Access Control Policies Research Articles

Dual Fine-Grained Public-Key Searchable Encryption from Lattices

Fine-grained public key encryption with keyword search (PEKS), allowing users to search on encrypted data with flexible access control policy, has been widely studied recently due to its promising application to real-world scenarios such as cloud computing. However, most of the existing fine-grained PEKS schemes are either only able to support single access control (e.g., attribute-based access control) or susceptible to being attacked or compromised by quantum computers in or after a short time. In this paper, we propose a fine-grained PEKS scheme that o ers dual access control based on lattice. In particular, we first define a dual fine-grained PEKS primitive against chosen keyword attacks under selective security. Subsequently, we adapt the key homomorphic technique and noise rerandomization technique to design a concrete scheme. Particularly, the keyword space in our construction is unlimited. Then, we present a formal security proof against chosen keyword attacks on the learning with errors (LWE) problem in the standard model. Moreover, we demonstrate the theoretical performance and experimental result of our proposed scheme. Finally, we discuss that our scheme can be easily extended to support conjunctive keywords and delegation without incurring complex operations.

Design of the Secure Smart Home System Based on the Blockchain and Cloud Service

In this paper, a variety of cloud service combinations is used to form the control core of a smart home, realize data forwarding, storage, and analysis in the cloud, and complete the remote management of smart home devices. This paper studies the secure access control of smart home data combined with the blockchain technology and password technology to realize the secure and efficient access control of smart home data. The system can achieve the goal of independent research and development. Aiming at the problem that the access control of a smart home is generally managed by third-party authorized institutions and there is an unauthorized access, a blockchain-based smart home (BSH) access control scheme is proposed. The scheme extends the attribute-based access control model (ABAC) and applies the blockchain technology to the smart home ABAC model to realize fine-grained access control. In the scheme, the resource provider first publishes the access control policy of the resource to the blockchain. If the resource visitor wants to access the resource, he needs to submit an access request to the blockchain and use an SM2 threshold signature to process the transaction proposal. The endorsement peer node in the blockchain runs the access control policy smart contract to decide whether to grant access rights. This scheme can ensure that resource providers can participate in all the processes of access control and avoid the risk of unauthorized access caused by the centralized management of the third party. Finally, the simulation experiment is carried out on the Hyperledger Fabric alliance chain development platform. The results show that the BSH access control scheme has good applicability in the smart home scenario.

BCST-APTS: Blockchain and CP-ABE Empowered Data Supervision, Sharing, and Privacy Protection Scheme for Secure and Trusted Agricultural Product Traceability System

Blockchain provides new technologies and ideas for the construction of agricultural product traceability system (APTS). However, if data is stored, supervised, and distributed on a multiparty equal blockchain, it will face major security risks, such as data privacy leakage, unauthorized access, and trust issues. How to protect the privacy of shared data has become a key factor restricting the implementation of this technology. We propose a secure and trusted agricultural product traceability system (BCST-APTS), which is supported by blockchain and CP-ABE encryption technology. It can set access control policies through data attributes and encrypt data on the blockchain. This can not only ensure the confidentiality of the data stored in the blockchain, but also set flexible access control policies for the data. In addition, a whole-chain attribute management infrastructure has been constructed, which can provide personalized attribute encryption services. Furthermore, a reencryption scheme based on ciphertext-policy attribute encryption (RE-CP-ABE) is proposed, which can meet the needs of efficient supervision and sharing of ciphertext data. Finally, the system architecture of the BCST-APTS is designed to successfully solve the problems of mutual trust, privacy protection, fine-grained, and personalized access control between all parties.

A Security Framework for Scientific Workflow Provenance Access Control Policies

The notion of collaborative scientific workflow is coined to address the increasing need for collaborative data analytics. In collaborative environments, access control policies are necessary for controlling the sharing of workflows, data products, and provenance information among collaborating parties. In particular, the protection of workflow provenance is critical because it often encodes the detailed protocol of a scientific experiment and carries the intellectual property of the respective stakeholders. In addition, since scientific workflows often evolve quickly, the corresponding access control policies for workflow provenance have to evolve as well. It is important to ensure that the evolution of workflow provenance access control policies maintain certain properties, in order to guarantee the correctness and performance of the corresponding policy enforcement. In this paper, we 1) propose a role-based access control model for scientific workflow provenance; 2) define three quality requirements for scientific workflow provenance access control policies - consistency, completeness, and conciseness; 3) develop a mechanism mapping from specifications of workflows to their counterparts in a provenance that preserves such quality properties, and 4) conduct a case study on a scientific workflow for autism behavioral data analysis that demonstrates the feasibility of our proposed analysis algorithms.

A Multi-Factor Authentication-Based Framework for Identity Management in Cloud Applications

User's data is considered as a vital asset of several organizations. Migrating data to the cloud computing is not an easy decision for any organization due to the privacy and security concerns. Service providers must ensure that both data and applications that will be stored on the cloud should be protected in a secure environment. The data stored on the public cloud will be vulnerable to outside and inside attacks. This paper provides interactive multi-layer authentication frameworks for securing user identities on the cloud. Different access control policies are applied for verifying users on the cloud. A security mechanism is applied to the cloud application that includes user registration, granting user privileges, and generating user authentication factor. An intrusion detection system is embedded to the security mechanism to detect malicious users. The multi factor authentication, intrusion detection, and access control techniques can be used for ensuring the identity of the user. Finally, encryption techniques are used for protecting the data from being disclosed. Experimental results are carried out to verify the accuracy and efficiency of the proposed frameworks and mechanism. The results recorded high detection rate with low false positive alarms.

Towards Blockchain-Based Secure Storage and Trusted Data Sharing Scheme for IoT Environment

Nowadays, cloud-based storage systems play a vital role in IoT data storage, processing, and sharing. Despite its contribution, the current cloud-based architecture may cause severe data leakage or jeopardize user privacy. Meanwhile, the cloud-based architecture heavily relies on a trusted third-party auditor (TPA) and runs in a centralized control manner. However, the TPA may not be a completely trustworthy entity, and a single point of failure might cause the centralized system to collapse. Fortunately, with the advent of blockchain technology, the decentralized storage model has gained popularity. A decentralized storage system successfully eradicates the rule of TPA, solves the problem of a single point of failure, and has many advantages over a centralized control architecture, such as low storage prices and high throughput. This study offers a blockchain-based decentralized distributed storage and sharing scheme that provides end-to-end encryption and fine-grained access control. In our proposed IoTChain model, fine-grained permission is based on attribute-based access control (A-BAC) policy by employing the Ethereum blockchain as an auditable access control layer. Smart contracts are tailored for the IoTChain model, which combines the Ethereum blockchain and the interplanetary file system (IPFS). We used an advanced encryption standard (AES) for encryption and the elliptic curve Diffie-Hellman key exchange protocol for secret key sharing between data owners and users. Also, the proof-of-work (PoW) consensus mechanism is replaced with a proof-of-authority (PoA) to minimize system transaction cost and boost system throughput. Additionally, our solution has been tested on the Ethereum official test network Rinkeby, and the results demonstrate that our approach is realistic and economical on the IoT data.

Misconfiguration-Free Compositional SDN for Cloud Networks

Cloud computing provides a new paradigm to offer flexible IT infrastructures. In IaaS clouds, tenants deploy software-defined networking (SDN) policies to simplify network management and customize network behaviors. However, programming SDN networks is error-prone no matter using low-level APIs or high-level programming languages. Specifically, SDN policies may contain misconfigurations that do not break the pre-defined network invariants (e.g., black holes), but either degrade the deployment efficiency or mistakenly translate tenants intents. Prior studies for checking either traditional access control policies or network-wide invariants, are thus fail to detect these misconfigurations. To address this gap, this paper presents PMM, a misconfiguration checking tool for compositional SDN that works at the data plane of cloud networks. We first propose a new data structure, minimal interval set, to represent the match patterns of rulesets. This representation serves the basis for composition algebra construction and misconfiguration checking. We then propose the principles, algorithms and also optimisations for fast and accurate checking. We finally implement PMM in Covisor. Experiments with both real-world rulesets and synthetic rulesets show that PMM can detect misconfigurations of SDN policies in cloud networks within hundreds of milliseconds.

DSMAC: Privacy-Aware Decentralized Self-Management of Data Access Control Based on Blockchain for Health Data

In recent years, the interest in using wireless communication technologies and mobile devices in the healthcare environment has increased. However, despite increased attention to the security of electronic health records, patient privacy is still at risk for data breaches. Thus, it is quite a challenge to involve an access control system especially if the patients’ medical data are accessible by users who have diverse privileges in different situations. Blockchain is a new technology that can be adopted for decentralized access control management issues. Nevertheless, different scalability, security, and privacy challenges affect this technology. To address these issues, we suggest a novel Decentralized Self-Management of data Access Control (DSMAC) system using a blockchain-based Self-Sovereign Identity (SSI) model for privacy-preserving medical data, empowering patients with mechanisms to preserve control over their personal information and allowing them to self-grant access rights to their medical data. DSMAC leverages smart contracts to conduct Role-based Access Control policies and adopts the implementation of decentralized identifiers and verifiable credentials to describe advanced access control techniques for emergency cases. Finally, by evaluating performance and comparing analyses with other schemes, DSMAC can satisfy the privacy requirements of medical systems in terms of privacy, scalability, and sustainability, and offers a new approach for emergency cases.

A Fine-grained Dynamic Access Control Method for Power IoT Based on Kformer

The existing static ABAC(Attribute-Based Access Control) model cannot fully meet the increasingly complex, dynamic and scalable demands of the power grid. At the same time, its versatility and flexibility bring high costs. Additionally, the increasing complexity of organizational systems and the need for federated access to their resources make implementing and managing access control more challenging. This paper proposes a fine-grained dynamic access control method based on Kformer to automate authorization management tasks. We use Kformer, which filters and integrates external knowledge through feed-forward layers in Transformer. Then, we use BERT(Bidirectional Encoder Representations from Transformer) to perform feature extraction on the input fused text, extract the implied attribute-authority relationship from the log records and external documents, and finally, perform sequence modeling on the extracted attribute features and input the obtained results. The final authorization result is obtained by classification through the softmax function in the final fully connected layer. The authorization management of the user’s request to the object is dynamically completed. Finally, using the access data of the grid information system to evaluate the method proposed by us, the experimental results show that the model can continuously monitor the access behavior of users inside the grid information system, change the access rights of entities and adjust the policy in real-time, and carry out dynamic access authorization. At the same time, the accuracy of the generated access control policy can reach 87.73%.

Securing utility computing using enhanced elliptic curve cryptography and attribute-based access control policy

Securing utility computing using enhanced elliptic curve cryptography and attribute-based access control policy

Dynamic generation of access control policies from social policies

Access to and processing of personal data is regulated by norms that are written down in legal source documents, including laws, regulations and contracts. Compliance can be automated through the formalisation of these norms, reducing human effort and making the applied interpretations explicit. In addition, trust between parties may increase, thus promoting collaborations to gain more insights from sharing data. Although several policy specification languages have been proposed, there are not many that can be used to specify both social policies, such as privacy regulations and contracts, and system-level policies such as those used for access control. In this work, we present extensions to eFLINT, a domain-specific language developed to formalise norms from various sources. The extensions make it possible to interconnect social and system-level policies. We demonstrate the new features of eFLINT within the healthcare domain by formalising the regulatory document of the SIOPE DIPG/DMG Network, a consortium established to advance research into a rare form of pediatric brain cancer, and by showing how the resulting specifications are used to automate compliance checking of access and processing requests made by members of the consortium.

A consortium blockchain-based information management system for unmanned vehicle logistics

Unmanned vehicle (UDV) delivery technology can meet the special needs of users and realize efficient and flexible distribution of logistics orders. However, there are risks of order data leakage and tampering in the intelligent logistics distribution environment. To solve this problem, this paper designs and implements a system based on the Hyperledger Fabric blockchain platform. Based on the blockchain technology, the system adopts a distributed architecture to establish a secure and trustworthy logistics data management platform to achieve the integrity and traceability of data in the logistics process. The data dual-chain storage strategy is used to ensure the efficiency of data queries. Furthermore, four smart contracts including order management contract (OMC), access control management contract (ACC), access control policy management contract (ACPC), and environmental data management contract (EDC) are designed in combination with the attribute-based access control strategy. By triggering the smart contract, the controllable access of order data can be realized. Finally, two groups of experiments are designed to test the performance of the system. Experimental results show that the proposed system can maintain high throughput in a large-scale request environment under the premise of ensuring data security.

Securing utility computing using enhanced elliptic curve cryptography and attribute-based access control policy

Securing utility computing using enhanced elliptic curve cryptography and attribute-based access control policy

Big Data between Quality and Security: Dynamic Access Control for Collaborative Platforms

Big Data often refers to a set of technologies dedicated to deal with large volumes of data. Data Quality and Data Security are two essential aspects for any Big Data project. While Data Quality Management Systems are about putting in place a set of processes to assess and improve certain characteristics of data such as Accuracy, Consistency, Completeness, Timeliness, etc., Security Systems are designed to protect the Confidentiality, Integrity and Availability of data. In a Big Data environment, data quality processes can be blocked by data security mechanisms. Indeed, data is often collected from external sources that could impose their own security policies. In many research works, it has been recognized that merging and integrating access control policies are real challenges for Big Data projects. To address this issue, we suggest in this paper a framework to secure data collection in collaborative platforms. Our framework extends and combines two existing frameworks namely: PolyOrBAC and SLA- Framework. PolyOrBAC is a framework intended for the protection of collaborative environments. SLA-Framework, for its part, is an implementation of the WS-Agreement Specification, the standard for managing bilaterally negotiable SLAs (Service Level Agreements) in distributed systems; its integration into PolyOrBAC will automate the implementation and application of security rules. The resulting framework will then be incorporated into a data quality assessment system to create a secure and dynamic collaborative activity in the Big Data context.

On the Expressive Power of Negated Conditions and Negative Authorizations in Access Control Models

Access control policies specify which access requests should be allowed or denied in a system. Many access control policy models have used the concept of “negation” as part of their policy language, to enable fine-grained specification of authorizations. We identify two forms of this concept in the literature, namely, negated conditions and negative authorizations (deny rules). We argue that the choice of supporting negated conditions or negative authorizations can affect the expressive power of a policy model. Understanding their differences is crucial for designing an appropriate policy model for an intended application. However, no prior work has concretely analyzed them.In this work, we formally analyze the expressive power of negated conditions and negative authorizations. We formulate two abstract policy models that support negated conditions and negative authorizations (including consideration of different meta-policies). Then, using a logic-based representation of policies, we prove the relative expressive power of those models in the context of a formal access control expressiveness analysis framework. The main result of our analysis is that models which support negated conditions are more expressive than models that support negative authorizations. That is, using negated conditions, we can represent all policies that can be expressed using negative authorizations. However, the converse is not true, i.e., negative authorizations cannot fully represent policies supporting negated conditions.

Specification and adaptive verification of access control policy for cyber-physical-social spaces

Cyber-Physical-Social Space (CPSS) is a promising paradigm to provide people with an intelligent environment by emphasizing the deep fusion of cyberspace, physical space, and social space. The interdependence of these spaces makes that CPSS is more likely to be attacked. The attack consequences may directly affect the state of the physical world and even endanger the people’s life. Thus, the most challenging issue for CPSS is to ensure the space security. However, existing security analysis methods focus on the static analysis at the design phase. They do not consider the open and dynamic characteristics which are the core features of CPSS. In this paper, we propose an adaptive security analysis framework for CPSS to prevent the unauthorized flow of information. Firstly, the access control model of CPSS is proposed. It controls the access behaviors by considering the space information covering the social, cyber, and physical spaces. Secondly, Labelled Transition System (LTS) is established to describe the future evolutions of CPSS. The space states in the LTS which violate the security requirements are reasoned by the model checking technology. Thirdly, a policy adjustment method is proposed to prevent the system from entering the violated states or mitigate the bad results caused by the violations. In the end, the effectiveness of our approach is evaluated by a smart building case, and the necessity of our approach is analyzed by the performance evaluation.

A Novel Blockchain-Based Encryption Model to Protect Fog Nodes from Behaviors of Malicious Nodes

The world has experienced a huge advancement in computing technology. People prefer outsourcing their confidential data for storage and processing in cloud computing because of the auspicious services provided by cloud service providers. As promising as this paradigm is, it creates issues, including everything from data security to time latency with data computation and delivery to end-users. In response to these challenges, the fog computing paradigm was proposed as an extension of cloud computing to overcome the time latency and communication overhead and to bring computing and storage resources close to both the ground and the end-users. However, fog computing inherits the same security and privacy challenges encountered by traditional cloud computing. This paper proposed a fine-grained data access control approach by integrating the ciphertext policy attribute-based encryption (CP-ABE) algorithm and blockchain technology to secure end-users’ data security against rogue fog nodes in case a compromised fog node is ousted. In this approach, we proposed federations of fog nodes that share the same attributes, such as services and locations. The fog federation concept minimizes the time latency and communication overhead between fog nodes and cloud servers. Furthermore, the blockchain idea and the CP-ABE algorithm integration allow for fog nodes within the same fog federation to conduct a distributed authorization process. Besides that, to address time latency and communication overhead issues, we equip each fog node with an off-chain database to store the most frequently accessed data files for a particular time, as well as an on-chain access control policies table (on-chain files tracking table) that must be protected from tampering by rogue fog nodes. As a result, the blockchain plays a critical role here because it is tamper-proof by nature. We assess our approach’s efficiency and feasibility by conducting a simulation and analyzing its security and performance.

An Effective Naming Heterogeneity Resolution for XACML Policy Evaluation in a Distributed Environment

Policy evaluation is a process to determine whether a request submitted by a user satisfies the access control policies defined by an organization. Naming heterogeneity between the attribute values of a request and a policy is common due to syntactic variations and terminological variations, particularly among organizations of a distributed environment. Existing policy evaluation engines employ a simple string equal matching function in evaluating the similarity between the attribute values of a request and a policy, which are inaccurate, since only exact match is considered similar. This work proposes several matching functions which are not limited to the string equal matching function that aim to resolve various types of naming heterogeneity. Our proposed solution is also capable of supporting symmetrical architecture applications, in which the organization can negotiate with the users for the release of their resources and properties that raise privacy concerns. The effectiveness of the proposed matching functions on real XACML policies, designed for universities, conference management, and the health care domain, is evaluated. The results show that the proposed solution has successfully achieved higher percentages of Recall and F-measure compared with the standard Sun’s XACML implementation, with our improvement, these measures gained up to 70% and 57%, respectively.

Design of the Wireless Network Hierarchy System of Intelligent City Industrial Data Management Based on SDN Network Architecture

With the rapid development of the industrial Internet of Things and the comprehensive popularization of mobile intelligent devices, the construction of smart city and economic development of wireless network demand are increasingly high. SDN has the advantages of control separation, programmable interface, and centralized control logic. Therefore, integrating this technical concept into the smart city data management WLAN network not only can effectively solve the problems existing in the previous wireless network operation but also provide more functions according to different user needs. In this case, the traditional WLAN network is of low cost and is simple to operate, but it cannot guarantee network compatibility and performance. From a practical perspective, further network compatibility and security are a key part of industrial IoT applications. This paper designs the network architecture of smart city industrial IoT based on SDN, summarizes the access control requirements and research status of industrial IoT, and puts forward the access control requirements and objectives of industrial IoT based on SDN. The characteristics of the industrial Internet of Things are regularly associated with data resources. In the framework of SDN industrial Internet of Things, gateway protocol is simplified and topology discovery algorithm is designed. The access control policy is configured on the gateway. The access control rule can be dynamically adjusted in real time. An SDN-based intelligent city industrial Internet of Things access control function test platform was built, and the system was simulated. The proposed method is compared with other methods in terms of extension protocol and channel allocation algorithm. Experimental results verify the feasibility of the proposed scheme. Finally, on the basis of performance analysis, the practical significance of the design of a smart city wireless network hierarchical data management system based on SDN industrial Internet of Things architecture is expounded.

Detecting violations of access control and information flow policies in data flow diagrams

The security of software-intensive systems is frequently attacked. High fines or loss in reputation are potential consequences of not maintaining confidentiality, which is an important security objective. Detecting confidentiality issues in early software designs enables cost-efficient fixes. A Data Flow Diagram (DFD) is a modeling notation, which focuses on essential, functional aspects of such early software designs. Existing confidentiality analyses on DFDs support either information flow control or access control, which are the most common confidentiality mechanisms. Combining both mechanisms can be beneficial but existing DFD analyses do not support this. This lack of expressiveness requires designers to switch modeling languages to consider both mechanisms, which can lead to inconsistencies. In this article, we present an extended DFD syntax that supports modeling both, information flow and access control, in the same language. This improves expressiveness compared to related work and avoids inconsistencies. We define the semantics of extended DFDs by clauses in first-order logic. A logic program made of these clauses enables the automated detection of confidentiality violations by querying it. We evaluate the expressiveness of the syntax in a case study. We attempt to model nine information flow cases and six access control cases. We successfully modeled fourteen out of these fifteen cases, which indicates good expressiveness. We evaluate the reusability of models when switching confidentiality mechanisms by comparing the cases that share the same system design, which are three pairs of cases. We successfully show improved reusability compared to the state of the art. We evaluated the accuracy of confidentiality analyses by executing them for the fourteen cases that we could model. We experienced good accuracy.