Contrôle d’Accès Sécurisé dans l’Info-Nuage Mobile (Secure Access Control in Mobile Cloud)

Mobile cloud computing has emerged as a promising technology to make use of highly scalable servers in the cloud, and to overcome the limitations of mobile devices. However, because of the risks associated with the security and privacy of enterprises’ stored-data in the cloud, most IT and chief executive officers are concerned about using this type of technology. These concerns are intensified when users/employees tend to use wireless devices (e.g. laptops and smart phones) to stay connected while moving across/outside the enterprise.  In this thesis, we develop new methods, based on Attribute-Based Encryption (ABE) technique, to design secure and efficient data access control for mobile cloud. These methods allow data owners (enterprises or individuals) to ensure security of data and provide fine-grained access of data to mobile users using defined policies and constraints. We start by exploring security threats and challenges related to access provision of data stored in the cloud. We identify challenging issues, when attribute-based access control is used by mobile devices, related to anonymity, mobility, and restricted computational resources of devices. To address these issues, we develop three methods; each of them is the subject of one contribution.   The first contribution provides privacy preserving anonymous access of data stored in the cloud. It develops a new statistical anonymity model for ABE, provides cryptanalysis results for existing contributions in anonymous attribute-based encryption, and presents a new multi-authority ABE (i.e. FACS) that anonymizes users’ identities (without trusting any authority or provider). It also extends FACS to EFACS, which enables it to support users’ statistical anonymity. The second contribution provides Location-Based Services (LBSs) for attribute-based access control in mobile cloud. More specifically, it introduces a new multi-authority attribute-based access control scheme (i.e. PPLBACS) that anonymizes users’ identities against malicious authorities and providers. The proposed scheme uses dynamic location of mobile users as a contextual attribute, employs location interval constraints as a policy, and authorizes access to legitimate mobile users. The third contribution provides spatio-temporal anonymity for location-aware access control in mobile cloud. In particular, it presents a new decentralized multi-authority ABE scheme (i.e. IDMA-ABE), which supports intervals for the domains of attributes/policies. Based on DMA-ABE scheme, a new Location-Based Access Control Scheme (LBACS) is proposed. LBACS aims at: (a) supporting coexistence of spatio-temporal attributes as well as static attributes; (b) using range of values (instead of a specific value) for domains of spatio-temporal policies and specific values for other policies/constraints; and (c) protecting users’ identities against malicious Cloud Service Provider (CSP). We also extend LBACS to ELBACS in order to provide untraceability and spatio-temporal statistical anonymity of users without trusting authorities and providers.

Keyphrases: Access Control, Mobile Cloud, Attribute-Based Encryption, Location-Based Services