SDN结合云网中基于上下文的加密与访问控制技术研究

Software Defined Network (SDN), which enables to control the network flow centralized and delicately, could visibly stimulate the innovation and development of the cloud computing technologies. However, considering the random access for various unknown applications and users with dynamic permission in programmable SDN enabled cloud computing networks, the threats of disclosure or abuse for the key resource are increasing. In order to handle these multiple security threats, we will explore dynamic encryption and access control models which could not only combine static and dynamic states but also mix network uniform and user dedicated strategy so as to realize confidentiality protection and flexible access control for data flow. To be specific, for privacy protection, an attribute-based encryption with location restriction and an inner-product encryption with k-times limitation schemes are designed respectively. By applying access control encryption, the read-write rights are taken into consideration simultaneously. Meanwhile, after introducing trust value, a user behavior based access control mechanism with the mixture of attribute-based encryption and UCON model are presented for continuity and dynamic fine-grained request. Furthermore, taking advantage of the SDN structure, hierarchical encryption and access control service compositions are proposed based on network situation and user demand for inner domain scene. Finally, the prototype system and the corresponding testing platform are developed so as to evaluate and verify the feasibility of the relevant theoretical results.

SDN便于实现网络流量的集中化控制和精细化管理，能够更好地推动云计算技术的创新发展。然而，可编程的SDN结合云网中，面对权限多变、访问随机的各类未知应用/用户的访问请求，重要资源被泄露与滥用的风险日益加大。因此，本项目以数据的机密性保护和灵活的访问控制为目标，探索构建基于上下文的动态加密与访问控制系统，使其在策略上具有静态与动态结合、网络全局统一与用户专有定制结合的独特优势。具体地，针对域间保护隐私、限制用户读写的资源访问需求，结合访问控制加密，研究基于位置隐私的属性加密算法和基于访问不可关联的k-次限制内积加密方案；针对连续、细粒度的动态跨域资源访问与版权保护需求，引入信任度，提出基于行为的UCON融合属性加密模型；针对SDN域内资源访问场景，利用其架构优势，设计基于网络态势和用户需求的加密与访问控制服务组合策略；最后，本项目将搭建试验平台对关键技术和核心成果进行验证评估。

针对可编程的SDN结合云网中，重要资源的机密性保护与细粒度安全共享访问需求，本项目探索构建了基于上下文的动态加密与访问控制系统，方案结合了静态与动态策略，具有兼顾网络全局统一与用户专有定制的独特优势。具体地，我们设计了内积加密方案来盲化访问中心点和用户所在位置，再结合静态属性加密，云服务可以在不知限定位置与用户位置情况下进行位置范围过滤，并为符合静态属性要求的用户进行代理解密；我们提出了基于访问不可关联的k-次限制内积加密方案，用户与云服务器通过交互的零知识证明协议，可在不泄露身份及之前访问信息的情况下，向服务器证明这是其第k次访问请求；针对跨域连续、细粒度资源访问与版权保护需求，我们提出的跨域UCON模型，可对域间访问进行信任传递；针对SDN域内资源访问场景，我们设计了分级加密与访问控制模式以及基于Trie树的安全功能组合策略。最后，我们在试验平台对关键技术进行了验证评估。