Overview
This research introduces DVAC (Distributed Version control system Access Control), a scheme designed to implement cryptographic access control within distributed version control systems (DVCS). DVAC aims to address limitations in existing access control mechanisms for both central (CVCS) and distributed version control systems, particularly concerning the necessity of central servers and fine-grained write permission enforcement in distributed environments.
Research Context
Version control systems (VCS) are utilized for managing changes to software code and various document types. These systems fall into two primary categories: central VCS (CVCS) and distributed VCS (DVCS). In CVCS, data is retrieved from a central server, whereas in DVCS, each entity independently stores the entire repository and facilitates sharing. A noted characteristic of existing access control schemes in VCS is their reliance on central server participation, making them unsuitable for fully distributed scenarios. Furthermore, these schemes often lack the capability to enforce fine-grained access control for write permissions, which is critical for collaborative work in distributed settings.
Approach
DVAC is engineered to enforce a cryptographic access control protocol for DVCS. The scheme leverages attribute-based encryption (ABE) and attribute-based signature (ABS) to apply cryptographic access control directly on distributed user nodes. A core design principle of DVAC is to enable file granularity read and write separation access control without requiring support from a central server. To ensure the integrity of fundamental version control functions within DVCS while concurrently protecting data security, DVAC incorporates a version control adaptation protocol. Access control policies within DVAC are maintained using Ethereum smart contracts, which are utilized for distributed storage and trusted management of these policies. The architecture of DVAC is designed for seamless integration with existing mature DVCS platforms, such as Git, requiring minimal modifications. A prototype implementation of DVAC was developed and integrated with Git.
Findings
- DVAC successfully enforces cryptographic access control on distributed user nodes.
- The scheme utilizes attribute-based encryption (ABE) and attribute-based signature (ABS).
- DVAC enables file-granularity read and write separation access control without central server support.
- A version control adaptation protocol is incorporated to maintain DVCS core function integrity and data security.
- Access control policies are stored and managed through Ethereum smart contracts, providing distributed and trusted management.
- The architecture allows for integration with existing DVCS like Git with minimal modifications.
- Performance evaluation of the DVAC prototype integrated with Git indicated a modest overhead.
Why This Matters
The development of DVAC offers a mechanism for enforcing cryptographic access control in distributed version control systems without relying on a central server. This addresses a critical gap in existing VCS access control schemes, which typically require central server participation. By enabling file-granularity read and write separation and managing policies via Ethereum smart contracts, DVAC could enhance security and decentralization in collaborative software development and document management environments.