Attribute-based Access Control Research Articles

Surveying Authentication and Authorization Mechanisms in Today's Web Technology Landscape

This paper presents a comprehensive survey of authentication and authorization mechanisms in contemporary web technology. It examines the diverse approaches and frameworks employed to secure web systems and protect user data. Beginning with an overview of fundamental concepts such as authentication methods and access control models, the paper explores the landscape of authentication and authorization in depth. It evaluates the effectiveness and limitations of various authentication methods, including passwords, biometrics, and multifactor authentication (MFA). Additionally, the paper scrutinizes authorization mechanisms such as role-based access control (RBAC), attribute-based access control (ABAC), and policy-based access control (PBAC). Through a systematic review of integration frameworks like OAuth and OpenID Connect, it assesses their role in facilitating secure authentication and authorization processes. Furthermore, the paper analyzes emerging trends and innovations in authentication and authorization practices, providing insights into the future direction of web security. By synthesizing existing research and identifying key challenges and opportunities, this survey paper aims to inform researchers, practitioners, and policymakers about the state-of-the-art in authentication and authorization mechanisms and guide future developments in web security.

A Secure Storage For Medical Information Scheme Using Blockchain

Nowadays, many companies, organizations, hospitals and individuals have adopted centralized data storage systems to store and share data. However, these systems create a single point of failure and involve a centralized entity or third party, which can cause concern for users. Decentralized storage systems are therefore needed to overcome the drawbacks of the traditional approach. However, in the face of centralization issues, this paper proposes a combination of Hyperledger Fabric, InterPlanetary File System (IPFS), Attribute-Based Access Control (ABAC), and proxy re-encryption to enhance the security and transparency features of decentralized storage systems. Thus, the proposed scheme provides a secure decentralized system storage of medical information using a consortium blockchain

Trusted Data Access Control Based on Logistics Business Collaboration Semantics

In the context of the digital evolution of the logistics industry, the interconnection of logistics information systems and associated data have become an obstacle of business collaboration among various stakeholders. A critical challenge in this domain is ensuring controllable access to logistics business data, given the industry’s current state characterized by independence, autonomy, disconnection, and heterogeneity, alongside the non-negotiable requirement for data privacy. We propose a novel model of trusted data access control based on of logistics business collaboration semantics. This approach incorporates semantic inference technologies into attribute-based access control mechanisms, thereby enabling the streamlined formulation of access control policies and facilitating unified authorization and control. Moreover, the method addresses the issue of access control policy management and maintenance at the semantic level. The proposed solution can pave the way for enhanced business collaboration between business entities, and further enable the building of a data exchange service platform within the logistics industry.

A cross-chain access control mechanism based on blockchain and the threshold Paillier cryptosystem

With the continuous maturation of blockchain technology and the increasing demands for various industry applications, data sharing and interoperability among different blockchain networks face significant challenges. Research on cross-chain interoperability mechanisms has facilitated data collaboration across organizations and industries, enhancing the value and utility of data. When engaging in cross-chain data interactions, access control ensures the security and privacy of data while promoting collaboration and information exchange among multiple chains. Attribute-based access control can provide fine-grained authorization support, matching complex business scenarios. However, publicly disclosed policies and attributes in a transparent blockchain network may pose privacy and security issues. To address these issues, this paper proposes a cross-heterogeneous multichain data access control scheme based on attributes and threshold homomorphic encryption, achieving fine-grained and secure cross-domain access control in cross-chain networks. This scheme uses the threshold Paillier cryptosystem to encrypt and conceal user attributes and access policies. Through smart contracts, homomorphic differential computation is performed on the ciphertext of policies and attributes, to protect data privacy. This solution leverages private key decryption shares from multiple relay nodes in the cross-chain network to jointly decrypt the computation results, providing secure access control in complex cross-chain scenarios. Security analysis and experimental results demonstrate that the proposed scheme ensures security with reasonable computational overhead, to meet the access control requirements in cross-chain networks.

Compare and Analysis of Different Access Controlling Mechanisms in OAuth 2.0

This article analyses the basic concepts associated with authorization methods and how existing solutions face the common problems in the modern world. Different possible methods are introduced to solve such kind of problems. This paper proposes a model for attribute-based access control for cross-domain sources using APIs. The model includes basic architectural decisions and principles of ABAC (attribute based access control), RBAC (role based access control) and OAuth. Within the capabilities of OAuth 2.0 and ABAC will allow you to implement an end-to-end security model that can protect the privacy of customers and employees, the most important transactions for the financial sectors, business, and in general the most sensitive data over the API gateway. It is also possible to filter the response message, which is very important for customers.

Zero-Trust Cryptographic Protocols and Differential Privacy Techniques for Scalable Secure Multi-Party Computation in Big Data Analytics

This research explores the integration of zero-trust cryptographic protocols and differential privacy techniques to establish scalable secure multi-party computation in the context of big data analytics. The study delves into the challenges of collaborative data processing and presents a comprehensive framework that addresses the intricate balance between security, scalability, and privacy. The framework focuses on zero-trust cryptographic protocols, advocating for a fundamental shift in trust assumptions within distributed systems. Differential privacy techniques are then seamlessly integrated to preserve individual privacy during collaborative data analytics. This model employs a layered approach and distributed architecture and leverages serverless and edge computing fusion to enhance scalability and responsiveness in dynamic big data environments. This also explores the optimization of computational resources and real-time processing capabilities through serverless and edge computing fusion. A distributed architecture facilitates efficient collaboration across multiple parties, allowing for seamless data integration, preprocessing, analytics, and visualization. Privacy preservation takes centre stage in the big data privacy component of the framework. Context-aware attribute analysis, distributed federated learning nodes, and Attribute-Based Access Control (ABAC) with cryptographic enforcement are introduced to ensure fine-grained access control, contextual understanding of attributes, and collaborative model training without compromising sensitive information. Smart Multi-Party Computation Protocols (SMPCP) further enhance security, enabling joint computation of functions over private inputs while ensuring the integrity and immutability of data transactions. In essence, the achieved results manifest a paradigm shift where the layered approach, distributed architecture, and advanced privacy techniques converge to heighten data security, drive efficient computation, and robustly preserve privacy in the expansive landscape of big data analytics. Fault tolerance and resource utilization exhibit significant advancements, with fault tolerance experiencing a 10% boost and resource utilization optimizing by 12%. These enhancements underscore the robustness and efficiency of the system's design, ensuring resilience and optimized resource allocation.

Efficient and Secure Blockchain-Based Access Control for Fog-Assisted IoT Cloud in Electronic Medical Records Sharing

Fog-assisted IoT Cloud environments have emerged as a result of the rapid spread of Internet of Things (IoT) devices and the requirement for seamless data sharing in the healthcare industry. The effective and safe management of access control to sensitive data, such as Electronic Medical Records (EMRs), becomes crucial in such configurations. The Efficient and Secure Blockchain-Based Access Control (ESBAC) framework, designed specifically for Fog-assisted IoT Cloud scenarios in EMR sharing, is our creative approach to this problem. The ESBAC architecture makes use of the blockchain's openness and immutability to provide reliable access control and auditability. The implementation of a consortium blockchain includes participants including healthcare providers, patients, and authorised entities. Each EMR has a smart contract attached to it that specifies access restrictions and permissions to make sure that only authorised parties are able to access and edit the data. Because of the decentralisation provided by the blockchain, security and privacy are improved because no single party has overwhelming control. Proposed framework uses attribute-based access control and lightweight encryption methods to provide a fair trade-off between security and efficiency. As a result, there can be fine-grained access control policies with the least amount of computing overhead. Comprehensive simulations are used to evaluate the suggested solution and compare it to current methods. The outcomes show that ESBAC improves security in EMR sharing and greatly lowers access latency.

Blockchain Solutions for Secure Healthcare Data Management: A Comprehensive Survey

The paper introduces an innovative approach to healthcare data security, addressing the critical concerns surrounding privacy and data integrity in the modern healthcare landscape. By amalgamating blockchain technology, AWS S3 services, and attribute-based access control (ABAC), the proposed solution offers a robust framework for safeguarding sensitive medical information. Through the implementation of ABAC, the solution enables dynamic and precise access control, ensuring that only authorized entities can access and manipulate healthcare data. Additionally, the utilization of a blockchain-based XML ledger on AWS S3 services enhances data security by providing an immutable and tamper-proof storage mechanism. This comprehensive solution not only addresses the privacy challenges inherent in the digitization of healthcare but also facilitates secure data sharing among authorized parties. By leveraging the combined strengths of ABAC, blockchain technology, and AWS S3 services, the proposed framework delivers a scalable and efficient infrastructure for managing healthcare data securely. It represents a significant advancement in healthcare information security, promising to safeguard patient privacy and maintain the accuracy and reliability of medical data in an increasingly interconnected digital ecosystem. Key Words: AWS S3 Service, Blockchain technology, medical information, XML ledger, Attribute-based access control (ABAC), Tamper-proof

Comparison of attribute-based encryption schemes in securing healthcare systems

E-health has become a top priority for healthcare organizations focused on advancing healthcare services. Thus, medical organizations have been widely adopting cloud services, resulting in the effective storage of sensitive data. To prevent privacy and security issues associated with the data, attribute-based encryption (ABE) has been a popular choice for encrypting private data. Likewise, the attribute-based access control (ABAC) technique has been widely adopted for controlling data access. Researchers have proposed electronic health record (EHR) systems using ABE techniques like ciphertext policy attribute-based encryption (CP-ABE), key policy attribute-based encryption (KP-ABE), and multi authority attribute-based encryption (MA-ABE). However, there is a lack of rigorous comparison among the various ABE schemes used in healthcare systems. To better understand the usability of ABE techniques in medical systems, we performed a comprehensive review and evaluation of the three popular ABE techniques by developing EHR systems using knowledge graphs with the same data but different encryption mechanisms. We have used the MIMIC-III dataset with varying record sizes for this study. This paper can help healthcare organizations or researchers using ABE in their systems to comprehend the correct usage scenario and the prospect of ABE deployment in the most recent technological evolution.

A Trusted Authentication Scheme Using Semantic LSTM and Blockchain in IoT Access Control System

In edge computing scenarios, due to the wide distribution of devices, complex application environments, and limited computing and storage capabilities, their authentication and access control efficiency is low. To address the above issues, a secure trusted authentication scheme based on semantic Long Short-Term Memory (LSTM) and blockchain is proposed for IoT applications. The attribute-based access control model is optimized, combining blockchain technology with access control models, effectively improving the robustness and credibility of access control systems. Semantic LSTM is used to predict environmental attributes that can further restrict user access and dynamically meet the minimum permission granting requirements. Experiments show that when the number of certificates is 60, the computational overhead of the proposed method is only 203s, which is lower than other state-of-the-art methods. Therefore, the performance of the proposed schema in information security protection in IoT environments shows promise as a scalable authentication solution for IoT applications.

Evolving Access Control Paradigms: A Comprehensive Multi-Dimensional Analysis of Security Risks and System Assurance in Cyber Engineering

This study evaluates the effectiveness of traditional access control paradigms—Role-Based Access Control (RBAC), Policy-Based Access Control (PBAC), and Attribute-Based Access Control (ABAC)—against ransomware threats in critical infrastructures and examines the potential benefits of integrating machine learning (ML) and artificial intelligence (AI) technologies. Utilizing a quantitative research design, the investigation collected data from 383 cybersecurity professionals across various sectors through a systematically structured questionnaire. The questionnaire, which demonstrated excellent internal consistency with a reliability score of 0.81, featured Likert scale questions aimed at assessing perceptions and experiences concerning the efficacy of different access control models in combating ransomware. Employing multiple regression analysis, the study explored the relationship between access control paradigms and their capability to mitigate ransomware risks, while also considering the impact of cybersecurity awareness among employees. The findings indicate that traditional access control methods are less effective against the dynamic nature of ransomware attacks, primarily due to their static configurations. In contrast, the integration of ML and AI into access control systems significantly enhances their adaptability and effectiveness in detecting and preventing ransomware incidents. Additionally, the study highlights the crucial role of cybersecurity awareness and training among employees in fortifying critical infrastructures against cyber threats. The adoption of a layered security strategy, incorporating advanced technological solutions and comprehensive cybersecurity practices, was found to markedly improve the resilience of critical infrastructures against ransomware attacks. Based on these insights, the study recommends the embrace of ML and AI technologies in access control systems, the prioritization of cybersecurity training for all organizational members, and the implementation of a multifaceted security approach to better defend against the evolving threat of ransomware. These strategies are essential for safeguarding the continuity and reliability of essential services in an increasingly digital and interconnected world.

Healthcare System Using Blockchain

The global Electronic Health Record (EHR) market is growing dramatically and is expected to reach $39.7 billion by 2022. To safeguard the security and privacy of EHR, access control is an essential mechanism for managing EHR data. This paper proposes a hybrid architecture to facilitate access control of EHR data by using both blockchain and edge nodes. Within the architecture, a blockchain-based controller manages identity and access control policies and serves as a tamper-proof log of access events. In addition, off-chain edge nodes store the EHR data and apply policies specified in Abbreviated Language For Authorization (ALFA) to enforce attribute-based access control on EHR data in collaboration with the blockchain-based access control logs. We evaluate the proposed hybrid architecture by utilizing the Hyperledger Composer Fabric blockchain to measure the performance of executing smart contracts and ACL policies in terms of transaction processing time and response time against unauthorized data retrieval. Keywords:Attribute-based Access Control, Access Control List, Blockchain, Edge Computing, Hyperledger, Smart Contract

A secure and efficient electronic medical record data sharing scheme based on blockchain and proxy re-encryption

With the rapid development of the Internet of Medical Things (IoMT) and the increasing concern for personal health, sharing Electronic Medical Record (EMR) data is widely recognized as a crucial method for enhancing the quality of care and reducing healthcare expenses. EMRs are often shared to ensure accurate diagnosis, predict prognosis, and provide health advice. However, the process of sharing EMRs always raises significant concerns about potential security issues and breaches of privacy. Previous research has demonstrated that centralized cloud-based EMR systems are at high risk, e.g., single points of failure, denial of service (DoS) attacks, and insider attacks. With this motivation, we propose an EMR sharing scheme based on a consortium blockchain that is designed to prioritize both security and privacy. The interplanetary file system (IPFS) is used to store the encrypted EMR while the returned hash addresses are recorded on the blockchain. Then, the user can authorize other users to decrypt the EMR ciphertext via the proxy re-encryption algorithm, ensuring that only authorized personnel may access the files. Moreover, the scheme attains personalized access control and guarantees privacy protection by employing attribute-based access control. The safety analysis shows that the designed scheme meets the expected design goals. Security analysis and performance evaluation show that the scheme outperforms the comparison schemes in terms of computation and communication costs.

ABAC as Access Control Solution for Digital Evidence Storage

Digital evidence is content that must be protected against access and use by parties who should not have the authority to do so. Some protection parameters for access to digital evidence must be implemented to ensure its integrity and authenticity. Access to digital evidence is not enough to be facilitated only with authorization and authentication mechanisms but must also be facilitated with other aspects of access by users according to their level of authority. One approach is to use the concept of access control. The study of access control to digital evidence is essential. However, studies on this matter are still limited. Among the many access control models, the application of access control based on attribute variations is a concept that can be applied to the context of access to digital evidence. This paper discusses policy design and modeling using attribute-based access control (ABAC) with four attributes: subject, resource, action, and environment. Then, it implements and tests various requests to the system based on attribute variations and possible algorithms. This study supports the security of digital evidence storage systems through access control to the resources it manages using the Policy Statement, Policy Modeling, Policy Implementation, and Policy Validation approaches. The application of the access control design shows that the ABAC concept has been successfully applied as an access control solution for digital evidence stored in digital evidence storage systems. The built policy design was successfully validated using ACPT Tools, concluding that there was no inconsistency or incompleteness.

A Revocable and Fair Outsourcing Attribute-Based Access Control Scheme in Metaverse

A Revocable and Fair Outsourcing Attribute-Based Access Control Scheme in Metaverse

Combo-Chain: Towards a hierarchical attribute-based access control system for IoT with smart contract and sharding technique

The Internet of Things (IoT) provides a collaborative environment among different entities (i.e., users, IoT devices, sensors, applications, etc.) to access resources. Despite the benefits that IoT technology brings to individuals, society, and industry, this technology faces a critical challenge in controlling access to various resources in IoT environments. To address this challenge, we propose Combo-Chain, an blockchain-based access control system deeply rooted in the concepts of the attribute-based access control (ABAC) model, smart contracts, and sharding. Combo-Chain introduces the concept of hierarchy for both subject attributes and object attributes to enhance flexibility and dynamicity when specifying ABAC policies, simplifying policy and attribute management. It not only manages access policies but also attributes by deploying a set of smart contracts. Furthermore, Combo-Chain utilizes sharding technique to distribute the overhead associated with storing and managing both access policies and attributes. Sharding also helps Combo-Chain to distribute the computational overhead when evaluating access requests among two groups of nodes, addressing the issues of low scalability and poor performance often associated with blockchain technology. Combo-Chain is implemented on a private Ethereum platform, and the experimental results demonstrate the superiority of Combo-Chain compared to existing blockchain-based access control systems.

ABAC Policy Mining through Affiliation Networks and Biclique Analysis

Policy mining is an automated procedure for generating access rules by means of mining patterns from single permissions, which are typically registered in access logs. Attribute-based access control (ABAC) is a model which allows security administrators to create a set of rules, known as the access control policy, to restrict access in information systems by means of logical expressions defined through the attribute–values of three types of entities: users, resources, and environmental conditions. The application of policy mining in large-scale systems oriented towards ABAC is a must because it is not workable to create rules by hand when the system requires the management of thousands of users and resources. In the literature on ABAC policy mining, current solutions follow a frequency-based strategy to extract rules; the problem with that approach is that selecting a high-frequency support leaves many resources without rules (especially those with few requesters), and a low support leads to the rule explosion of unreliable rules. Another challenge is the difficulty of collecting a set of test examples for correctness evaluation, since the classes of user–resource pairs available in logs are imbalanced. Moreover, alternative evaluation criteria for correctness, such as peculiarity and diversity, have not been explored for ABAC policy mining. To address these challenges, we propose the modeling of access logs as affiliation networks for applying network and biclique analysis techniques (1) to extract ABAC rules supported by graph patterns without a frequency threshold, (2) to generate synthetic examples for correctness evaluation, and (3) to create alternative evaluation measures to correctness. We discovered that the rules extracted through our strategy can cover more resources than the frequency-based strategy and perform this without rule explosion; moreover, our synthetics are useful for increasing the certainty level of correctness results. Finally, our alternative measures offer a wider evaluation profile for policy mining.

Enabling Attribute-based Access Control for OpenStack Cloud Resources through Smart Contracts

The increasing complexity of cloud computing has prompted a greater emphasis on protecting the privacy, integrity, and security of data stored and processed in the cloud. Data privacy is safeguarded through access control, but existing models such as Role Based Access Control (RBAC) and Attribute Based Access Control (ABAC) rely on a centralized server. If this server is compromised, it poses significant risks to data security. To address this issue, there is a need for Distributed ABAC (DABAC) system for OpenStack services based on blockchain. The unique features of blockchain enables access control systems which ensures data integrity and privacy. Additionally, blockchain offers a level of transparency for both the resource owner and a user. In this work, we propose a smart contract based ABAC system. We implemented the proposed work using an Ethereum blockchain and OpenStack cloud. Furthermore, we evaluated two consensus algorithms for scalability analysis of DABC mechanism. The results demonstrate that DABAC performs better than ABAC in ensuring fine-grade access control with proof of stake consensus algorithm providing better scalability.

Medical record information storage scheme based on blockchain and attribute role-based access control

The integration of the Internet with the healthcare industry has ushered in a transformative revolution in the medical field, where efficient and prompt electronic medical records can save precious resources. However, incomplete or tampered electronic medical records have serious implications on patient. Ensuring the complete, accurate storage of medical record information is an urgent problem that needs to be addressed. Therefore, this paper proposes a blockchain-based solution for secure storage and sharing of medical record information, combining the role-based access control (RBAC) with the attribute-based access control (ABAC).Firstly, by utilizing RBAC and ABAC, dynamic fine-grained access control for medical information is achieved based on role differences. Then, the medical record information is stored in the blockchain through chaincode. In addition, Advanced Encryption Standard and Feature-Aware Stateful Routing technology is applied to further enhance security and storage efficiency of the scheme. Experimental results demonstrate that the proposed solution ensures the security and integrity of medical record, while providing efficient information storage and access.

Anonymity in Attribute-Based Access Control: Framework and Metric

Anonymous access is an effective method for preserving privacy in access control. This study assumes that anonymous access control requires both frameworks and policies. Numerous solutions have been proposed for anonymous access at the framework level. In this study, these solutions are analyzed and quantified using a unified attribute-based access control (ABAC) anonymous access reference framework. Anonymous access at the framework level is the first line of defense, and inappropriate policies may undermine subject anonymity. An anonymity metric is proposed at the policy level to prevent authorization authority from re-identification using specific attributes and policies. The anonymity metric evaluates the risk of re-identifying a subject due to inappropriate access requests, as well as subject attribute assignment schemes and policies. This study is the first to focus on anonymity at the policy level in ABAC. Furthermore, a formal definition of anonymity suitable for ABAC is proposed. The feasibility of the proposed anonymity metric is verified through simulations.