Attribute-based Access Control Research Articles

A survey on blockchain envisioned attribute based access control for internet of things: Overview, comparative analysis, and open research challenges

The Internet of Things (IoT) network is rapidly expanding due to sudden technological advancements, which enable objects to become intelligent and contribute to the network. Before permitting a newly added IoT device to communicate with the network, it is essential to provide access and authenticate the device’s legitimacy by ensuring that it has not been tampered. Recently, blockchain technology has been integrated into Attribute Based Access Control (ABAC) protocols to supply a more robust security mechanism for access control in IoT. The IoT and blockchain-based ABAC serve as the foundation of this survey, offering a comprehensive introduction to both topics. Additionally, several security concerns and vulnerabilities associated with Blockchain Envisioned ABAC (BE-ABAC) are presented. A Comparison with related surveys has also been made. Besides, we also present a comparative analysis based on evaluation based on Distance from Average Solution (EDAS) to rank the best schemes among the suggested BE-ABAC schemes. In conclusion, we discuss some open research challenges in an IoT network that uses blockchain to manage access control.

A hybrid framework to enhance cloud security for storing and retrieving confidential data in clouds

<p>The building pieces for creating a secure cloud framework for data exchange with authenticated and authorized users are ECC and ABAC. So, the goal of this study is to improve access control and encryption-related methods in order to increase security. The elliptic curve is a key component of the comparative study of cloud encryption and access control techniques. This research project’s main goal is to provide a security architecture that combines authenticated access with attribute-based access control and better elliptic curve encryption. The second goal is to provide a better mapping strategy with reduced time and space complexity for elliptic curve encoding from plain text. To boost the performance of the standard ECC, a thorough algorithm focusing on designing an improved mapping mechanism for encoding plain text to elliptic curve points with excellent security has been included. The strength of the security should not be sacrificed in order to reduce security measures’ overhead costs. ABE is regarded as an effective way for protecting cloud data, according to study results. Because to the use of complex pairing processes, the same is difficult to use. As a result, a hybrid approach using ECC and ABAC performs better to handle the increasing processing capacity.</p>

A Systematic Comparison between the Ethereum and Hyperledger Fabric Blockchain Platforms for Attribute-Based Access Control in Smart Home IoT Environments.

Despite the lack of blockchain systems being utilized in modern IoT environments, the prevalence of blockchain technology is increasing, due to its high level of security and accountability. The integration of blockchain technology and access control in a decentralized system for smart home networks is a promising solution to this issue. This paper compares the implementation of attribute-based access control (ABAC) with two popular blockchain platforms, Ethereum and Hyperledger Fabric, for a smart home internet of things (IoT) environment. We present a comprehensive summary of access-control and blockchain-access-control methods, to provide the necessary background for this study. Additionally, we present an original ABAC smart contract for Ethereum, and the modification of a pre-existing Hyperledger Fabric ABAC smart contract, for this comparison. Through the simulation of both implementations, the advantages and limitations will be considered, to determine which is better suited for a smart home IoT environment.

Microsoft Purview: A System for Central Governance of Data

Modern data estates are spread across data located on premises, on the edge and in one or more public clouds, spread across various sources like multiple relational databases, file and storage systems, and no-SQL systems, both operational and analytic; this phenomenon is referred to as data sprawl. Data administrators who wish to enforce compliance across the entire organization have to inventory their data, identify what parts of it are sensitive, and govern the sensitive data appropriately --- across the entirety of their sprawling data estate. Today, governance of data is completely siloed; each of the data subsystems has its own (and varied) governance features. Policies applied to sensitive data are applied piece-meal by iterating over all the data sources in a custom language specific to each source. This makes data governance cumbersome, error-prone (because a given policy must be manually enforced across different subsystems, inconsistencies can easily arise), and expensive. This paper presents Microsoft Purview , a service for unified governance of the entire data estate of an organization from a single central pane of glass. The Purview service consists of three parts: (1) a Data Map or metadata catalog that is populated by automated scanning of data sources in the organization, (2) a system to store and manage sensitivity classification of data, and (3) a policy system that enables data security officers to author and implement policies that span the entire organization, e.g., a policy that says, "Non-full-time employees should be denied access to data classified as PII (Personally Identifiable Information.") Purview transforms data governance across a complex data estate by offering the ability to govern centrally and automating data discovery, classification and policy enforcement. While other commercial catalog systems also build a global catalog, Purview is unique in its support for policies. It is also distinguished by covering both structured and unstructured data, thanks to its deep integration with Office 365 and its governance framework; indeed, "Microsoft Purview" represents a new unified offering that combines Office 365 governance and what was formerly a service for governing structured data called "Azure Purview". By integrating with Office 365's Rights Management Service, Purview offers central governance over structured data stored in databases and stores, reports in systems such as Power BI, as well as document data stored in Office 365. The Purview vision is to make the metadata in the Data Map increasingly richer through further automation and curation support and to use this 360 degree view of the data estate to support a wide range of governance policies, ranging from access control to lifecycle management (e.g., retention, deletion, restricting data movement). This paper covers the design and implementation challenges in building the Purview service for Attribute-Based Access Control (ABAC) policies, focusing specifically on a detailed description of its integration with Azure SQL Database. We illustrate the power of unifying Office 365 governance with structured data governance through Purview policies that enforce consistent access control even as data flows between Office 365 and structured data engines like Azure SQL Database. We also describe the results of our empirical evaluation of the performance overheads imposed by Purview.

Fine-grained access control policy in blockchain-enabled edge computing

In the process of data sharing and interaction between untrusted intelligence edge devices, there are risks of misuse and tampering with the data. Hence, how to ensure data security and prevent unauthorized data access is the key problem to be solved in the cloud edge collaborative architecture. However, due to the heterogeneity of edge devices and the diversity of data sources, traditional access control methods cannot meet the requirements of the large-scale, distributed, dynamic and flexible expansion of edge intelligence applications. Therefore, this paper studies the fine-grained data access control method on the basis of smart contracts, and implements the attribute-based access control (ABAC) model through smart contracts. To improve the query efficiency of attributes and policies in the process of access request decision, an attribute management scheme is designed on the basis of the Bloom filter to achieve fast retrieval of attributes and policies. The decentralized fine-grained access control method is tested under the performance indicators such as retrieval delay, deployment delay, rule reduction rate and decision response time.

Smart contracts attribute-based access control model for security & privacy of IoT system using blockchain and edge computing

Smart contracts attribute-based access control model for security & privacy of IoT system using blockchain and edge computing

A Blockchain-Based Trustworthy Model Evaluation Framework for Deep Learning and Its Application in Moving Object Segmentation.

Model evaluation is critical in deep learning. However, the traditional model evaluation approach is susceptible to issues of untrustworthiness, including insecure data and model sharing, insecure model training, incorrect model evaluation, centralized model evaluation, and evaluation results that can be tampered easily. To minimize these untrustworthiness issues, this paper proposes a blockchain-based model evaluation framework. The framework consists of an access control layer, a storage layer, a model training layer, and a model evaluation layer. The access control layer facilitates secure resource sharing. To achieve fine-grained and flexible access control, an attribute-based access control model combining the idea of a role-based access control model is adopted. A smart contract is designed to manage the access control policies stored in the blockchain ledger. The storage layer ensures efficient and secure storage of resources. Resource files are stored in the IPFS, with the encrypted results of their index addresses recorded in the blockchain ledger. Another smart contract is designed to achieve decentralized and efficient management of resource records. The model training layer performs training on users' servers, and, to ensure security, the training data must have records in the blockchain. The model evaluation layer utilizes the recorded data to evaluate the recorded models. A method in the smart contract of the storage layer is designed to enable evaluation, with scores automatically uploaded as a resource attribute. The proposed framework is applied to deep learning-based motion object segmentation, demonstrating its key functionalities. Furthermore, we validated the storage strategy adopted by the framework, and the trustworthiness of the framework is also analyzed.

Designing a Robust Security Framework for Safeguarding Cloud Computing Environments in the Age of Cyber Threats

As online threats grow, it is very important to keep cloud computer settings safe. This paper suggests a complete security system that will keep cloud platforms and data safe from different threats. To make a multi-layered defense system, the framework combines a number of important parts, such as encryption methods, access control systems, and intruder detection systems. Strong encryption methods, like AES (Advanced Encryption Standard) and RSA (Rivest-Shamir-Adleman), are at the heart of the system. They protect the privacy and security of data. Strong key management techniques go along with these methods to keep encryption keys safe and stop people from getting in without permission. Based on the principle of least privilege, access control methods are very important for making sure that only the right people can use resources. Tough access rules are put in place with role-based access control (RBAC) and attribute-based access control (ABAC). In addition, the framework has an intrusion detection system (IDS) that constantly checks cloud settings for any strange activity. Machine learning techniques are used by the IDS to find and stop possible threats in real time. This security strategy covers all aspects of protecting cloud computing settings and adapts to the changing nature of cyber dangers. By using this framework, businesses can make their cloud systems safer and keep private data safe from threats and people who aren't supposed to see it.

AccessChain: An access control framework to protect data access in blockchain enabled supply chain

In recent years, supply chains have evolved into huge ecosystems, demanding trust, provenance, and data privacy. Since blockchain technology (BCT) allows for the development of a distributed environment, it is ideal for supply chain management (SCM) applications. However, concerns regarding data privacy have impeded the development of blockchains. Despite the fact that some blockchains can restrict participants from reading and/or writing data, blockchain’s transparency makes protecting sensitive data challenging. To solve the data privacy challenge, this paper proposes a framework, AccessChain, that is an SCM access control framework that is based on an attribute-based access control (ABAC) model that restricts access to competing parties while allowing for network scalability. This proposed AccessChain model has two types of ledgers in its system: local and global. Local ledgers are used to store business contracts between stakeholders and the attribute-based access control model management, whereas the global ledger is used to record transaction data. AccessChain can enable decentralized, fine-grained and dynamic access control management in SCM when combined with the ABAC model and BCT. This paper’s experimental results illustrate that high throughput can be achieved in a large-scale request environment while maintaining data privacy and sustaining a scalable network.

Enhanced Adaptable and Distributed Access Control Decision Making Model Based on Machine Learning for Policy Conflict Resolution in BYOD Environment

Organisations are adopting new IT strategies such as “Bring Your Own Device” (BYOD) and remote working. These trends are highly beneficial both for enterprise owners and employees in terms of increased productivity and reduced costs. However, security issues such as unauthorised access as well as privacy concerns pose significant obstacles. These can be overcome by adopting access control techniques and a dynamic security and privacy policy that governs these issues where they arise. Policy decision points in traditional access control systems, such as role-based access control (RBAC), attribute-based access control (ABAC), or relationship-based access control (ReBAC), may be limited because the status of access control can vary in response to minor changes in user and resource properties. As a result, system administrators rely on a solution for constructing complex rules with many conditions and permissions for decision control. This results in access control issues, including policy conflicts, decision-making bottlenecks, delayed access response times and mediocre performance. This paper proposes a policy decision-making and access control-based supervised learning algorithm. The algorithm enhances policy decision points (PDPs). This is achieved by transforming the PDP’s problem into a binary classification for security access control that either grants or denies access requests. Also, a vector decision classifier based on the supervised machine learning algorithm is developed to generate an accurate, effective, distributed and dynamic policy decision point (PDP). Performance was evaluated using the Kaggle-Amazon access control policy dataset, which compared the effectiveness of the proposed mechanism to previous research benchmarks in terms of performance, time and flexibility. The proposed solution obtains a high level of privacy for access control policies because the PDP does not communicate directly with the policy administration point (PAP). In conclusion, PDP-based ML generates accurate decisions and can simultaneously fulfill multiple massive policies and huge access requests with 95% Accuracy in a short response time of around 0.15 s without policy conflicts. Access control security is improved by making it dynamic, adaptable, flexible and distributed.

Attribute-based access control scheme for secure storage and sharing of EHRs using blockchain and IPFS

Attribute-based access control scheme for secure storage and sharing of EHRs using blockchain and IPFS

An extended Attribute-based access control with controlled delegation in IoT

Access control is one of the main concerns for securing the Internet of Things (IoT) due to its inherent features. It is particularly challenging to manage access policies and authorization (rights) propagation in a highly dynamic and scalable environment with a potentially unbound number of connected objects. This paper proposes an Attribute-Capability-Based Access Control (ACapBAC) system for the IoT. ACapBAC enables flexible and dynamic access control with fine-grained controlled delegation. The reliability of the proposed solution is highlighted through both efficiency and security analysis.

Authorization Recycling in Attribute-Based Access Control

In most access control scenarios, the communication between the PDP (policy decision point) and the PEP (policy enforcement point) can cause high authorization overhead. Authorization recycling enables PEP to use the previous access control decisions fetched from the PDP to handle some upcoming access control requests, reduce authorization costs, and increase the efficiency of access control decision-making. Inspired by the RBAC (role-based access control) authorization recycling mechanism, this article first presents an ABAC (attribute-based access control) model based on Boolean expressions of subject and object attributes. It then proposes an authorization recycling approach for this model. In this approach, we provide construction and update methods for authorization data caches and access control decision-making rules for SDP (secondary decision point) by using the caches. The proposed approach can deduce precise and approximate access control decisions from the cache of authorization data, reducing communication between the PEP and the PDP. Finally, the feasibility of the proposed method is verified by conducting a small-scale test. ABAC, SDP, authorization recycling, and authorization caching.

Enforcement of separation of duty constraints in attribute-based access control

While the verification of separation of duty (SoD) constraints on attribute based access control (ABAC) systems has been defined and examined in existing works, it still remains an open problem since the existing approaches are either inefficient or inadequate to check all SoD constraints; furthermore, the problem of solving SoD violations has not yet been addressed in the literature. In this paper, we present an integer linear programming (ILP) based approach to check the satisfiability of all SoD constraints. It can be applied to different SoDs. Hence, it is feasible in real-world scenarios. Moreover, we present an ILP based violation solution that can correct all SoD violations with a minimum number of restrictions regarding users’ normal operations on target objects. All SoD violations can be solved in a once-and-done way while simultaneously guaranteeing the satisfaction of all SoD constraints.

Attribute based access control (ABAC) scheme with a fully flexible delegation mechanism for IoT healthcare

Attribute based access control (ABAC) scheme with a fully flexible delegation mechanism for IoT healthcare

BLOCKCHAIN BASED SCHEME CASHLESS SOCIETY

Abstract: Cashless Society in the world of the digital era is now growing rapidly where the buying and selling system uses the Cashless society system where the phenomenon of society utilizes digital payments when making financial transactions, so that the use of cash is minimal. This phenomenon was born as a result of a cashless economy where technological developments and digitalization is able to shift the use of physical money. This research builds on Design Science Research Methods as proposed in the work of Hevner et al and Peffer et al. It follows the design science research objectives of creating IT artefacts through problem identification and motivation, solution goal definition, design and development, demonstration, evaluation, and communication. Therefore, this study aims to establish a method of spanning IT artifacts (i.e., attribute-based access control) and instantiation (i.e., allowable blockchains using hyperledger fabrics). While the implementation process uses Cashless Society in the world of the digital era now, the current study has contributed by expanding efforts to integrate blockchain and business process management.

A traceable and revocable multi-authority attribute-based access control scheme for mineral industry data secure storage in blockchain

With the rapid advancements of the mineral industry, the data generated by this industry chain have increased dramatically. To reduce the growing pressure of data storage and security risks, we design a credible on-chain and off-chain collaborative dual storage system that integrates blockchain technology and Interplanetary file system (IPFS), also construct a traceable and revocable multi-authority ciphertext-policy attributed-based encryption (CP-ABE) algorithm to meet the demand of privacy protection and dynamic fine-grained access control. Furthermore, the multi-authority layered authorization with a central authority model distributes system overhead while enabling the platform can be regulated. More importantly, our scheme achieves accurate trace of the malicious users by white-box traceability and capable of implementing indirect immediate user and attribute revocation without requiring key or ciphertext updates. Finally, the proposed scheme is indistinguishably secure under chosen-plaintext attack (IND-CPA) in the standard model. And the performance analysis demonstrates that our scheme is feature-rich, practical and efficient.

Cloud Storage Systems with Secure Attribute-Based Access Control

This research presents a novel approach to safe access procedure in cloud storage structure by addressing the challenges associated with managing and distributing complex secret keys. The proposed procedure utilizes attribute-based access control and incorporates a client process, an authentication terminal process, and a storage terminal process. The client generates a main secret key and public parameters for each user using an attribute password mechanism. The authentication terminal maintains user attribute, file attribute, and attribute secret key databases. Access control is determined by constructing an access control string from the attributes of the user, file, and file operation type, enabling fine-grained access control and accommodating large-scale user dynamic expansion. Consequently, the access control costs of the cloud storage structure are significantly reduced, while offering a flexible, effective, and secure access control mechanism for safe storage structure access.

End-to-End Database Software Security

End-to-end security is essential for relational database software. Most database management software provide data protection at the server side and in transit, but data are no longer protected once they arrive at the client software. In this paper, we present a methodology that, in addition to server-side security, protects data in transit and at rest on the application client side. Our solution enables flexible attribute-based and role-based access control, such that, for a given role or user with a given set of attributes, access can be granted to a relation, a column, or even to a particular data cell of the relation, depending on the data content. Our attribute-based access control model considers the client’s attributes, such as versions of the operating system and the web browser, as well as type of the client’s device. The solution supports decentralized data access and peer-to-peer data sharing in the form of an encrypted and digitally signed spreadsheet container that stores data retrieved by SQL queries from a database, along with data privileges. For extra security, keys for data encryption and decryption are generated on the fly. We show that our solution is successfully integrated with the PostgreSQL® database management system and enables more flexible access control for added security.

An Internet of Things Access Control Scheme Based on Permissioned Blockchain and Edge Computing

In the IoT (Internet of Things) environment, the existing access control schemes for device resources have some problems, such as poor scalability, high latency, security, and dynamics. Combining the advantages of the permissioned blockchain and edge computing, an access control scheme for the Internet of Things based on the permissioned blockchain and edge computing is proposed. By authenticating the user’s identity at the edge, the user’s identity is reliable and the response time is improved. In the ABAC (Attribute Based Access Control) model, the blockchain is regarded as a trusted entity, and the access control policy is written into a smart contract and deployed on the blockchain for calling. Most of the existing consensus algorithms have the problems of low throughput and scalability. A Kraft (Kademlia–Raft) consensus algorithm is introduced to solve the above issues. Security analysis and experimental results show that the scheme can achieve fine-grained, dynamic access control, has high throughput and low latency, and ensures security and reliability.