Fine-grained Access Control Mechanism Research Articles

Application of Attribute-Based Encryption in Military Internet of Things Environment

The Military Internet of Things (MIoT) has emerged as a new research area in military intelligence. The MIoT frequently has to constitute a federation-capable IoT environment when the military needs to interact with other institutions and organizations or carry out joint missions as part of a coalition such as in NATO. One of the main challenges of deploying the MIoT in such an environment is to acquire, analyze, and merge vast amounts of data from many different IoT devices and disseminate them in a secure, reliable, and context-dependent manner. This challenge is one of the main challenges in a federated environment and forms the basis for establishing trusting relationships and secure communication between IoT devices belonging to different partners. In this work, we focus on the problem of fulfillment of the data-centric security paradigm, i.e., ensuring the secure management of data along the path from its origin to the recipients and implementing fine-grained access control mechanisms. This problem can be solved using innovative solutions such as applying attribute-based encryption (ABE). In this work, we present a comprehensive solution for secure data dissemination in a federated MIoT environment, enabling the use of distributed registry technology (Hyperledger Fabric), a message broker (Apache Kafka), and data processing microservices implemented using the Kafka Streams API library. We designed and implemented ABE cryptography data access control methods using a combination of pairings-based elliptic curve cryptography and lightweight cryptography and confirmed their suitability for the federations of military networks. Experimental studies indicate that the proposed cryptographic scheme is viable for the number of attributes typically assumed to be used in battlefield networks, offering a good trade-off between security and performance for modern cryptographic applications.

Edge-based secure image denoising scheme supporting flexible user authorization

Image denoising is a fundamental tool in the fields of image processing and computer vision. With the rapid development of multimedia and cloud computing, it has become popular for resource-constrained users to outsource the storage and denoising of massive images. However, it may cause privacy concerns and response delays. In this scenario, we propose an efFicient privAcy-preseRving Image deNoising schEme (FARINE) for outsourcing digital images. By introducing a key conversion mechanism, FARINE allows removing noise from a given noisy image using a non-local mean way without leaking any information about the plaintext content. Due to its low computational latency/communication cost, edge computing is considered to improve the user experience. To achieve a dynamic user set efficiently, we design a fine-grained access control mechanism to support user authorization and revocation in multi-user scenarios. Extensive experiments over several benchmark data sets show that FARINE obtains comparable performance to plaintext image denoising.

XACML for Mobility (XACML4M)-An Access Control Framework for Connected Vehicles.

The automotive industry is experiencing a transformation with the rapid integration of software-based systems inside vehicles, which are complex systems with multiple sensors. The use of vehicle sensor data has enabled vehicles to communicate with other entities in the connected vehicle ecosystem, such as the cloud, road infrastructure, other vehicles, pedestrians, and smart grids, using either cellular or wireless networks. This vehicle data are distributed, private, and vulnerable, which can compromise the safety and security of vehicles and their passengers. It is therefore necessary to design an access control mechanism around the vehicle data's unique attributes and distributed nature. Since connected vehicles operate in a highly dynamic environment, it is important to consider context information such as location, time, and frequency when designing a fine-grained access control mechanism. This leads to our research question: How can Attribute-Based Access Control (ABAC) fulfill connected vehicle requirements of Signal Access Control (SAC), Time-Based Access Control (TBAC), Location-Based Access Control (LBAC), and Frequency-Based Access Control (FBAC)? To address the issue, we propose a data flow model based on Attribute-Based Access Control (ABAC) called eXtensible Access Control Markup Language for Mobility (XACML4M). XACML4M adds additional components to the standard eXtensible Access Control Markup Language (XACML) to satisfy the identified requirements of SAC, TBAC, LBAC, and FBAC in connected vehicles. Specifically, these are: Vehicle Data Environment (VDE) integrated with Policy Enforcement Point (PEP), Time Extensions, GeoLocation Provider, Polling Frequency Provider, and Access Log Service. We implement a prototype based on these four requirements on a Raspberry Pi 4 and present a proof-of-concept for a real-world use case. We then perform a functional evaluation based on the authorization policies to validate the XACML4M data flow model. Finally, we conclude that our proposed XACML4M data flow model can fulfill all four of our identified requirements for connected vehicles.

A Review of Functional Encryption in IoT Applications.

The Internet of Things (IoT) represents a growing aspect of how entities, including humans and organizations, are likely to connect with others in their public and private interactions. The exponential rise in the number of IoT devices, resulting from ever-growing IoT applications, also gives rise to new opportunities for exploiting potential security vulnerabilities. In contrast to conventional cryptosystems, frameworks that incorporate fine-grained access control offer better opportunities for protecting valuable assets, especially when the connectivity level is dense. Functional encryption is an exciting new paradigm of public-key encryption that supports fine-grained access control, generalizing a range of existing fine-grained access control mechanisms. This survey reviews the recent applications of functional encryption and the major cryptographic primitives that it covers, identifying areas where the adoption of these primitives has had the greatest impact. We first provide an overview of different application areas where these access control schemes have been applied. Then, an in-depth survey of how the schemes are used in a multitude of applications related to IoT is given, rendering a potential vision of security and integrity that this growing field promises. Towards the end, we identify some research trends and state the open challenges that current developments face for a secure IoT realization.

Energy Internet and Its Trusted Protection Architecture

Through the combination of new energy and Internet technology, the Energy Internet deeply integrates various complex network systems such as power, transportation and natural gas, aiming to change the energy utilization model and promote the sustainable development of economy and society. The Energy Internet takes the power grid as the "Backbone Network" , integrating the autonomous units of distributed energy, and integrating information and energy through the open-peer information and energy integration architecture. Information interaction scenarios of the Energy Internet information interaction scenarios include "human-object" , "human-human" and "object-object" . In this new interconnection mechanism environment, the lack of any security defenses may leave the Energy Internet exposed to the risk of information leakage, theft and loss, resulting in immeasurable losses. From "human-object" , "object-object" and "human-human" interaction scenarios, the paper puts forward fine-grained access control mechanism, trusted computing environment building in IoT devices and trusted communication channel construction, and designs a trusted protection architecture for the Energy Internet to ensure the data security throughout its life cycle. We verify that the proposed architecture can provide trusted environment for the Energy Internet.

A Secure and Efficient Wireless Charging Scheme for Electric Vehicles in Vehicular Energy Networks

To address the limited driving range of electric vehicles (EVs) and promote EVs’ penetration, vehicular energy networks (VENs) have emerged and opened possibility to charge EVs in motion via dynamic wireless power transfer (DWPT) technology. However, security and efficiency concerns arise due to the untrusted operating environment and EVs’ selfish charging/discharging behaviors. Existing trust models rely on the personal recommendations from neighboring EVs to identify malicious entities in VENs, which may cause potential privacy breaches and data misuse for recommenders. Besides, it is challenging to optimally schedule EVs’ energy behaviors by considering complex interactions among three energy entities (i.e., energy nodes, charging EVs, and discharging EVs). To this end, by leveraging blockchain technology and game theory, this paper proposes a secure and efficient wireless charging scheme to address these issues in VENs. Firstly, a blockchain-based fine-grained access control mechanism with traceability and auditability is presented to enable EV users to fully control and audit their personal rating data usage during trust management by logging data activities and issuing access tokens into decentralized ledgers. In this manner, the privacy of recommenders can be preserved by fully controlling the access and usage of personal rating data. Furthermore, by introducing cooperative wireless energy transfer mode, a hierarchical game-based energy scheduling algorithm is developed to optimize the strategies of three energy parties tier by tier, while considering their cooperation and competition. Finally, extensive simulations are conducted, which demonstrate that the proposed scheme can effectively improve users’ utility and security of energy transmission for EVs, compared with existing representative approaches.

Designing Fine-Grained Access Control for Software-Defined Networks Using Private Blockchain

Emerging next-generation Internet yields proper administration of a wide-ranging dynamic network to assist rapid ubiquitous resource accessibility, whilst providing higher channel bandwidth. Since its inception, the traditional static network infrastructure-based solutions involve manual configuration and proprietary controls of networked devices. It then leads to improper utilization of the overall resources, and hence experiences various security threats. Although transport layer security (TLS)-based solution is presently advocated in the said framework, it is vulnerable to many security threats like man-in-the-middle, replay, spoofing, privileged insider, impersonation, and denial-of-service attacks. Moreover, the current settings of the said tool do not facilitate any secure and reliable mechanisms for data forwarding, application flow routing, new configuration deployment, and network event management. Also, it suffers from the single point of controller failure issue. In this article, we propose a new private blockchain-enabled fine-grained access control mechanism for the SDN environment. In this regard, attribute-based encryption (ABE) and certificate-based access control protocol are incorporated. This proposed solution can resist several well-known security threats, and alleviate different system-level inconveniences. The formal and informal security inspections and performancewise comparative study of the proposed scheme endorse better qualifying scores as compared to the other existing competing state-of-the-art schemes. Besides, the experimental testbed implementation and blockchain simulation show the implementation feasibility of the proposed mechanism.

An Efficient and Secure Revocation-Enabled Attribute-Based Access Control for eHealth in Smart Society.

The ever-growing ecosystem of the Internet of Things (IoT) integrating with the ever-evolving wireless communication technology paves the way for adopting new applications in a smart society. The core concept of smart society emphasizes utilizing information and communication technology (ICT) infrastructure to improve every aspect of life. Among the variety of smart services, eHealth is at the forefront of these promises. eHealth is rapidly gaining popularity to overcome the insufficient healthcare services and provide patient-centric treatment for the rising aging population with chronic diseases. Keeping in view the sensitivity of medical data, this interfacing between healthcare and technology has raised many security concerns. Among the many contemporary solutions, attribute-based encryption (ABE) is the dominant technology because of its inherent support for one-to-many transfer and fine-grained access control mechanisms to confidential medical data. ABE uses costly bilinear pairing operations, which are too heavy for eHealth’s tiny wireless body area network (WBAN) devices despite its proper functionality. We present an efficient and secure ABE architecture with outsourcing intense encryption and decryption operations in this work. For practical realization, our scheme uses elliptic curve scalar point multiplication as the underlying technology of ABE instead of costly pairing operations. In addition, it provides support for attribute/users revocation and verifiability of outsourced medical data. Using the selective-set security model, the proposed scheme is secure under the elliptic curve decisional Diffie–Hellman (ECDDH) assumption. The performance assessment and top-ranked value via the help of fuzzy logic’s evaluation based on distance from average solution (EDAS) method show that the proposed scheme is efficient and suitable for access control in eHealth smart societies.

Server-Aided Fine-Grained Access Control Mechanism with Robust Revocation in Cloud Computing

As an innovative technique for cloud storage services, attribute based encryption (ABE) enables fine-grained access control over encrypted data in many cloud computing applications. However, there exist two main drawbacks that restrict the development of ABE. One is that most of the existing user revocation mechanisms cannot achieve high efficiency, immediacy and robustness simultaneously. Another is that the decryption of ABE contains expensive pairing operations which often grow with the complexity of access policy. In this work, we propose a practical server-aided revocable fine-grained access control mechanism with the help of cloud&#x2019;s storage, computing and management capabilities, which not only achieves efficient fine-grained attribute based access control, but also actualizes immediate and robust user revocation. Moreover, most of the complicated operations in decryption are outsourced to the public cloud server, leaving one exponentiation for the users. At last, we implement our proposed mechanism with <inline-formula><tex-math notation="LaTeX">$\mathsf{Charm}$</tex-math><alternatives><mml:math><mml:mi mathvariant="sans-serif">Charm</mml:mi></mml:math><inline-graphic xlink:href="zhang-ieq1-2925028.gif"/></alternatives></inline-formula> framework. The benchmark results demonstrate the high efficiency and practicality of our proposed mechanism.

Lightweight and Expressive Fine-Grained Access Control for Healthcare Internet-of-Things

Healthcare Internet-of-Things (IoT) is an emerging paradigm that enables embedded devices to monitor patients vital signals and allows these data to be aggregated and outsourced to the cloud. The cloud enables authorized users to store and share data to enjoy on-demand services. Nevertheless, it also causes many security concerns because of the untrusted network environment, dishonest cloud service providers and resource-limited devices. To preserve patients&#x2019; privacy, existing solutions usually apply cryptographic tools to offer access controls. However, fine-grained access control among authorized users is still a challenge, especially for lightweight and resource-limited end-devices. In this paper, we propose a novel healthcare IoT system fusing advantages of attribute-based encryption, cloud and edge computing, which provides an efficient, flexible, secure fine-grained access control mechanism with data verification in healthcare IoT network without any secure channel and enables data users to enjoy the lightweight decryption. We also define the formal security models and present security proofs for our proposed scheme. The extensive comparison and experimental simulation demonstrate that our scheme has better performance than existing solutions.

A Novel Spatio-Temporal Access Control Model for Online Social Networks and Visual Verification

With the rapid development of mobile internet, a large number of online social networking platforms and tools have been widely applied. As a classic method for protecting the privacy and information security of social users, access control technology is evolving with the spatio-temporal change of social application requirements and scenarios. However, nowadays there is a lack of effective theoretical model of social spatio-temporal access control as a guide. This paper proposed a novel spatio-temporal access control model for online social network (STAC) and its visual verification, combined with the advantages of discretionary access control, using formal language to describe the access control rules based on spatio-temporal, and real-life scenarios for access control policy description, realizes a more fine-grained access control mechanism for social network. By using the access control verification tool ACPT developed by NIST to visually verify the proposed model, the security and effectiveness of the STAC model are proved.

SEA-BREW: A scalable Attribute-Based Encryption revocable scheme for low-bitrate IoT wireless networks

Attribute-Based Encryption (ABE) is an emerging cryptographic technique that allows one to embed a fine-grained access control mechanism into encrypted data. In this paper we propose a novel ABE scheme called SEA-BREW (Scalable and Efficient Abe with Broadcast REvocation for Wireless networks), which is suited for Internet of Things (IoT) and Industrial IoT (IIoT) applications. In contrast to state-of-the-art ABE schemes, ours is capable of securely performing key revocations with a single short broadcast message, instead of a number of unicast messages that is linear with the number of nodes. This is desirable for low-bitrate Wireless Sensor and Actuator Networks (WSANs) which often are the heart of (I)IoT systems. In SEA-BREW, sensors, actuators, and users can exchange encrypted data via a cloud server, or directly via wireless if they belong to the same WSAN. We formally prove that our scheme is secure also in case of an untrusted cloud server that colludes with a set of users, under the generic bilinear group model. We show by simulations that our scheme requires a constant computational overhead on the cloud server with respect to the complexity of the access control policies. This is in contrast to state-of-the-art solutions, which require instead a linear computational overhead.

Revocable Attribute-Based Data Storage in Mobile Clouds

It is becoming fashionable for people to access data outsourced to clouds with mobile devices. To protect data security and privacy, attribute-based encryption (ABE) has been widely used in cloud storage systems. However, one of the main efficiency drawbacks of ABE is the high computation overheads at mobile devices during user revocation and file access. To address this issue, we propose a revocable attribute-based data storage (RADS) scheme equipped with several attracting features. First, our RADS scheme achieves a fine-grained access control mechanism, by which file owners do not need to explicitly specify authorized visitors to their outsourced files. Second, our RADS scheme allows mobile users to authorize the cloud service provider (CSP) to share costly computations in file access, without exposing the file content. Third, our RADS scheme offloads the operations of access-credential update and file re-encryption during revocation process to CSP, leaving all non-revoked users undisturbed. The revocation of RADS achieves a strong data protection, i.e., revoked users can access neither newly uploaded files nor old ones. The security and efficiency of the RADS scheme are validated via both analysis and experimental results.

A Traceable and Revocable Ciphertext-Policy Attribute-based Encryption Scheme Based on Privacy Protection

Considered as a promising fine-grained access control mechanism for data sharing without a centralized trusted third-party, the access policy in a plaintext form may reveal sensitive information in the traditional CP-ABE method. To address this issue, a hidden policy needs to be applied to the CP-ABE scheme, as the identity of a user cannot be accurately confirmed when the decryption key is leaked, so the malicious user is traced and revoked as demanded. In this article, a CP-ABE scheme that realizes revocation, white-box traceability, and the application of hidden policy is proposed, and such ciphertext is composed of two parts. One is related to the access policy encrypted by the attribute value, and only the attribute name is evident in the access policy. Another is related to the revocation information and updated when revoking, where the revocation information is generated by the binary tree related to users. The leaf node value of a binary tree in the decryption key is used to trace the malicious user. From experimental results, it is shown that the proposed scheme is proven to be IND-CPA secure under the chosen plaintext attacks and selective access policy based on the decisional q-BDHE assumption in the standard model, efficient, and promising.

A Data Security Enhanced Access Control Mechanism in Mobile Edge Computing

Mobile edge computing, with characteristics of position awareness, mobile support, low latency, decentralization, and distribution, has received widespread attention from industry and academia, and has been applied to application areas such as intelligent transportation, smart city, and real-time big data analysis. However, it also brings the new security threats, especially data security threats during data access that leads to unauthorized/unauthorized access, alteration and disclosure of data, affecting the confidentiality and integrity of the data. Therefore, access control, as an important method to ensure the security of user data during data access, began to be applied to mobile edge computing. However, the existing access control has the disadvantages of coarse-grain, poor flexibility and accuracy, lack of internal attack considerations, etc., which cannot meet the needs of data security in practical applications of mobile edge computing. In this paper, a data security enhanced Fine-Grained Access Control mechanism (FGAC) is proposed to ensure data security during data access in mobile edge computing. In FGAC, a dynamic fine-grained trusted user grouping scheme based on attributes and metagraphs theory was first designed. Secondly, the scheme was combined with the traditional role-based access control mechanism to assign roles to users based on user group credibility. And then, based on attribute matching the user authentication further verifies whether the user is allowed to perform the access operations to achieve fine-grained data protection. Experimental results show that FGAC can effectively identify malicious users and make group adjustments, while achieving fine-grained access control and assure the data security during the data access process in mobile edge computing.

Decentralized Context Aware Access Control Model for Internet of Things

Access control mechanisms are a primary security requirement in Internet of Things applications. Traditional access control mechanisms are inefficient while applying directly to IoT applications. Various proposals have been made to adapt traditional access control models for IoT applications. These proposals are either centralized or distributed approaches. In centralized approach, for each access request, it is required that device access central control server to verify access rights via multiple message exchanges. This results in communication overhead at a device side. A single point of failure is also possible if the central server fails. In distributed approach, for each access control request, reliance is still there on a central unit, which again results into communication overhead and possibility of a single point of failure. In IoT applications, access rights are also dependent on various characteristics of the entities involved at the specific instance of access request. These characteristics are interpreted by providing context awareness to the access control models. Context aware access control models are used to provide fine-grained access rights in IoT applications. We propose a decentralized context aware access control model in this paper. Our design results in lesser communication overhead with the central unit and removes single point of failure. Our model uses contextual information to provide fine-grained access control mechanism. Our model provides greater flexibility to users to easily add/modify access control policies for different entities.

FGAC-NDN: Fine-Grained Access Control for Named Data Networks

Named data network (NDN) is one of the most promising information-centric networking architectures, where the core concept is to focus on the named data (or contents) themselves. Users in NDN can easily send a request packet to get the desired content regardless of its address. The routers in NDN have cache functionality to make the users instantly retrieve the desired file. Thus, the user can immediately get the desired file from the nearby nodes instead of the remote host. Nevertheless, NDN is a novel proposal and there are still some open issues to be resolved. In view of previous research, it is a challenge to achieve access control on a specific user and support potential receivers simultaneously. In order to solve it, we present a fine-grained access control mechanism tailored for NDN, supporting data confidentiality, potential receivers, and mobility. Compared to previous works, this is the first to support fine-grained access control and potential receivers. Furthermore, the proposed scheme achieves provable security under the DBDH assumption.

Faces are Protected as Privacy: An Automatic Tagging Framework Against Unpermitted Photo Sharing in Social Media

On social platforms like Facebook, it is popular and pleasurable to share photos among friends, but it also puts other participants in the same picture in jeopardy when the photos are released online without the permission from them. To solve this problem, recently, the researchers have designed some fine-grained access control mechanisms for photos shared on the social platform. The uploader will tag each participant in the photo, then they will receive internal messages and configure their own privacy control strategies. These methods protect their privacy in photos by blurring out the faces of participants. However, there is still some defect in these strategies due to the unpredictable tagging behaviors of the uploader. Malicious users can easily manipulate unauthorized tagging processes and then publish the photos, which the participants want them to be confidential in social media. To address this critical problem, we propose a participant-free tagging system for photos on social platforms. This system excludes potential adversaries through automatic tagging processes over two cascading stages: 1) an initialization stage will be applied to every new user to collect his/her own portrait samples for future internal searching and tagging, and; 2) the remaining unidentified participants will be tagged in cooperative tagging stage by the users who have been identified in the first stage. For the system evaluation of efficiency and effectiveness, we conducted a series of experiments. The results demonstrated the tagging efficiency (96% tagging rate and 0.77s/photo tagging speed on average), photo masking and unmasking efficiency (0.13s/face on average), and the privacy preserving performance (over 90% identities in both group and individual photo are preserved).

Towards a Fine-Grained Access Control Mechanism for Privacy Protection and Policy Conflict Resolution

Access control is a security technique that specifies access rights to resources in a computing environment. As information systems nowadays become more complex, it plays an important role in authenticating and authorizing users and preventing an attacker from targeting sensitive information. However, no proper consideration has been fully investigated so far in privacy protection. While many studies have acknowledged this issue, recent studies have not provided a fine-grained access control system for data privacy protection. As the data set becomes larger, we have to confront more privacy challenges. For example, the access control mechanism must be able to guarantee fine-grained access control, privacy protection, conflicts and redundancies between rules of the same policy or between different policies. In this paper, we propose a comprehensive framework for enforcing attribute-based security policies stored in the JSON document together with the feature of data privacy protection and incorporates a policy structure based on the prioritization of functions to resolve conflicts at a fine-grained level called “Privacy aware access control model for policy conflict resolution”. We also use Polish notation for modeling condi-tional expressions which are the combination of subject, action, resource, and environment attributes so that privacy policies are flexible, dynamic and fine-grained. Experiments are carried out to two aspects (i) illustrate the relationship between the processing time for access decision and the complexity of policies;(ii) illustrate the relationship between the processing time for the traditional approach (single policy, multi-policy without priority) and our approach (multi-policy with priority). Experimental results show that the evaluation performance satisfies the privacy requirements defined by the user.

An efficient and revocable storage CP-ABE scheme in the cloud computing

As a special kind of public-key encryption, attribute-based encryption (ABE) is able to achieve fine-grained access control mechanism by offering one-to-many encryption. Due to such unique characteristic, this primitive is widely employed in the cloud computing environment to provide flexible and secure data sharing. However, how to revoke the access privilege of a user to access encrypted data stored in cloud servers is challenging. Furthermore, the complex operation of ABE may cause a huge computational cost and is usually considered to be a heavy burden for system users. Motivated by the practical needs, an ABE scheme called efficient and revocable storage CP-ABE scheme with outsourced decryption and constant-size ciphertexts and secret keys is proposed in this paper. Our scheme offers the following features: In addition, the scheme is provably secure against selectively chosen-ciphertext attack. At the end, we describe how to deploy the scheme in cloud computing environment.