云计算环境基于客体属性匹配的逆向混合访问控制方案

doi:10.11772/j.issn.1001-9081.2020121954

计算机应用 ›› 2021, Vol. 41 ›› Issue (6): 1604-1610.DOI: 10.11772/j.issn.1001-9081.2020121954

所属专题： 2020年全国开放式分布与并行计算学术年会（DPCS 2020）

• 2020年全国开放式分布与并行计算学术年会（DPCS 2020） • 上一篇下一篇

云计算环境基于客体属性匹配的逆向混合访问控制方案

葛丽娜^1,2,3, 胡雨谷¹, 张桂芬^1,2, 陈园园¹

1. 广西民族大学人工智能学院, 南宁 530006;
2. 广西民族大学网络通信工程重点实验室, 南宁 530006;
3. 广西混杂计算与集成电路设计分析重点实验室, 南宁 530006

收稿日期:2020-11-04 修回日期:2021-04-01 出版日期:2021-06-10 发布日期:2021-06-21
通讯作者: 葛丽娜
作者简介:葛丽娜(1969-),女,广西环江人,教授,博士,CCF高级会员,主要研究方向:信息安全、人工智能;胡雨谷(1991-),男,江苏淮安人,硕士研究生,主要研究方向:信息安全;张桂芬(1974-),女,广西凌云人,副教授,硕士,主要研究方向:数据处理、信息安全;陈园园(1995-),女,广西北海人,硕士研究生,主要研究方向:信息安全。
基金资助:
国家自然科学基金资助项目（61862007）；广西自然科学基金资助项目（2018GXNSFAA138147，2018GXNSFAA281269）。

Reverse hybrid access control scheme based on object attribute matching in cloud computing environment

GE Lina^1,2,3, HU Yugu¹, ZHANG Guifen^1,2, CHEN Yuanyuan¹

1. School of Artificial Intelligence, Guangxi University for Nationalities, Nanning Guangxi 530006, China;
2. Key Laboratory of Network Communication Engineering, Guangxi University for Nationalities, Nanning Guangxi 530006, China;
3. Guangxi Key Laboratory of Hybrid Computation and IC Design Analysis, Nanning Guangxi 530006, China

Received:2020-11-04 Revised:2021-04-01 Online:2021-06-10 Published:2021-06-21
Supported by:
This work is partially supported by the National Natural Science Foundation of China (61862007), the Natural Science Foundation of Guangxi (2018GXNSFAA138147, 2018GXNSFAA281269).

摘要/Abstract

摘要： 云计算提高了大数据的使用、分析和管理的效率，但也给数据贡献者带来了对云服务的数据安全及隐私信息泄露的担忧。针对这个问题，结合了基于角色的访问控制、基于属性的访问控制方法并采用了下一代访问控制的体系结构，提出了云计算环境下的基于客体属性匹配的逆向混合访问控制方法。首先，数据贡献者设置共享文件访问权限级别，逆向规定了访问客体的最低权值；然后，采用变异系数加权的方法直接计算各属性的权值，取消了以属性为中心的基于角色的访问控制中策略规则匹配的过程；最后，把数据贡献者对数据文件设定的权限值定为数据访问者被允许访问的阈值，这样既实现了数据访问控制，又保障了对隐私数据的保护。实验结果表明，随着访问次数的增多，所提方法对恶意行为、权限不足行为等的判断基准趋于稳定，检测能力越来越强，成功率趋于一个较为平稳的水平。该方法在用户访问数量较大的环境下相较传统的访问控制方法能够实现更高的决策效率，验证了所提方法的有效性和可行性。

关键词: 访问控制, 权值计算, 访问策略, 数据共享, 云计算

Abstract: Cloud computing improves the efficiency of the use, analysis and management of big data, but also brings the worry of data security and private information disclosure of cloud service to the data contributors. To solve this problem, combined with the role-based access control, attribute-based access control methods and using the architecture of next generation access control, a reverse hybrid access control method based on object attribute matching in cloud computing environment was proposed. Firstly, the access right level of the shared file was set by the data contributor, and the minimum weight of the access object was reversely specified. Then, the weight of each attribute was directly calculated by using the variation coefficient weighting method, and the process of policy rule matching in the attribute centered role-based access control was cancelled. Finally, the right value of the data contributor setting to the data file was used as the threshold for the data visitor to be allowed to access, which not only realized the data access control, but also ensured the protection of private data. Experimental results show that, with the increase of the number of visits, the judgment standards of the proposed method for malicious behaviors and insufficient right behaviors tend to be stable, the detection ability of the method becomes stronger and stronger, and the success rate of the method tends to a relatively stable level. Compared with the traditional access control methods, the proposed method can achieve higher decision-making efficiency in the environment of large number of user visits, which verifies the effectiveness and feasibility of the proposed method.

Key words: access control, weight calculation, access policy, data sharing, cloud computing

中图分类号:

TP393.08

葛丽娜, 胡雨谷, 张桂芬, 陈园园. 云计算环境基于客体属性匹配的逆向混合访问控制方案[J]. 计算机应用, 2021, 41(6): 1604-1610.

GE Lina, HU Yugu, ZHANG Guifen, CHEN Yuanyuan. Reverse hybrid access control scheme based on object attribute matching in cloud computing environment[J]. Journal of Computer Applications, 2021, 41(6): 1604-1610.

参考文献

[1] FERRAIOLO D F,KUHN D R. Future directions in role-based access control[C]//Proceedings of the 19961st ACM Workshop on Role-based Access Control. New York:ACM, 1996:Article No. 8-es.
[2] SANDHU R,BHAMIDIPATI V,MUNAWER Q. The ARBAC97 model for role-based administration of roles[J]. ACM Transactions on Information and System Security,1999,2(1):105-135.
[3] BERTINO E,BONATTI P A,FERRARI E. TRBAC:a temporal role-based access control model[J]. ACM Transactions on Information and Systems Security,2001,4(3):191-223.
[4] JOSHI J B D. A generalized temporal role based access control model for developing secure systems[D]. West Lafayette:Purdue University,2003:94-122.
[5] CRAMPTON J. Specifying and enforcing constraints in role-based access control[C]//Proceedings of the 2003 8th ACM Symposium on Access Control Models and Technologies. New York:ACM, 2003:43-50.
[6] Wikipedia. Attribute-based access control[EB/OL].[2019-12-31]. https://en.wikipedia.org/wiki/Attribute-based_access_control.
[7] SMARI W W, CLEMENTE P, LALANDE J F. An extended attribute based access control model with trust and privacy:application to a collaborative crisis management system[J]. Future Generation Computer Systems,2014,31(1):147-168.
[8] DNSstuff. RBAC vs. ABAC:what's the difference?[EB/OL].[2020-01-19]. https://www.dnsstuff.com/rbac-vs-abac-accesscontrol.
[9] KUHN D R,COYNE E J,WEIL T R. Adding attributes to rolebased access control[J]. Computer,2010,43(6):79-81.
[10] ZHU Y,HUANG D,HU C J,et al. From RBAC to ABAC:constructing flexible data access control for cloud storage services[J]. IEEE Transactions on Services Computing,2015,8(4):601-616.
[11] 熊厚仁, 陈性元, 费晓飞, 等. 基于属性和RBAC的混合扩展访问控制模型[J]. 计算机应用研究, 2016, 33(7):2162-2169. (XIONG H R,CHEN X Y,FEI X F,et al. Attribute and RBACbased hybrid access control model[J]. Application Research of Computers,2016,33(7):2162-2169.)
[12] LO N W,YANG T C,GUO M H. An attribute-role based access control mechanism for multi-tenancy cloud environment[J]. Wireless Personal Communications,2015,84(3):2119-2134.
[13] HUANG J, NICOL D M, BOBBA R, et al. A framework integrating attribute-based policies into role-based access control[C]//Proceedings of the 2012 17th ACM Symposium on Access Control Models and Technologies. New York:ACM, 2012:187-196.
[14] 王于丁, 杨家海. 一种基于角色和属性的云计算数据访问控制模型[J]. 清华大学学报(自然科学版), 2017, 57(11):1150-1158.(WANG Y D,YANG J H. Data access control model based on data's role and attributes for cloud computing[J]. Journal of Tsinghua University(Science and Technology),2017,57(11):1150-1158.)
[15] 汪玉江, 曹成堂, 游林. 基于区块链和属性基加密的个人隐私数据保护方案[J]. 密码学报, 2021, 8(1):14-27.(WANG Y J, CAO C T,YOU L. A novel personal privacy data protection scheme based on blockchain and attribute-based encryption[J]. Journal of Cryptologic Research,2021,8(1):14-27.)
[16] 马佳乐, 郭银章. 云计算用户行为信任评估与访问控制策略研究[J]. 计算机应用研究, 2020, 37(S2):260-262.(MA J L,GUO Y Z. Research on cloud computing user behavior trust evaluation and access control strategy[J]. Application Research of Computers,2020,37(S2):260-262.)
[17] American National Standards Institute. American National Standard for Information Technology-Next Generation Access Control-Functional Architecture(NGAC-FA):INCITS 499-2018[S]. New York:ANSI,2018-01-03.
[18] 胡雨谷. 医疗隐私数据安全共享的机制研究[D]. 南宁:广西民族大学,2020:14-52.(HU Y G. Research on the mechanism of security sharing of medical privacy data[D]. Nanning:Guangxi University for Nationalities,2020:14-52.)

云计算环境基于客体属性匹配的逆向混合访问控制方案

Reverse hybrid access control scheme based on object attribute matching in cloud computing environment

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

[1]	葛纪红, 沈韬. 基于区块链的能源数据访问控制方法[J]. 计算机应用, 2021, 41(9): 2615-2622.
[2]	陈家豪, 殷新春. 基于云雾计算的可追踪可撤销密文策略属性基加密方案[J]. 计算机应用, 2021, 41(6): 1611-1620.
[3]	杜心雨, 王化群. LTE-A网络中基于动态组的有效的身份认证和密钥协商方案[J]. 计算机应用, 2021, 41(6): 1715-1722.
[4]	张利华, 王欣怡, 胡方舟, 黄阳, 白甲义. 基于双联盟链的智能电网数据共享模型[J]. 计算机应用, 2021, 41(4): 963-969.
[5]	杨翎, 姜春茂. 基于三支决策的虚拟机节能迁移策略[J]. 计算机应用, 2021, 41(4): 990-998.
[6]	包玉龙, 朱雪阳, 张文辉, 孙鹏飞, 赵颖琪. 物联网应用中访问控制智能合约的形式化验证[J]. 计算机应用, 2021, 41(4): 930-938.
[7]	吕佳玉, 竺智荣, 姚志强. 云计算环境下的双通道数据动态加密策略[J]. 计算机应用, 2020, 40(8): 2268-2273.
[8]	王海勇, 潘启青, 郭凯璇. 基于区块链和用户信用度的访问控制模型[J]. 计算机应用, 2020, 40(6): 1674-1679.
[9]	陈程军, 毛莺池, 王绎超. 基于激活-熵的分层迭代剪枝策略的CNN模型压缩[J]. 计算机应用, 2020, 40(5): 1260-1265.
[10]	郭曙杰, 李志华, 蔺凯青. 云环境下基于模糊隶属度的虚拟机放置算法[J]. 计算机应用, 2020, 40(5): 1374-1381.
[11]	史锦山, 李茹, 松婷婷. 基于区块链的物联网访问控制框架[J]. 计算机应用, 2020, 40(4): 931-941.
[12]	许英鑫, 孙磊, 赵建成, 郭松辉. 基于蚁群优化算法的虚拟现场可编程门阵列部署策略[J]. 计算机应用, 2020, 40(3): 747-752.
[13]	王庆永, 毛莺池, 王绎超, 王龙宝. 基于多微云协作的计算任务卸载[J]. 计算机应用, 2020, 40(2): 328-334.
[14]	刘福鑫, 李劲巍, 王熠弘, 李琳. 基于Kubernetes的云原生海量数据存储系统设计与实现[J]. 计算机应用, 2020, 40(2): 547-552.
[15]	付伟, 顾晨阳, 高强. 基于属性加密的多用户共享ORAM方案[J]. 计算机应用, 2020, 40(2): 497-502.