the key space ◮ publishes {Ek(x)(k(y)) : y ⋖ x, x, y ∈ L}

◮ y ⋖ x denotes that y is an immediate child of x in L ◮ Ek(m) denotes the encryption of message m with key k

slide-9
SLIDE 9

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Iterative key assignment schemes

The data owner

◮ chooses k(y) at random from the key space ◮ publishes {Ek(x)(k(y)) : y ⋖ x, x, y ∈ L}

◮ y ⋖ x denotes that y is an immediate child of x in L ◮ Ek(m) denotes the encryption of message m with key k

◮ Sends k(λ(u)) to user u

slide-10
SLIDE 10

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Iterative key assignment schemes

The data owner

◮ chooses k(y) at random from the key space ◮ publishes {Ek(x)(k(y)) : y ⋖ x, x, y ∈ L}

◮ y ⋖ x denotes that y is an immediate child of x in L ◮ Ek(m) denotes the encryption of message m with key k

◮ Sends k(λ(u)) to user u

The user obtains

◮ k(y), y ⋖ λ(u), by decrypting the appropriate datum of

public information

slide-11
SLIDE 11

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Iterative key assignment schemes

The data owner

◮ chooses k(y) at random from the key space ◮ publishes {Ek(x)(k(y)) : y ⋖ x, x, y ∈ L}

◮ y ⋖ x denotes that y is an immediate child of x in L ◮ Ek(m) denotes the encryption of message m with key k

◮ Sends k(λ(u)) to user u

The user obtains

◮ k(y), y ⋖ λ(u), by decrypting the appropriate datum of

public information

◮ k(y), y < λ(u), by iteratively decrypting keys on some

path between λ(u) and y

slide-12
SLIDE 12

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Problem statement and motivation

Design a hierarchical key assignment scheme that supports multiple keys for each security label

◮ Minimize public storage ◮ Minimize number of keys distributed to users

slide-13
SLIDE 13

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Problem statement and motivation

Design a hierarchical key assignment scheme that supports multiple keys for each security label

◮ Minimize public storage ◮ Minimize number of keys distributed to users

Such schemes are useful for

◮ supporting lazy re-encryption ◮ enforcing hierarchical access control policies

slide-14
SLIDE 14

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Design decisions

◮ Is the number of updates determined in advance?

If yes, we say the scheme is bounded (and unbounded

  • therwise)

◮ Can the key for label x be updated independently of the

  • ne for y?

If yes, we say the scheme is asynchronous (and synchronous otherwise)

slide-15
SLIDE 15

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

slide-16
SLIDE 16

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Illustration

Initial security lattice – one key per label

a d c b

slide-17
SLIDE 17

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Illustration

k(d) is updated – two keys for d

a d c b a d c b

slide-18
SLIDE 18

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Illustration

k(b) is updated – two keys for b, three for d

a d c b a d c b a d c b

slide-19
SLIDE 19

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Basic approach

There are two “orthogonal” dimensions to the problem

◮ The set of security labels L ◮ Temporal – a chain of keys associated with each element

  • f L
slide-20
SLIDE 20

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Basic approach

There are two “orthogonal” dimensions to the problem

◮ The set of security labels L ◮ Temporal – a chain of keys associated with each element

  • f L

One solution is to

◮ construct an iterative key assignment scheme for L ◮ define a “key chain” for the temporal dimension

slide-21
SLIDE 21

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Hash chain solution

For a bounded scheme there are at most m keys for each label

slide-22
SLIDE 22

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Hash chain solution

For a bounded scheme there are at most m keys for each label

◮ Define an iterative key assignment scheme for L ◮ For each x ∈ L

◮ choose a key km(x) from {0, 1}l ◮ define ki−1(x) = h(ki(x)), where h : {0, 1}∗ → {0, 1}l is a

suitable (public) hash function

slide-23
SLIDE 23

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Hash chain solution

For a bounded scheme there are at most m keys for each label

◮ Define an iterative key assignment scheme for L ◮ For each x ∈ L

◮ choose a key km(x) from {0, 1}l ◮ define ki−1(x) = h(ki(x)), where h : {0, 1}∗ → {0, 1}l is a

suitable (public) hash function

◮ When the key for label x needs to be changed

◮ select the next key for each label y x ◮ update public information for L’s scheme

slide-24
SLIDE 24

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Hash chain solution

For a bounded scheme there are at most m keys for each label

◮ Define an iterative key assignment scheme for L ◮ For each x ∈ L

◮ choose a key km(x) from {0, 1}l ◮ define ki−1(x) = h(ki(x)), where h : {0, 1}∗ → {0, 1}l is a

suitable (public) hash function

◮ When the key for label x needs to be changed

◮ select the next key for each label y x ◮ update public information for L’s scheme

◮ A user with security label x can

◮ compute the current key for y < x from the public

information for L

◮ iteratively compute hashes of y’s key until the key for the

desired time period is obtained

slide-25
SLIDE 25

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Hash chain solution

For a bounded scheme there are at most m keys for each label

◮ Define an iterative key assignment scheme for L ◮ For each x ∈ L

◮ choose a key km(x) from {0, 1}l ◮ define ki−1(x) = h(ki(x)), where h : {0, 1}∗ → {0, 1}l is a

suitable (public) hash function

◮ When the key for label x needs to be changed

◮ select the next key for each label y x ◮ update public information for L’s scheme

◮ A user with security label x can

◮ compute the current key for y < x from the public

information for L

◮ iteratively compute hashes of y’s key until the key for the

desired time period is obtained

◮ Future keys cannot be feasibly computed (if the hash

function is any good!)

slide-26
SLIDE 26

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

slide-27
SLIDE 27

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

The scheme

We place no upper limit on the number of key updates

◮ Define an iterative key assignment scheme for L

slide-28
SLIDE 28

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

The scheme

We place no upper limit on the number of key updates

◮ Define an iterative key assignment scheme for L ◮ Compute (n, e, d) using RSA key generator and publish

(n, e)

slide-29
SLIDE 29

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

The scheme

We place no upper limit on the number of key updates

◮ Define an iterative key assignment scheme for L ◮ Compute (n, e, d) using RSA key generator and publish

(n, e)

◮ Select a key for each x ∈ L

slide-30
SLIDE 30

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

The scheme

We place no upper limit on the number of key updates

◮ Define an iterative key assignment scheme for L ◮ Compute (n, e, d) using RSA key generator and publish

(n, e)

◮ Select a key for each x ∈ L ◮ When the key for label x needs to be changed

◮ for each y x define the new key to be (k(y))d mod n ◮ compute and replace appropriate public information

slide-31
SLIDE 31

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Key derivation

Note that (ki(y))e = ((ki−1(y)d)e = ki−1(y)

slide-32
SLIDE 32

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Key derivation

Note that (ki(y))e = ((ki−1(y)d)e = ki−1(y) In other words, the most recent key can be computed from the current one

slide-33
SLIDE 33

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Key derivation

Note that (ki(y))e = ((ki−1(y)d)e = ki−1(y) In other words, the most recent key can be computed from the current one A user with security label x can

◮ compute the current key for y < x from the public

information

◮ iteratively compute the key for the desired time period

slide-34
SLIDE 34

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Key derivation

Note that (ki(y))e = ((ki−1(y)d)e = ki−1(y) In other words, the most recent key can be computed from the current one A user with security label x can

◮ compute the current key for y < x from the public

information

◮ iteratively compute the key for the desired time period

Future keys cannot be feasibly computed (without breaking RSA)

slide-35
SLIDE 35

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

slide-36
SLIDE 36

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Using and evaluating schemes

Note that

◮ any asynchronous scheme can be used as a synchronous

scheme

◮ any unbounded scheme can be used as a bounded scheme ◮ unbounded asynchronous schemes are particularly suitable

for lazy revocation

◮ bounded synchronous schemes are particularly suitable for

temporal access control policies

slide-37
SLIDE 37

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Using and evaluating schemes

Note that

◮ any asynchronous scheme can be used as a synchronous

scheme

◮ any unbounded scheme can be used as a bounded scheme ◮ unbounded asynchronous schemes are particularly suitable

for lazy revocation

◮ bounded synchronous schemes are particularly suitable for

temporal access control policies Ideally a scheme should

◮ have direct key derivation and low storage costs ◮ be unbounded and asynchronous ◮ require a single key for each user

slide-38
SLIDE 38

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Summary of schemes

The schemes presented in this talk Derivation Update Storage U A L Prev Public Private Ind Dir Yes |E| 1 No Yes Ind Ind Yes |E| 1 No Yes Dir n/a No |L| q Yes No Dir Ind No |L| 1 Yes No Ind Ind Yes |E| 1 Yes Yes Ind Ind Yes q|E| 1 Yes Yes

slide-39
SLIDE 39

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Summary of schemes

A good scheme for temporal access control policies Derivation Update Storage U A L Prev Public Private Ind Dir Yes |E| 1 No Yes Ind Ind Yes |E| 1 No Yes Dir n/a No |L| q Yes No Dir Ind No |L| 1 Yes No Ind Ind Yes |E| 1 Yes Yes Ind Ind Yes q|E| 1 Yes Yes

slide-40
SLIDE 40

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Summary of schemes

A good scheme for lazy revocation Derivation Update Storage U A L Prev Public Private Ind Dir Yes |E| 1 No Yes Ind Ind Yes |E| 1 No Yes Dir n/a No |L| q Yes No Dir Ind No |L| 1 Yes No Ind Ind Yes |E| 1 Yes Yes Ind Ind Yes q|E| 1 Yes Yes

slide-41
SLIDE 41

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Contributions

◮ First schemes to consider the design of multi-key

assignment schemes

◮ Demonstrate applicability to lazy revocation and temporal

access control

◮ Use both iterative key assignment schemes and Akl-Taylor

schemes (see proceedings)

slide-42
SLIDE 42

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Future work

Formal security analysis

◮ Multi-key assignment schemes are constructed from

components

◮ Atallah et al & Ateniese et al have undertaken security

analyses for key assignment schemes

◮ Can it be shown that a multi-key scheme is as secure as

(the weakest of) its components?

slide-43
SLIDE 43

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions

Preliminaries A bounded asynchronous scheme An unbounded asynchronous scheme Concluding remarks Questions