基于属性的匿名信息共享模型研究

发布时间：2018-09-19 12:48

【摘要】：随着信息技术的快速发展,网络上的资源共享让信息的获取变得更加的便捷。各种层出不穷的应用域包含了丰富的资源,各应用域之间的用户安全互访以及域间资源共享已经成为一种趋势,保证跨域资源共享的安全性已经成为重中之重。其次,用户从应用域获取资源时,往往被要求提交个人身份信息,存在着身份隐私泄露的隐患,所以用户都希望能够匿名获取资源。在传统的访问控制中,基于角色的访问控制被广泛应用于企业机构,然而以角色作为授权依据太过单一,不足以表达用户的所有权限,且难以应用于跨域的访问控制。在身份隐私保护方面,有学者提出基于PKI/PMI体系的匿名身份认证方案,但是这些方案依然存在着冒充攻击、中间人攻击等安全性问题。依据上面提到的问题,本文提出一种解决方案,来实现匿名的跨域认证和授权管理。本文首先介绍了 PKI/PMI体系,访问控制技术的发展和XACML的策略语言模型及其特点,分析了相关匿名认证和授权管理方案的不足。在上述基础上,本文设计了一种匿名身份认证方案可以实现域内和跨域的匿名身份认证,整个认证过程具有匿名性,安全性。在匿名身份认证的基础上,本文又提出基于属性的匿名信息共享模型。以属性证书作为用户属性的载体实现了基于属性的跨域访问,给出了策略制定及策略评估算法,可以针对不同应用域的用户来制定策略,实现对用户的权限管理。最后设计了具体的测试场景,由上传模块制定策略,模拟了访问控制的过程,将测试结果与理论结果进行对比验证策略以及访问决策的正确性。
[Abstract]:With the rapid development of information technology, resource sharing on the network makes the access to information more convenient. All kinds of application domains contain abundant resources. It has become a trend to ensure the security of cross-domain resource sharing. Secondly, when users obtain resources from the application domain, they are often required to submit personal identity information, there is a hidden danger of identity privacy disclosure, so users want to be able to obtain resources anonymously. In the traditional access control, role-based access control is widely used in enterprises, but the role as the authorization basis is too single to express all user rights, and it is difficult to apply to cross-domain access control. In the aspect of privacy protection, some scholars have proposed anonymous authentication schemes based on PKI/PMI system, but these schemes still have some security problems such as impersonation attacks, man-in-the-middle attacks and so on. According to the above mentioned problems, this paper proposes a solution to implement anonymous cross-domain authentication and authorization management. This paper first introduces the PKI/PMI architecture, the development of access control technology, the policy language model of XACML and its characteristics, and analyzes the shortcomings of related anonymous authentication and authorization management schemes. On the basis of the above, this paper designs an anonymous identity authentication scheme which can implement anonymous identity authentication both in domain and across domains. The whole authentication process is anonymous and secure. On the basis of anonymous identity authentication, this paper proposes an attribute-based anonymous information sharing model. The attribute certificate is used as the carrier of the user attribute to realize the cross-domain access based on the attribute. The algorithm of policy formulation and policy evaluation is given. The policy can be formulated for the users in different application domains and the authority management of the user can be realized. Finally, a specific test scenario is designed. The upload module formulates the strategy, simulates the process of access control, compares the test results with the theoretical results and verifies the correctness of the strategy and the access decision.
【学位授予单位】：浙江工商大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP309

【参考文献】