Security and privacy issues have become a rapidly growing problem with the fast development of big data in public health.However,big data faces many ongoing serious challenges in the process of collection,storage,and ...Security and privacy issues have become a rapidly growing problem with the fast development of big data in public health.However,big data faces many ongoing serious challenges in the process of collection,storage,and use.Among them,data security and privacy problems have attracted extensive interest.In an effort to overcome this challenge,this article aims to present a distributed privacy preservation approach based on smart contracts and Intel Software Guard Extensions(SGX).First of all,we define SGX as a trusted edge computing node,design data access module,data protection module,and data integrity check module,to achieve hardware-enhanced data privacy protection.Then,we design a smart contract framework to realize distributed data access control management in a big data environment.The crucial role of the smart contract was revealed by designing multiple access control contracts,register contracts,and history contracts.Access control contracts provide access control methods for different users and enable static access verification and dynamic access verification by checking the user’s properties and history behavior.Register contract contains user property information,edge computing node information,the access control and history smart contract information,and provides functions such as registration,update,and deletion.History contract records the historical behavior information of malicious users,receives the report information of malicious requestors from the access control contract,implements a misbehavior check method to determines whether the requestor has misbehavior,and returns the corresponding result.Finally,we design decentralized system architecture,prove the security properties,and analysis to verify the feasibility of the system.Results demonstrate that our method can effectively improve the timeliness of data,reduce network latency,and ensure the security,reliability,and traceability of data.展开更多
Kerberos是广泛应用于云计算、物联网等场景下的身份认证系统,其密钥分发中心(key distribution center,KDC)的数据库存储着明文的密钥信息,在分布式环境中存在存储管理、内存泄露等安全隐患,进而影响身份认证系统的安全.因此提出基于In...Kerberos是广泛应用于云计算、物联网等场景下的身份认证系统,其密钥分发中心(key distribution center,KDC)的数据库存储着明文的密钥信息,在分布式环境中存在存储管理、内存泄露等安全隐患,进而影响身份认证系统的安全.因此提出基于Intel SGX(software guard extensions)的Kerberos安全增强方案,将密钥的初始化和身份认证流程中涉及密钥使用模块迁移至SGX提供的安全隔离区域Enclave中,通过基于硬件支持的内存隔离机制动态保护密钥;在安全区内使用密封机制密封存储至数据库.通过实验证明了该方案能够保障密钥动态和静态的机密性和完整性,减小了可信计算基础的范围.而性能评估显示,该方案在保障密钥运行和存储安全的同时,性能的额外开销也在可接受范围之内.展开更多
基金This work was supported by the National Natural Science Foundation of China(Grant No.61762033)Hainan Provincial Natural Science Foundation of China(Grant Nos.2019RC041 and 2019RC098)+2 种基金Opening Project of Shanghai Trusted Industrial Control Platform(Grant No.TICPSH202003005-ZC)Ministry of Education Humanities and Social Sciences Research Program Fund Project(Grant No.19YJA710010)Zhejiang Public Welfare Technology Research(Grant No.LGF18F020019).
文摘Security and privacy issues have become a rapidly growing problem with the fast development of big data in public health.However,big data faces many ongoing serious challenges in the process of collection,storage,and use.Among them,data security and privacy problems have attracted extensive interest.In an effort to overcome this challenge,this article aims to present a distributed privacy preservation approach based on smart contracts and Intel Software Guard Extensions(SGX).First of all,we define SGX as a trusted edge computing node,design data access module,data protection module,and data integrity check module,to achieve hardware-enhanced data privacy protection.Then,we design a smart contract framework to realize distributed data access control management in a big data environment.The crucial role of the smart contract was revealed by designing multiple access control contracts,register contracts,and history contracts.Access control contracts provide access control methods for different users and enable static access verification and dynamic access verification by checking the user’s properties and history behavior.Register contract contains user property information,edge computing node information,the access control and history smart contract information,and provides functions such as registration,update,and deletion.History contract records the historical behavior information of malicious users,receives the report information of malicious requestors from the access control contract,implements a misbehavior check method to determines whether the requestor has misbehavior,and returns the corresponding result.Finally,we design decentralized system architecture,prove the security properties,and analysis to verify the feasibility of the system.Results demonstrate that our method can effectively improve the timeliness of data,reduce network latency,and ensure the security,reliability,and traceability of data.
