Fine-grained Access Control Model Research Articles

Blockchain-based dynamic trust access control game mechanism

The blockchain-based access control mechanism (BACM) is gradually becoming an essential paradigm for solving dynamic and trusted access control problems in the open network environment. However, since the current open network environment has such features as dynamic variability and the uncertainty of user identity, most of the existing BACM cannot solve the access control problems in the current open network environment in a dynamic, flexible, proactive, efficient, and fine-grained approach. In this paper, we propose a novel BACM scheme to address such problems. Specifically, we first design a new, proactive, and fine-grained access control model, by utilizing the dynamicity and fine-grain of the attribute-based access control model, flexibility shown by the trust evaluation mechanism in evaluating the trust level of users, and proactivity shown by the game evaluation mechanism in curbing malicious users who suddenly launch malicious access requests. Second, based on the above access control model, we propose a dynamic, flexible, and proactive BACM for the current open network environment, exploiting the trustworthiness and transparency that the smart contract and the transaction mechanism in blockchain technology show during program execution. Further, a double sliding storage window is built, guaranteeing accurate data acquisition by BACM while efficiently allowing it to acquire time-sensitive data during the permission management process. Meanwhile, a pre-authorization concept is introduced to improve the efficiency and flexibility of BACM in processing access control problems. Security analysis demonstrates that our proposed BACM scheme satisfies the simple security issue and the simple availability issue. Experiments on a real user trust record dataset demonstrate the high effectiveness of the proposed BACM scheme in evaluating and deciding on access requests and the superiorities over most existing schemes in dynamicity, fine granularity, flexibility, and proactivity.

A Fine-grained Access Control Model with Enhanced Flexibility and On-chain Policy Execution for IoT Systems

A Fine-grained Access Control Model with Enhanced Flexibility and On-chain Policy Execution for IoT Systems

Janus: Hierarchical Multi-Blockchain-Based Access Control (HMBAC) for Multi-Authority and Multi-Domain Environments

Although there are several access control systems in the literature for flexible policy management in multi-authority and multi-domain environments, achieving interoperability and scalability, without relying on strong trust assumptions, is still an open challenge. We present HMBAC, a distributed fine-grained access control model for shared and dynamic multi-authority and multi-domain environments, along with Janus, a practical system for HMBAC policy enforcement. The proposed HMBAC model supports: (a) dynamic trust management between different authorities; (b) flexible access control policy enforcement, defined at the domain and cross-domain level; (c) a global source of truth for all entities, supported by an immutable, audit-friendly mechanism. Janus implements the HMBAC model and relies on the effective fusion of two core components. First, a Hierarchical Multi-Blockchain architecture that acts as a single access point that cannot be bypassed by users or authorities. Second, a Multi-Authority Attribute-Based Encryption protocol that supports flexible shared multi-owner encryption, where attribute keys from different authorities are combined to decrypt data distributedly stored in different authorities. Our approach was implemented using Hyperledger Fabric as the underlying blockchain, with the system components placed in Kubernetes Docker container pods. We experimentally validated the effectiveness and efficiency of Janus, while fully reproducible artifacts of both our implementation and our measurements are provided.

An Attribute-Based Encryption Method Using Outsourced Decryption and Hierarchical Access Structure

Cloud computing is being rapidly adopted by many organizations from different domains and large amounts of data is stored in the cloud. In order to ensure data security, the attribute-based access control mechanism has been emerging recently as a fine-grained access control model that grants access based on the data user’s attributes. In this model, the data owner builds the access policy using the attributes of the data users and access to the data is granted only if the requirements of such an access policy are satisfied. Ciphertext policy-based attribute-based encryption (CPABE) is one of the most widely used methods for providing encrypted access control. Complex, time consuming and costly paring operations are the major issue with the CPABE method. Hence, another efficient method is needed to reduce the data user’s overhead while decrypting data. This paper presents an efficient method consisting in outsourcing decryption operations to a third-party server, so that complex operations may be performed by that machine with only some simple calculations left on the data user’s side. The concept of a hierarchical access structure is also integrated with the traditional CPABE technique. The hierarchical approach enables the data owner to encrypt multiple data using a single common hierarchical access structure. This allows the user to decrypt only the relevant part of ciphertext, depending on which fragment of the hierarchical access structure is satisfied. The paper evaluates also the performance of the proposed model in terms of time and storage cost.

A revocable multi-authority fine-grained access control architecture against ciphertext rollback attack for mobile edge computing

Mobile edge computing is an emerging decentralized cloud paradigm that can provide real-time mobile services for users. But there are some limitations in the existing access control architectures for mobile edge computing, such as low efficiency, poor expansibility and high algorithm complexity. Therefore in this paper, we propose a decentralized ciphertext-policy attribute-based encryption scheme which with mutually verifiable outsourced decryption and non-delegated computing mode attribute revocation as the fine-grained access control model for the mobile edge cloud. Compared with the state-of-art access control models with revocation function, first, our scheme is based on Type-3 pairing, which has higher efficiency and stronger security. Second, our outsourcing decryption algorithm can realize mutual verification, that is, not only the server can verify the validity of the user’s outsourcing key, but also the user can verify the correctness of the decrypted plaintext. Thirdly, our revocation algorithm can not only resist ciphertext rollback attacks to achieve the genuine backward and forward security, but also does not need the assistance of any intermediate proxy server, which greatly simplifies the network topology.

Fine-Grained Access Control Mechanism of Energy Internet

The Energy Internet has generated huge amounts of information on the production devices, transmission devices, and energy consumption devices. The leakage of data in the collection, transmission, and storage process will cause serious security problems. The existing Energy Internet security methods rely on traditional access control mechanisms and specific network boundary defense mechanisms, which has the limitations of static strategies and coarse design. We combine the advantages of role-based access control (RBAC) and attribute-based access control (ABAC), and propose a trusted Energy Internet fine-grained access control model based on devices' attribute and users' roles. We have not only achieved fine-grained Energy Internet resource allocation, but also ensured that the access control process is related to the security status of the environment in real time. Experimental results show that the access control model can safely and accurately execute access decisions in the Energy Internet scenario, and the processing performance is more stable.

RTBAC: A Risk-Aware Topic-Based Access Control Model for Text Data with Paragraph-Level Authorization

Granting users precise access rights is one of the purposes of access control technologies. With the increasing requirements of fine-grained authorization, too strict or too loose access control models may cause many problems. In this paper, aiming at insufficient authorizations in text databases, we propose a risk-aware topic-based access control (RTBAC) model, which uses topics to represent the content relationships between users and data. The RTBAC model also uses risk technologies to grant users corresponding access rights based on their historical behaviours and their access requests. The RTBAC model is a fine-grained access control model, and the authorization of RTBAC can reach the paragraph level. Experimental results show that RTBAC is an efficient access control model and the access control granularity of the RTBAC model is more than 3 times that of the existing content-based access control models.

Fine-grained access control model based on sensitivity calculation by fuzzy mathematics

Access control regulates the behavior of legitimate users in the security domain to access and operate resources, and ensures that resources are not used by unauthorized users, in order to protect resources. With the maturity of security label technology, new requirements are put forward for access control of multi-level security network. In this paper, a fine-grained access control model based on sensitivity calculation by fuzzy mathematics is proposed. Fuzzy mathematics is used to comprehensively calculate the sensitivity level of users and files based on their security label attributes. On this basis, the mandatory access control policies are set to make the access control mechanism between users and files more reasonable.

Proxy re-encryption for fine-grained access control: Its applicability, security under stronger notions and performance

Proxy Re-encryption (PRE) offers an efficient solution for enforcing access control on outsourced data through delegation of decryption rights of a delegator to a delegatee. However, to meet practical security requirements of an access control model, the delegator must control these delegations such that a re-encryption key enables the delegation of decryption rights of only a subset of the delegator’s ciphertexts. In this paper, we focus on a category of PRE-based primitives, which we refer to as “PRE with controlled delegation”. In these primitives, instead of the re-encryption key alone, the re-encryption key and authorization of the delegatee for a data item collectively determine whether the ciphertext transformation results in a valid re-encrypted ciphertext under the delegatee’s public key. This paper provides an exhaustive functional, security and performance analysis of all the existing schemes for PRE with controlled delegation in a concrete fine-grained access control model. We show that the traditional PRE security notions are insufficient to address all the security aspects of the access control model. Motivated by our analysis, we formulate stronger security notions and state the desirable efficiency requirements for PRE schemes applicable in the concrete fine-grained access control model. We show the validity of the proposed security notions by formally proving the insecurity of a conventional PRE scheme and security of one of the PRE schemes with controlled delegation under the proposed stronger PRE security notions. We critically analyze all schemes for PRE with controlled delegation under the proposed stronger security notions and with respect to the efficiency requirements. We show that no scheme for PRE with controlled delegation simultaneously satisfies the efficiency and security requirements formulated in this paper. Finally, we present possible future research directions to obtain a PRE-based solution that is secure under the proposed stronger security notions and satisfies all desirable performance requirements in a fine-grained access control model.

A trust and attribute-based access control framework in internet of things

Internet of things (IoT) is widely used in kinds of environment where cloud computing provides super-strong computing support. However, it becomes a key issue that each node can access data under control within the human intention and data is shared securely in distributed IoT environment. Moreover, nodes may belong to different security domains, and data must be accessed only by selected users which could ensure the security of IoT system. Therefore, an effective access control technique is the key point to solve this issue. To address the problems of security, scalability and cross-domain, this paper proposes a fine-grained and dynamic access control model which combines ABAC with trust mechanism and considers dynamic trust attribute and static multi-attribute as synthetic constraints. The simulation results show the feasibility and effectiveness of the proposed scheme, which provides superior characteristics and improves the security of IoT system.

Pseudonymization for research data collection: is the juice worth the squeeze?

BackgroundThe collection of data and biospecimens which characterize patients and probands in-depth is a core element of modern biomedical research. Relevant data must be considered highly sensitive and it needs to be protected from unauthorized use and re-identification. In this context, laws, regulations, guidelines and best-practices often recommend or mandate pseudonymization, which means that directly identifying data of subjects (e.g. names and addresses) is stored separately from data which is primarily needed for scientific analyses.DiscussionWhen (authorized) re-identification of subjects is not an exceptional but a common procedure, e.g. due to longitudinal data collection, implementing pseudonymization can significantly increase the complexity of software solutions. For example, data stored in distributed databases, need to be dynamically combined with each other, which requires additional interfaces for communicating between the various subsystems. This increased complexity may lead to new attack vectors for intruders. Obviously, this is in contrast to the objective of improving data protection. What is lacking is a standardized process of evaluating and reporting risks, threats and countermeasures, which can be used to test whether integrating pseudonymization methods into data collection systems actually improves upon the degree of protection provided by system designs that simply follow common IT security best practices and implement fine-grained role-based access control models. To demonstrate that the methods used to describe systems employing pseudonymized data management are currently heterogeneous and ad-hoc, we examined the extent to which twelve recent studies address each of the six basic security properties defined by the International Organization for Standardization (ISO) standard 27,000. We show inconsistencies across the studies, with most of them failing to mention one or more security properties.ConclusionWe discuss the degree of privacy protection provided by implementing pseudonymization into research data collection processes. We conclude that (1) more research is needed on the interplay of pseudonymity, information security and data protection, (2) problem-specific guidelines for evaluating and reporting risks, threats and countermeasures should be developed and that (3) future work on pseudonymized research data collection should include the results of such structured and integrated analyses.

Privacy-aware relationship semantics–based XACML access control model for electronic health records in hybrid cloud

State-of-the-art progress in cloud computing encouraged the healthcare organizations to outsource the management of electronic health records to cloud service providers using hybrid cloud. A hybrid cloud is an infrastructure consisting of a private cloud (managed by the organization) and a public cloud (managed by the cloud service provider). The use of hybrid cloud enables electronic health records to be exchanged between medical institutions and supports multipurpose usage of electronic health records. Along with the benefits, cloud-based electronic health records also raise the problems of security and privacy specifically in terms of electronic health records access. A comprehensive and exploratory analysis of privacy-preserving solutions revealed that most current systems do not support fine-grained access control or consider additional factors such as privacy preservation and relationship semantics. In this article, we investigated the need of a privacy-aware fine-grained access control model for the hybrid cloud. We propose a privacy-aware relationship semantics–based XACML access control model that performs hybrid relationship and attribute-based access control using extensible access control markup language. The proposed approach supports fine-grained relation-based access control with state-of-the-art privacy mechanism named Anatomy for enhanced multipurpose electronic health records usage. The proposed (privacy-aware relationship semantics–based XACML access control model) model provides and maintains an efficient privacy versus utility trade-off. We formally verify the proposed model (privacy-aware relationship semantics–based XACML access control model) and implemented to check its effectiveness in terms of privacy-aware electronic health records access and multipurpose utilization. Experimental results show that in the proposed (privacy-aware relationship semantics–based XACML access control model) model, access policies based on relationships and electronic health records anonymization can perform well in terms of access policy response time and space storage.

Fine-grained Image Authorization Mechanism for Image Management Systems

To protect personal privacy and confidential preservation, access control is used to authorize legal users for safe browsing the authorized contents on photos. The access control generates an authorization rule according to each permission assignment. With low maintenance loads, this paper integrates the PM-tree compression and access control technique to propose a fine-grained access control model for digital image systems. The proposed scheme enables users to have different views of an image after they login to the system. The authorization unit for the image can be parts of the image, such as a pixel, a block, several blocks or the whole image. The experiments implement this model on the Blueprint Collaboration System (BCS) provided the positive data to confirm its feasibility.

Feasibility Assessment of a Fine-Grained Access Control Model on Resource Constrained Sensors.

Upcoming smart scenarios enabled by the Internet of Things (IoT) envision smart objects that provide services that can adapt to user behavior or be managed to achieve greater productivity. In such environments, smart things are inexpensive and, therefore, constrained devices. However, they are also critical components because of the importance of the information that they provide. Given this, strong security is a requirement, but not all security mechanisms in general and access control models in particular are feasible. In this paper, we present the feasibility assessment of an access control model that utilizes a hybrid architecture and a policy language that provides dynamic fine-grained policy enforcement in the sensors, which requires an efficient message exchange protocol called Hidra. This experimental performance assessment includes a prototype implementation, a performance evaluation model, the measurements and related discussions, which demonstrate the feasibility and adequacy of the analyzed access control model.

Research on access control model of social network based on distributed logic

Highly decentralized, dynamic and fine-grained access control models of social networks need that the access control mechanisms of social networks own sufficient expressiveness and flexibility. Most of current authorizations are difficult to satisfy the requirements of social network. Some access control models need a centralized access control mode or implementation. Some access control models use hybrid declarative/imperative languages with operational semantic. This paper develops an access control model of social network based on distributed logic with active rules and triggering mechanism, which we call DUD_RuleSN, a rule-based access control model of social network based on distributed updatable datalog. The logic makes the model a powerful authorization expressiveness and flexibility that can meet the requirements for access control of social network appropriately. Firstly, the paper elaborates syntax, semantics and evaluation algorithm of Active-UD-Datalog, which is a distributed updatable datalog with active rules and triggering mechanism we develop for the model. Secondly, access control model DUD_RuleSN for Social Network is introduced and the authorization framework is explained. Finally, a motivational example and a contrastive analysis are discussed.

Optimal security-aware query processing

Security-Aware Query Processing is the problem of computing answers to queries in the presence of access control policies. We present general impossibility results for the existence of optimal algorithms for Security-Aware Query Processing and classify query languages for which such algorithms exist. In particular, we show that for the relational calculus there are no optimal algorithms, whereas optimal algorithms exist for some of its fragments, such as the existential fragment. We also establish relationships between two different models of Fine-Grained Access Control, called Truman and Non-Truman models, which have been previously presented in the literature as distinct. For optimal Security-Aware Query Processing, we show that the Non-Truman model is a special case of the Truman model for boolean queries in the relational calculus, moreover the two models coincide for more powerful languages, such as the relational calculus with aggregation operators. In contrast, these two models are distinct for non-boolean queries.

A Fine-Grained Access Control Model for Smart Grid

The smart grid that the next-generation electric power system is studied intensively as a promising solution for energy crisis. One important feature of the smart grid is the integration of high-speed, reliable and secure data communication networks to manage the complex power systems effectively and intelligently. The goal of smart grid is to achieve the security of operation, economic efficient and environmental friendly. To achieve this goal, we proposed a fine-grained access control model for smart grid. In order to improve the security of smart grid, an access-trust-degree algorithm is proposed to evaluate the reliability of the user who want to access to the smart grid.

TC-BAC: A trust and centrality degree based access control model in wireless sensor networks

Access control is one of the major security concerns for wireless sensor networks. However, applying conventional access control models that rely on the central Certificate Authority and sophisticated cryptographic algorithms to wireless sensor networks poses new challenges as wireless sensor networks are highly distributed and resource-constrained. In this paper, a distributed and fine-grained access control model based on the trust and centrality degree is proposed (TC-BAC). Our design uses the combination of trust and risk to grant access control. To meet the security requirements of an access control system with the absence of Certificate Authority, a distributed trust mechanism is developed to allow access of a trusted node to a network. Then, centrality degree is used to assess the risk factor of a node and award the access, which can reduce the risk ratio of the access control scheme and provide a certain protection level. Finally, our design also takes multi-domain access control into account and solves this problem by utilizing a mapping mechanism and group access policies. We show with simulation that TC-BAC can achieve both the intended level of security and high efficiency suitable for wireless sensor networks.

Fine-Grained Access Control Model Based on RBAC

Military information system has unusually tough restrictions on the rank, and attaches weight to the safety and secrecy of the information. This makes the higher demands on access control on information. So a new access control model based on RBAC is prompted against the limitation of the existing models of RBAC. This model is named as fine-grained access control model based on RBAC. This model not only assigns different roles to different users, but also adds an attribute of department ,so the role and the department are combined; It realizes fine-grained access control and refines to controls of pages, so this keeps access control more precise; Role tree is used to define roles and in order to prevent the problem brought up by role inheriting, it impose s restrictions on whether it can role inherit; At last, ACL store the especial instances’ alteration. When a control is accessed, it will examine the role and department and then judge whether it can role inherit and then judge by combing ACL. So this will attain access control objective. The fulfillment indicates that this model can meet the requirement of real application of military information management system.

A fine-grained access control model for relational databases

Fine-grained access control (FGAC) must be supported by relational databases to satisfy the requirements of privacy preserving and Internet-based applications. Though much work on FGAC models has been conducted, there are still a number of ongoing problems. We propose a new FGAC model which supports the specification of open access control policies as well as closed access control policies in relational databases. The negative authorization is supported, which allows the security administrator to specify what data should not be accessed by certain users. Moreover, multiple policies defined to regulate user access together are also supported. The definition and combination algorithm of multiple policies are thus provided. Finally, we implement the proposed FGAC model as a component of the database management system (DBMS) and evaluate its performance. The performance results show that the proposed model is feasible.