Data Access Control Scheme Research Articles

Robust and Scalable Data Access Control in D2D Communications

As an emerging technique in 5G cellular networks, D2D communication efficiently utilizes the available resources. However, the concerns of data security, identity privacy, and system scalability have not been sufficiently addressed. In this paper, we propose a robust and scalable data access control scheme (RSDAC) in D2D communication, where the key build block is a multi-authority ciphertext-policy attribute-based encryption (MA-CP-ABE) with the large universe and verifiable outsourced decryption. In RSDAC, the system attribute universe is scalable, which is exponentially large without resource waste. Each base station (BS) governs the whole attribute universe individually. The data owner can define any monotonic access structure to encrypt its data. During the key generation phase, each BS can independently verify the user’s legitimacy and then generate an intermediate key for the legal user according to its attribute set. A core network server (CNS) acts as the central authority which will generate the final private key for the user basing on his intermediate key. We also design an efficient method to offload the complicated decryption to some devices with adequate computation resource and further check the correctness of decryption result. The security analysis and performance comparison indicate that our scheme is secure, efficient, and applicable.

A Novel Efficient Pairing-Free CP-ABE Based on Elliptic Curve Cryptography for IoT

Ciphertext-policy attribute-based encryption (CP-ABE) is a promising cryptographic technique that integrates data encryption with access control for ensuring data security in IoT systems. However, the efficiency problem of CP-ABE is still a bottleneck limiting its development and application. A widespread consensus is that the computation overhead of bilinear pairing is excessive in the practical application of ABE, especially for the devices or the processors with limited computational resources and power supply. In this paper, we proposed a novel pairing-free data access control scheme based on CP-ABE using elliptic curve cryptography, abbreviated PF-CP-ABE. We replace complicated bilinear pairing with simple scalar multiplication on elliptic curves, thereby reducing the overall computation overhead. And we designed a new way of key distribution that it can directly revoke a user or an attribute without updating other users’ keys during the attribute revocation phase. Besides, our scheme use linear secret sharing scheme access structure to enhance the expressiveness of the access policy. The security and performance analysis show that our scheme significantly improved the overall efficiency as well as ensured the security.

Secure Multi-Authority Data Access Control Scheme in Cloud Storage System Based on Attribute-Based Signcryption

Nowadays, secure data access control has become one of the major concerns in a cloud storage system. As a logical combination of attribute-based encryption and attribute-based signature, attribute-based signcryption (ABSC) can provide confidentiality and an anonymous authentication for sensitive data and is more efficient than traditional “encrypt-then-sign” or “sign-then-encrypt” strategies. Thus, ABSC is suitable for fine-grained access control in a semi-trusted cloud environment and is gaining more and more attention in recent years. However, in many previous ABSC schemes, user’s sensitive attributes can be disclosed to the authority, and only a single authority that is responsible for attribute management and key generation exists in the system. In this paper, we propose PMDAC-ABSC, a novel privacy-preserving data access control scheme based on Ciphertext-Policy ABSC, to provide a fine-grained control measure and attribute privacy protection simultaneously in a multi-authority cloud storage system. The attributes of both the signcryptor and the designcryptor can be protected to be known by the authorities and cloud server. Furthermore, the decryption overhead for user is significantly reduced by outsourcing the undesirable bilinear pairing operations to the cloud server without degrading the attribute privacy. The proposed scheme is proven to be secure in the standard model and has the ability to provide confidentiality, unforgeability, anonymous authentication, and public verifiability. The security analysis, asymptotic complexity comparison, and implementation results indicate that our construction can balance the security goals with practical efficiency in computation.

Toward Delay-Tolerant Flexible Data Access Control for Smart Grid With Renewable Energy Resources

In the smart grid with renewable energy resources (RERs), the residential units (RUs) with distributed energy resources are considered to be both power consumers and suppliers. Specifically, RUs with excessive renewable generations can trade with the utility in deficit of power supplies for mutual benefits. It causes two challenging issues. First, the trading data of RUs are quite sensitive, which should be only accessed by authorized users with fine-grained policies. Second, the behaviors of the RUs to generate trading data are spontaneous and unpredictable, and then the problem is how to guarantee system efficiency and delay tolerance simultaneously. In this paper, we propose a delay-tolerant flexible data access control scheme based on key policy attribute-based encryption for smart grid with RERs. We adopt the secret-sharing scheme to realize a flexible access control with encryption delay tolerance. Furthermore, there is no central trusted server to perform the encryption/decryption. We reduce the computation cost on RUs and operators via a semitrusted model. The analysis shows that the proposed scheme can meet the data security requirement of the smart grid with RERs, and it also has less cost compared with other popular models.

A fair data access control towards rational users in cloud storage

In cloud storage, many encrypted data are inaccessible unless several users are simultaneously present. However, when directly adopting the existing rational secret sharing schemes, it is difficult to achieve a fair key reconstruction, which leads that none of the users sends their shares and no one can access the shared data. To address this problem, this paper introduces an incentive exchange mechanism into rational secret sharing, and proposes a fair data access control scheme for cloud storage. In the proposed scheme, a large number of fake keys are generated to obfuscate the decryption key of the shared data. During the exchange of shares, a user is required to first send his/her shares when he/she deviates from the prescribed scheme. This punishes the users’ selfish behaviors and incentives them to access the shared data together. Theoretical analysis shows that, in the proposed scheme, the Nash equilibrium is that all the users always send their shares, enabling them to reconstruct the decryption key fairly. Additionally, extensive experiments demonstrate that the proposal can control data access policies efficiently.

DECENT: Secure and fine-grained data access control with policy updating for constrained IoT devices

The Internet of Things (IoT) is a novel paradigm where many of the objects that surround us can be connected to the internet. Since IoT is always related to user's personal information, it raises lot of data security and privacy issues. In this paper, we present a secure and fine-grained data access control scheme for constrained IoT devices and cloud computing based on hierarchical attribute-based encryption, which reduces the key management by introducing hierarchical attribute authorities. In order to relieve local computation burden, we propose an outsourced encryption and decryption construction by delegating most of laborious operations to gateway and cloud server. Further, our scheme achieves efficient policy updating, which allows the sender device to update access policies without retrieving and re-encrypting the data. The security and performance analysis results show that our scheme is secure and efficient.

Secure, efficient and revocable data sharing scheme for vehicular fogs

With the rapid development of vehicular networks, the problem of data sharing in vehicular networks has attached much attention. However, existing data access control schemes in cloud computing cannot be applied to the scenario of vehicular networks, because cloud computing paradigm cannot satisfy the rigorous requirement posed by latency-sensitive mobile application. Fog Computing is a paradigm that extends Cloud computing and services to the edge of the network. The vehicular fog is the ideal platform to achieve data sharing in vehicular networks. In this paper, we propose a revocable data sharing scheme for vehicular fogs. We construct a new multi-authority ciphertext policy attribute-based encryption (CP-ABE) scheme with efficient decryption to realize data access control in vehicular network system, and design an efficient user and attribute revocation method for it. The analysis and the simulation results show that our scheme is secure and highly efficient.

A fine-grained and lightweight data access control scheme for WSN-integrated cloud computing

WSN-integrated cloud computing (WCC) has become a promising cloud service architecture, in which sensors and mobile devices are utilized as the data collecting and processing nodes for the cloud service model, while cloud servers can provide computing services and storage services with high performance and reliability. However, since cloud servers are not fully trusted, and sensors and mobile devices have very limited computing capability and storage capacity, WCC brings forth new challenges for data confidentiality, data integrity and access control when sensors store important data for sharing in the WCC environment. Moreover, there are still no proper solutions for fine-grained, efficient and secure data access control in WCC. To solve this issue, we propose a fine-grained and lightweight data access control scheme for WCC, namely FLAC, which includes a ciphertext-policy attribute-based encryption algorithm for data confidentiality and fine-grained data access control, and an attribute-based signature algorithm for data integrity and the many-read-many-write case of data access. By delegating most computation intensive tasks to cloud services, FLAC enables resource constrained sensors and mobile devices to perform security operations rapidly. The security assessment and performance evaluation demonstrate that FLAC is secure, highly efficient and well suited for WSN applications.

An Efficient and Fine-Grained Big Data Access Control Scheme With Privacy-Preserving Policy

How to control the access of the huge amount of big data becomes a very challenging issue, especially when big data are stored in the cloud. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising encryption technique that enables end-users to encrypt their data under the access policies defined over some attributes of data consumers and only allows data consumers whose attributes satisfy the access policies to decrypt the data. In CP-ABE, the access policy is attached to the ciphertext in plaintext form, which may also leak some private information about end-users. Existing methods only partially hide the attribute values in the access policies, while the attribute names are still unprotected. In this paper, we propose an efficient and fine-grained big data access control scheme with privacy-preserving policy. Specifically, we hide the whole attribute (rather than only its values) in the access policies. To assist data decryption, we also design a novel attribute bloom filter to evaluate whether an attribute is in the access policy and locate the exact position in the access policy if it is in the access policy. Security analysis and performance evaluation show that our scheme can preserve the privacy from any linear secret-sharing schemes access policy without employing much overhead.

On the Security of Data Access Control for Multiauthority Cloud Storage Systems

Data access control has becoming a challenging issue in cloud storage systems. Some techniques have been proposed to achieve the secure data access control in a semitrusted cloud storage system. Recently, K. Yang et al. proposed a basic data access control scheme for multiauthority cloud storage system (DAC-MACS) and an extensive data access control scheme (EDAC-MACS). They claimed that the DAC-MACS could achieve efficient decryption and immediate revocation and the EDAC-MACS could also achieve these goals even though nonrevoked users reveal their Key Update Keys to the revoked user. However, through our cryptanalysis, the revocation security of both schemes cannot be guaranteed. In this paper, we first give two attacks on the two schemes. By the first attack, the revoked user can eavesdrop to obtain other users’ Key Update Keys to update its Secret Key, and then it can obtain proper Token to decrypt any secret information as a nonrevoked user. In addition, by the second attack, the revoked user can intercept Ciphertext Update Key to retrieve its ability to decrypt any secret information as a nonrevoked user. Secondly, we propose a new extensive DAC-MACS scheme (NEDAC-MACS) to withstand the above two attacks so as to guarantee more secure attribute revocation. Then, formal cryptanalysis of NEDAC-MACS is presented to prove the security goals of the scheme. Finally, the performance comparison among NEDAC-MACS and related schemes is given to demonstrate that the performance of NEDAC-MACS is superior to that of DACC, and relatively same as that of DAC-MACS.

An efficient signcryption for data access control in cloud computing

Data storage is one of main services in cloud computing. How to ensure the confidentiality and authorized access of data is the central issue of data storage. In this paper, we propose a novel data access control scheme that can simultaneously achieve confidentiality and authentication for cloud computing. In this scheme, users store encrypted data in the cloud. When a user wants to access the data, the data owner delegates the cloud to re-encrypt the data and only the authorized user can decrypt the data. The cloud can not get any plaintext information about the data. In addition, the authorized user can verify the integrity and authentication of the data. We realize the data access control scheme by proposing an identity-based signcryption (IBSC) scheme with proxy re-encryption. We prove that the IBSC scheme has the indistinguishability against adaptive chosen ciphertext attack under the decisional bilinear Diffie-Hellman problem and existential unforgeability against adaptive chosen message attack under the computational Diffie-Hellman problem in the random oracle model.

A novel temporal access control scheme for outsourced data in cloud with user revocation

E-governance can be implemented very effectively using the cloud computing technologies. Security and privacy of data are the major challenges in cloud-based e-governance systems. With proper access control and user revocation schemes, we can protect the privacy and security of data stored in cloud servers used for e-governance. There are a lot of techniques to achieve the controlled access in cloud computing. In some applications of e-government, the users should be allowed to access data, only for a specific period of time. In this paper, we introduce a temporal access control scheme based on attribute-based encryption (ABE), which allows users to access the data according to their access policy and for a specific time period only. Our model includes both the temporal access scheme and a time-based proxy re-encryption scheme to allow a user's access right to expire automatically.

A Novel Temporal Access Control Scheme for Outsourced Data in Cloud with User Revocation

E-governance can be implemented very effectively using the cloud computing technologies. Security and privacy of data are the major challenges in cloud-based e-governance systems. With proper access control and user revocation schemes, we can protect the privacy and security of data stored in cloud servers used for e-governance. There are a lot of techniques to achieve the controlled access in cloud computing. In some applications of e-government, the users should be allowed to access data, only for a specific period of time. In this paper, we introduce a temporal access control scheme based on attribute-based encryption (ABE), which allows users to access the data according to their access policy and for a specific time period only. Our model includes both the temporal access scheme and a time-based proxy re-encryption scheme to allow a user's access right to expire automatically.

Secure Data Access Control With Ciphertext Update and Computation Outsourcing in Fog Computing for Internet of Things

Fog computing is a paradigm that extends cloud computing to the edge of the network. It can provide computation and storage services to end devices in Internet of Things (IoT). Attribute-based cryptography is a well-known technology to guarantee data confidentiality and fine-grained data access control. However, its computational cost in encryption and decryption phase is linear with the complexity of policy. In this paper, we propose a secure and fine-grained data access control scheme with ciphertext update and computation outsourcing in fog computing for IoT. The sensitive data of data owner are first encrypted using attribute-based encryption with multiple policies and then outsourced to cloud storage. Hence, the user whose attributes satisfy the access policy can decrypt the ciphertext. Based on the attribute-based signature technique, authorized user whose attributes integrated in the signature satisfy the update policy can renew the ciphertext. Specifically, most of the encryption, decryption, and signing computations are outsourced from end devices to fog nodes, and thus, the computations for data owners to encrypt, end users to decrypt, re-encrypt, and sign are irrelevant to the number of attributes in the policies. The security analysis shows that the proposed scheme is secure against known attacks, and the experimental results show that the fog nodes perform most of the computation operations of encryption, decryption, and signing, and hence, the time of encryption for data owner, decryption, re-encryption, and signing for users is small and constant.

Secure and efficient data access control in cloud computing environment: A survey

Cloud computing is very emerging area in IT industries. In a cloud environment, many distributed systems are interconnected to provide software, hardware and resources over the internet. Since this new paradigm requires users to ensure the security of their personal data, there are gradually increasing security and privacy issues on outsourced data. A natural way to keep the data in a confidential manner is to encrypt it before storing on cloud server. The main problems of this process include building scalable access control for storing data and revoking access rights from users if they are revoked from the system. Many access control schemes have been already developed. In this paper, a taxonomy and brief survey of secure data access control schemes in cloud environment have been presented. The current research issues and future work directions are also presented in this paper in the area of security of cloud computing.

New large-universe multi-authority ciphertext-policy ABE scheme and its application in cloud storage systems

We propose a new ciphertext-policy attribute-based encryption system. In this system, any string can be used as an attribute of the system, and there are several authorities, each of which is responsible for the authorized key distribution of a specific set of attributes. Then, we prove its security under two static assumptions without random oracle. The main techniques used in this work are Waters' hash over global identifier and attribute information in the construction, as well as dual system encryption in the security proof. To the best of our knowledge, this is the first ciphertext-policy attribute-based encryption system satisfying both of large-universe property and multi-authority property without random oracle. Finally, as the application of our new scheme, we propose a new data access control scheme for cloud storage systems.

Cryptographically Enforced Data Access Control in Personal Health Record Systems

Personal Health Record (PHR) systems play a vital role during digital transformation of healthcare. These systems provide many value-added features like viewing one's health related information, secure transmission and tracking of that information with the health service providers. A cloud assisted PHR system maximizes the possibility for PHR systems to interoperate with other systems in health information management environments. Each patient needs to encrypt his/her PHR data before uploading it in the cloud since the patients will lose their physical access to their health data stored in cloud servers. Moreover, to achieve fine-grained data access control on encrypted PHR data in an effective and scalable manner is a challenging task. Since there are multiple owners or patients are available in a PHR system and existing data access control schemes are mostly designed for the single-authority/owner scenarios, a novel patient-centric data access control scheme called Revocable Multi Authority Attribute Set Based Encryption (R- MA- ASBE) is proposed. The proposed scheme inherits flexibility, scalability and fine-grained patient-centric data access control.

Enhanced Retreat of Cloud Storage Data users by Using Improved Data Access Control Scheme for Multi-Authority Cloud Storage

Enhanced Retreat of Cloud Storage Data users by Using Improved Data Access Control Scheme for Multi-Authority Cloud Storage

Secure and efficient fine-grained data access control scheme in cloud computing1

Cloud computing, which provides quite inexpensive and dynamically scalable computing services via network and communication infrastructures, is increasingly important for future information and communication technologies. At the same time, it brings many new chal- lenges for data security and access control when sensitive data are shared and stored on cloud servers. To protect the data privacy, cryptographic methods are usually used. Attribute-based encryption is a good way to implement access control. However, in practical application, efficiency of attribute-based encryption schemes is rather low due to a large number of algebraic operations. Thus, it is very important to improve efficiency of user addition/revocation and file re-encryption. In this paper we introduce an improved data access control scheme based on attribute-based encryption. Our scheme significantly improves the efficiency of adding and revoking user access to the cloud.

EPPS: Efficient and Privacy-Preserving Personal Health Information Sharing in Mobile Healthcare Social Networks.

Mobile healthcare social networks (MHSNs) have emerged as a promising next-generation healthcare system, which will significantly improve the quality of life. However, there are many security and privacy concerns before personal health information (PHI) is shared with other parities. To ensure patients’ full control over their PHI, we propose a fine-grained and scalable data access control scheme based on attribute-based encryption (ABE). Besides, policies themselves for PHI sharing may be sensitive and may reveal information about underlying PHI or about data owners or recipients. In our scheme, we let each attribute contain an attribute name and its value and adopt the Bloom filter to efficiently check attributes before decryption. Thus, the data privacy and policy privacy can be preserved in our proposed scheme. Moreover, considering the fact that the computational cost grows with the complexity of the access policy and the limitation of the resource and energy in a smart phone, we outsource ABE decryption to the cloud while preventing the cloud from learning anything about the content and access policy. The security and performance analysis is carried out to demonstrate that our proposed scheme can achieve fine-grained access policies for PHI sharing in MHSNs.