Design and implementation of a confidentiality and access control solution for publish/subscribe systems

Ion, Mihaela; Russello, Giovanni; Crispo, Bruno

doi:10.1016/j.comnet.2012.02.013

Cited by 46 publications

(43 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We review below the work related to key management for content-based pub/sub. Solutions such as [18] and [35] adapt Attribute Based Encryption (ABE) [5,15], or use similar techniques for publication payload encryption. The message headers are still secured with encrypted matching schemes.…”

Section: Related Workmentioning

confidence: 99%

“…A typical publication could be {symbol = "GOOG", value = 600.70, variation = −5.55, date = 2015.09.04}. Another application of interest for pub/sub is e-health systems [14,17,18]. Figure 1 illustrates the information flow in a pub/sub system.…”

Section: Introductionmentioning

confidence: 98%

“…Unfortunately, normal encryption techniques prevent the brokers from matching messages based on their content. As a result, encryption techniques have been proposed that allow the brokers to match and route encrypted pub/sub data without disclosing plaintext content [9,18,20,24,28]. We call such an operation encrypted matching.…”

Section: Introductionmentioning

confidence: 99%

“…This key is used to encrypt the headers of publications and constraints in subscriptions. Most schemes use symmetric encryption [9,20,28], and schemes that adapt public key (asymmetric) encryption algorithms still require some common secret information to be sent to both publishers and subscribers [18]. For all schemes, the secret key information must be updated regularly.…”

Section: Introductionmentioning

confidence: 99%

“…Encrypted matching schemes are based on secret key encryption algorithms [9,18,20,28]. Publishers and subscribers must receive a common or correlated secret key.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Efficient Key Updates through Subscription Re-encryption for Privacy-Preserving Publish/Subscribe

Onica

Felber

Mercier

et al. 2015

Proceedings of the 16th Annual Middleware Conference

View full text Add to dashboard Cite

Content-based publish/subscribe (pub/sub) is an appealing information dissemination paradigm for distributed systems. Consumers of data subscribe to a pub/sub service, typically offered through a distributed broker overlay, and indicate their interests as constraints over the information content. Publishers generate the information flow, which the brokers filter and route to the interested subscribers. Protecting the information confidentiality, and in particular the interests of subscribers, is an important concern when brokers are located in untrusted domains such as public clouds. Encrypted matching techniques allow untrusted brokers to store encrypted subscriptions and match them against encrypted publications. Updates of encryption keys regularly happen in such contexts due to changes in trust relations. These key updates cause the invalidation of stored encrypted subscriptions and force subscribers to re-encrypt and re-submit them. This long and costly operation impacts the pub/sub service continuity and performance. In this paper, we propose a novel technique that allows updating encrypted subscriptions directly at the brokers while maintaining privacy. We present an implementation of the technique for the ASPE encrypted matching scheme and prove the security of our extension. We evaluate its practical effectiveness through a prototype implementation including a dependable key distribution protocol. Our experiments show the ability to handle key updates while preserving service continuity and performance.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 98%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…Encrypted matching schemes are based on secret key encryption algorithms [9,18,20,28]. Publishers and subscribers must receive a common or correlated secret key.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Efficient Key Updates through Subscription Re-encryption for Privacy-Preserving Publish/Subscribe

Onica

Felber

Mercier

et al. 2015

Proceedings of the 16th Annual Middleware Conference

View full text Add to dashboard Cite

show abstract

Secure and efficient data‐sharing in clouds

Zhang

2014

Concurrency and Computation

View full text Add to dashboard Cite

SummaryWith the rapid development of cloud computing, cloud storage has become a cost‐effective solution for many users with the demand of data storage. However, there are still two main concerns for users with sensitive/private data: (1) Is it secure to store private data in public cloud storages? (2) Is there an efficient way to share private data with other specified users? In the past years, several papers in the literature have used proxy re‐encryption (PRE) to address these two concerns, where the efficiency of the underlying PRE scheme is usually a bottleneck of the overall performance of cloud storages. In this paper, we dedicate to design a secure and practical PRE scheme for cloud‐based data‐sharing. First, we discuss a ‘pitfall’ in the security proof of several existing PREs. Then, we give a general framework for proving the chosen ciphertext attacks (CCA) security of single‐hop unidirectional PRE schemes. Finally, we propose a practical PRE scheme that is proven secure against CCA under the computational Diffie–Hellman problem in the random oracle model. We evaluate the performance of our PRE scheme both in theoretical comparisons with related schemes and in implementations at several security levels. The results indicate that our scheme can be practical in cloud‐based data‐sharing. Copyright © 2014 John Wiley & Sons, Ltd.

show abstract

CUPS: Secure opportunistic cloud of things framework based on attribute‐based encryption scheme supporting access policy update

Belguith

Kaaniche

Russello

2019

Security and Privacy

Self Cite

View full text Add to dashboard Cite

The ever-growing number of Internet connected devices, coupled with the new computing trends, namely within emerging opportunistic networks, engenders several security concerns. Most of the exchanged data between the Internet of Things (IoT) devices are not adequately secured due to resource constraints on IoT devices. Attribute Based Encryption is a promising cryptographic mechanism suitable for distributed environments, providing flexible access control to encrypted data contents. However, it imposes high decryption costs, and does not support access policy update, for highly dynamic environments. This paper presents CUPS, an ABE-based framework for opportunistic cloud of things applications, that securely outsources data decryption process to edge nodes in order to reduce the computation overhead on the user side. CUPS allows endusers to offload most of the decryption overhead to an edge node and verify the correctness of the received partially decrypted data from the edge node. Moreover, CUPS provides the access policy update feature with neither involving a proxy-server, nor re-encrypting the enciphered data contents and re-distributing the users' secret keys. The access policy update feature in CUPS does not affect the size of the message received by the end-user which reduces the bandwidth and the storage usage. Our comprehensive theoretical analysis proves that CUPS outperforms existing schemes in terms of functionality, communication and computation overheads.

show abstract

Design and implementation of a confidentiality and access control solution for publish/subscribe systems

Cited by 46 publications

References 33 publications

Efficient Key Updates through Subscription Re-encryption for Privacy-Preserving Publish/Subscribe

Efficient Key Updates through Subscription Re-encryption for Privacy-Preserving Publish/Subscribe

Secure and efficient data‐sharing in clouds

CUPS: Secure opportunistic cloud of things framework based on attribute‐based encryption scheme supporting access policy update

Contact Info

Product

Resources

About