Attribute-based Access Control System Research Articles

Combo-Chain: Towards a hierarchical attribute-based access control system for IoT with smart contract and sharding technique

The Internet of Things (IoT) provides a collaborative environment among different entities (i.e., users, IoT devices, sensors, applications, etc.) to access resources. Despite the benefits that IoT technology brings to individuals, society, and industry, this technology faces a critical challenge in controlling access to various resources in IoT environments. To address this challenge, we propose Combo-Chain, an blockchain-based access control system deeply rooted in the concepts of the attribute-based access control (ABAC) model, smart contracts, and sharding. Combo-Chain introduces the concept of hierarchy for both subject attributes and object attributes to enhance flexibility and dynamicity when specifying ABAC policies, simplifying policy and attribute management. It not only manages access policies but also attributes by deploying a set of smart contracts. Furthermore, Combo-Chain utilizes sharding technique to distribute the overhead associated with storing and managing both access policies and attributes. Sharding also helps Combo-Chain to distribute the computational overhead when evaluating access requests among two groups of nodes, addressing the issues of low scalability and poor performance often associated with blockchain technology. Combo-Chain is implemented on a private Ethereum platform, and the experimental results demonstrate the superiority of Combo-Chain compared to existing blockchain-based access control systems.

Enabling Attribute-based Access Control for OpenStack Cloud Resources through Smart Contracts

The increasing complexity of cloud computing has prompted a greater emphasis on protecting the privacy, integrity, and security of data stored and processed in the cloud. Data privacy is safeguarded through access control, but existing models such as Role Based Access Control (RBAC) and Attribute Based Access Control (ABAC) rely on a centralized server. If this server is compromised, it poses significant risks to data security. To address this issue, there is a need for Distributed ABAC (DABAC) system for OpenStack services based on blockchain. The unique features of blockchain enables access control systems which ensures data integrity and privacy. Additionally, blockchain offers a level of transparency for both the resource owner and a user. In this work, we propose a smart contract based ABAC system. We implemented the proposed work using an Ethereum blockchain and OpenStack cloud. Furthermore, we evaluated two consensus algorithms for scalability analysis of DABC mechanism. The results demonstrate that DABAC performs better than ABAC in ensuring fine-grade access control with proof of stake consensus algorithm providing better scalability.

Self sovereign and blockchain based access control: Supporting attributes privacy with zero knowledge

Recent years have witnessed, especially in Europe, a shift aimed at bringing users back at the center of digital systems. This has driven innovation towards the affirmation of decentralized systems, in line with the Self Sovereign Identity paradigm. User control over the consumption and disclosure of their data is a key topic of such drive. In this paper we show how it is possible to apply this increasingly popular concept to a traditionally centralized and opaque digital process: Access Control systems. To this aim we expand the XACML standard for Attribute Based Access Control systems with the novel concept of private attributes, i.e. attributes whose values should not be disclosed while still contributing to a policy evaluation result after user consent. Basing our proposal on blockchain systems, we show how to leverage smart contracts and zero knowledge proofs to allow for transparent policies evaluation without disclosing the value of such sensible attributes. Beside formalizing our goals, presenting the system architecture, and discussing its advantages and drawbacks with respect to the traditional model, we provide a reference example to show our proposal innovative capabilities and provide a prototype experimental evaluation to prove its feasibility.

A Privacy Risk Assessment Scheme for Fog Nodes in Access Control System

In the fog computing, it is difficult to satisfy the security and privacy requirement for traditional access control system, such as attribute-based access control system. Risk-based access control system can adapt to the dynamic fog environment. However, the existing risk schemes are modeled for users in majority, not for fog nodes, and the context and privacy sensitivity are rarely considered. In this article, we propose a risk assessment scheme for fog nodes in access control system. Firstly, to improve the accuracy of risk score, the risk assessment is modeled with the subject, object, and context for fog nodes; Secondly, we address the risk assessment computing module for every component. Moreover, we depict system model for risk assessment and implement its prototype system risk assessment model. In the end, the reasonability and correctness of computing model are analyzed by proving and simulation. According to the experiments, the accuracy of risk score is higher than that of the work-based access control and dynamic access control for IoT. Therefore, the feasibility and effectiveness of this scheme are proved through the experiments.

SmartAccess: Attribute-Based Access Control System for Medical Records Based on Smart Contracts

Cross-organisation data sharing is challenging because all the involved organisations must agree on ’how’ and ’why’ the data is processed. Due to a lack of transparency, the organisations need to trust that others comply with the agreements and regulations. We propose to exploit blockchain and smart contracts technologies to define an Attribute-Based Access Control System for cross-organisation medical records sharing, coined SmartAccess. SmartAccess offers joint agreement over access policies and dynamic access control besides blockchain transparency and auditability. We leverage the Attribute-Based Access Control model to implement smart contracts.We deploy and test them on a private and permissioned blockchain, transforming the access control process into a distributed smart contract execution. This paper proposes the SmartAccess system and its application in two healthcare use cases. We introduce the threat model and perform a security analysis of the system. To demonstrate the feasibility of our proposal, we implement a proof-of-concept of the smart contracts, written in Solidity language, with a size-efficient policy representation, and analyse the complexity and scalability of the contracts’ functions. Furthermore, we present performance results, measuring the latency and throughput of the transactions to execute the access control functions with different blockchain network consensus setups. We also compare the performance of the SmartAccess system against two open-source Solidity implementations of smart contract-based access control, Role-based Access Control and Access Control List. Finally, we discuss the strengths and drawbacks of our proposal. SmartAccess requires the overhead of a decentralised system, but the trade-off is transparency, regulation compliance and auditability for complex cross-organisation data sharing.

Enabling Workforce Optimization in Constrained Attribute-Based Access Control Systems.

Effective utilization of human capital is one of the key requirements for any successful business endeavor, with reorganization necessary if there are nonproductive employees or employees that are retiring. However, while reorganizing tasks for newer employees, it should be ensured that the employees have the requisite capabilities of handling the assigned tasks. Furthermore, security constraints forbid any arbitrary assignment of tasks to employees and also enforce major dependencies on other employees who have access to the same tasks. Since Attribute Based Access Control (ABAC) is poised to emerge as the de facto model for specifying access control policies in commercial information systems, we consider organizational policies and constraints to be modeled with ABAC. Given the increasing size and scale of organizations, both in terms of employees and resources that need to be managed, it is crucial that computational solutions are developed to automate the process of employee to task assignment. In this work, we define the Employee Replacement Problem (ERP) which answers the question of whether a given set of employees can be replaced by a smaller set of employees, while ensuring that the desired security constraints are not violated. We prove that the problem is NP-hard and use CNF-SAT to obtain a solution. An extensive experimental evaluation is carried out on diverse data sets to validate the efficiency of the proposed solution.

A revocable attribute-based access control system using blockchain

Attribute-based access control is an effective cryptographic mechanism that allows a data owner to perform attribute-level access control over users’ access capabilities. In the application background of blockchain, it is urgent to use attribute-based access control to solve a series of security problems. Although there exist several similar schemes, they do not consider attribute revocation. By adopting the attribute revocation technique based on binary trees, we extended Waters’ ciphertext policy attribute-based encryption (CP-ABE) scheme into a revocable CP-ABE (RCP-ABE) scheme. By combining our RCP-ABE with blockchain, we constructed a revocable attribute-based access control system. The new system supports expressive access control policies and allows the attribute authority to revoke users’ attributes or part of their attributes. The security analysis shows that the new system satisfies several ideal properties, i.e., forward security, backward security, confidentiality, and integrity.

Efficient Ciphertext-Policy Attribute-Based Encryption Constructions with Outsourced Encryption and Decryption

The invention of the Ciphertext-Policy Attribute-Based Encryption scheme opened a new perspective for realizing attribute-based access control systems without being forced to trust the storage service provider, which is the case in traditional systems where data are sent to the storage service provider in clear and the storage service provider is the party that controls the access to these data. In the Ciphertext-Policy Attribute-Based Encryption model, the data owner encrypts data using an attribute-based access structure before sending them to the storage service, and only users with authorized sets of attributes can successfully decrypt the generated ciphertext. However, Ciphertext-Policy Attribute-Based Encryption schemes employ expensive operations (i.e., bilinear pairings and modular exponentiations) and generate long ciphertexts and secret keys, which makes them hard to implement in real-life applications especially for resource-constrained devices. In this paper, we propose two Ciphertext-Policy Attribute-Based Encryption Key Encapsulation Mechanisms that can be provided as services in the cloud, minimizing the user’s encryption and decryption costs without exposing any sensitive information to the public cloud provider. In the first scheme, the ABE Service Provider is considered fully untrusted. On the other hand, the second scheme requires the ABE Service Provider to be semi-trusted (Honest-but-Curious) and does not collude with illegitimate users. Both schemes are proved to be selectively CPA-secure in the random oracle. The theoretical and experimental performance results show that both our first and second schemes are more efficient than the reviewed outsourced CP-ABE schemes in terms of user-side computation, communication, and storage costs.

Distributed attribute-based access control system using permissioned blockchain

Auditing provides essential security control in computer systems by keeping track of all access attempts, including both legitimate and illegal access attempts. This phase can be useful in the context of audits, where eventual misbehaving parties can be held accountable. Blockchain technology can provide the trusted auditability required for access control systems. In this paper, we propose a distributed Attribute-Based Access Control (ABAC) system based on blockchain to provide trusted auditing of access attempts. Besides auditability, our system presents a level of transparency that both access requesters and resource owners can benefit from it. We present a system architecture with an implementation based on Hyperledger Fabric, achieving high efficiency and low computational overhead. The proposed solution is validated through a use case of independent digital libraries. Detailed performance analysis of our implementation is presented, taking into account different consensus mechanisms and databases. The experimental evaluation shows that our presented system can effectively handle a transaction throughput of 270 transactions per second, with an average latency of 0.54 seconds per transaction.

A symbolic attribute-based access control model for data security in the cloud

There have been several attempts made in literature to develop access control techniques to stem data security problems. Many of these techniques had been found to have one deficiency or other. Hence, this study developed a Symbolic Attribute-Based Access Control (SABAC) system for data security in the cloud service environment. SABAC system was implemented by developing Hash-tag Symbol Authentication (HSA) algorithm using the Message Digest-5 encryption. SABAC utilizes a 3-Tier continuous authentication method by combining the use of username and password, HSA code, and real-time image monitoring and verification. HSA code is generated by combining 5-tuple user attributes and the string generated from the user’s image using Obfuscation Technique. The concatenated string is converted to hexadecimal which serves as input to MD5 to produces a unique HSA code. SABAC was evaluated using three major security metrics of confidentiality, integrity, and avail-ability. The result of security metrics tests showed a confidence level of 99.993%, integrity threshold of 99.998%, and availability throughput of 150 users/second. This implies that SABAC is highly efficient for cloud data security. It shows that hackers would find it impossible to match any fake identity with valid HSA in the database. The study concluded that SABAC could be used for access control in a cloud environment for assuring data security. It was recommended that the SABAC system should be adopted by Cloud Solution Providers and Security Specialists.

An efficient attribute-based access control system with break-glass capability for cloud-assisted industrial control system.

In the era of Industry4.0, cloud-assisted industrial control system (ICS) is considered to be the most promising technology for industrial processing automation systems. However, the emerging attack techniques targeted at ICS underlines the importance of data security. To protect the data from the unauthorized accesses, attribute-based encryption is utilized to meet the requirement of confidentiality and access control demand of an open network environment. In ICS scenarios, it is critically important to offer the timely and efficient service, especially in the emergency situations. This paper proposes an efficient access control strategy that enables two access modes: attribute-based access and emergency break-glass access. Normally, users can access the encrypted data as long as their attributes satisfy the access policy specified by the data owner. In emergency cases, emergency situation handlers can override the access control policy of the encrypted data by the break-glass access capability. To eliminate the overhead for data consumers, the scheme outsources the data decryption and policy updating to the semi-trusted fog and cloud. The scheme also implements the CP-ABE scheme in terms of an asymmetric Type-3 pairings instead of the symmetric Type-1 pairings, which are inefficient and have security issues. Finally, the paper analyses the security of the scheme, evaluates its performance, and compares it with related works.

Policy-Engineering Optimization with Visual Representation and Separation-of-Duty Constraints in Attribute-Based Access Control

Recently, attribute-based access control (ABAC) has received increasingly more attention and has emerged as the desired access control mechanism for many organizations because of its flexibility and scalability for authorization management, as well as its security policies, such as separation-of-duty constraints and mutually exclusive constraints. Policy-engineering technology is an effective approach for the construction of ABAC systems. However, most conventional methods lack interpretability, and their constructing processes are complex. Furthermore, they do not consider the separation-of-duty constraints. To address these issues in ABAC, this paper proposes a novel method called policy engineering optimization with visual representation and separation of duty constraints (PEO_VR&SOD). First, to enhance interpretability while mining a minimal set of rules, we use the visual technique with Hamming distance to reduce the policy mining scale and present a policy mining algorithm. Second, to verify whether the separation of duty constraints can be satisfied in a constructed policy engineering system, we use the method of SAT-based model counting to reduce the constraints and construct mutually exclusive constraints to implicitly enforce the given separation of duty constraints. The experiments demonstrate the efficiency and effectiveness of the proposed method and show encouraging results.

An Attribute-Based Access Control for Cloud Enabled Industrial Smart Vehicles

Smart cities' vision will encompass connected industrial vehicles, which will offer data-driven and intelligent services to the user. Such interaction within dispersed connected objects are sometimes referred as the industrial Internet-of-Vehicles (IIoV). The prime motivation of an intelligent transportation system (ITS) is ensuring the safety of the drivers and offering a comfortable experience to the user. However, such complex infrastructures opens broad attack surfaces to the adversaries, which can remotely exploit and control the critical mechanics in the smart vehicles, including engine and brake systems. Security and privacy concerns are significant barriers to the wide adoption of this revolutionary technology that has to be addressed before a comprehensive implementation of the real vision of ITS. This article is a stepping stone to address access control issues in the IIoV ecosystem and propose a formal attribute-based access control system (referred to ITS-ABAC <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</sub> ). The proposed model introduces the notion of groups, which are assigned to various smart entities based on the different attributes. It also offers the implementation of fine-grained security policies and considers individualized privacy preferences along with system-wide policies to accept or reject notification, alerts, and advertisements from different participating smart entities. We present the prototype implementation of our proposed model in the Amazon Web Services IoT platform together with extensive performance to reflect the practicality and wide-scale adoption of the proposed system.

Policy Adaptation in Hierarchical Attribute-based Access Control Systems

In Attribute-Based Access Control (ABAC), access to resources is given based on the attributes of subjects, objects, and environment. There is an imminent need for the development of efficient algorithms that enable migration to ABAC. However, existing policy mining approaches do not consider possible adaptation to the policy of a similar organization. In this article, we address the problem of automatically determining an optimal assignment of attribute values to subjects for enabling the desired accesses to be granted while minimizing the number of ABAC rules used by each subject or other appropriate metrics. We show the problem to be NP-Complete and propose a heuristic solution.

Deploying ABAC policies using RBAC Systems.

The flexibility, portability and identity-less access control features of Attribute Based Access Control(ABAC) make it an attractive choice to be employed in many application domains. However, commercially viable methods for implementation of ABAC do not exist while a vast majority of organizations use Role Based Access Control (RBAC) or their temporal extensions, such as Temporal Role Based Access Control (TRBAC). In this paper, we present a solution for organizations having a RBAC/TRBAC that can deploy an ABAC policy. Essentially, we propose a method for the translation of an ABAC policy (including time constraints) into a form that can be adopted by an RBAC/TRBAC system. We experimentally demonstrate that time taken to evaluate an access request in RBAC and TRBAC systems is significantly less than that of the corresponding ABAC system. Since the cost of security management is more expensive under RBAC when compared to ABAC, we present an analysis of the different management costs and present mitigation approaches by considering various administrative operations.

PolTree: A Data Structure for Making Efficient Access Decisions in ABAC.

In Attribute-Based Access Control (ABAC), a user is permitted or denied access to an object based on a set of rules (together called an ABAC Policy) specified in terms of the values of attributes of various types of entities, namely, user, object and environment. Efficient evaluation of these rules is therefore essential for ensuring decision making at on-line speed when an access request comes. Sequentially evaluating all the rules in a policy is inherently time consuming and does not scale with the size of the ABAC system or the frequency of access requests. This problem, which is quite pertinent for practical deployment of ABAC, surprisingly has not so far been addressed in the literature. In this paper, we introduce two variants of a tree data structure for representing ABAC policies, which we name as PolTree. In the binary version (B-PolTree), at each node, a decision is taken based on whether a particular attribute-value pair is satisfied or not. The n-ary version (N-PolTree), on the other hand, grows as many branches out of a given node as the total number of possible values for the attribute being checked at that node. An extensive experimental evaluation with diverse data sets shows the scalability and effectiveness of the proposed approach.

A secure IoT cloud storage system with fine-grained access control and decryption key exposure resistance

Internet of Things (IoT) cloud provides a practical and scalable solution to accommodate the data management in large-scale IoT systems by migrating the data storage and management tasks to cloud service providers (CSPs). However, there also exist many data security and privacy issues that must be well addressed in order to allow the wide adoption of the approach. To protect data confidentiality, attribute-based cryptosystems have been proposed to provide fine-grained access control over encrypted data in IoT cloud. Unfortunately, the existing attributed-based solutions are still insufficient in addressing some challenging security problems, especially when dealing with compromised or leaked user secret keys due to different reasons. In this paper, we present a practical attribute-based access control system for IoT cloud by introducing an efficient revocable attribute-based encryption scheme that permits the data owner to efficiently manage the credentials of data users. Our proposed system can efficiently deal with both secret key revocation for corrupted users and accidental decryption key exposure for honest users. We analyze the security of our scheme with formal proofs, and demonstrate the high performance of the proposed system via experiments.

Security Analysis of ABAC under an Administrative Model.

In the present day computing environment, where access control decisions are often dependent on contextual information like the location of the requesting user and the time of access request, Attribute Based Access Control (ABAC) has emerged as a suitable choice for expressing security policies. In an ABAC system, access decisions depend on the set of attribute values associated with the subjects, resources and the environment in which an access request is made. In such systems, the task of managing the set of attributes associated with the entities as well as that of analyzing and understanding the security implications of each attribute assignment is of paramount importance. In this paper, we first introduce a comprehensive attribute based administrative model, named as AMABAC (Administrative Model for ABAC), for ABAC systems and then suggest a methodology for analyzing the security properties of ABAC in the presence of the administrative model. For performing analysis, we use μZ, a SMT (Satisfiability Modulo Theories) based model checking tool. We study the impact of the various components of ABAC and AMABAC on the time taken for security analysis.

Attribute-Based Access Control for the Swarm With Distributed Policy Management

The Internet of Things (IoT) is revolutionizing society by enabling everyday life objects with processing and communication. The Swarm is an edge-centric IoT approach in which independent, cross-niche, and heterogeneous devices can cooperate with each other to execute tasks synergistically. Access control is indispensable for the Swarm, as it ensures confidentiality and ownership, and prevents cyber-attacks since only authorized services can communicate. Although many access control models do exist, there is a lack of edge-based and easy-to-use access control systems in the consumer electronics field. This paper presents a distributed attribute-based access control system for the Swarm. It features a distributed policy management GUI that allows users to setup policies for IoT devices in a decentralized way. The proposed system is evaluated according to a set of national institute of standards and technologies quality metrics, and it is also subject to a performance evaluation. Results indicate that the system offers good usability factors and can handle from 10 000 to 6 billion services when considering, respectively, an arbitrary graph density of 20% and a social-based graph density of 0.000034%.

Automated extraction of attributes from natural language attribute-based access control (ABAC) Policies

The National Institute of Standards and Technology (NIST) has identified natural language policies as the preferred expression of policy and implicitly called for an automated translation of ABAC natural language access control policy (NLACP) to a machine-readable form. To study the automation process, we consider the hierarchical ABAC model as our reference model since it better reflects the requirements of real-world organizations. Therefore, this paper focuses on the questions of: how can we automatically infer the hierarchical structure of an ABAC model given NLACPs; and, how can we extract and define the set of authorization attributes based on the resulting structure. To address these questions, we propose an approach built upon recent advancements in natural language processing and machine learning techniques. For such a solution, the lack of appropriate data often poses a bottleneck. Therefore, we decouple the primary contributions of this work into: (1) developing a practical framework to extract authorization attributes of hierarchical ABAC system from natural language artifacts, and (2) generating a set of realistic synthetic natural language access control policies (NLACPs) to evaluate the proposed framework. Our experimental results are promising as we achieved - in average - an F1-score of 0.96 when extracting attributes values of subjects, and 0.91 when extracting the values of objects’ attributes from natural language access control policies.