Attribute-based Access Control Research Articles

Multiauthority Attribute-Based Access Control for Supply Chain Information Sharing in Blockchain

Information sharing has become an important application in modern supply chain management systems with business technology development. Because traditional supply chain information systems have problems such as easy data tampering, low information transparency, and interaction delays, blockchain has been taken consideration into supply chain information sharing research. Furthermore, blockchain technology is expected to provide decentralized supply chain information sharing solutions to enhance security, availability, and transparency. However, with the in-depth study of the application of blockchain technology in supply chain information sharing, people have found that the data stored publicly in the blockchain are still threatened by privacy leakage. In addition, due to the openness and accessibility of the blockchain, the lack of fine-grained access control is also apparent. In order to improve the security of data, we propose a novel privacy-preserving multiauthority attribute-based access control scheme for secure blockchain-based information sharing in a supply chain. In this scheme, blockchain stores encrypted supply chain information on distributed nodes. Multiple attribute authorities manage different attributes of users to achieve fine-grained access control and flexible authorization. Even if some attribute authorities fail, the user’s private key will not be leaked. In user secret key generation, we adopt an anonymous key generation protocol to realize the secure distribution of user keys by the attribute authorities. Furthermore, in order to meet the protection of communication privacy between blockchain nodes, properties of policy hiding and identity hiding are considered. Finally, we design experiments to analyze the performance of our scheme, including secret key sizes and running time of encryption and decryption.

Blockchain-Based Internet of Things Access Control Technology in Intelligent Manufacturing

The integration of information systems and physical systems is the development trend of today’s manufacturing industry. Intelligent manufacturing is a new model of manufacturing, based on advanced manufacturing technology with human–machine–material collaboration. Internet of Things technology is the core technology of intelligent manufacturing, and access control technology is one of the main measures to ensure the security of the IoT. In view of the problem that the existing IoT access control model does not support distributed and fine-grained dynamic access control, this paper uses the characteristics of blockchain, such as decentralization and non-tampering, combined with the attribute-based access control (ABAC) method, to propose a distributed access control method, applicable to the IoT environment in the process of intelligent manufacturing. This paper describes a fine-grained access control policy by defining the access control attribute values in a formal language, which supports complex logic operations in the policy and enhances the expressiveness of the model. Distributed access control decision making, using smart contracts for blockchain, improves the decision-making efficiency of the access control model, increases the post-facto audit of the access control behavior, and improves the overall security of IoT data protection. The paper concludes with proof of security and a performance analysis, and the experimental results, such as storage and computing overheads, show that this method can provide fine-grained, dynamic, and distributed access control for devices in intelligent manufacturing, ensuring the security and reliability of access control for IoT devices.

Policychain: A Decentralized Authorization Service With Script-Driven Policy on Blockchain for Internet of Things

Decentralization mechanism provides manufacturers and distributors with greater customization and flexibility they need through IoT-based Industrial Collaboration Systems (IoT-ICS), but it has brought forward security concerns about the shared data-processing tasks and IoT-based access to services and resources. To address them, we propose a practical blockchain solution to achieve decentralized policy management and evaluation on Attribute-based Access Control (ABAC). By offloading the responsibility of ABAC policy administration and decision-making to blockchain nodes, a blockchain-based access control framework, called Policychain, is presented to ensure policy with high availability, autonomy, and traceability. To deliver a solid design, we first present a transaction-oriented policy expression scheme with a well-defined syntax and semantics. The scheme can translate ABAC policies into the blockchain transactions with JavaScript Object Notation (JSON) syntax and Script-based logical expression. We further realize a script-driven policy evaluation by extending blockchain inherent scripting instructions to support attribute acquisition of ABAC entities. Furthermore, we propose a policy lifecycle management scheme from policy creation, renovation, to revocation, in which policies are verified by three validation principles at the transaction level. Finally, we provide sophisticated analysis and experiments to show that our framework is secure and practical for decentralized policy management on ABAC in IoT-ICS.

SmartABAC: Enabling Constrained IoT Devices to Make Complex Policy-Based Access Control Decisions

While Attribute-Based Access Control (ABAC) is a promising technique to govern interactions in the Internet of Things (IoT), most existing ABAC models are designed to run on remote servers or gateway devices. This scenario is misaligned with recent trends towards IoT decentralization, such as the Swarm, which expects devices to autonomously share resources, making their own access decisions for enhanced privacy and reliability. In this paper, we propose SmartABAC: a fast, concise, and expressive ABAC model that can be executed in constrained IoT devices. It combines the performance of policies based on attribute enumeration, with techniques that enhance policy expressiveness, such as typed and hierarchical attributes. We specified SmartABAC using first-order logic, designed a use case, and evaluated it in both constrained and non-constrained IoT environments. Results show that our model can represent a variety of access policies, including nested multi-attribute rules, while using less than 100 bytes per policy, on average, for a smart home use case. Our C-based SmartABAC implementation is at least 255 times faster than existing models and can evaluate 3000 policies under 5 milliseconds on a 32 MHz MCU.

Secure and Efficient Communication in VANETs Using Level-Based Access Control

In recent years, the development of vehicular ad-hoc networks (VANETs) has received much attention in intelligent transportation systems (ITS). Unlike traditional ad-hoc networks, VANETs are emerging with unique characteristics that share similar technology with autonomous vehicles (AVs) and automated driving systems (ASDs). Communication between vehicles and the surrounding infrastructure unit, such as a roadside unit (RSU), must be secured, concise, and authentic. Hence, an access control system for the ad-hoc environment is required. We introduced a level-based controlled signcryption (LBS) scheme, which can be easily constructed and implemented into an access control system for VANETs environment. Our encrypted message has a short and constant size, which is better when compared with other attribute-based signcryption or encryption. Confidentiality, privacy, and authenticity are also provided in our scheme to ensure secure and authentic communication. Therefore, our scheme has addressed communication cost, scalability, security, and privacy issues in VANETs. This primitive can be applied to simplify attribute-based access control, as the only attribute required is an integer representing the security level. Our objective is to improve the quality and security of VANET communication. Moreover, an optional privacy mechanism in our scheme provides flexibility in controlling node privacy in VANETs.

Privacy Protection of Task in Crowdsourcing: Policy-Hiding and Attribute Updating Attribute-Based Access Control Based on Blockchain

Crowdsourcing is a new way to solve complex problems by using human intelligence. However, the tasks and user information privacy concerned in crowdsourcing have not been adequately addressed. It is necessary to design a privacy protection mechanism for tasks that need to be restricted to specific user groups. Ciphertext-policy attribute-based encryption (CP-ABE) is an efficient and feasible cryptographic tool, particularly for crowdsourcing systems. The encryptor can choose the access policy independently, which limits the scope of decryption users. At present, most CP-ABE schemes adopt a centralized management platform, which poses problems such as high trust-building costs, DDoS attacks, and single point of failure. In this paper, we propose a new access control scheme based on CP-ABE and blockchain, which has the properties of policy hiding and attribute updating. To protect the privacy of worker’s attributes, we adopt a test algorithm based on a fully homomorphic cryptosystem to confidentially judge whether the worker’s attribute lists match the hidden attributes policy in ciphertext or not before the decryption. Experiment results and comprehensive comparisons show that our mechanism is more flexible, private, and scalable than existing schemes.

Hyperledger Fabric Access Control for Industrial Internet of Things

The Industrial Internet of Things (IIoT) plays an important role in Industry 4.0, but the existing IIoT systems could be vulnerable to a single point of failure and malicious attacks, failing to provide reliable services. IIoT devices have some particularities, such as mobility, limited performance, and distributed deployment, which are challenging to traditional centralized access control methods in the large-scale IIoT environment. To resolve the challenges, we propose an access control system for the Industrial Internet of Things. The system contains three smart contracts: device contract (DC), policy contract (PC), and access contract (AC). The device contract provides a method of storing the URL of the resource data generated by the equipment and a query method. The policy contract provides the function of managing the attribute-based access control (ABAC) of the administrator user. The access contract is the core program that implements the access control method for ordinary users. Combining ABAC and blockchain technology provides decentralized, fine-grained, and dynamic access control management for IIoT.

Policy-driven Data Sharing over Attribute-Based Encryption supporting Dual Membership

Attribute-Based Encryption (ABE) plays an important role in current secure data sharing through fine-grained customizable policies. However, the existing ABE schemes only support simple predicates, = and ≠, but cannot express a more general membership predicates, ∈ and ∉, in policies. The low expressivity of ABE will enlarge the ciphertext storage and reduce the communication efficiency. To overcome this problem, we propose an ABE supporting Dual Membership (DM-ABE). The core problem for implementing this scheme is how to use cryptographic methods to decide the membership between the verified element and the given set. In order to solve this problem, we design a cryptographic algorithm, called Secure Decision of Membership (SDM), based on aggregation functions. In this algorithm, any set can be aggregated into one cryptographic element, and the verified element and the given set can be converted into another cryptographic element in decision process. The membership between them can be decided by the above two cryptographic elements. Furthermore, we construct the DM-ABE by using SDM. Because of the good expressivity of our DM-ABE, we further propose a novel cryptographic data sharing framework by integrating DM-ABE and attribute-based access control to provide fine-grained access control and security protection for private data. In the security proof of DM-ABE, we prove that the DM-ABE satisfies the semantic security against chosen-plaintext attacks under the DBDHE assumption in the standard model through a unified way, considering both two encryption methods for ∈ and ∉ at the same time. Finally, we analyze our scheme in terms of time and space complexity, and compare it with some existing schemes. The results show that our DM-ABE has a better expressive ability on the boolean logic of general membership predicates, ∈ and ∉.

MLS-ABAC: Efficient Multi-Level Security Attribute-Based Access Control scheme

Realizing access control to sensitive data offloaded to a Cloud is challenging in the Internet of Things, where various devices with low computational power and different security levels are interconnected. Despite various solutions, the National Institute of Standards and Technology (NIST)’s Attribute-Based Access Control (ABAC) model is one of the preferred techniques in the literature. In this model, users who satisfy access policies using both static and dynamic attributes are allowed to access the data. However, NIST’s ABAC model does not support encryption and therefore does not satisfy data confidentiality. Attribute-Based Encryption (ABE) is a known cryptographic primitive that enables fine-grained access control over encrypted data. However, currently the existing ABE schemes do not meet NIST’s ABAC requirements or are not computationally efficient enough for IoT applications. In this paper, we propose a Multi-Level Security ABAC (MLS-ABAC) scheme that satisfies the requirements of NIST’s ABAC model. Our construction is efficient and relies on a decryption outsourceable Ciphertext-Policy ABE scheme. Additionally, based on realistic application scenarios, only the authorized data users can decrypt the ciphertext, and check the integrity of the retrieved message. Furthermore, we present both conceptual and formal models for our proposed MLS-ABAC architecture along with performance metrics. The experimental results show that the proposed MLS-ABAC achieves a constant ciphertext size of ∼230 bytes and with encryption and decryption running times of ∼18 and ∼10 ms, respectively, independent of the number of attributes.

An Attribute-Based Approach toward a Secured Smart-Home IoT Access Control and a Comparison with a Role-Based Approach

The area of smart homes is one of the most popular for deploying smart connected devices. One of the most vulnerable aspects of smart homes is access control. Recent advances in IoT have led to several access control models being developed or adapted to IoT from other domains, with few specifically designed to meet the challenges of smart homes. Most of these models use role-based access control (RBAC) or attribute-based access control (ABAC) models. As of now, it is not clear what the advantages and disadvantages of ABAC over RBAC are in general, and in the context of smart-home IoT in particular. In this paper, we introduce HABACα, an attribute-based access control model for smart-home IoT. We formally define HABACα and demonstrate its features through two use-case scenarios and a proof-of-concept implementation. Furthermore, we present an analysis of HABACα as compared to the previously published EGRBAC (extended generalized role-based access control) model for smart-home IoT by first describing approaches for constructing HABACα specification from EGRBAC and vice versa in order to compare the theoretical expressiveness power of these models, and second, analyzing HABACα and EGRBAC models against standard criteria for access control models. Our findings suggest that a hybrid model that combines both HABACα and EGRBAC capabilities may be the most suitable for smart-home IoT, and probably more generally.

Dual Fine-Grained Public-Key Searchable Encryption from Lattices

Fine-grained public key encryption with keyword search (PEKS), allowing users to search on encrypted data with flexible access control policy, has been widely studied recently due to its promising application to real-world scenarios such as cloud computing. However, most of the existing fine-grained PEKS schemes are either only able to support single access control (e.g., attribute-based access control) or susceptible to being attacked or compromised by quantum computers in or after a short time. In this paper, we propose a fine-grained PEKS scheme that o ers dual access control based on lattice. In particular, we first define a dual fine-grained PEKS primitive against chosen keyword attacks under selective security. Subsequently, we adapt the key homomorphic technique and noise rerandomization technique to design a concrete scheme. Particularly, the keyword space in our construction is unlimited. Then, we present a formal security proof against chosen keyword attacks on the learning with errors (LWE) problem in the standard model. Moreover, we demonstrate the theoretical performance and experimental result of our proposed scheme. Finally, we discuss that our scheme can be easily extended to support conjunctive keywords and delegation without incurring complex operations.

Design of the Secure Smart Home System Based on the Blockchain and Cloud Service

In this paper, a variety of cloud service combinations is used to form the control core of a smart home, realize data forwarding, storage, and analysis in the cloud, and complete the remote management of smart home devices. This paper studies the secure access control of smart home data combined with the blockchain technology and password technology to realize the secure and efficient access control of smart home data. The system can achieve the goal of independent research and development. Aiming at the problem that the access control of a smart home is generally managed by third-party authorized institutions and there is an unauthorized access, a blockchain-based smart home (BSH) access control scheme is proposed. The scheme extends the attribute-based access control model (ABAC) and applies the blockchain technology to the smart home ABAC model to realize fine-grained access control. In the scheme, the resource provider first publishes the access control policy of the resource to the blockchain. If the resource visitor wants to access the resource, he needs to submit an access request to the blockchain and use an SM2 threshold signature to process the transaction proposal. The endorsement peer node in the blockchain runs the access control policy smart contract to decide whether to grant access rights. This scheme can ensure that resource providers can participate in all the processes of access control and avoid the risk of unauthorized access caused by the centralized management of the third party. Finally, the simulation experiment is carried out on the Hyperledger Fabric alliance chain development platform. The results show that the BSH access control scheme has good applicability in the smart home scenario.

Accessing electronic health records in critical incidents using context-aware attribute-based access control

In emergency situations, different actors involved in first aid services should be authorized to retrieve information from the patient’s Electronic Health Records (EHRs). The research objectives of this work involve the development and implementation of methods to characterise emergency situations requiring extraordinary access to healthcare data. The aim is to implement such methods based on contextual information pertaining to specific patients and emergency situations and also leveraging personalisation aspects which enable the efficient access control on sensitive data during emergencies. The Attribute Based Access Control paradigm is used in order to grant access to EHRs based on contextual information. We introduce an ABAC approach using personalized context handlers, in which raw contextual information can be uplifted in order to recognize critical situations and grant access to healthcare data. Results indicate that context-aware ABAC is a very effective method for detecting critical situations that require emergency access to personal health records. In comparison to RBAC implementations of emergency access control to EHRs, the proposed ABAC implementation leverages contextual information pertaining to the specific patient and emergency situations. Contextual information increases the capability of ABAC to recognize critical situations and grant access to healthcare data.

Fine Grained Access Control Based on Smart Contract for Edge Computing

Traditional centralized access control faces data security and privacy problems. The core server is the main target to attack. Single point of failure risk and load bottleneck are difficult to solve effectively. And the third-party data center cannot protect data owners. Traditional distributed access control faces the problem of how to effectively solve the scalability and diversified requirements of IoT (Internet of Things) applications. SCAC (Smart Contract-based Access Control) is based on ABAC (Attributes Based Access Control) and RBAC (Role Based Access Control). It can be applied to various types of nodes in different application scenarios that attributes are used as basic decision elements and authorized by role. The research objective is to combine the efficiency of service orchestration in edge computing with the security of consensus mechanism in blockchain, making full use of smart contract programmability to explore fine grained access control mode on the basis of traditional access control paradigm. By designing SSH-based interface for edge computing and blockchain access, SCAC parameters can be found and set to adjust ACLs (Access Control List) and their policies. The blockchain-edge computing combination is powerful in causing significant transformations across several industries, paving the way for new business models and novel decentralized applications. The rationality on typical process behavior of management services and data access control be verified through CPN (Color Petri Net) tools 4.0, and then data statistics on fine grained access control, decentralized scalability, and lightweight deployment can be obtained by instance running in this study. The results show that authorization takes into account both security and efficiency with the “blockchain-edge computing” combination.

Big Data Handling Approach for Unauthorized Cloud Computing Access

Nowadays, cloud computing is one of the important and rapidly growing services; its capabilities and applications have been extended to various areas of life. Cloud computing systems face many security issues, such as scalability, integrity, confidentiality, unauthorized access, etc. An illegitimate intruder may gain access to a sensitive cloud computing system and use the data for inappropriate purposes, which may lead to losses in business or system damage. This paper proposes a hybrid unauthorized data handling (HUDH) scheme for big data in cloud computing. The HUDH scheme aims to restrict illegitimate users from accessing the cloud and to provide data security provisions. The proposed HUDH consists of three steps: data encryption, data access, and intrusion detection. The HUDH scheme involves three algorithms: advanced encryption standards (AES) for encryption, attribute-based access control (ABAC) for data access control, and hybrid intrusion detection (HID) for unauthorized access detection. The proposed scheme is implemented using the Python and Java languages. The testing results demonstrated that the HUDH scheme can delegate computation overhead to powerful cloud servers. User confidentiality, access privilege, and user secret key accountability can be attained with more than 97% accuracy.

Break-Glass Conceptual Model for Distributed EHR management system based on Blockchain, IPFS and ABAC

The recently proposed Blockchain-based healthcare system proposes an interesting vision for the level of data integrity and security. This research aims to propose a conceptual model of a break-glass conceptual for Blockchain-based healthcare systems. In case of emergency, it provides access to the whole patient’s medical records for healthcare professionals as quickly as possible regarding patients’ privacy and data security. The proposed conceptual model was designed based on blockchain technology, IPFS (InterPlanetary File System), and ABAC (Attribute-Based Access control) as a novel design in this domain. In current healthcare systems, regulatory and non-integrated offline data sources make it near impossible for timely access to patients’ EHRs and EMRs, even in case of emergencies for healthcare professionals. Our conceptual model could be a satisfactory alternative not only for patients but also for governing organizations to handle this situation clearly by regarding patients’ privacy. Additionally, it can work in an untrusted environment, and it doesn’t require bypassing the access control system to make the patients’ data available. In case of emergencies, healthcare professionals receive medical records access near just in time with regard to all the rights of security and privacy based on the attribute which were set by the patients in the past. This novel conceptual model has been designed by coupling Blockchain technology with IPFS, and the attribute base control system (ABAC).

Integrating Cyber Deception Into Attribute-Based Access Control (ABAC) for Insider Threat Detection

Insider threat is an ever-present challenge to corporate security. The availability of knowledge and privileges to insiders makes it extremely difficult to prevent, detect or deter malicious insider activities. In the literature, several studies have proposed deception-based approaches to mitigate insider threats through different layers of corporate systems. However, the integration of access control and cyber deception methods has not been adequately discussed. In this paper, we integrate Attribute-based Access Control (ABAC) with honey-based deception techniques to effectively track insiders, particularly in the context of a dynamic work environment. To the best of our knowledge, this is the first study to design, implement and evaluate this integration. Our evaluation results show that the proposed framework reliably identifies sensitive attributes in the system and generates indistinguishable honey values to protect them with an average similarity score of 0.90 to the truth.

PAMMELA: Policy Administration Methodology using Machine Learning.

In recent years, Attribute-Based Access Control (ABAC) has become quite popular and effective for enforcing access control in dynamic and collaborative environments. Implementation of ABAC requires the creation of a set of attribute-based rules which cumulatively form a policy. Designing an ABAC policy ab initio demands a substantial amount of effort from the system administrator. Moreover, organizational changes may necessitate the inclusion of new rules in an already deployed policy. In such a case, re-mining the entire ABAC policy requires a considerable amount of time and administrative effort. Instead, it is better to incrementally augment the policy. In this paper, we propose PAMMELA, a Policy Administration Methodology using Machine Learning to assist system administrators in creating new ABAC policies as well as augmenting existing policies. PAMMELA can generate a new policy for an organization by learning the rules of a policy currently enforced in a similar organization. For policy augmentation, new rules are inferred based on the knowledge gathered from the existing rules. A detailed experimental evaluation shows that the proposed approach is both efficient and effective.

A Fine-grained Dynamic Access Control Method for Power IoT Based on Kformer

The existing static ABAC(Attribute-Based Access Control) model cannot fully meet the increasingly complex, dynamic and scalable demands of the power grid. At the same time, its versatility and flexibility bring high costs. Additionally, the increasing complexity of organizational systems and the need for federated access to their resources make implementing and managing access control more challenging. This paper proposes a fine-grained dynamic access control method based on Kformer to automate authorization management tasks. We use Kformer, which filters and integrates external knowledge through feed-forward layers in Transformer. Then, we use BERT(Bidirectional Encoder Representations from Transformer) to perform feature extraction on the input fused text, extract the implied attribute-authority relationship from the log records and external documents, and finally, perform sequence modeling on the extracted attribute features and input the obtained results. The final authorization result is obtained by classification through the softmax function in the final fully connected layer. The authorization management of the user’s request to the object is dynamically completed. Finally, using the access data of the grid information system to evaluate the method proposed by us, the experimental results show that the model can continuously monitor the access behavior of users inside the grid information system, change the access rights of entities and adjust the policy in real-time, and carry out dynamic access authorization. At the same time, the accuracy of the generated access control policy can reach 87.73%.

Towards Supporting Attribute-Based Access Control in Hyperledger Fabric Blockchain.

Hyperledger Fabric (HLF) is an open-source platform for deploying enterprise-level permissioned blockchains where users from multiple organizations can participate. Preventing unauthorized access to resources in such blockchains is of critical importance. Towards addressing this requirement, HLF supports different access control models. However, support for Attribute-Based Access Control (ABAC) in the current version of HLF is not comprehensive enough to address various requirements that arise when multiple organizations interact in an enterprise setting. To address those shortcomings, in this paper, we develop and present methods for providing full ABAC functionality in Hyperledger Fabric. Performance evaluation under different network configurations using the Hyperledger Caliper benchmarking tool shows that the proposed approach is quite efficient in practice.