Attribute-based Access Control Research Articles

Attribute and User Trust Score-Based Zero Trust Access Control Model in IoV

The Internet of Vehicles (IoV) is an innovative area of interest in modern mobility that is rapidly evolving while facing complex challenges. Traditional IoV networks are susceptible to intrusion threats, which can lead to data leakage and seizure of vehicle control by attackers, thereby endangering vehicle users’ privacy and personal safety. An Attribute and User Trust Score-based Zero Trust Access Control Model (AU-ZTAC) is proposed, combining the zero-trust and attribute-based access control models to meet network protection requirements while achieving fine-grained dynamic access control and incorporating trust evaluation in the access control process to better reflect users’ intent. Experimental results demonstrate the effectiveness and feasibility of trust assessment through the proposed model. A comparison with the classical schemes illustrates that AU-ZTAC allows for more flexible and fine-grained access control in complex access control environments while improving IoV security.

Flexible and secure access control for EHR sharing based on blockchain

With the rapid development of the healthcare industry, many Electronic Health Records (EHRs) have emerged in different healthcare centers. However, lots of personal medical data are stored directly in plaintext at a single healthcare center, which makes it suffer from the single point of failure and brings many security and privacy issues such as privacy information leakage or tampering. The combination of blockchain and attributed-based cryptography can effectively solve the above problems. Therefore, in order to enable flexible fine-grained access control and efficient data retrieval while achieving privacy protection, we employ the ciphertext-policy attributed-based encryption (CP-ABE) and ciphertext-policy attribute-based searchable encryption (CP-ABSE) to propose a hidden policy attribute-based access control scheme. In addition, we combine consortium blockchain and smart contract to provide secure and reliable search and outsourcing decryption. Finally, through the security analysis and experimental results, we demonstrate that our scheme is secure and efficient.

Context-Driven Multigranularity Blockchain: A Comprehensive Framework for Secure Data Management

Effective access control and revocation mechanisms are paramount in the ever-evolving landscape of information security. Traditional models often fall short in addressing the complexities of modern systems, necessitating the integration of context-aware decision-making and multi-granularity attributes. In this manuscript, we propose a novel access control framework leveraging the strengths of Attribute-Based Access Control (ABAC) and Attribute-Based Encryption (ABE) and blockchain technologies. The decentralized and immutable nature of blockchain further bolsters the trustworthiness of access control decisions. Our method introduces context-awareness and multi-granularity attributes into the decision-making process, enhancing adaptability and responsiveness. Through extensive experiments and comparisons with existing approaches, our results demonstrate the superior performance of our proposed method. This work not only contributes to the theoretical foundations of access control but also provides a practical solution that outperforms current state-of-the-art methods, addressing the dynamic security challenges of contemporary information systems.

Securing Cloud Data: An Enhanced Approach through Attribute-Based Access Control Mechanism

Cloud computing is considered one of the most dominant paradigms in the Information Technology (IT) industry these days. It offers new cost-effective services on-demand such as Software as a Service (SaaS), Infrastructure as a Service (IaaS) and Platform as a Service (PaaS). However, with all of these services promising facilities and benefits, there are still a number of challenges associated with utilizing cloud computing such as data security, abuse of cloud services, malicious insider and cyber-attacks. Among all security requirements of cloud computing, access control is one of the fundamental requirements in order to avoid unauthorized access to systems and protect organizations assets. Although, various access control models and policies have been developed such as Attribute based Access Control (ABAC) and Role Based Access Control (RBAC) for different environments, these models may not fulfil cloud’s access control requirements. In this paper, an enhanced attribute-based access control based on strategy mechanism is proposed by introducing a strategy for providing access control to the users in the cloud environment.

Secure monitoring model for smart agriculture using an optimized attribute-based access control centralized authority system

Secure monitoring model for smart agriculture using an optimized attribute-based access control centralized authority system

Secure Data Management with Blockchain-Enabled Attribute-Based Access Control

Secure Data Management with Blockchain-Enabled Attribute-Based Access Control

Heart disease severity level identification system on Hyperledger consortium network.

Electronic Health Records (EHRs) play a vital role in the healthcare domain for the patient survival system. They can include detailed information such as medical histories, medications, allergies, immunizations, vital signs, and more. It can help to reduce medical errors, improve patient safety, and increase efficiency in healthcare delivery. EHR approaches are proven to be an efficient and successful way of sharing patients' personal health information. These kinds of highly sensitive information are vulnerable to privacy and security associated threats. As a result, new solutions must develop to meet the privacy and security concerns in health information systems. Blockchain technology has the potential to revolutionize the way electronic health records (EHRs) are stored, accessed, and utilized by healthcare providers. By utilizing a distributed ledger, blockchain technology can help ensure that data is immutable and secure from tampering. In this article, a Hyperledger consortium network has been developed for sharing health records with enhanced privacy and security. The attribute based access control (ABAC) mechanism is used for controlling access to electronic health records. The use of ABAC on the network provides EHRs with an extra layer of security and control, ensuring that only authorized users have access to sensitive data. By using attributes such as user identity, role, and health condition, it is possible to precisely control access to records on blockchain. Besides, a Gaussian naïve Bayes algorithm has been integrated with this consortium network for prediction of cardiovascular disease. The prediction of cardiovascular is difficult due to its correlated risk factors. This system is beneficial for both patients and physicians as it allows physicians to quickly identify high-risk patients and easily provide them with patient severity level using feature weight prediction algorithms. Dynamic emergency access control privileges are used for the emergency team and will be withdrawn once the emergency has been resolved, depending on the severity score. The system is implemented with the following medical datasets: the heart disease dataset, the Pima Indian diabetes dataset, the stroke prediction dataset, and the body fat prediction dataset. The above datasets are obtained from the Kaggle repository. This system evaluates system performance by simulating various operations using the Hyperledger Caliper benchmarking tool. The performance metrics such as latency, transaction rate, resource utilization, etc. are measured and compared with the benchmark.

An Enhanced Lightweight Security Gateway Protocol for the Edge Layer

With the rapid expansion of the Internet of Things (IoT), the necessity for lightweight communication is also increasing due to the constrained capabilities of IoT devices. This paper presents the design of a novel lightweight protocol called the Enhanced Lightweight Security Gateway Protocol (ELSGP) based on a distributed computation model of the IoT layer. This model introduces a new type of node called a sub-server to assist edge layer servers and IoT devices with computational tasks and act as a primary gateway for dependent IoT nodes. This paper then introduces six features of ELSGP with developed algorithms that include access token distribution and validation, authentication and dynamic interoperability, attribute-based access control, traffic filtering, secure tunneling, and dynamic load distribution and balancing. Considering the variability of system requirements, ELSGP also outlines how to adopt a system-defined policy framework. For fault resiliency, this paper also presents fault mitigation mechanisms, especially Trust and Priority Impact Relation for Byzantine, Cascading, and Transient faults. A simulation study was carried out to validate the protocol’s performance. Based on the findings from the performance evaluation, further analysis of the protocol and future research directions are outlined.

DACP: Enforcing a dynamic access control policy in cross-domain environments

Enabling hybrid authorisations to enforce dynamic access control policy from single-domain to cross-domain environments (CDEs) is important for distributed services. However, traditional Attribute-Based Access Control (ABAC) models are incompatible with CDEs. To fill this gap, approaches that apply cryptographic primitives, e.g., attribute-based encryption (ABE), have been proposed. The computation and storage overhead in most ABE constructions is non-negligible and increases with the complexity of the associated policies. In addition, most access control policy systems enforce authorisation policies in a centralised way, raising serious security and privacy issues. In this paper, we introduce DACP – a practical Dynamic Access Control Policy system supporting dynamic cross-domain authorisation. DACP combines traditional ABAC approach and a novel cryptographic primitive Attribute-based group signature (ABGS). ABAC is used for the access control decision and policy enforcement according to the user’s attributes whereas ABGS is used for managing the user’s attributes between users and authorities. Thus, the user’s attributes are securely distributed along with the access structure in CDEs while preserving the user’s privacy. We present the concrete design and implementation of DACP, and evaluate it in real-world settings. The evaluation shows that DACP is practical and efficient in CDEs.

Security label and attribute-based access control in service-oriented environments

Compared with traditional systems, service-oriented environments are more dynamic and distributed. Although traditional access control is able to fulfill the security of requirements of closed systems on the whole, it can no longer meet the requirements of service-oriented environments. To deal with the issues that access control in the service-oriented environment needs to cross the boundary of the security domain, the high distribution, and heterogeneity of environmental characteristics, and how to establish efficient and guaranteed access to resources, access control based on security label and attribute is proposed for fine-grained resource information and rich policy security requirements. By using a CP-ABE mechanism, distributed fine-grained access control can be realized in the company of solving the issue of policy privacy leakage; By using the security label technology, the multi-level security mandatory access control is realized, and the security flow of information is achieved, thus protecting the service and its methods from unauthorized users. Finally, the proposed scheme has been verified to have reliable security through security analysis. The experimental outcomes indicate this proposed scheme is available and effective in terms of performance.

Access Control Strategy for the Internet of Vehicles Based on Blockchain and Edge Computing

Data stored in the Internet of Vehicles (IoV) face problems with ease of tampering, easy disclosure and single access control. Based on this problem, we propose an access control scheme for the IoV based on blockchain, trust values and weighted attribute-based encryption, called the Blockchain Trust and Weighted Attribute-Based Access Control Strategy (BTWACS). First, we utilize both local and global blockchains to jointly maintain the generation, verification and storage of blocks, achieving distributed data storage and ensuring that data cannot arbitrarily be tampered with. Local blockchain mainly uses Road Side Unit (RSU) technology to calculate trust values, while global blockchain is mainly responsible for data storage and access policy selection. Secondly, we design a blockchain-based trust evaluation scheme called Blockchain-Based Trust Evaluation (BBTE). In this evaluation scheme, the trust value of the vehicle node is based on four factors: initial trust, historical experience trust, recommendation trust and RSU observation trust. CRITIC is used to determine the optimal weights of four factors to obtain the trust value. Then, we use the Network Simulator version 3 (NS3) to verify the security and accuracy of BBTE, improving the recognition accuracy and detection rate of malicious vehicle nodes. Finally, by mining the association relationships between attribute permissions among various roles, we construct a hierarchical access control strategy based on weight and trust, and further optimize the access strategy through pruning techniques. The experiment results indicate that this scheme can effectively respond to gray hole attacks, defamation attacks and collusion attacks from other vehicle nodes. This method can effectively reduce the computing and transmission costs of vehicles and meet the access requirements of multiple entities and roles in the IoV.

Massive Data Connection Architecture Design of Web Platform Based on Blockchain

In order to improve the universality and security of the data management of the Internet of Things and avoid the single point of failure problem in the traditional management architecture, this paper proposes a massive connection management architecture based on blockchain. The blockchain is reconstructed according to the hierarchical structure of blockchain technology, and with reference to the attribute-based access control mechanism, a data exchange model is designed using gossip mode and TLS networking mode to ensure the safe transmission of data. The peer computer network technology, data signature, and consensus mechanism are used to complete the design of the data exchange network layer and realize the design of the blockchain-based massive connection management architecture, so as to effectively avoid the single point of failure problem in the traditional management architecture and greatly reduce the burden of the management center. The access requests of massive devices in 5G application scenarios were simulated, and the results showed that the blockchain-based access control architecture designed in this article can quickly process received requests, with information leakage below 10%, improving the security and processing performance of data connections, achieving efficient processing and management of large-scale data, and providing reliable guarantees for the development of the Internet era.

User Authorization in Microservice-Based Applications

Microservices have emerged as a prevalent architectural style in modern software development, replacing traditional monolithic architectures. The decomposition of business functionality into distributed microservices offers numerous benefits, but introduces increased complexity to the overall application. Consequently, the complexity of authorization in microservice-based applications necessitates a comprehensive approach that integrates authorization as an inherent component from the beginning. This paper presents a systematic approach for achieving fine-grained user authorization using Attribute-Based Access Control (ABAC). The proposed approach emphasizes structure preservation, facilitating traceability throughout the various phases of application development. As a result, authorization artifacts can be traced seamlessly from the initial analysis phase to the subsequent implementation phase. One significant contribution is the development of a language to formulate natural language authorization requirements and policies. These natural language authorization policies can subsequently be implemented using the policy language Rego. By leveraging the analysis of software artifacts, the proposed approach enables the creation of comprehensive and tailored authorization policies.

CRABAC: Combined Role-Attribute Based Access Control Model

Access control is one of the techniques to provide accessibility, flexibility and control over the cloud resources. The traditional access control model is no longer sufficient to provide protection of data. Due to the rising data breaches, it is important to evolve our data security mechanisms. Therefore, it is better to combine several techniques to bring out the most efficient technique. Thus, this paper introduces custom access control model where Role- Based Access Control (RBAC) model and Attribute-Based Access Control (ABAC) model is combined to give a single hybrid model. This technique brings out the best qualities of both models. It provides both flexibility and dynamicity. The assignment of attributes provides better security. Key Words: Access Control, Role-Based Access Control, Attribute-Based Access Control, Cloud Computing

Hybrid Approaches (ABAC and RBAC) Toward Secure Access Control in Smart Home IoT

Smart homes are interconnected homes in which a wide variety of digital devices with limited resources communicate with multiple users and among themselves using multiple protocols. The deployment of resource-limited devices and the use of a wide range of technologies expand the attack surface and position the smart home as a target for many potential security threats. Access control is among the top security challenges in smart home IoT. Several access control models have been developed or adapted for IoT in general, with a few specifically designed for the smart home IoT domain. Most of these models are built on the role-based access control (RBAC) model or the attribute-based access control (ABAC) model. However, recently some researchers demonstrated that the need arises for a hybrid model combining ABAC and RBAC, thereby incorporating the benefits of both models to better meet IoT access control challenges in general and smart homes requirements in particular. In this paper, we used two approaches to develop two different hybrid models for smart home IoT. We followed a role-centric approach and an attribute-centric approach to develop HyBAC <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$_{RC}$</tex-math></inline-formula> and HyBAC <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$_{AC}$</tex-math></inline-formula> , respectively. We formally define these models and illustrate their features through a use case scenario demonstration. We further provide a proof-of-concept implementation for each model in Amazon Web Services (AWS) IoT platform. Finally, we conduct a theoretical comparison between the two models proposed in this paper in addition to the EGRBAC model (RBAC model for smart home IoT) and HABAC model (ABAC model for smart home IoT), which were previously developed to meet smart homes' challenges.

Secure Big Data Storage on Multi-Cloud Servers with Enhanced Attribute-Based Access Control

Abstract: Data outsourcing is now subject to additional safety and privacy concerns as a result of the rise in cloud computing demand. Because data management was moved to words an unstable cloud during the outsourcing stage of the data, data permit control identified a key problem in the cloud repository. This analysis uses the Attribute-Based Access Control method to control access to the cloud storage to solve the issue. The data is reserved in the cloud and protected by strict security before the user may access it. This model takes into account specific properties of the cloud data stored in the database authentication process in order to store the information of registered collections alongside the user-committed data. Each of the clusters has a unique set of benefits, including usernames, group names, and registry message authorization codes. Prior to sending the data to the service provider, it should be encrypted to ensure its security. However, there may occasionally be problems with the supplier’s security measures. In this outcome, a variety of metrics are analyzed, such as the amount of time used for encryption, decryption, key generation, and time consumption. The numerous existing techniques, like Nth Truncated Ring Units and Cipher text. Constraints on online storage access may make policy attribute-based encryption impossible. The time of encryption is reduced by 20% and 36%, respectively, via NTRU and CP-ABE. The proposed technique decrypts data 10.64% faster than the current approach, which decrypts data 19% more slowly.

A survey on blockchain envisioned attribute based access control for internet of things: Overview, comparative analysis, and open research challenges

The Internet of Things (IoT) network is rapidly expanding due to sudden technological advancements, which enable objects to become intelligent and contribute to the network. Before permitting a newly added IoT device to communicate with the network, it is essential to provide access and authenticate the device’s legitimacy by ensuring that it has not been tampered. Recently, blockchain technology has been integrated into Attribute Based Access Control (ABAC) protocols to supply a more robust security mechanism for access control in IoT. The IoT and blockchain-based ABAC serve as the foundation of this survey, offering a comprehensive introduction to both topics. Additionally, several security concerns and vulnerabilities associated with Blockchain Envisioned ABAC (BE-ABAC) are presented. A Comparison with related surveys has also been made. Besides, we also present a comparative analysis based on evaluation based on Distance from Average Solution (EDAS) to rank the best schemes among the suggested BE-ABAC schemes. In conclusion, we discuss some open research challenges in an IoT network that uses blockchain to manage access control.

A hybrid framework to enhance cloud security for storing and retrieving confidential data in clouds

&lt;p&gt;The building pieces for creating a secure cloud framework for data exchange with authenticated and authorized users are ECC and ABAC. So, the goal of this study is to improve access control and encryption-related methods in order to increase security. The elliptic curve is a key component of the comparative study of cloud encryption and access control techniques. This research project’s main goal is to provide a security architecture that combines authenticated access with attribute-based access control and better elliptic curve encryption. The second goal is to provide a better mapping strategy with reduced time and space complexity for elliptic curve encoding from plain text. To boost the performance of the standard ECC, a thorough algorithm focusing on designing an improved mapping mechanism for encoding plain text to elliptic curve points with excellent security has been included. The strength of the security should not be sacrificed in order to reduce security measures’ overhead costs. ABE is regarded as an effective way for protecting cloud data, according to study results. Because to the use of complex pairing processes, the same is difficult to use. As a result, a hybrid approach using ECC and ABAC performs better to handle the increasing processing capacity.&lt;/p&gt;

A Systematic Comparison between the Ethereum and Hyperledger Fabric Blockchain Platforms for Attribute-Based Access Control in Smart Home IoT Environments.

Despite the lack of blockchain systems being utilized in modern IoT environments, the prevalence of blockchain technology is increasing, due to its high level of security and accountability. The integration of blockchain technology and access control in a decentralized system for smart home networks is a promising solution to this issue. This paper compares the implementation of attribute-based access control (ABAC) with two popular blockchain platforms, Ethereum and Hyperledger Fabric, for a smart home internet of things (IoT) environment. We present a comprehensive summary of access-control and blockchain-access-control methods, to provide the necessary background for this study. Additionally, we present an original ABAC smart contract for Ethereum, and the modification of a pre-existing Hyperledger Fabric ABAC smart contract, for this comparison. Through the simulation of both implementations, the advantages and limitations will be considered, to determine which is better suited for a smart home IoT environment.

Microsoft Purview: A System for Central Governance of Data

Modern data estates are spread across data located on premises, on the edge and in one or more public clouds, spread across various sources like multiple relational databases, file and storage systems, and no-SQL systems, both operational and analytic; this phenomenon is referred to as data sprawl. Data administrators who wish to enforce compliance across the entire organization have to inventory their data, identify what parts of it are sensitive, and govern the sensitive data appropriately --- across the entirety of their sprawling data estate. Today, governance of data is completely siloed; each of the data subsystems has its own (and varied) governance features. Policies applied to sensitive data are applied piece-meal by iterating over all the data sources in a custom language specific to each source. This makes data governance cumbersome, error-prone (because a given policy must be manually enforced across different subsystems, inconsistencies can easily arise), and expensive. This paper presents Microsoft Purview , a service for unified governance of the entire data estate of an organization from a single central pane of glass. The Purview service consists of three parts: (1) a Data Map or metadata catalog that is populated by automated scanning of data sources in the organization, (2) a system to store and manage sensitivity classification of data, and (3) a policy system that enables data security officers to author and implement policies that span the entire organization, e.g., a policy that says, "Non-full-time employees should be denied access to data classified as PII (Personally Identifiable Information.") Purview transforms data governance across a complex data estate by offering the ability to govern centrally and automating data discovery, classification and policy enforcement. While other commercial catalog systems also build a global catalog, Purview is unique in its support for policies. It is also distinguished by covering both structured and unstructured data, thanks to its deep integration with Office 365 and its governance framework; indeed, "Microsoft Purview" represents a new unified offering that combines Office 365 governance and what was formerly a service for governing structured data called "Azure Purview". By integrating with Office 365's Rights Management Service, Purview offers central governance over structured data stored in databases and stores, reports in systems such as Power BI, as well as document data stored in Office 365. The Purview vision is to make the metadata in the Data Map increasingly richer through further automation and curation support and to use this 360 degree view of the data estate to support a wide range of governance policies, ranging from access control to lifecycle management (e.g., retention, deletion, restricting data movement). This paper covers the design and implementation challenges in building the Purview service for Attribute-Based Access Control (ABAC) policies, focusing specifically on a detailed description of its integration with Azure SQL Database. We illustrate the power of unifying Office 365 governance with structured data governance through Purview policies that enforce consistent access control even as data flows between Office 365 and structured data engines like Azure SQL Database. We also describe the results of our empirical evaluation of the performance overheads imposed by Purview.