Authorization Revocation Research Articles

An Access Control Framework using Blockchain on Medical Data

Cloud is a computing model that provides sharing and supports ubiquitous on-demand access computing, providing new data processing and services for many industries, significantly reducing user computing and storage costs, and improving ease of use. With the development of cloud-scale and intensification, cloud security has become an essential issue in the field of cloud computing. Access control is one of the critical security technologies for protecting sensitive data stored in the cloud by enterprises and individuals. Since the centralized access control mechanism is adopted in the cloud, the sensitive data in the cloud are easy to be tampered with or leaked by hackers or cloud internal managers. To address this issue, we propose a blockchain- based access control framework with privacy protection called AuthPrivacyChain. Firstly, we use the account address of the node in blockchain as the identity, and at the same time, redefine the access control permission of data for the cloud, which is encrypted and stored in blockchain. After that, we design processes of access control, authorization, and authorization revocation in AuthPrivacyChain. Finally, we implement AuthPrivacyChain based on enterprise operation system (EOS), and the results show that AuthPrivacyChain can not only prevent hackers and administrators from illegally accessing resources, but also protect authorized privacy.

Enabling Proxy-Free Privacy-Preserving and Federated Crowdsourcing by Using Blockchain

With the rapid development and widespread application of crowdsourcing, the limitations of traditional systems are gradually exposed. First, traditional systems fail to protect the privacy of task requesters and workers. They typically rely on a centralized server to aggregate the task content and workers’ interests, while these data contain sensitive information. Second, crowdsourcing resources in each system are isolated. The tasks in one system cannot reach potential workers in other systems. Thus, there is a great need to build a new privacy-preserving and federated crowdsourcing system. However, the existing privacy-preserving solutions rely on a trusted third party to perform key management, which is not applicable in a federated setting. To this end, we propose the first proxy-free privacy-preserving and federated crowdsourcing system. It interconnects the existing crowdsourcing systems and can perform encrypted task matching across various systems without relying on a trusted third-party authority. Our main idea is to achieve federated crowdsourcing by moving secure task matching to the trusted smart contract. To get rid of the dependence on the trusted authority, we combine the rewritable deterministic hashing technique with searchable encryption schemes to achieve secure on-chain task-matching authorization. Moreover, we utilize the puncturable encryption technique to implement secure authorization revocation. We formally analyze the security of our design and implement a prototype on Ethereum. Evaluation results demonstrate that our design is secure and efficient for blockchain-based crowdsourcing.

A Novel Revocable and Identity-Based Conditional Proxy Re-Encryption Scheme With Ciphertext Evolution for Secure Cloud Data Sharing

Proxy re-encryption (PRE), with the unique ciphertext transformation ability, enables various ciphertext authorization applications to be implemented efficiently. However, most existing PRE schemes mainly focus on access authorization while ignoring the situation where the key needs to be changed and the ciphertext needs to be evolved, making the scheme's practicability and security inadequate. Moreover, the few schemes that simultaneously combine ciphertext authorization, key update, and ciphertext evolution are not satisfactory in terms of security. For solving this problem, based on Xiong et al.'s scheme, this paper proposes an improved revocable and identity-based conditional proxy re-encryption scheme with ciphertext evolution (RIB-CPRE-CE) for secure and efficient cloud data sharing. The proposed scheme inherits the characteristics of multi-use, constant ciphertext length, fine-grained authorization, collision-resistance security, and chosen ciphertext attack (CCA) security from the original method. Also, it supports updating ciphertext to adapt to the new key after changing the identity (key) or achieves authorization revocation by evolving ciphertext. Two new algorithms, URKeyGen and UpReEnc, have been integrated into the original delegation scheme to support ciphertext evolution. The formal definition, security model, concrete construction, and security analysis of RIB-CPRE-CE have been presented. The comparison and analysis show that the proposed scheme is practical and secure. Although it adds a ciphertext evolution function for supporting key update and delegation revocation, its efficiency and security are not reduced. The proposed scheme can also be used in other access authorization systems that need to change the key or revoke the authorization. It has certain practicability and security.

A Collusion-Resistant Identity-Based Proxy Reencryption Scheme with Ciphertext Evolution for Secure Cloud Sharing

In order to solve the challenges of user data security in the cloud computing (storage) environment, many encryption solutions with different features have been presented. Among them, proxy reencryption (PRE) based on public-key infrastructure (PKI) is a promising technology for secure cloud sharing. And identity-based proxy reencryption (IBPRE), which uses identity as the public key, eliminates burdensome certificate management and is, therefore, more preferable. However, most of the current IBPRE schemes only focus on the processing of data sharing while overlooking the functions of authorization revocation and ciphertext update, which are more closely related to the security of data itself. Moreover, the few existing schemes that involve ciphertext update turn out to be impractical because the length of ciphertext increases with the reencryption of ciphertext. In this paper, an improved IBPRE scheme, which provides improvements on the inadequacies of the scheme proposed by Ateniese et al. especially in terms of collusion safety and ciphertext evolution, is proposed. To the best of our knowledge, this is a practical IBPRE scheme integrating the functions of access authorization, delegation revocation, ciphertext update, reauthorization, and conditional reservation delegation. The proposed technique has high practicability in the scenario where a large number of ciphertexts need to be updated synchronously. Lastly, the comparative analysis and simulation results show that the two reencryption algorithms in the proposed scheme have the shortest computing time than other schemes.

Server-aided searchable encryption in multi-user setting

Searchable encryption schemes allow users to search encrypted data containing some keyword without decrypting the data. It protects the data privacy of data owners, meanwhile facilitates efficient data access in secure cloud storage service. Most of the existing schemes only considered the single-user setting, in which a user uploads his encrypted data and later performs searches on it. However, the majority of databases in practice do not only serve one user; instead, they support write operations by multiple data owners and search operations by some authorized users. There exists the following issues in existing multi-user searchable encryption schemes. First, some schemes allow only one data owner to write to the encrypted database; second, a number of schemes may require the data owner to interact with the authorized users to distribute secret keys; third, some other schemes cannot efficiently support the search authorization revocation on users, and do not achieve the trapdoor unlinkability. In this paper, we address these issues by proposing a server-aided searchable encryption scheme in multi-user setting. In our scheme, the data owners only need to know the public key of an administration server to generate the searchable ciphertext, regardless of the number of authorized users. Furthermore, our scheme is shown to be semantically secure against outside keyword guessing attacks. Finally, the performance analyses and comparisons with some existing schemes demonstrate that our scheme achieves better performance.

BacS: A blockchain-based access control scheme in distributed internet of things

Distributed Internet of Things (Distributed IoT) is a large-scale, heterogeneous, dynamic distributed architecture environment which is gradually formed based on Internet of Things (IoT) technology. In order to cope with the large number access requirements for IoT data brought by application expansion, the data of IoT devices are usually stored in the management server (DMS) of current domain, and adopt a centralized access control mechanism to user. This centrally approach can easily cause data to be tampered with and leaked. Moreover, registering different identities when user accesses different domains increases the difficulty to manage his identities. Therefore, this paper proposes a blockchain-based access control scheme called BacS for Distributed IoT. In BacS, firstly, we use account address of the node in blockchain as the identity to access DMS, redefine the access control permission of data of devices and store on blockchain. Then we design processes of authorization, authorization revocation, access control and audit in BacS. Finally, we use a lightweight symmetric encryption algorithm (SEA) to achieve privacy-preserving for Distributed IoT system. We build a credible experimental model on Ethereum private chain, results show that BacS is feasible and effective that it can achieve secure access in Distributed IoT environment while protecting privacy.

A Blockchain-Based Access Control Framework for Cyber-Physical-Social System Big Data

Cyber-Physical-Social System (CPSS) big data is specified as the global historical data which is usually stored in cloud, the local real-time data which is usually stored in the fog-edge server (FeS) of the mobile terminal devices or sensors, and the social data which is usually stored in the social data server (SdS), moreover adopts a centralized access control mechanism to offer users' access strategy which can easily cause CPSS big data to be tampered with and to be leaked. Therefore, a blockchain-based access control scheme called BacCPSS for CPSS big data is proposed. In BacCPSS, account address of the node in blockchain is used as the identity to access CPSS big data, the access control permission for CPSS big data is redefined and stored in blockchain, and processes of authorization, authorization revocation, access control and audit in BacCPSS are designed, and then a lightweight symmetric encryption algorithm is used to achieve privacy-preserving. Finally, a credible experimental model on EOS and Aliyun cloud is built. Results show that BacCPSS is feasible and effective, and can achieve secure access in CPSS while protecting privacy.

AuthPrivacyChain: A Blockchain-Based Access Control Framework With Privacy Protection in Cloud

Cloud is a computing model that provides sharing and supports ubiquitous on-demand access computing, providing new data processing and services for many industries, significantly reducing user computing and storage costs, and improving ease of use. With the development of cloud-scale and intensification, cloud security has become an essential issue in the field of cloud computing. Access control is one of the critical security technologies for protecting sensitive data stored in the cloud by enterprises and individuals. Since the centralized access control mechanism is adopted in the cloud, the sensitive data in the cloud are easy to be tampered with or leaked by hackers or cloud internal managers. To address this issue, we propose a blockchain-based access control framework with privacy protection called AuthPrivacyChain. Firstly, we use the account address of the node in blockchain as the identity, and at the same time, redefine the access control permission of data for the cloud, which is encrypted and stored in blockchain. After that, we design processes of access control, authorization, and authorization revocation in AuthPrivacyChain. Finally, we implement AuthPrivacyChain based on enterprise operation system (EOS), and the results show that AuthPrivacyChain can not only prevent hackers and administrators from illegally accessing resources, but also protect authorized privacy.

AAnA: Anonymous authentication and authorization based on short traceable signatures

Due to the privacy concerns prevailing in today's computing environments, users are more likely to require anonymity or at least pseudonyms; on the other hand, they must be traceable or revokable in case of abuse. Meanwhile, an authorization mechanism that controls access rights of users to services or resources is frequently needed in various real-world applications but does not favor anonymity. To cope with these problems, we explore an anonymous authentication and authorization method that very efficiently supports fine-grained authorization services without losing strong but traceable anonymity. The efficiency of our method comes from atomizing authorization within a group and issuing multiple authorization values for a group membership. The cryptographic basis of our method is the famous short traceable signature scheme. Our method allows a user to selectively disclose authorization according to need and also provides revocation and update of authorization without revoking membership or anonymity. To prevent users from forging authorization, our method enables the users to prove their authorizations while hiding the corresponding authorization values from other users. We formally analyze security and compare the related methods in terms of efficiency and functionality. We show that our method is secure against misidentification, anonymity-break and framing attacks and is efficient within a reasonable bound while still providing various functionalities such as fine-grained authorization and authorization revocation, commonly required in many practical applications.

A HIPAA-compliant key management scheme with revocation of authorization

Patient control over electronic protected health information (ePHI) is one of the major concerns in the Health Insurance and Accountability Act (HIPAA). In this paper, a new key management scheme is proposed to facilitate control by providing two functionalities. First, a patient can authorize more than one healthcare institute within a designated time period to access his or her ePHIs. Second, a patient can revoke authorization and add new authorized institutes at any time as necessary. In the design, it is not required to re-encrypt ePHIs for adding and revoking authorizations, and the implementation is time- and cost-efficient. Consent exception is also considered by the proposed scheme.

Effective Collaboration with Information Sharing in Virtual Universities

A global education system, as a key area in future IT, has fostered developers to provide various learning systems with low cost. While a variety of e-learning advantages has been recognized for a long time and many advances in e-learning systems have been implemented, the needs for effective information sharing in a secure manner have to date been largely ignored, especially for virtual university collaborative environments. Information sharing of virtual universities usually occurs in broad, highly dynamic network-based environments, and formally accessing the resources in a secure manner poses a difficult and vital challenge. This paper aims to build a new rule-based framework to identify and address issues of sharing in virtual university environments through role-based access control (RBAC) management. The framework includes a role-based group delegation granting model, group delegation revocation model, authorization granting, and authorization revocation. We analyze various revocations and the impact of revocations on role hierarchies. The implementation with XML-based tools demonstrates the feasibility of the framework and authorization methods. Finally, the current proposal is compared with other related work.

An authorization mechanism for a relational database system

A multiuser database system must selectively permit users to share data, while retaining the ability to restrict data access. There must be a mechanism to provide protection and security, permitting information to be accessed only by properly authorized users. Further, when tables or restricted views of tables are created and destroyed dynamically, the granting, authentication, and revocation of authorization to use them must also be dynamic. Each of these issues and their solutions in the context of the relational database management system System R are discussed. When a database user creates a table, he is fully and solely authorized to perform upon it actions such as read, insert, update, and delete. He may explicitly grant to any other user any or all of his privileges on the table. In addition he may specify that that user is authorized to further grant these privileges to still other users. The result is a directed graph of granted privileges originating from the table creator. At some later time a user A may revoke some or all of the privileges which he previously granted to another user B. This action usually revokes the entire subgraph of the grants originating from A's grant to B. It may be, however, that B will still possess the revoked privileges by means of a grant from another user C, and therefore some or all of B's grants should not be revoked. This problem is discussed in detail, and an algorithm for detecting exactly which of B's grants should be revoked is presented.