![](bg2.png)
2 RELATED WORK
The basic idea of CAC is simple – almost every
piece of information is encrypted and signed. The
simplicity of the idea is why models, schemes,
implementations and even standards abound. The
previous work on CAC can be roughly divided in
two: symmetric and asymmetric key methods.
Asymmetric key methods, such as XML encryption,
do not generally formalize their access control
models.
Symmetric-key CAC-schemes stem from the
world of DRM and broadcast encryption, distributed
file servers, outsourced data and cloud computing.
Symmetric-key CAC-schemes use formalization to
show the optimality of their metrics (Naor, 2001);
(De Capitani di Vimercati, 2007) or that the
described method actually does implement the
desired policy (De Capitani di Vimercati, 2007).
Formalizations are not on the access control concept
level, the way MAC and RBAC have been
formalized (Bell, 1973); (Ferraiolo, 1992).
A major advance within the CAC paradigm in
asymmetric-key methods was achieved with the
introduction of attribute-based cryptography.
Attribute-based cryptogrpahy can enforce read-
rights very flexibly via ABE and (in principle) write-
rights through ABGS.
ABE encodes subject properties, called attributes
(such as rank, clearance, etc.) to a set of keys, and
the object access control list is used as a logical
formula to encrypt the actual plaintext.
The CBIS-concept (Content-based Information
Security) experimented by US DoD between 2000
and 2005 as an Advanced Concept and Technology
Demonstrator (McGovern, 2001); (Savoie, 2004)
and researched later e.g. in (Kiviharju, 2010) was
based on similar threat model we use here.
In conjunction with CBIS it was presented the
idea of using metadata in helping to extend the CAC
paradigm to additional security services, but the idea
was not elaborated further, nor applied to specific
types of rights.
The recent interest in FHE - (fully)
homomorphic encryption (Gentry, 2009) for cloud
computing solves many confidentiality problems for
performing computations remotely without the data
storage being able to decipher the meaning of the
computations. FHE, however, does not cover a wide
area in the access control domain: as a program
using FHE is able to run normally without
decrypting any of its input or output, it would seem
that the execute-permission is covered by FHE as
well. However, this is not the case: even with
sufficiently efficient FHE the encryption scheme
does not stop anyone from actually running the code,
or make the execution flow itself encrypted.
3 THE CASE FOR EXTENDED
CAC MODELS
Our main setting considers a cloud-based storage
service with typical dynamic subjects and
collaboratively modifiable objects. The main focus
here is on the properties of the cloud: it is assumed
to be reliable in the sense of availability (as
documents are distributed, backed up, shared and
synchronized, it becomes less and less likely to
actually lose information accidentally or by
malevolent interaction).
Specifically, we lay out the following
assumptions:
A server (in the cloud) acts as a storage or an
execution platform only, focusing on availability and
speed. It may have the capability to remove (all its
copies of the) files on an authorized request. The
server does not have the capability to perform key-
management or cryptographic duties related to the
stored content.
A storage-server is almost always assumed to be
able to provide at least one “clean” copy of the
requested data, although it may not have the ability
to identify the correct instance.
There are no unpassable reference monitors
“close” to the data. For authorized users, some RM-
functionality is expected, but it is also possible to
read and write (including deletion) the data by
bypassing these RMs.
We propose to extend the current CAC-paradigm to
cover the full spectrum of access control rights by:
Including most conventional reference-monitor-
enforced permissions.
Extending the cryptographic enforcement further
from the content / data, in terms of metadata.
If more types of access rights than just read on data
and selected metadata are to be protected, there is
need to encode the whole access control matrix
somehow to be enforced cryptographically. This is,
however, more complex than just encrypting and
signing the whole access control matrix as metadata
to the protected data. On the other hand, metadata
encryption itself seems a viable option.
One of the main promises of some of the
cryptographically enforced access control
implementations seems to be that since data is
encrypted, there is no need for reference monitors,
SECRYPT2012-InternationalConferenceonSecurityandCryptography
240