Attribute-based Access Control Research Articles

An Enhanced Access Control Mechanism for Mobile Cloud Computing

Cloud computing is the emerging technology where resources are available pay as you go basis. Cloud storage technology provides the large pool of storage capacity to the cloud users. Providing security to the data stored in cloud is the major concern. So, Security can be enhanced by providing access control to the authorized users. Access control gives the authorization to the users which gives the access privileges on data and other resources. Access control can be enabled in most of the computing environment such as Peer to Peer, Grid and Cloud.Access control is an important measure for the protection of information and system resources to prevent illegitimate users from getting access to protected objects and legitimate users from attempting to access the objects in ways that exceed what they are allowed. The restriction placed on access from a subject to an object is determined by the access policy. With the rapid development of cloud computing, cloud security has increasingly become a common concern and should be dealt with seriously. In this paper, an enhanced access control mechanism is proposed with hierarchical attribute-based access control method.

Hybrid Role and Attribute Based Access Control Applied in Information Systems

Abstract It this paper it is proposed a new access control model – Hybrid Role and Attribute Based Access Control (HRABAC). It is an extension of Role-Based Access Control (RBAC). HRABAC is designed for information systems and enterprise software and combines the advantages of RBAC and Attribute-Based Access Control (ABAC). HRABAC is easy configurable, fine-grained and supports role hierarchies. The proposed model HRABAC describes the access control scheme in Laravel package laravelroles/rolespermissions, which is developed by the author of the paper, as an answer to the requirements of practice of fine-grained and easy configurable access control solution. Laravel is chosen, because it is the most popular and the most widely used PHP framework. The package laravelroles/rolespermissions is developed on Laravel so that maximum number of programmers could use it. This package contains working and tested functionalities for managing users, roles and permissions, and it is applied in accounting information system.

The security function dynamic calling scheme for software-defined security

With the rapid development of cloud computing, various network attack methods are becoming more advanced, and the attack speed is getting faster. Traditional security protection solutions can no longer adapt to new network attacks, bringing significant challenges to security protection in virtualized network environments such as cloud computing. Based on these problems, this paper proposes a dynamic calling mechanism of security functions for software-defined security based on software-defined network technology. This mechanism defined the strategies of dynamically scheduling of virtual security service nodes in the virtualized network environment. The strategies describe the network’s data flow and virtual security devices by extending the attribute-based access control policy model. It can dynamically construct the mapping relationship between network flow and virtual security devices according to users’ security requirements, thus forming a personalized security service chain for specific network flows. This mechanism can protect the “north-south” network flow at the IoT edge agent according to the user security business requirements.

Hyperledger Fabric Access Control System for Internet of Things Layer in Blockchain-Based Applications.

Blockchain-based applications are gaining traction in various application fields, including supply chain management, health care, and finance. The Internet of Things (IoT) is a critical component of these applications since it allows for data collection from the environment. In this work, we integrate the Hyperledger Fabric blockchain and IoT devices to demonstrate the access control and establish the root of trust for IoT devices. The Hyperledger Fabric is designed to be secure against unwanted access and use through encryption protocols, access restrictions, and cryptography algorithms. An attribute-based access control (ABAC) mechanism was created using Hyperledger Fabric components only to gain access to the IoT device. Single board computers based on the ARM architecture are becoming increasingly powerful and popular in automation applications. In this study, the Raspberry Pi 4 Model B based on ARM64 architecture is used as the IoT device. Because the ARM64 architecture is not supported by default, we build executable binaries and Docker images for the ARM64 architecture, using the Hyperledger Fabric source code. On an IoT device, we run the fabric node in native mode to evaluate the executable binaries generated for the ARM64 architecture. Through effective chaincode execution and testing, we successfully assess the Hyperledger fabric blockchain implementation and access control mechanism on the ARM64 architecture.

SealedGRID: Secure and Interoperable Platform for Smart GRID Applications.

Recent advancements in information and communication technologies (ICT) have improved the power grid, leading to what is known as the smart grid, which, as part of a critical economic and social infrastructure, is vulnerable to security threats from the use of ICT and new emerging vulnerabilities and privacy issues. Access control is a fundamental element of a security infrastructure, and security is based on the principles of less privilege, zero-trust, and segregation of duties. This work addresses how access control can be applied without disrupting the power grid’s functioning while also properly maintaining the security, scalability, and interoperability of the smart grid. The authentication in the platform presumes digital certificates using a web of trust. This paper presents the findings of the SealedGRID project, and the steps taken for implementing Attribute-based access control policies specifically customized to the smart grid. The outcome is to develop a novel, hierarchical architecture composed of different licensing entities that manages access to resources within the network infrastructure. They are based on well-drawn policy rules and the security side of these resources is placed through a context awareness module. Together with this technology, the IoT is used with Big Data (facilitating easy handling of large databases). Another goal of this paper is to present implementation and evaluations details of a secure and scalable security platform for the smart grid.

A Non-Interactive Attribute-Based Access Control Scheme by Blockchain for IoT

As an important method of protecting data confidentiality in the Internet of Things (IoT), access control has been widely concerned. Because attribute-based access control mechanisms are dynamic, it is not only suitable to solve the dynamic access problem in IoT, but also to deal with the dynamic caused by node movement and access data change. The traditional centralized attribute-based access control mechanism has some problems: due to the large number of devices in IoT, the central trusted entity may become the bottleneck of the whole system. Moreover, when a central trusted entity is under distributed denial-of-service (DDoS) attack, the entire system may crash. Blockchain is a good way to solve the above problems. Therefore, we developed a non-interactive, attribute-based access control scheme that applies blockchain technology in IoT scenarios by using PSI technology. In addition, the attributes of data user and data holder are hidden, which protects the privacy of both parties’ attributes and access policy. Furthermore, the experimental results indicate that our scheme has high efficiency.

Combining IOTA and Attribute-Based Encryption for Access Control in the Internet of Things.

Unauthorized resource access represents a typical security threat in the Internet of Things (IoT), while distributed ledger technologies (e.g., blockchain and IOTA) hold great promise to address this threat. Although blockchain-based IoT access control schemes have been the most popular ones, they suffer from several significant limitations, such as high monetary cost and low throughput of processing access requests. To overcome these limitations, this paper proposes a novel IoT access control scheme by combining the fee-less IOTA technology and the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) technology. To control the access to a resource, a token, which records access permissions to this resource, is encrypted by the CP-ABE technology and uploaded to the IOTA Tangle (i.e., the underlying database of IOTA). Any user can fetch the encrypted token from the Tangle, while only those who can decrypt this token are authorized to access the resource. In this way, the proposed scheme enables not only distributed, fee-less and scalable access control thanks to the IOTA but also fine-grained attribute-based access control thanks to the CP-ABE. We show the feasibility of our scheme by implementing a proof-of-concept prototype system using smart phones (Google Pixel 3XL) and a commercial IoT gateway (NEC EGW001). We also evaluate the performance of the proposed scheme in terms of access request processing throughput. The experimental results show that our scheme enables object owners to authorize access rights to a large number of subjects in a much (about 5 times) shorter time than the existing access control scheme called Decentralized Capability-based Access Control framework using IOTA (DCACI), significantly improving the access request processing throughput.

The New Method of Sensor Data Privacy Protection for IoT

This article introduces the new method of sensor data privacy protection method for IoT. Asymmetric encryption is used to verify the identity of the gateway by the sensor. The IoT gateway node verifies the integrity and source of the data, then creates a block, and submits the block chain transaction. In order to avoid tracking the source of the data, a ring signature is used to anonymize the gateway transaction. The proxy re-encryption method realizes the sharing of encrypted data. On the basis of smart contracts, attribute-based data access control allows decentralized applications to finely control data access. Through experiments, the effects of sensor/gateway verification, transaction signatures, and sensor data encryption on performance are discussed. The results show that transaction delays are all controlled within a reasonable range. The system performance achieved by this method is also relatively stable.

A Lightweight Attribute-Based Access Control Scheme for Intelligent Transportation System With Full Privacy Protection

The Intelligent Transportation System (ITS) provides more possibilities for the realization of smart cities by integrating the Internet of Things (IoT) and cloud computing. However, how to ensure security of IoT data stored in the cloud has become one of the biggest challenges at present. As a promising solution for realizing fine-grained access control, Ciphertext-Policy Attribute-Based Encryption (CP-ABE) can be used to ensure data security. However, the traditional CP-ABE schemes may leak privacy of ITS users. Moreover, due to their high computational overheads, the current privacy-preserving techniques are not suitable for IoT lightweight devices. To fill this gap, this article presents ABE-FPP, a lightweight attribute-based access control scheme with full privacy protection (FPP), which can achieve full privacy protection in the three key stages (i.e., key generation, access control, and partial decryption), while reducing consumption overhead on the user side. Specifically, to protect privacy during key generation, a lightweight two-party secure computing protocol between the user and the authority is designed to generate secret keys; to protect privacy during the access control policy setting, we present an efficient policy hidden strategy, which only reveals attribute names and efficiently hides attribute values; to protect privacy during partial decryption, we propose a hybrid authentication method that does not need to submit attribute values to the cloud. Moreover, to achieve lightweight computation for IoT devices, online/offline encryption and outsourced decryption are employed in ABE-FPP. Finally, formal security proofs show that our scheme is secure in the standard model. The asymptotic complexity analyses and experimental results demonstrate that the presented scheme achieves higher computation efficiency than the state-of-the-art ones.

A revocable attribute-based access control system using blockchain

Attribute-based access control is an effective cryptographic mechanism that allows a data owner to perform attribute-level access control over users’ access capabilities. In the application background of blockchain, it is urgent to use attribute-based access control to solve a series of security problems. Although there exist several similar schemes, they do not consider attribute revocation. By adopting the attribute revocation technique based on binary trees, we extended Waters’ ciphertext policy attribute-based encryption (CP-ABE) scheme into a revocable CP-ABE (RCP-ABE) scheme. By combining our RCP-ABE with blockchain, we constructed a revocable attribute-based access control system. The new system supports expressive access control policies and allows the attribute authority to revoke users’ attributes or part of their attributes. The security analysis shows that the new system satisfies several ideal properties, i.e., forward security, backward security, confidentiality, and integrity.

An Access Control Scheme Supporting Privacy Protection Based on Blockchain and Attribute

With the large-scale application of cloud storage systems, lots of attribute-based access control (ABAC) schemes have been introduced to protect data and user security in this insecure environment. ABAC can make data owners control their own data and protect data security and privacy. However, there are two serious privacy leakage problems, namely user attribute privacy and policy privacy, should be solved in the process of constructing ABAC schemes. In this paper, an ABAC scheme supporting privacy protection is constructed, which can solve privacy leakage problems of user attribute privacy and policy privacy in large universe attribute system. Furthermore, a framework is proposed. The framework combines our ABAC scheme, the Ethereum blockchain and blockchain-based storage system. In this framework, the security characteristics of blockchain technology are used to realize decentralization, tamper-resistant and avoiding single point of failure. Besides, the problems of attribute revocation and policy updating are solved by smart contract on the Ethereum blockchain. Finally, we established an initial implementation on Linux and Rinkeby test network, and the experimental results show that our scheme is feasible.

A blockchain-based access control scheme for smart home

With the advancement of technology and economy, the scale of the smart home industry has exploded. While improving people’s lives, smart home systems are facing threats to privacy leaks, malicious attacks, and structural security. Effective security mechanisms are very important for protecting valuable data in smart home systems. Access control helps information systems prevent malicious access, thereby reducing the risk of privacy leakage. Blockchain can provide security support for the Internet of Things system due to its advantages of decentralization and immutability. Therefore, in this paper, a smart home access control scheme based on blockchain is proposed. The scheme uses Hyperledger Fabric and implements access control strategies through smart contracts. By designing a hybrid access control model based on dynamic attribute-based access control and static access control matrix, the remote access control initiated by the user through the Internet and the access control between local devices are well guaranteed at the same time. Through safety analysis and performance evaluation, the feasibility of the proposed scheme is demonstrated.

Extended Authorization Policy for Graph-Structured Data

The high increase in the use of graph databases also for business- and privacy-critical applications demands for a sophisticated, flexible, fine-grained authorization and access control (AC) approach. Attribute-based access control (ABAC) supports a fine-grained definition of authorization rules and policies. Attributes can be associated with the subject, the requested resource and action, but also the environment. Thus, this is a promising starting point. However, specific characteristics of graph-structured data, such as attributes on vertices and edges along a path from a given subject to the resource to be accessed, are not yet considered. The well-established eXtensible Access Control Markup Language (XACML), which defines a declarative language for fine-grained, attribute-based authorization policies, is the basis for our proposed approach—XACML for Graph-structured data (XACML4G). The additional path-specific constraints, described in graph patterns, demand for specialized processing of the rules and policies as well as adapted enforcement and decision-making in the access control process. To demonstrate XACML4G and its enforcement process, we present a scenario from the university domain. Due to the project’s environment, the prototype is built with the multi-model database ArangoDB. Finally, compliance of XACML4G with quality standards for access control systems administration and enforcement is assessed. The results are promising and further studies concerning performance and use in practice are planned.

TRUST- BASED MODELING MAC-TYPE ACCESS CONTROL THROUGH ACCESS AND ACTIONS CONTROL POLICIES

In recent decades, the number of researches on access control and user actions in computer systems has increased. Over time, there have been two models of implementing Mandatory Access Control (MAC) policies for government institutions and Discretionary Access Control (DAC) for the business environment, policies that various access control modeling solutions seek to implement. Among the access control modeling solutions developed are Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC), presented in the U.S.A. by the National Institute of Standard and Technology (NIST). In Romania, in 2010, the access control solution based on trust was presented. This paper presents Mandatory Access Control policy modeling using the trust-based access and actions control modeling solution.

Trust-Based Blockchain Authorization for IoT

Authorization or access control limits the actions a user may perform on a computer system, based on predetermined access control policies, thus preventing access by illegitimate actors. Access control for the Internet of Things (IoT) should be tailored to take inherent IoT network scale and device resource constraints into consideration. However, common authorization systems in IoT employ conventional schemes, which suffer from overheads and centralization. Recent research trends suggest that blockchain has the potential to tackle the issues of access control in IoT. However, proposed solutions overlook the importance of building dynamic and flexible access control mechanisms. In this paper, we design a decentralized attribute-based access control mechanism with an auxiliary Trust and Reputation System (TRS) for IoT authorization. Our system progressively quantifies the trust and reputation scores of each node in the network and incorporates the scores into the access control mechanism to achieve dynamic and flexible access control. We design our system to run on a public blockchain, but we separate the storage of sensitive information, such as user’s attributes, to private sidechains for privacy preservation. We implement our solution in a public Rinkeby Ethereum test-network interconnected with a lab-scale testbed. Our evaluations consider various performance metrics to highlight the applicability of our solution for IoT contexts.

Research on Decentralized Access Control in Big Data Environment

With the rapid increase of network data, there are many challenges of security about data sharing in big data environment. The traditional attribute-based access control model generally adopts the centralized method. In the process of practical operation, once the decision node is attacked, the method will bring security risks to data resources. In order to improve the security of centralized access control and adapt to both dynamic and fine-grained characteristics of data access control in big data environment. The decentralized access control method for big data is proposed by combining the blockchain technology with attribute-based access control model.

Efficient Ciphertext-Policy Attribute-Based Encryption Constructions with Outsourced Encryption and Decryption

The invention of the Ciphertext-Policy Attribute-Based Encryption scheme opened a new perspective for realizing attribute-based access control systems without being forced to trust the storage service provider, which is the case in traditional systems where data are sent to the storage service provider in clear and the storage service provider is the party that controls the access to these data. In the Ciphertext-Policy Attribute-Based Encryption model, the data owner encrypts data using an attribute-based access structure before sending them to the storage service, and only users with authorized sets of attributes can successfully decrypt the generated ciphertext. However, Ciphertext-Policy Attribute-Based Encryption schemes employ expensive operations (i.e., bilinear pairings and modular exponentiations) and generate long ciphertexts and secret keys, which makes them hard to implement in real-life applications especially for resource-constrained devices. In this paper, we propose two Ciphertext-Policy Attribute-Based Encryption Key Encapsulation Mechanisms that can be provided as services in the cloud, minimizing the user’s encryption and decryption costs without exposing any sensitive information to the public cloud provider. In the first scheme, the ABE Service Provider is considered fully untrusted. On the other hand, the second scheme requires the ABE Service Provider to be semi-trusted (Honest-but-Curious) and does not collude with illegitimate users. Both schemes are proved to be selectively CPA-secure in the random oracle. The theoretical and experimental performance results show that both our first and second schemes are more efficient than the reviewed outsourced CP-ABE schemes in terms of user-side computation, communication, and storage costs.

How to implement secure cloud file sharing using optimized attribute-based access control with small policy matrix and minimized cumulative errors

The stunning growth of Internet users through Cloud File Sharing (CFS) is raising great concerns about unprecedented cloud security and privacy breach. Also, the recent breakthrough in quantum computing further reinforces this kind of concerns, thus we exploit an efficient solution to guarantee personal privacy and resist quantum attacks in the CFS service. In our solution, we integrate the Attribute-based Access Control/eXtensible Access Control Markup Language (ABAC/XACML) model and the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) into the CFS. To improve the performance of CP-ABE, we make use of an optimization method to convert the ABAC/XACML policy into a Small Policy Matrix (SPM). We further prove that this matrix has small coefficients and generates an all-one reconstruction vector, such that it reduces the cumulative error in lattice cryptosystem to the minimum. By using the SPM, we design a new CP-ABE scheme from Lattice (CP-ABE-L) to prevent the enlargement of error bounds. We also give the optimal estimation of system parameters, which satisfy three lattice-generation conditions to implement a valid Error Proportion Allocation (EPA). Our scheme is proved secure against chosen-plaintext attack with a selective attribute set under the Decision Learning with Errors (DLWE) assumption in the standard model. The performance evaluation and analyses illustrate that our scheme not only has short parameters, but also maintains efficient computation and reasonable storage overloads.

ETPAC: ECC based trauma plight access control for healthcare Internet of Things

Healthcare Industry experiences a rapid change in the traditional way of providing Medical Services to Patients with the revolution of the Internet of Things (IoT) and the Digitization of services. The Healthcare IoT (HIoT) provides Hospitals to render excellent services to Patients at an optimized cost. The Healthcare IoT must ensure not to disrupt or tamper with sensitive Medical Information of the Patient in addition to the continuous availability of data and services. The proposed framework is designed for secure emergency access to Patient data over Healthcare IoT. Normally, the Doctor obtains the Shared Key directly from the Patient to access the Medical data. In Trauma Plight, a Patient pre-shares an Attribute based Key with a set of Secondary Authority in Trauma Plight (SATP) and access permission to the Doctor for utilizing Emergency Key from SATP. The Doctor retrieves the medical record by using the Attribute based key and the Emergency-key to medicate the Patient in Trauma. The proposed ECC model based Trauma Plight Access Control (ETPAC) reduces the Shared Secret Key generation time, Encryption, Decryption Time, Cipher-Text size with low Secret Key Size. The performance analysis indicates the enhanced security with reduced time complexity of Computation and Communication in ETPAC compared to Lightweight Break-glass Access Control, an Efficient Policy Hiding Attribute Based Access Control, and an Efficient and Robust Attribute based Encryption Supporting Access Policy Hiding in Healthcare IoT.

Distributed Ciphertext-Policy Attribute-Based Encryption With Enhanced Collusion Resilience and Privacy Preservation

In recent years, numerous incidents of information leakage have not only violated the privacy of users but also been a key issue hindering the development of cloud computing. How to guarantee the confidentiality of shared data while protecting the privacy of users has become a hot topic of research. In this article, we propose a decentralized attribute-based access control mechanism. Compared with the existing well-known schemes, the proposed scheme enhances private security and the confidentiality of shared data. An anonymous key extraction protocol is introduced to help users prove their identities with zero knowledge and help the authorities to generate legitimate private keys without knowing the users global identifiers and specific attributes. We also eliminate linear relationships among the keys appearing in the previous reported works, which makes unauthorized users unable to combine their private keys to generate a legal secret key or combine their respective decryption results to recover the plaintext message. Performance and security analyses show that the new work is secure against collusion attacks, thus protecting users’ privacy and security. Besides, the security of the proposed scheme is reduced to the q-PBDHE assumption in the standard model.