CT-ISG: Attribute-based Security and Messaging

消息传递系统是互联网的关键应用，但基于SMTP协议的互联网电子邮件等系统受到许多问题的困扰，例如滥用电子邮件收件箱（SPAM）的访问控制，身份验证（网络钓鱼和其他类型的欺诈），机密性（其中端到端加密仍然是一个挑战）和可靠性。 医疗和金融等重要应用领域已转向其他机制。 例如，疾病控制和预防中心（CDC）的消息传递标准设想了一种通信基于Web服务的体系结构，Web服务是分布式计算的一种新兴的基于XML的基础。 像银行和共同基金这样的金融实体已经开发出这样的技术，其中后端服务器系统实现它们自己的安全消息传递，而用户通过SMTP被通知消息并使用浏览器访问消息。 这个架构已经成为一个广泛的临时工作区，以实现一个实际的解决方案，但没有更深入的分析（特别是安全性），以确保其严格的基础。这个项目将开发新的架构和战略，安全的消息传递系统的基础上，基于属性的安全和消息。在这种方法中，主体的属性是访问控制、路由和安全转换的主要基础。 基于属性的访问控制承诺比访问控制列表和角色更大的灵活性和集成性。基于属性的消息传递使消息传递更加动态和有针对性。 基于属性的加密仅允许具有指定属性的主体解密消息。 该项目将推进这三种基于属性的技术，并评估它们在Web服务应用程序中的有效性。

Messaging systems are a critical application for the Internet, but systems like Internet email based on the SMTP protocol are beset by many problems such as abuse of access control for email in-bins (SPAM), authentication (phishing and other types of fraud), confidentiality (where end-to-end encryption is still a challenge), and reliability. Important application areas such as the medical and financial sectors have turned to other mechanisms. For example, the Centers for Disease Control and Prevention (CDC) standards for messaging envision an architecture in which communications are based on web services, an emerging XML-based foundation for distributed computing. Financial entities like banks and mutual funds have developed techniques where back-end server systems implement their own secure messaging while users are notified of messages by SMTP and use browsers to access messages. This architecture has emerged as a widespread ad hoc work-around to achieve a practical solution but without the deeper analyses (especially for security) for ensuring its rigorous foundations.This project will develop new architectures and strategies for secure messaging systems based on attribute-based security and messaging. In this approach, attributes of principals are the primary foundation for access control, routing, and security transformations. Attribute-Based Access Control promises greater flexibility and integration than access control lists and roles. Attribute-Based Messaging makes messaging more dynamic and targeted. Attribute-Based Encryption allows only the principals with specified attributes to decrypt messages. The project will advance these three attribute-based techniques and assess their effectiveness in a web-services application.