This work proposes a new distributed and self-organized authentication scheme for Mobile Ad-hoc NETworks (MANETs). Apart from describing all its components, special emphasis is placed on proving that the proposal fulfils most requirements derived from the special characteristics of MANETs, including limited physical protection of broadcast medium, frequent route changes caused by mobility, and lack of structured hierarchy. Interesting conclusions are obtained from an analysis of simulation experiments in different scenarios.
Later, @cite_17 developed a group access control framework based on a menu of cryptographic techniques, which included simple access control policies, such as static ACLs (Access Control Lists), as well as admission based on the decision of a fixed entity: external (e.g., a CA or a Trusted Third Party) or internal (e.g., a group founder). The main drawback of such a proposal is that those policies are inflexible and unsuitable for dynamic ad-hoc networks. For instance, static ACLs enumerate all possible members and hence cannot support truly dynamic membership, and admission decisions made by a Trusted Third Party (TTP) or a group founder violate the peer nature of the underlying ad-hoc group.
@cite_17
2081768367 2123558779 2043563246 73246841
This paper proposes a novel key management scheme for multi-dimensional scalable multimedia access control. We build up a collusion-attack model and prove that the proposed scheme is indeed resilient to collusion attack. The lower bound of number of the segment keys is also given in the analysis. We consider the key management problem on partially order set and propose a general approach consists of a poset decomposition step and an element projection step. Under the proposed framework, a novel hierarchical 3D poset decomposition approach is further developed. The proposed scheme is the first provable collusion resilient scheme in 3-dimension (and higher) scenario. It can be easily adapted to other scalable dependence structure and higher dimension. Analysis on the proposed scheme proves its collusion-resilient property. Access control in content distribution networks (CDNs) is a long-standing problem and has attracted extensive research. Traditional centralized access control approaches, such as reference monitor based approach, do not suit for CDNs as such networks are of large scale and geographically distributed in nature. Current CDNs usually resort to cryptographic-based distributed approaches for better fulfilling the goal of access control. Hence, it is highly critical to design and adapt appropriate cryptographic primitives for such purpose. In this paper, we propose a novel distributed access control approach for CDNs by exploiting a new cryptographic primitive called Ciphertext Policy Attributed-Based Encryption (CP-ABE). Our approach provides flexible yet fine-grained access control (per file level) so that the contents are available only to the authorized users. We further consider the protection of user privacy and enhance the current design of CP-ABE so that not only the cAccess control in content distribution networks (CDNs) is a long-standing problem and has attracted extensive research. Traditional centralized access control approaches, such as reference monitor based approach, do not suit for CDNs as such networks are of large scale and geographically distributed in nature. Current CDNs usually resort to cryptographic-based distributed approaches for better fulfilling the goal of access control. Hence, it is highly critical to design and adapt appropriate cryptographic primitives for such purpose. In this paper, we propose a novel distributed access control approach for CDNs by exploiting a new cryptographic primitive called ciphertext policy attributed-based encryption (CP-ABE). Our approach provides flexible yet fine-grained access control (per file level) so that the contents are available only to the authorized users. We further consider the protection of user privacy and enhance the current design of CP-ABE so that not only the contents themselves but also the access policies, which could lead to the revelation of sensitive user information, are well protected.ontents themselves but also the access policies, which could lead to the revelation of sensitive user information, are well protected. Access control policy is typically defined in terms of attributes, but in many applications it is more natural to define permissions in terms of relationships that resources, systems, and contexts may enjoy. The paradigm of relationship-based access control has been proposed to address this issue, and modal logic has been used as a technical foundation. We argue here that hybrid logic -- a natural and well-established extension of modal logic -- addresses limitations in the ability of modal logic to express certain relationships. We identify a fragment of hybrid logic to be used for expressing relationship-based access-control policies, show that this fragment supports important policy idioms, and demonstrate that it removes an exponential penalty in existing attempts of specifying complex relationships such as "at least three friends". We also capture the previously studied notion of relational policies in a static type system. Access control policies are often partly static, i.e. no dependence on any run-time information, and partly dynamic. However, they are usually enforced dynamically - even the static parts. We propose a new hybrid approach to policy enforcement using the Category-Based Access Control (CBAC) meta-model. We build on previous work, which established a static system for the enforcement of (static) hierarchical Role-Based Access Control (RBAC) policies. We modify the previous policy language, JPol, to specify static and dynamic categories. We establish an equivalence between static categories and static roles (in RBAC), therefore we are able to use the previous design patterns and static verification algorithm, with some changes, to enforce static categories. For dynamic categories, we propose a new design methodology and generate code in the target program to do the necessary run-time checks.