使用隐私功能扩展表达性访问策略
Extending Expressive Access Policies with Privacy Features
摘要：
身份验证、授权和信任验证是访问控制系统的核心部分。在这种系统中授予访问权限的条件收集在访问策略中。由于访问条件往往很复杂，因此使用专门的语言-政策语言-来定义政策。然而，目前的政策语言无法表达这样的条件，考虑到用户的隐私。与隐私保护技术，用户能够证明信息的访问system. In这项工作中，我们提出了一个通用的设计，支持隐私保护技术的政策语言。我们的设计防止不必要的敏感信息的披露，同时仍然允许制定的表达规则的访问控制。为此，我们使用零知识证明（NIZKs）。我们证明了我们的设计，将其应用到TPL策略语言，同时使用SNARKs。此外，我们还评估了由此产生的ZK-TPL语言及其相关的工具链。我们的评估表明，对于常规大小的凭证，通信和验证开销可以忽略不计。
英文摘要：
Authentication, authorization, and trust verification are central parts of an access control system. The conditions for granting access in such a system are collected in access policies. Since access conditions are often complex, dedicated languages -- policy languages -- for defining policies are in use. However, current policy languages are unable to express such conditions having privacy of users in mind. With privacy-preserving technologies, users are enabled to prove information to the access system without revealing it. In this work, we present a generic design for supporting privacy-preserving technologies in policy languages. Our design prevents unnecessary disclosure of sensitive information while still allowing the formulation of expressive rules for access control. For that we make use of zero-knowledge proofs (NIZKs). We demonstrate our design by applying it to the TPL policy language, while using SNARKs. Also, we evaluate the resulting ZK-TPL language and its associated toolchain. Our evaluation shows that for regular-sized credentials communication and verification overhead is negligible.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
