在不信任服务器的情况下实施密码学分布式版本控制系统访问控制
Enforcing Cryptographic Distributed-VCS Access Control with No Trust on Servers
浏览论文内容
中文总结 AI 辅助
针对现有分布式VCS访问控制需中央服务器参与、写权限细粒度控制缺失的问题，提出基于ABE和ABS的DVAC方案，借助以太坊智能合约实现无中央服务器的文件粒度读写访问控制，原型开销较小且可与Git集成。
中文摘要 AI 辅助
版本控制系统（VCS）包括集中式版本控制系统（CVCS）和分布式版本控制系统（DVCS），被广泛用于管理软件代码及各类文档的变更。与从中央服务器获取数据的CVCS不同，DVCS中每个实体都存储整个仓库并独立共享。现有VCS访问控制方案需要中央服务器参与，无法部署在完全分布式场景，且往往无法对写权限实施细粒度访问控制，而这对分布式环境下的协作工作至关重要。本文提出一种分布式版本控制系统访问控制方案（命名为DVAC），该方案基于属性加密（ABE）和属性签名（ABS），在分布式用户节点上实施密码学访问控制。DVAC旨在为DVCS实施密码学访问控制协议，无需中央服务器支持即可实现文件粒度的读写分离访问控制。为在保护数据安全性的同时确保DVCS核心版本控制功能的完整性，DVAC纳入版本控制适配协议。此外，DVAC利用以太坊智能合约维护访问控制策略，确保访问策略的分布式存储与可信管理。DVAC的架构设计可与现有成熟的DVCS（如Git）无缝集成，仅需少量修改。我们已实现DVAC原型并将其与Git集成，开展全面性能评估以评估DVAC引入的开销，结果表明该开销较小。
英文摘要
Version control systems (VCS), including central VCS (CVCS) and distributed VCS (DVCS), are widely adopted to manage changes to software code and various types of documents. Unlike CVCS, where entities obtain data from a central server, each entity in DVCS stores the entire repository and shares it independently. In VCS, existing access control schemes require the participation of a central server and cannot be deployed in a completely distributed scenario. Additionally, these schemes often fail to enforce fine-grained access control for write permissions, which is crucial for collaborative work in a distributed environment. In this paper, we propose a distributed version control system access control scheme (named DVAC), which enforces cryptographic access control on distributed user nodes based on attribute-based encryption (ABE) and attribute-based signature (ABS). DVAC is designed to enforce a cryptographic access control protocol for DVCS, which enables file granularity read and write separation access control without the support of a central server. To ensure the integrity of the core version control functions in DVCS while protecting data security, DVAC incorporates a version control adaptation protocol. Additionally, DVAC leverages Ethereum smart contracts to maintain access control policies, ensuring distributed storage and trusted management of access policies. The architecture of DVAC is designed to seamlessly integrate with existing mature DVCS, such as Git, with minimal modifications. We have implemented a prototype of DVAC and integrated it with Git. A comprehensive performance evaluation was conducted to assess the overhead introduced by DVAC, and it was demonstrated that the overhead is modest.
