Attribute-based Access Control Mechanism Research Articles

Trusted Data Access Control Based on Logistics Business Collaboration Semantics

Trusted Data Access Control Based on Logistics Business Collaboration Semantics

Securing Cloud Data: An Enhanced Approach through Attribute-Based Access Control Mechanism

Cloud computing is considered one of the most dominant paradigms in the Information Technology (IT) industry these days. It offers new cost-effective services on-demand such as Software as a Service (SaaS), Infrastructure as a Service (IaaS) and Platform as a Service (PaaS). However, with all of these services promising facilities and benefits, there are still a number of challenges associated with utilizing cloud computing such as data security, abuse of cloud services, malicious insider and cyber-attacks. Among all security requirements of cloud computing, access control is one of the fundamental requirements in order to avoid unauthorized access to systems and protect organizations assets. Although, various access control models and policies have been developed such as Attribute based Access Control (ABAC) and Role Based Access Control (RBAC) for different environments, these models may not fulfil cloud’s access control requirements. In this paper, an enhanced attribute-based access control based on strategy mechanism is proposed by introducing a strategy for providing access control to the users in the cloud environment.

Massive Data Connection Architecture Design of Web Platform Based on Blockchain

In order to improve the universality and security of the data management of the Internet of Things and avoid the single point of failure problem in the traditional management architecture, this paper proposes a massive connection management architecture based on blockchain. The blockchain is reconstructed according to the hierarchical structure of blockchain technology, and with reference to the attribute-based access control mechanism, a data exchange model is designed using gossip mode and TLS networking mode to ensure the safe transmission of data. The peer computer network technology, data signature, and consensus mechanism are used to complete the design of the data exchange network layer and realize the design of the blockchain-based massive connection management architecture, so as to effectively avoid the single point of failure problem in the traditional management architecture and greatly reduce the burden of the management center. The access requests of massive devices in 5G application scenarios were simulated, and the results showed that the blockchain-based access control architecture designed in this article can quickly process received requests, with information leakage below 10%, improving the security and processing performance of data connections, achieving efficient processing and management of large-scale data, and providing reliable guarantees for the development of the Internet era.

TABI: Trust-Based ABAC Mechanism for Edge-IoT Using Blockchain Technology

Recent research has focused on applying blockchain technology to solve security-related problems in Internet of Things (IoT) networks. However, implementing blockchain technology directly on IoT networks is prone to high overheads and energy-expensive operations. Therefore, in this paper, we use edge computing technology to avoid these problems. We also propose a novel Trust-based Access Control Mechanism for Edge-IoT Networks using Blockchain technology (named TABI) to implement end-to-end security in resource-constrained IoT networks. The TABI mechanism utilizes both access control and trust evaluation mechanisms to mitigate the impact of malicious IoT users and devices. Additionally, it incorporates permissioned Hyperledger blockchain technology to provide an added layer of security through authentication. The trust evaluation mechanism is implemented as a trust calculation contract (TCC) on the edge devices using Hyperledger Composer. The access control mechanism employs an Attribute-based Access Control (ABAC) mechanism, which is implemented on the Hyperledger blockchain using two smart contracts: the attribute contract (AC) and the access control contract (ACC). We implement a proof-of-concept (PoC) implementation using Hyperledger Caliper (a benchmark testing tool) and Docker images. Our evaluation includes five analyses: Trust Evaluation Mechanism, Access Control Mechanism, Security, Blockchain, and IoT Applications. Through this evaluation, we highlight the effectiveness of TABI in terms of throughput, latency, detection of malicious IoT devices, and resource consumption of the IoT devices. Our analyses demonstrate that TABI is particularly useful in IoT applications that require low latency and resource efficiency.

Context-Based, Predictive Access Control to Electronic Health Records

Effective access control techniques are in demand, as electronically assisted healthcare services require the patient’s sensitive health records. In emergency situations, where the patient’s well-being is jeopardized, different healthcare actors associated with emergency cases should be granted permission to access Electronic Health Records (EHRs) of patients. The research objective of our study is to develop machine learning techniques based on patients’ time sequential health metrics and integrate them with an Attribute Based Access Control (ABAC) mechanism. We propose an ABAC mechanism that can yield access to sensitive EHRs systems by applying prognostic context handlers where contextual information, is used to identify emergency conditions and permit access to medical records. Specifically, we use patients’ recent health history to predict the health metrics for the next two hours by leveraging Long Short Term Memory (LSTM) Neural Networks (NNs). These predicted health metrics values are evaluated by our personalized fuzzy context handlers, to predict the criticality of patients’ status. The developed access control method provides secure access for emergency clinicians to sensitive information and simultaneously safeguards the patient’s well-being. Integrating this predictive mechanism with personalized context handlers proved to be a robust tool to enhance the performance of the access control mechanism to modern EHRs System.

RFAP: A Revocable Fine-Grained Access Control Mechanism for Autonomous Vehicle Platoon

Autonomous Vehicle Platoon (AVP) is conceived as a promising solution to enhance the traffic capacity and reduce the energy consumption in the intelligent transportation system. Nevertheless, AVP without security guarantees are prone to various attacks, which probably lead to life-threatening accidents. Motivated by solving this issue, an outsourced attribute-based access control mechanism with direct revocation for AVP (RFAP) is introduced in this paper. Among them, attribute-based encryption is utilized to implement fine-grained access control during the encryption process. Furthermore, RFAP can not only realize the immediate revocation of platoon member who is about to leave the platoon without affecting others, but also achieve secure outsourced decryption with the help of edge computing units for minimizing the computational overhead of decryption on the vehicle side. Security analysis and simulation results indicate that our RFAP mechanism is practical in aspects of security and efficiency.

An Attribute-Based Encryption Method Using Outsourced Decryption and Hierarchical Access Structure

Cloud computing is being rapidly adopted by many organizations from different domains and large amounts of data is stored in the cloud. In order to ensure data security, the attribute-based access control mechanism has been emerging recently as a fine-grained access control model that grants access based on the data user’s attributes. In this model, the data owner builds the access policy using the attributes of the data users and access to the data is granted only if the requirements of such an access policy are satisfied. Ciphertext policy-based attribute-based encryption (CPABE) is one of the most widely used methods for providing encrypted access control. Complex, time consuming and costly paring operations are the major issue with the CPABE method. Hence, another efficient method is needed to reduce the data user’s overhead while decrypting data. This paper presents an efficient method consisting in outsourcing decryption operations to a third-party server, so that complex operations may be performed by that machine with only some simple calculations left on the data user’s side. The concept of a hierarchical access structure is also integrated with the traditional CPABE technique. The hierarchical approach enables the data owner to encrypt multiple data using a single common hierarchical access structure. This allows the user to decrypt only the relevant part of ciphertext, depending on which fragment of the hierarchical access structure is satisfied. The paper evaluates also the performance of the proposed model in terms of time and storage cost.

A Non-Interactive Attribute-Based Access Control Scheme by Blockchain for IoT

As an important method of protecting data confidentiality in the Internet of Things (IoT), access control has been widely concerned. Because attribute-based access control mechanisms are dynamic, it is not only suitable to solve the dynamic access problem in IoT, but also to deal with the dynamic caused by node movement and access data change. The traditional centralized attribute-based access control mechanism has some problems: due to the large number of devices in IoT, the central trusted entity may become the bottleneck of the whole system. Moreover, when a central trusted entity is under distributed denial-of-service (DDoS) attack, the entire system may crash. Blockchain is a good way to solve the above problems. Therefore, we developed a non-interactive, attribute-based access control scheme that applies blockchain technology in IoT scenarios by using PSI technology. In addition, the attributes of data user and data holder are hidden, which protects the privacy of both parties’ attributes and access policy. Furthermore, the experimental results indicate that our scheme has high efficiency.

Trust-Based Blockchain Authorization for IoT

Authorization or access control limits the actions a user may perform on a computer system, based on predetermined access control policies, thus preventing access by illegitimate actors. Access control for the Internet of Things (IoT) should be tailored to take inherent IoT network scale and device resource constraints into consideration. However, common authorization systems in IoT employ conventional schemes, which suffer from overheads and centralization. Recent research trends suggest that blockchain has the potential to tackle the issues of access control in IoT. However, proposed solutions overlook the importance of building dynamic and flexible access control mechanisms. In this paper, we design a decentralized attribute-based access control mechanism with an auxiliary Trust and Reputation System (TRS) for IoT authorization. Our system progressively quantifies the trust and reputation scores of each node in the network and incorporates the scores into the access control mechanism to achieve dynamic and flexible access control. We design our system to run on a public blockchain, but we separate the storage of sensitive information, such as user’s attributes, to private sidechains for privacy preservation. We implement our solution in a public Rinkeby Ethereum test-network interconnected with a lab-scale testbed. Our evaluations consider various performance metrics to highlight the applicability of our solution for IoT contexts.

Distributed Ciphertext-Policy Attribute-Based Encryption With Enhanced Collusion Resilience and Privacy Preservation

In recent years, numerous incidents of information leakage have not only violated the privacy of users but also been a key issue hindering the development of cloud computing. How to guarantee the confidentiality of shared data while protecting the privacy of users has become a hot topic of research. In this article, we propose a decentralized attribute-based access control mechanism. Compared with the existing well-known schemes, the proposed scheme enhances private security and the confidentiality of shared data. An anonymous key extraction protocol is introduced to help users prove their identities with zero knowledge and help the authorities to generate legitimate private keys without knowing the users global identifiers and specific attributes. We also eliminate linear relationships among the keys appearing in the previous reported works, which makes unauthorized users unable to combine their private keys to generate a legal secret key or combine their respective decryption results to recover the plaintext message. Performance and security analyses show that the new work is secure against collusion attacks, thus protecting users’ privacy and security. Besides, the security of the proposed scheme is reduced to the q-PBDHE assumption in the standard model.

The Importance of Body Part Labeling to Enable Enterprise Imaging: A HIMSS-SIIM Enterprise Imaging Community Collaborative White Paper

In order for enterprise imaging to be successful across a multitude of specialties, systems, and sites, standards are essential to categorize and classify imaging data. The HIMSS-SIIM Enterprise Imaging Community believes that the Digital Imaging Communications in Medicine (DICOM) Anatomic Region Sequence, or its equivalent in other data standards, is a vital data element for this role, when populated with standard coded values. We believe that labeling images with standard Anatomic Region Sequence codes will enhance the user’s ability to consume data, facilitate interoperability, and allow greater control of privacy. Image consumption—when a user views a patient’s images, he or she often wants to see relevant comparison images of the same lesion or anatomic region for the same patient automatically presented. Relevant comparison images may have been acquired from a variety of modalities and specialties. The Anatomic Region Sequence data element provides a basis to allow for efficient comparison in both instances. Interoperability—as patients move between health care systems, it is important to minimize friction for data transfer. Health care providers and facilities need to be able to consume and review the increasingly large and complex volume of data efficiently. The use of Anatomic Region Sequence, or its equivalent, populated with standard values enables seamless interoperability of imaging data regardless of whether images are used within a site or across different sites and systems. Privacy—as more visible light photographs are integrated into electronic systems, it becomes apparent that some images may need to be sequestered. Although additional work is needed to protect sensitive images, standard coded values in Anatomic Region Sequence support the identification of potentially sensitive images, enable facilities to create access control policies, and can be used as an interim surrogate for more sophisticated rule-based or attribute-based access control mechanisms. To satisfy such use cases, the HIMSS-SIIM Enterprise Imaging Community encourages the use of a pre-existing body part ontology. Through this white paper, we will identify potential challenges in employing this standard and provide potential solutions for these challenges.

Internet of Things Access Control System Based on Hyperledger

The current access control of IoT devices adopts the traditional method of centralized control, which leads to the shortcomings of single point of failure and low efficiency of the entire system. Due to the increasing amount of data generated by the Internet of Things network and the more complex data structure, the traditional access control system has exposed the problem of insufficient security when communicating. Based on the characteristics of blockchain decentralization, non-tampering, and programmable Hyperledger, an attribute-based access control mechanism combining blockchain with the Internet of Things is proposed to realize dynamic changes to the access control strategy and ensure the access control of the Internet of Things Safety and reliability.

AACS: Attribute-Based Access Control Mechanism for Smart Locks

This article researched the security and application of smart locks in Internet of Things environments in the domain of computer and engineer science and symmetry. Smart locks bring much convenience for users. However, most smart lock systems are cloud-based and it is problematic managing and enforcing the permissions of an authorized device if the device is offline. Moreover, most smart lock systems lack fine-grained access control and cascading removal of permissions. In this paper, we leverage attribute-based access control mechanisms to manage the access of visitors with different identities. We use identity-based encryption to verify the identity of the visitor. In our proposed system, the administrator uses the policy set in the smart lock to implement access control on the device side, which reduces the dependence of access control on the server. We set attributes such as role, time, date, and location to have fine-grained control over access to different permissions and roles that might appear in the house. And the scheme provides the cascading delete function while providing the group access function. Our solution considers multiple roles in the home as well as hierarchical management issues, and improves the applicability of the smart lock system in complex residential and commercial situations. In the experimental section, we show that our system can be applied to premises with many different inhabitant identities.

Secure and Efficient Attribute-Based Access Control Optimization Scheme for EMR System

Electronic Medical Record (EMR) system based on the cloud has serious leaks of patient data and private information. Access control and privacy protection are considered to be the keys to ensuring the privacy of patients. Attribute-Based Access Control (ABAC) can realize fine-grained control of cloud medical data, but lacks the corresponding encryption mechanism. Moreover, as the scale of medical data grows, the number of entity attributes and policies required by ABAC is increasing, leading to performance degradation. Most of the existing research schemes focus on security but ignore efficiency, and the encryption scheme does not fit ABAC mechanism well. This paper proposed a retrieval method that enables attribute value, which filtered invalid policies, and improved Ciphertext-Policy Attribute-Based Encryption (CP-ABE), shared attribute set with ABAC to save attribute processing time, thus constructing a secure and efficient SE-ABAC solution in EMR system. Finally, through simulation experiment analysis, the optimizes solution is effective and more efficient than traditional ABAC.

Lightweight job submission and file sharing schemes for a teaching ecosystem for parallel computing courses

Parallel computing has been widely used in various industries. Many colleges and universities have launched courses on parallel computing and can build teaching ecosystems to serve these courses. Job submission and file sharing are two essential functionalities. This paper builds a teaching ecosystem for parallel computing courses and proposes lightweight job submission and file sharing schemes for the ecosystem. The job submission scheme supports Pthread, OpenMP, and MPI (message passing interface) jobs. It has five working modes: demonstration, experiment, examination, research, and maintenance. In particular, the examination mode can be applied for online examinations. For the fair use of resources, the job submission scheme not only limits the submission times of each student and the run time of each job but also designs a fair job scheduling algorithm. The ecosystem adopts Samba to supply file sharing services. To ensure the safety of the shared files, this paper proposes a lightweight attribute-based access control mechanism. This mechanism uses Python logical expressions to describe access rules; thus, it is not only easy to use but also able to describe complicated rules. In addition, the ecosystem has a well-structured module design that facilitates functionality expansion and modification. Experiments verify the feasibility and validity of the ecosystem.

A framework for the extended evaluation of ABAC policies

A main challenge of attribute-based access control (ABAC) is the handling of missing information. Several studies have shown that the way standard ABAC mechanisms, e.g. based on XACML, handle missing information is flawed, making ABAC policies vulnerable to attribute-hiding attacks. Recent work has addressed the problem of missing information in ABAC by introducing the notion of extended evaluation, where the evaluation of a query considers all queries that can be obtained by extending the initial query. This method counters attribute-hiding attacks, but a naïve implementation is intractable, as it requires an evaluation of the whole query space. In this paper, we present a framework for the extended evaluation of ABAC policies. The framework relies on Binary Decision Diagram (BDDs) data structures for the efficient computation of the extended evaluation of ABAC policies. We also introduce the notion of query constraints and attribute value power to avoid evaluating queries that do not represent a valid state of the system and to identify which attribute values should be considered in the computation of the extended evaluation, respectively. We illustrate our framework using three real-world policies, which would be intractable with the original method but which are analyzed in seconds using our framework.

An Enhancement Role and Attribute Based Access Control Mechanism in Big Data

To be able to leverage big data to achieve enhanced strategic insight and make informed decision, an efficient access control mechanism is needed for ensuring end to end security of such information asset. Attribute Based Access Control (ABAC), Role Based Access Control (RBAC) and Event Based Access Control (EBAC) are widely used access control mechanisms. The ABAC system is much more complex in terms of policy reviews, hence analyzing the policy and reviewing or changing user permission are quite complex task. RBAC system is labor intensive and time consuming to build a model instance and it lacks flexibility to efficiently adapt to changing user’s, objects and security policies. EBAC model considered only the events to allocate access controls. Yet these mechanisms have limitations and offer feature complimentary to each other. So in this paper, Event-Role-Attribute based fine grained Access Control mechanism is proposed, it provide a flexible boundary which effectively adapt to changing user’s, objects and security policies based on the event. The flexible boundary is achieved by using temporal and environment state of an event. It improves the big data security and overcomes the disadvantages of the ABAC and RBAC mechanisms. The experiments are conducted to prove the effectiveness of the proposed Event-Role-Attribute based Access Control mechanism over ABAC and RBAC in terms of computational overhead.

A Privacy Preserving Attribute Based Access Control Mechanism In Distributed Environment for Cloud Storage

We propose a new decentralized access control scheme for secure data storage in clouds that supports anonymous authentication. In the proposed scheme, the cloud verifies the authenticity of the series without knowing the user’s identity before storing data. Our scheme also has the added feature of access control in which only valid users are able to decrypt the stored information. The scheme prevents replay attacks and supports creation, modification, and reading data stored in the cloud. We also address user revocation. Moreover, our authentication and access control scheme is decentralized and robust, unlike other access control schemes designed for clouds which are centralized. The communication, computation, and storage overheads are comparable to centralized approaches.

Fine-Grained Two-Factor Access Control for Web-Based Cloud Computing Services

In this paper, we introduce a new fine-grained two-factor authentication (2FA) access control system for web-based cloud computing services. Specifically, in our proposed 2FA access control system, an attribute-based access control mechanism is implemented with the necessity of both a user secret key and a lightweight security device. As a user cannot access the system if they do not hold both, the mechanism can enhance the security of the system, especially in those scenarios where many users share the same computer for web-based cloud services. In addition, attribute-based control in the system also enables the cloud server to restrict the access to those users with the same set of attributes while preserving user privacy, i.e., the cloud server only knows that the user fulfills the required predicate, but has no idea on the exact identity of the user. Finally, we also carry out a simulation to demonstrate the practicability of our proposed 2FA system.

Analysis of Healthcare Workflows in Accordance with Access Control Policies

Healthcare information systems deal with sensitive data across complex workflows. They often allow various stakeholders from different environments to access data across organizational boundaries. This elevates the risk of exposing sensitive healthcare information to unauthorized personnel, leading ‘controlling access to resources' a major concern. To prevent unwanted access to sensitive information, healthcare organizations need to adopt effective workflows and access control mechanisms. Many healthcare organizations are not yet considering or do not know how to accommodate the ‘context' element as a crucial element in their workflows and access control policies. The authors envision the future of healthcare where ‘context' will be considered as a crucial element. They can accommodate context through a new element ‘environment' in workflows, and can accommodate context in policies through well-known attribute based access control mechanism (ABAC). This research mainly addresses these problems by proposing a model to integrate workflows and access control policies and thereby identifying workflow activities that are not being protected by access control policies and improving the workflow activities and/or existing access control policies using SARE (Subject, Action, Resource, and environment) elements.