Attribute-based Access Control Research Articles

A symbolic attribute-based access control model for data security in the cloud

There have been several attempts made in literature to develop access control techniques to stem data security problems. Many of these techniques had been found to have one deficiency or other. Hence, this study developed a Symbolic Attribute-Based Access Control (SABAC) system for data security in the cloud service environment. SABAC system was implemented by developing Hash-tag Symbol Authentication (HSA) algorithm using the Message Digest-5 encryption. SABAC utilizes a 3-Tier continuous authentication method by combining the use of username and password, HSA code, and real-time image monitoring and verification. HSA code is generated by combining 5-tuple user attributes and the string generated from the user’s image using Obfuscation Technique. The concatenated string is converted to hexadecimal which serves as input to MD5 to produces a unique HSA code. SABAC was evaluated using three major security metrics of confidentiality, integrity, and avail-ability. The result of security metrics tests showed a confidence level of 99.993%, integrity threshold of 99.998%, and availability throughput of 150 users/second. This implies that SABAC is highly efficient for cloud data security. It shows that hackers would find it impossible to match any fake identity with valid HSA in the database. The study concluded that SABAC could be used for access control in a cloud environment for assuring data security. It was recommended that the SABAC system should be adopted by Cloud Solution Providers and Security Specialists.

Reliable Data Communication Model for Fog Computing

To maintain data privacy and control who has access to what in the cloud, attribute-based encryption might be utilized. Attribute security is violated when apparent qualities are introduced to the encrypted message to assist people to identify necessary details in vast systems. To offer an effective attribute-based access control with an authorized search strategy, this research expands the anonymous key-policy attribute-based encryption (AKP-ABE) to provide fine-grained data retrieval while safeguarding attribute privacy (EACAS). In EACAS, data users may generate the trapdoor using the secret key supplied by data owners and conduct searches based on access restrictions to get the relevant data. Cryptographic protocols and trapdoor generation use a synthetic property devoid of syntactic significance to provide an attribute-based search on the exported encoded information in the fog. Data owners may implement granular access control on their outsourced data by establishing the search criteria that will be used by data consumers to locate relevant content based on protected attributes. We show that compared to the state-of-the-art methods, EACAS requires less time and space to process and store data.

A Novel Access Control Method Via Smart Contracts for Internet-Based Service Provisioning

The dramatic rise in internet-based service provisioning has highlighted the importance of deploying scalable access control methods, facilitating service authorization for eligible users. Existing centralized methods suffer from single-point-of-failure, low scalability, and high computational overhead. In addition, in these methods, users pay for the service provider as well as the network provider independently for a specific service, imposing extra cost for the user. New business models are needed to resolve such shortcomings. The realization of these models calls for sophisticated access control methods which consider the requirements of all parties who want to: 1) access a service; 2) provide that service; and 3) provide the network connection. Blockchain is an enabling technology that provides unprecedented opportunities to novel distributed access control methods for new business models. We propose an Attribute-based access control solution by leveraging Blockchain to share network providers' and service providers' resources. Our solution offers access flexibility based on the requirements of the parties while fulfilling reliability, accountability, and immutability. Besides, it decreases the overall service cost which is beneficial for each party. Our solution makes it possible for service providers to outsource their access control procedures without requiring a trusted third party. The experiments confirm that our solution can provide a fast, comprehensive, and scalable access control mechanism.

An efficient attribute-based access control system with break-glass capability for cloud-assisted industrial control system.

In the era of Industry4.0, cloud-assisted industrial control system (ICS) is considered to be the most promising technology for industrial processing automation systems. However, the emerging attack techniques targeted at ICS underlines the importance of data security. To protect the data from the unauthorized accesses, attribute-based encryption is utilized to meet the requirement of confidentiality and access control demand of an open network environment. In ICS scenarios, it is critically important to offer the timely and efficient service, especially in the emergency situations. This paper proposes an efficient access control strategy that enables two access modes: attribute-based access and emergency break-glass access. Normally, users can access the encrypted data as long as their attributes satisfy the access policy specified by the data owner. In emergency cases, emergency situation handlers can override the access control policy of the encrypted data by the break-glass access capability. To eliminate the overhead for data consumers, the scheme outsources the data decryption and policy updating to the semi-trusted fog and cloud. The scheme also implements the CP-ABE scheme in terms of an asymmetric Type-3 pairings instead of the symmetric Type-1 pairings, which are inefficient and have security issues. Finally, the paper analyses the security of the scheme, evaluates its performance, and compares it with related works.

Improving Performance of ABAC Security Policies Validation using a Novel Clustering Approach

Cloud computing offers several services, such as storage, software, networking, and other computing services. Cloud storage is a boon for big data and big data owners. Although big data owners can easily avail cloud storage without spending much on infrastructure and software to manage their data, security is a big issue, and protecting the outsourced big data is challenging and ongoing research. Cloud service providers use the attribute-based access control model to detect malicious intruders and address the security requirements of today’s new computing technologies. Anomalies in security policies are removed to improve the efficiency of the access control model. This paper implements a novel clustering approach to cluster security policies. Our proposed approach uses a rule-specific cluster merging technique that compares the rule with the clusters where the probability of similarity is high. Hence this technique reduces the cost, time, and complexity of clustering. Rather than verifying all rules, detecting and removing anomalies in every cluster of rules improve the performance of the intrusion detection system. Our novel clustering approach is useful for the researchers and practitioners in the ABAC policy validation.

OO-ABMS: Online/Offline-Aided Attribute-Based Multi-Keyword Search

Recently, Attribute-Based Encryption (ABE) is used as a baseline technology for keyword searching mechanisms to cater users’ security and privacy-related concerns who outsource their data to the powerful and resource-rich cloud server. Almost all the existing Attribute-Based Keyword Searching (ABKS) schemes either operate on a single-keyword or multiple; conjunctive-keyword search setting. These schemes work on the premise of an “all-or-nothing” retrieval mode, which greatly limits users’ searching capabilities. The most recent work incorporates multi-keyword ranked search in attribute-based encryption, which improves user search results accuracy and the flexibility of retrieval mode. However, these schemes demand high computation overhead, which ultimately suffers searching efficiency. This dilemma prevents further research and application of ABKS schemes, especially mobile-resource constrained devices such as mobile phones. This paper proposes an Online/Offline-aided Attribute-Based Multi-keyword Search (OOABMS) scheme to delegate most laborious computation operations to the offline phase before acquiring the attribute-based access control policy or keywords. An online phase then quickly assembles the pre-computed index or trapdoor with the required specifics when it becomes known. Theoretical comparison and simulation results show that our scheme is more efficient and practical in the real world scenario for mobile cloud computing in terms of computation overhead and flexibility.

Privacy-Preserving Mechanism in Smart Home Using Blockchain

The IoT, or Internet of Things has been a major talking point amongst technology enthusiasts in recent years. The internet of thing (IoT) has been emerged and evolved rapidly, making the world's fabric around us smarter and more responsive. The smart home uses one such transformation of IoT, which seems to be the wave of the future. However, with the increasing wide adoption of IoT, data security, and privacy concerns about how our data is collected and shared with others, has also risen. To solve these challenges, an approach to data privacy and security in a smart home using blockchain technology is proposed in this paper. We propose authentication scheme that combines attribute-based access control with smart contracts and edge computing to create a secure framework for IoT devices in smart home systems. The edge server adds scalability to the system by offloading heavy processing activities and using a differential privacy method to aggregate data to the cloud securely and privately. We present several aspects of testing and implementing smart contracts, the differential private stochastic gradient descent algorithm, and system architecture and design. We demonstrate the efficacy of our proposed system by fully examining its security and privacy goals in terms of confidentiality, integrity, and availability. Our framework achieves desired security and privacy goals and is resilient against modification, DoS attacks, data mining and linkage attacks. Finally, we undertake a performance evaluation to demonstrate the proposed scheme's feasibility and efficiency.

Internet of Things Access Control System Based on Hyperledger

The current access control of IoT devices adopts the traditional method of centralized control, which leads to the shortcomings of single point of failure and low efficiency of the entire system. Due to the increasing amount of data generated by the Internet of Things network and the more complex data structure, the traditional access control system has exposed the problem of insufficient security when communicating. Based on the characteristics of blockchain decentralization, non-tampering, and programmable Hyperledger, an attribute-based access control mechanism combining blockchain with the Internet of Things is proposed to realize dynamic changes to the access control strategy and ensure the access control of the Internet of Things Safety and reliability.

An efficient attribute-based hierarchical data access control scheme in cloud computing

Security issues in cloud computing have become a hot topic in academia and industry, and CP-ABE is an effective solution for managing and protecting data. When data is shared in cloud computing, they usually have multiple access structures that have hierarchical relationships. However, existing CP-ABE algorithms do not consider such relationships and just require data owners to generate multiple ciphertexts to meet the hierarchical access requirement, which would incur substantial computation overheads. To achieve fine-grained access control of multiple hierarchical files effectively, first we propose an efficient hierarchical CP-ABE algorithm whose access structure is linear secret sharing scheme. Moreover, we construct an attribute-based hierarchical access control scheme, namely AHAC. In our scheme, when a data visitor’s attributes match a part of the access control structure, he can decrypt the data that associate with this part. The experiments show that AHAC has good security and high performance. Furthermore, when the quantity of encrypted data files increases, the superiority of AHAC will be more significant.

A Decentralized Blockchain-based Architecture for a Secure Cloud-Enabled IoT

The integration of cloud computing and Internet of Things (IoT) offers a promising, rich platform for data collection and analysis in smart healthcare. In such a model, IoT devices collect data about patient health status through multiple intelligent sensors, whereas cloud offers scalable resources to quickly meet workload demands. Despite these remarkable improvements, the current architectures do not sufficiently address the security needs for patient medical records. In this perspective, and bearing in mind the specific characteristics of each technology, we propose a distributed security mechanism in a way that fits with IoT and cloud constraints. Our contribution to secure cloud-enabled IoT is twofold. First, we rely on OM-AM (Objective, Model, Architecture and Mechanism) for modeling and analysing the security and privacy requirements of smart healthcare. Second, we use blockchain architecture along with Attribute-Based Access Control (ABAC) model as a decentralized flexible system to support access control decisions. In particular, we rely on XACML (eXtensible Access Control Markup Language) to easily build and implement robust policies required for maintaining a secure IoT-based environment. The novelty of the proposed framework lies at smartly leveraging the recent technologies to keep health information confidential. In fact, putting blockchain and IoT together would undoubtedly create a totally new solution for remote patient monitoring. The simulation results show that the proposal is an efficient way of implementing ubiquitous and cognitive tools for smart healthcare systems.

An efficient policy evaluation engine with locomotive algorithm

The evaluation performance of PDP (policy decision point), especially in large-scale policy sets, is one of the most significant challenges in XACML (eXtensible Access Control Markup Language). With high time-consuming and extensive storage policies, large-scale policy sets are becoming more complicated when their evaluation performance need to be improved. Based on numericalization and batch processing, a new locomotive algorithm is proposed to design and implement a novel policy evaluation engine called XDPNBE that can efficiently deal with large-scale policy sets and make authorization decisions in multiple circumstances. XDPNBE enables efficient decisions within an attributed-based access control framework that has a strong promotion of evaluation performance. By simulating requests, XDPNBE is compared with the Sun PDP, XEngine, HPEngine and SBA-XACML. Experimental results show that if the number of requests reaches 10,000, the evaluation time of XDPNBE on the large-scale policy set with 120,000 rules is approximately 0.21%, 4.69%, 5.67% and 9.66% of that of the Sun PDP, XEngine, HPEngine and SBA-XACML, respectively.

ICN Naming Scheme with Attribute-Based Access Control

ICN (Information Centric Networking) could be a replacement network design that ambitions to beat the vulnerability of present IP based networking design. ICN depends on information, i.e. data, which is exchanged over the network, rather than creating a link between the interacting hosts. ICN content clone may be stored at various locations. Here they have to build security and privacy for the entire system. Here 4 important roles are concentrated. The first role is the Data Owner. Here, the data owner should be properly authenticated for the upload of the file. The Second role is Attribute Authority. Here the Attribute Authority will receive both Data owner and Data Consumer request. Data Owner is used to OTP Authentication. That OTP is passed through the Email. Using that OTP to access our ICN server. OTP is used for full secure access to upload our file in ICN server. OTP is a one-time password to access our ICN server. It will be very secure to access our file in the ICN server. The Third role is Data Consumer. Data Consumers will enter the request for attribute key will send to attribute authority. Using the attribute key, the consumer has the privilege to send a request for file key. The final role is ICN server. It is used for storage purpose. This maintains a File Upload and Download history which is encrypted data from data owners and the data consumer. They create a multi-authority CP-ABE structure which features: 1) A scheme may not require a completely authorized central authority, and all attribute authorities may give secret keys to users on an individual basis; 2) Every attribute authority may automatically exclude any user by its jurisdiction so those withdrawn users will not access to the outsourced information afterwards.; 3) ICN servers may upgrade encrypted data from the actual timeline onto the next in this manner which revoked users are unable to access previously relevant information, and 4) updates of secret keys and encrypted content are carried out from a public manner. The benefits of our design are demonstrated by contrasting it with related works and by applying it too far to show its practicality. In addition, the suggested method is shown to be safe in the random oracle method.

A Secure Integrated Framework for Fog-Assisted Internet-of-Things Systems

Fog-assisted Internet-of-Things (Fog-IoT) systems are deployed in remote and unprotected environments, making them vulnerable to security, privacy, and trust challenges. Existing studies propose security schemes and trust models for these systems. However, mitigation of insider attacks, namely, blackhole, sinkhole, sybil, collusion, self-promotion, and privilege escalation, has always been a challenge and mostly carried out by the legitimate nodes. Compared to other studies, this article proposes a framework featuring attribute-based access control and trust-based behavioral monitoring to address the challenges mentioned above. The proposed framework consists of two components, the security component (SC) and the trust management component (TMC). SC ensures data confidentiality, integrity, authentication, and authorization. TMC evaluates Fog-IoT entities' performance using a trust model based on a set of Quality of Service (QoS) and network communication features. Subsequently, trust is embedded as an attribute within SC's access control policies, ensuring that only trusted entities are granted access to fog resources. Several attacking scenarios, namely, Denial of Service (DoS), Distributed DoS, probing, and data theft are designed to elaborate on how the change in trust triggers the change in access rights and, therefore, validates the proposed integrated framework's design principles. The framework is evaluated on a Raspberry Pi 3 Model B+ to benchmark its performance in terms of time and memory complexity. Our results show that both SC and TMC are lightweight and suitable for resource-constrained devices.

An Attribute-Based Cross-Domain Access Control Model for a Distributed Multiple Autonomous Network

The distributed multiple autonomous network has become the main trend of modern information systems, such as Cloud, Service-Oriented Architecture (SOA) and Internet of Things (IoT). Access control in such a heterogeneous and dynamic system has become a major information security challenge, which hinders the sharing of resources and information. In this work, we present an Attribute-Based Access Control (ABAC) model for cross-domain access control. The proposed access control model comprises a boundary control server designed to provide cross-domain access control capability. An eXtensible Access Control Markup Language (XACML) policy model-based implementation is introduced. Process and implementation show the proposed model alleviates the security risk on the domain boundary during the cross-domain access control process.

Attribute-Based Hybrid Boolean Keyword Search over Outsourced Encrypted Data

With cloud computing becoming increasingly popular, there has been a rapid increase in the number of data owners who outsource their data to the cloud while allowing users to retrieve the data. To preserve the privacy of data, data owners usually encrypt their data before outsourcing them to the cloud, and cloud servers can search across the ciphertext domain on behalf of users without learning any information about the data. However, existing work in the literature mostly supports only a single-user or single-keyword search which is not able to satisfy more desired expressive search. Thus, we propose a searchable encryption primitive with attribute-based access control for hybrid boolean keyword search over outsourced encrypted data. There exist several desirable features: (1) Data owners can set search permissions for outsourced encrypted data according to an access control policy. (2) Multiple users, whose attributes satisfy the access control policy, are allowed to perform a retrieval operation upon the encrypted data. (3) Authorized users are able to perform more expressive search, such as any required boolean keyword expression search. Additionally, this primitive is provably secure under our security model and we have also implemented the prototype to show the practicality of the primitive.

An efficient and outsourcing-supported attribute-based access control scheme for edge-enabled smart healthcare

In recent years, the continuous development of smart healthcare has brought substantial convenience to our lives, especially for emerging edge-enabled smart healthcare systems that transmit and store a large amount of medical data. However, if private health data of users are leaked or tampered with, it will cause enormous damage to users’ rights, even threatening the safety of their lives. Traditionally, attribute-based encryption (ABE) is used to encrypt data and implement fine-grained access control for such sensitive information. However, the computing overhead of traditional ABE is relatively large, and in an edge-enabled environment, the outsourcing part of encryption and decryption to the edge node can reduce the computing cost of resource-constrained devices for edge-enabled smart healthcare. However, current schemes are not efficient for resource-constrained devices and edge nodes. Therefore, an efficient ABE scheme is proposed that outsources part of the encryption and decryption to the edge nodes as well as supports attribute updates, enabling flexible right control. A formal security proof is provided, verifying that our scheme is secure under the Decisional Bilinear Diffie–Hellman assumption. The performance of our scheme is evaluated at different security levels, and the experimental results demonstrate that our scheme is more efficient for resource-constrained devices than the traditional ABE.

Attribute-Based Access Control for Smart Cities: A Smart-Contract-Driven Framework

Efficient and reliable access control in smart cities is critical for the protection of various resources for decision making and task execution. Existing centralized access control schemes suffer from the limitations of single point of failure, low reliability, and poor scalability. This article, therefore, proposes a distributed and reliable access control framework for smart cities by combining the blockchain smart contract technology and the attribute-based access control (ABAC) model. The framework consists of one policy management contract (PMC) for managing the ABAC policies, one subject attribute management contract (SAMC) for managing the attributes of subjects (i.e., entities accessing resources), one object attribute management contract (OAMC) for managing the attributes of objects (i.e., resources being accessed), and one access control contract (ACC) for performing the access control. To show the feasibility of the proposed framework, we construct a local private Ethereum blockchain system to implement the four smart contracts and also conduct experiments to evaluate the monetary cost as well as to compare the proposed framework with an existing access control list (ACL)-based scheme. The experimental results show that although the proposed scheme consumes more money than the ACL-based scheme at the deployment stage, it introduces less monetary cost during the system running especially for large-scale smart cities.

Policy-Engineering Optimization with Visual Representation and Separation-of-Duty Constraints in Attribute-Based Access Control

Recently, attribute-based access control (ABAC) has received increasingly more attention and has emerged as the desired access control mechanism for many organizations because of its flexibility and scalability for authorization management, as well as its security policies, such as separation-of-duty constraints and mutually exclusive constraints. Policy-engineering technology is an effective approach for the construction of ABAC systems. However, most conventional methods lack interpretability, and their constructing processes are complex. Furthermore, they do not consider the separation-of-duty constraints. To address these issues in ABAC, this paper proposes a novel method called policy engineering optimization with visual representation and separation of duty constraints (PEO_VR&SOD). First, to enhance interpretability while mining a minimal set of rules, we use the visual technique with Hamming distance to reduce the policy mining scale and present a policy mining algorithm. Second, to verify whether the separation of duty constraints can be satisfied in a constructed policy engineering system, we use the method of SAT-based model counting to reduce the constraints and construct mutually exclusive constraints to implicitly enforce the given separation of duty constraints. The experiments demonstrate the efficiency and effectiveness of the proposed method and show encouraging results.

A scalable and secure attribute-based access control method in Internet of Things with efficient revocation

The Internet of Things (IoT) is an emerging network paradigm that understands the Because IoT is connections between all things and is the foundation of the intelligent community. The pervasive, always about everyday life or daily work of the user, privacy and security are important.
 In other complex and heterogeneous properties of the IoT make its security issues very challenging. words, how to achieve data, while data privacy is a challenging task. In addition, resource constraints In spite of the attribute based of node creates a lightweight requirement for IoT security mechanisms. encryption like (CP-ABE), can provide access control to data by allowing specific users who their This paper provides a method of a attributes in accordance with the policy of access to decoded text. scalable and secure access control based on attribute with effective revocation based on allow users to access and as well as the possibility of expiring some users' access. Security and efficiency evaluations show that the proposed scheme can achieve the desired security goals, while keeping comparable
 computation overhead.

An Attribute-Based Access Control for Cloud Enabled Industrial Smart Vehicles

Smart cities' vision will encompass connected industrial vehicles, which will offer data-driven and intelligent services to the user. Such interaction within dispersed connected objects are sometimes referred as the industrial Internet-of-Vehicles (IIoV). The prime motivation of an intelligent transportation system (ITS) is ensuring the safety of the drivers and offering a comfortable experience to the user. However, such complex infrastructures opens broad attack surfaces to the adversaries, which can remotely exploit and control the critical mechanics in the smart vehicles, including engine and brake systems. Security and privacy concerns are significant barriers to the wide adoption of this revolutionary technology that has to be addressed before a comprehensive implementation of the real vision of ITS. This article is a stepping stone to address access control issues in the IIoV ecosystem and propose a formal attribute-based access control system (referred to ITS-ABAC <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">G</sub> ). The proposed model introduces the notion of groups, which are assigned to various smart entities based on the different attributes. It also offers the implementation of fine-grained security policies and considers individualized privacy preferences along with system-wide policies to accept or reject notification, alerts, and advertisements from different participating smart entities. We present the prototype implementation of our proposed model in the Amazon Web Services IoT platform together with extensive performance to reflect the practicality and wide-scale adoption of the proposed system.