Attribute-based Access Control Research Articles

Attribute-based access control and authentication mechanism using smart cards for cloud-based IoT applications

With exploding growth in information technology (IT), numerous services and applications having enhanced capabilities are coming into picture with an aim to serve the users. Internet of things (IoT) along with its enabling cutting-edge technologies is establishing a scenario where these services can be utilised effectively. However, with large number of users and applications, it becomes challenging to safeguard the identifying information being transmitted to provide access to these services. This paper presents a refined version of an integrated attribute-based access control and authentication mechanism using smart cards for cloud-based IoT applications. System-wide attributes not only restrict the users to access the remote cloud services, but also ensure user anonymity. We also implement the proposed mechanism on ACPT and AVISPA tool for its validation and to verify its correctness. Moreover, we present an analysis of its security and performance efficiency on the basis of different parameters.

Attribute-Based Access Control Using Smart Contracts for the Internet of Things

Abstract Access control is one of the most important security concerns, which is critical in resource and information protection over IoT devices. This paper proposes a new scheme that combines attribute-based access control (ABAC) model with blockchain technology and uses smart contracts for access control judgment. This scheme can realize dynamic, distributed and reliable access control in the open IoT environment. The IoT access control system based on this scheme consists of five functional modules. The information registration point registers information for each device that joins the system. Policy enforcement point (PEP) is responsible for managing agent-devices in the system and processing original access requests from access subjects. Policy decision point (PDP) makes access control right decision through smart contracts. Policy administration point (PAP) is used to manage smart contract information. Policy information point (PIP) is used to manage key attribute information of devices used for access control judgment. The scheme also includes three types of smart contracts, one management contract (MC) is used to manage other contracts in the system, one policy decision contract (PDC) is responsible for obtaining attribute information from PIP and making final access control right decision, and a large number of policy contracts (PCs) which composed of a public policy contract (PPC) and a large number of exclusive policy contracts (EPCs). These PCs are used to implement specific attribute-based access control policies. To demonstrate the application of the scheme, we simulated a scenario of access control in a home IoT environment and verified the feasibility of access control decisions using our proposed scheme through three experiments.

Attribute-based access control and authentication mechanism using smart cards for cloud-based IoT applications

Attribute-based access control and authentication mechanism using smart cards for cloud-based IoT applications

A trust and attribute-based access control framework in internet of things

Internet of things (IoT) is widely used in kinds of environment where cloud computing provides super-strong computing support. However, it becomes a key issue that each node can access data under control within the human intention and data is shared securely in distributed IoT environment. Moreover, nodes may belong to different security domains, and data must be accessed only by selected users which could ensure the security of IoT system. Therefore, an effective access control technique is the key point to solve this issue. To address the problems of security, scalability and cross-domain, this paper proposes a fine-grained and dynamic access control model which combines ABAC with trust mechanism and considers dynamic trust attribute and static multi-attribute as synthetic constraints. The simulation results show the feasibility and effectiveness of the proposed scheme, which provides superior characteristics and improves the security of IoT system.

A Scalable Attribute-Based Access Control Scheme with Flexible Delegation cum Sharing of Access Privileges for Cloud Storage

Nowadays cloud servers have become the primary choice to store and share data with multiple users across the globe. The major challenge in sharing data using cloud servers is to protect data against untrusted cloud service provider and illegitimate users. Attribute-Based Encryption (ABE) has emerged as a useful cryptographic technique to securely share data with legitimate recipients in fine-grained manner. Several solutions employing ABE have been proposed to securely share data using cloud servers. However, most of the solutions are data owner-centric and focus on providing data owner complete control on his outsourced data. The existing solutions in cloud computing fail to provide shared access privileges among users and to enable cloud users to delegate their access privileges in a flexible manner. In order to simultaneously achieve the notion of fine-grained access control, scalability and to provide cloud users shared access privileges and flexibility on delegation of their access privileges, we propose a scalable attribute-based access control scheme for cloud storage. The scheme extends the ciphertext policy attribute-based encryption to achieve flexible delegation of access privileges and shared access privileges along with scalability and fine-grained access control. The scheme achieves scalability by employing hierarchical structure of users. Furthermore, we formally prove the security of our proposed scheme based on security of the ciphertext-policy attribute-based encryption. We also implement the algorithm to show its scalability and efficiency.

A trust and attribute-based access control framework in internet of things

Internet of things (IoT) is widely used in kinds of environment where cloud computing provides super-strong computing support. However, it becomes a key issue that each node can access data under control within the human intention and data is shared securely in distributed IoT environment. Moreover, nodes may belong to different security domains, and data must be accessed only by selected users which could ensure the security of IoT system. Therefore, an effective access control technique is the key point to solve this issue. To address the problems of security, scalability and cross-domain, this paper proposes a fine-grained and dynamic access control model which combines ABAC with trust mechanism and considers dynamic trust attribute and static multi-attribute as synthetic constraints. The simulation results show the feasibility and effectiveness of the proposed scheme, which provides superior characteristics and improves the security of IoT system.

Cryptographic Attribute-Based Access Control (ABAC) for Secure Decision Making of Dynamic Policy With Multiauthority Attribute Tokens

This article aims to establish a cryptographic solution to improve security and reliability of the National Institute of Standards and Technology's attribute-based access control (ABAC) model. By breaking down the existing structure of attribute-based encryption, we propose a new cryptographic ABAC (C-ABAC) framework with dynamic policy authorization and real-time attribute credentials. Moreover, a practical C-ABAC construction is proposed to support provable policy decision making and verifiable attribute Tokens among multiple distributed authorities. In this construction, we develop a concrete approach of generating a cryptographic policy from access control markup language. We also prove that attribute Token has existential unforgeability under chosen-attribute and chosen-nonce attacks, and the cryptographic policy is existentially unforgeable under chosen-object attack. In addition, our C-ABAC construction provides semantic security against chosen-plaintext attack with Token and policy queries under the extended general Diffie–Hellman exponent assumption. Finally, we evaluate the performance of the C-ABAC system according to complexity analysis and experimental results. The results show that the C-ABAC system is reliable and easy to implement.

Kerberos Authorization with Hybrid Access Control Model in Public Cloud

Access control and Data confidentiality are key technology to ensure the security of system and to protect the privacy of the users. The modified Collaborative Trust Enhanced Security (CTES) model has an inbuilt access control mechanism for Kerberos protocol itself to enforce the access control policy directly into the Client system node. This paper explains the hybrid access control model with Role Based Access Control (RBAC) and Attribute Based Access Control (ABAC) for modified CTES framework through Kerberos protocol. Hence, it retains the concept of “role”, “group” and “attributes” for the user which are necessary to protect data privacy in the system. Data confidentiality for the stored data in Cloud is achieved by cryptographic techniques. Gnu Privacy Guard (GnuPG) based certificate is capable enough to verify the identity of the correspondent in information exchange as well as the information integrity. It is a strongest authentication technique where the user is asked to provide his/her digital ID for validation in the Server and enables Single sign-on services for Kerberos Authorization in modified CTES model. In this paper, it is proposed for a new Kerberos Authorization with Hybrid Access Control Model (KAHAC) for single-domain systems and multi-domain systems in Public Cloud based on roles, attributes, groups, access modes and the type of resources.

Context-Aware Adaptive Remote Access for IoT Applications

The rapid growth of communication networking, ubiquitous sensing, and signal processing has spurred the emergence of the Internet of Things (IoT) era. As a novel cutting-edge technology, the IoT enables a plethora of smart-devices equipped with diverse computing, sensing, and actuation capabilities to be connected to the Internet. Thus, it promises to provide a revolutionary and fully connected “smart” world while greatly developing economies and enhancing the quality of life. IoT is indeed an emergent global phenomenon, where real-time remote access to data and applications opens new unprecedented opportunities for ubiquitous monitoring and managing. In such dynamic, interconnected, and heterogeneous environment where the context conditions (location, time, situation sensitivity, etc.) are continuously and frequently changing, context-aware and adaptive solutions for data access are required to respond to the applications’ needs. Nevertheless, until now, no schemes provide concrete context-aware access control mechanisms in IoT. In this article, we design a novel context-aware attribute-based access control (CAABAC) that considers the dynamic context changes. The proposed approach incorporates the contextual information with the ciphertext-policy attribute-based encryption (CP-ABE) to guarantee adaptive contextual access to data. The extensive analysis and simulations prove both the effectiveness and efficiency of the proposed scheme. Specifically, context-aware and adaptive remote access is enabled while outperforming other benchmarked schemes in terms of storage, communication, and computational cost.

An efficient privacy‐enhanced attribute‐based access control mechanism

SummaryOwing to the rapid progress of network researching, attribute‐based access control (ABAC) has attracted more and more attention due to its appreciable expressiveness, flexibility, and scalability. Unfortunately, collecting user attributes is necessary to complete the standard ABAC decision process, which increases the risk of privacy disclosure. This problem increases public doubts about ABAC and hinders its popularization. In this paper, a privacy‐protected and efficient attribute‐based access control (EPABAC) scheme is proposed to prevent the privacy leakage of access subject in the decision‐making process of ABAC by introducing a novel hash‐based binary search tree. The analyses and experimental evaluations show that the EPABAC achieves user privacy protection in the decision‐making process with acceptable additional computing overhead.

An Attribute-Based Controlled Collaborative Access Control Scheme for Public Cloud Storage

In public cloud storage services, data are outsourced to semi-trusted cloud servers which are outside of data owners' trusted domain. To prevent untrustworthy service providers from accessing data owners' sensitive data, outsourced data are often encrypted. In this scenario, conducting access control over these data becomes a challenging issue. Attribute-based encryption (ABE) has been proved to be a powerful cryptographic tool to express access policies over attributes, which can provide a fine-grained, flexible, and secure access control over outsourced data. However, the existing ABE-based access control schemes do not support users to gain access permission by collaboration. In this paper, we explore a special attribute-based access control scenario where multiple users having different attribute sets can collaborate to gain access permission if the data owner allows their collaboration in the access policy. Meanwhile, the collaboration that is not designated in the access policy should be regarded as a collusion and the access request will be denied. We propose an attribute-based controlled collaborative access control scheme through designating translation nodes in the access structure. Security analysis shows that our proposed scheme can guarantee data confidentiality and has many other critical security properties. Extensive performance analysis shows that our proposed scheme is efficient in terms of storage and computation overhead.

Invoice Discounting: A Blockchain-Based Approach

Invoice discounting is a market with a double-digit potential growth rate in Europe and worldwide in the next years. The main benefit of invoice discounting is the acceleration of cash flow from customers to suppliers: suppliers get advance payments from the bank, rather than waiting for the customers to pay. Hence, thanks to the quick availability of capital, businesses can invest in expansion and growth. More specifically, one of the most relevant problems today is how to provide better and faster invoice discounting services while preventing the double spending and maintaining the risk low. The blockchain frameworks have the potential to provide the right solution and thus to revolutionize the invoice discounting process. The benefits for suppliers, customers and financial institutions are related to the increased transparency added to the whole discounting process and the following risk reduction for the banks due to the capability to enhance the entire process and to reduce the double spending. In our paper, we introduce a blockchain-based invoice discounting system, called Distributed Ledger Invoice, and we propose a novel assessment method for evaluating currently available blockchain solutions for the invoice discounting scenario. Moreover, we also discuss two main issues regarding the information accessibility and the interoperability. In particular, since blockchain is still an emerging technology interoperability is a key factor for the blockchain adoption in inter-banking processes, where different blockchains solutions might be used. In this work we propose a decoupling layer, based on the Attribute-Based Access Control language, to unify the access control to reserved information across heterogeneous blockchains.

An Extended Attribute-Based Access Control (ABAC) Model for Distributed Collaborative Healthcare System

The healthcare system is a real example of a distributed collaborative system, which aims to improve the patient's healthcare. The most important requirements of the healthcare system are the sensitivity of the medical data processed, large numbers of medical and para-medical interveners, as well as the medical treatment activity is a non-static process. Protecting data from unauthorized access and data sharing security in the healthcare environment is a critical process that influences system credibility. To achieve this goal and to meet the requirements of the healthcare system, the authors propose an extended Attribute-Based Access Control (ABAC) model by introducing the medical activity concept. This article defines the medical activity concept as an abstraction of collaboration in a care unit, defined by a medical activity purpose, in which the collaborators (or actors) realize their tasks in order to achieve the treatment purpose. The current access control model ABAC and these variants do not take into account the (business process) activity concept in the decision mechanism. In this paper, the authors propose a new access control model, called Medical-Activity-Attribute-Based Access Control (MA-ABAC), which can effectively enhance the security for healthcare system and produce more perfect and flexible mechanism of access control; order to strongly respond to the requirements of the distributed healthcare environment.

Integrity Checking in Cloud Storage and Policy Based User Revocation using Attribute Based Encryption

Applications that range over various mists are frequently observed to be powerless against security dangers. Such profoundly heterogeneous situations need a fine-grained access control system like Attribute-based Access Control for upholding security. One of the most encouraging applications in distributed computing is online information sharing. Step by step instructions to share client information securely and productively has turned out to be one of the most testing issues in distributed computing. Be that as it may, this postures new provokes identified with making secure and solid information stockpiling over questionable specialist co-ops. The principle objective of distributed computing is the means by which to verify, secure the information and procedure. In this study, we find the issue of guaranteeing the respectability of data in cloud computing. Specifically, we consider techniques for decreasing the weight of producing a consistent measure of metadata at the customer side. Ascribe division chooses whether to momentarily disavow client approval as indicated by property subset. Furthermore, we propose another model called Policy-based Attribute Based Access Control (Pa-ABAC) utilizing half breed property based encryption. Our goal is to officially determine the conduct of various components of the proposed model in a cloud domain. This is imperative to build up a substantial security arrangement for a cloud situation free from determination mistakes and irregularities.

Access Controls for IoT Networks

The message queuing telemetry transport (MQTT) protocol is becoming the main protocol for the internet of things (IoT). In this paper, we define a highly expressive attribute-based access control (ABAC) security model for the MQTT protocol. Our model allows us to regulate not only publications and subscriptions, but also distribution of messages to subscribers. We can express various types of contextual security rules (temporal security rules, content-based security rules, rules based on the frequency of events, etc.).

Research on multicloud access control policy integration framework

Multicloud access control is important for resource sharing and security interoperability across different clouds, and heterogeneity of access control policy is an important challenge for cloud mashups. XAC-ML is widely used in distributed environment as a declaratively fine-grained, attribute-based access control policy language, but the policy integration of XACML lacks formal description and theory foundation. Multicloud Access Control Policy Integration Framework (MACPIF) is proposed in the paper, which consists of Attribute-based Policy Evaluation Model (ABPEM), Four-value Logic with Completeness (FLC) and Four-value Logic based Policy Integration Operators (FLPIOs). ABPEM evaluates access control policy and extends XACML decision to four-value. According to policy decision set and policy integration characteristics, we construct FLC and define FLPIOs including Intersection, Union, Difference, Implication and Equivalence. We prove that MACPIF can achieve policy monotonicity, functional completeness, canonical suitability and canonical completeness. Analysis results show that this framework can meet the requirements of policy integration in Multicloud.

A correct-by-construction model for attribute-based access control

A correct-by-construction model for attribute-based access control

Policy Adaptation in Hierarchical Attribute-based Access Control Systems

In Attribute-Based Access Control (ABAC), access to resources is given based on the attributes of subjects, objects, and environment. There is an imminent need for the development of efficient algorithms that enable migration to ABAC. However, existing policy mining approaches do not consider possible adaptation to the policy of a similar organization. In this article, we address the problem of automatically determining an optimal assignment of attribute values to subjects for enabling the desired accesses to be granted while minimizing the number of ABAC rules used by each subject or other appropriate metrics. We show the problem to be NP-Complete and propose a heuristic solution.

An Attribute-Based Access Control Model in RFID Systems Based on Blockchain Decentralized Applications for Healthcare Environments

The growing adoption of Radio-frequency Identification (RFID) systems, particularly in the healthcare field, demonstrates that RFID is a positive asset for healthcare institutions. RFID offers the ability to save organizations time and costs by enabling data of traceability, identification, communication, temperature and location in real time for both people and resources. However, the RFID systems challenges are financial, technical, organizational and above all privacy and security. For this reason, recent works focus on attribute-based access control (ABAC) schemes. Currently, ABAC are based on mostly centralized models, which in environments such as the supply chain can present problems of scalability, synchronization and trust between the parties. In this manuscript, we implement an ABAC model in RFID systems based on a decentralized model such as blockchain. Common criteria for the selection of the appropriate blockchain are detailed. Our access control policies are executed through the decentralized application (DApp), which interfaces with the blockchain through the smart contract. Smart contracts and blockchain technology, on the one hand, solve current centralized systems issues as well as being flexible infrastructures that represent the relationship of trust and support essential in the ABAC model in order to provide the security of RFID systems. Our system has been designed for a supply chain environment with an use case suitable for healthcare systems, so that assets such as surgical instruments containing an associated RFID tag can only access to specific areas. Our system is deployed in both a local and Testnet environment in order to stablish a deep comparison and determining the technical feasibility.

Privacy-Preserving Data Sharing using Multi-layer Access Control Model in Electronic Health Environment

Electronic Health Data (EHD) is an emerging health information exchange model that facilitates healthcare providers and patients to efficiently store and share their private healthcare information from any place and at any time as per demand. Generally, Cloud services provide the infrastructure by reducing the cost of storing, processing and updating information with improved efficiency and quality. However, the privacy of Electronic Health Records (EHR) is a significant hurdle while outsourcing private health data in the cloud because there is a higher peril of leaking health information to unauthorized parties. Several existing techniques are able to analyse the security and privacy issues associated with e-healthcare services. These methods are designed for single database, or databases, with an authentication centre and thus cannot adequately protect the data from insider attacks. Therefore, this research study mainly focusses on how to ensure the patient privacy while sharing the sensitive data between same or different organisations as well as healthcare providers in a cloud environment. This paper proposes a multi-layer access control mechanism named MLAC Model to construct a secure and privacy-preserving EHR system that enables patients to share their data with stakeholders. In this paper, we use a Dual layer access control model named Pseudo-Role Attribute based access control (PR-ABAC) mechanism that integrates attributes with roles for the secure sharing of EHR between multiple collaborators. The proposed framework also uses the concept of Provenance to ensure the Integrity of patient data. This work is expected to provide a foundation for developing security solutions against cyber-attacks, and thus contribute to the robustness of healthcare information sharing environments.