Fine-grained Access Control Policies Research Articles

Efficient and Secure Blockchain-Based Access Control for Fog-Assisted IoT Cloud in Electronic Medical Records Sharing

Fog-assisted IoT Cloud environments have emerged as a result of the rapid spread of Internet of Things (IoT) devices and the requirement for seamless data sharing in the healthcare industry. The effective and safe management of access control to sensitive data, such as Electronic Medical Records (EMRs), becomes crucial in such configurations. The Efficient and Secure Blockchain-Based Access Control (ESBAC) framework, designed specifically for Fog-assisted IoT Cloud scenarios in EMR sharing, is our creative approach to this problem. The ESBAC architecture makes use of the blockchain's openness and immutability to provide reliable access control and auditability. The implementation of a consortium blockchain includes participants including healthcare providers, patients, and authorised entities. Each EMR has a smart contract attached to it that specifies access restrictions and permissions to make sure that only authorised parties are able to access and edit the data. Because of the decentralisation provided by the blockchain, security and privacy are improved because no single party has overwhelming control. Proposed framework uses attribute-based access control and lightweight encryption methods to provide a fair trade-off between security and efficiency. As a result, there can be fine-grained access control policies with the least amount of computing overhead. Comprehensive simulations are used to evaluate the suggested solution and compare it to current methods. The outcomes show that ESBAC improves security in EMR sharing and greatly lowers access latency.

Fine-grained access control policy in blockchain-enabled edge computing

In the process of data sharing and interaction between untrusted intelligence edge devices, there are risks of misuse and tampering with the data. Hence, how to ensure data security and prevent unauthorized data access is the key problem to be solved in the cloud edge collaborative architecture. However, due to the heterogeneity of edge devices and the diversity of data sources, traditional access control methods cannot meet the requirements of the large-scale, distributed, dynamic and flexible expansion of edge intelligence applications. Therefore, this paper studies the fine-grained data access control method on the basis of smart contracts, and implements the attribute-based access control (ABAC) model through smart contracts. To improve the query efficiency of attributes and policies in the process of access request decision, an attribute management scheme is designed on the basis of the Bloom filter to achieve fast retrieval of attributes and policies. The decentralized fine-grained access control method is tested under the performance indicators such as retrieval delay, deployment delay, rule reduction rate and decision response time.

A Smart Contract-Based Access Control Framework For Smart Healthcare Systems

Abstract Security faces huge challenges in Internet of Things (IoT) environments. In particular, conventional access control standards and models tend to be less tailored for IoT due to the constrained nature of smart objects. Usually, a powerful third party is used to handle the access control logic. However, this third party is lacking in transparency and could harm user privacy. Therefore, providing a distributed access control solution, while considering transparency and privacy-preserving awareness in IoT smart systems, is of paramount importance. The described issue can be addressed using the emergent Blockchain technology that provides a promising choice to build a new generation of decentralized and transparent access control solutions. This paper proposes a smart contract-based access control framework for IoT smart healthcare systems, which is based on smart contracts to provide a distributed and trustworthy access control, combined with the GTRBAC model to express fine-grained access control policies while considering temporal authorization constraints. To prove the feasibility and validity of the proposed framework, this paper also provides a detailed technical description and an initial implementation and execution. An experimental evaluation shows that security properties’ analyses on smart contracts achieved the best possible evaluation with no vulnerabilities found, and the cost of access control operations increases linearly as the number of policy constraints increases. Besides, a comparative analysis reveals that the proposed approach can achieve good results with low gas costs and latency.

Hybrid lightweight cryptography with attribute-based encryption standard for secure and scalable IoT system

ABSTRACT Internet of Things (IoT) devices require lower power consumption with higher security, which can be achieved by using lightweight cryptography (LWC) approaches. Attribute-based encryption (ABE) provides a fine-grained access control policy over encrypted data, making it useful in IoT-based cloud storage for allowed data protection. However, the conventional ABE approaches resulted in poor security performance against various attacks in the IoT environment. So, in this paper, the LWC-ABE method is proposed to enhance the security performance against various attacks in the IoT environment. The proposed LWC-ABE contains only multiple trusted authority environments, which is a bottleneck in IoT servers and IoT devices. The proposed LWC-ABE method supports high expressiveness, access policy updates, large attribute domains, and white box traceability properties. The simulation results shows that the proposed LWC-ABE resulted in reduced encryption and decryption times for multi users, different message sizes scenarios as compared to conventional approaches. The numerical outcomes of the proposed method are much better based on performance of encryption and decryption times as 0.000835 and 0.000310 respectively.

Fine-Grained and Controllably Editable Data Sharing With Accountability in Cloud Storage

With the increasing cloud storage service, users can enjoy non-interactive data sharing. Nonetheless, the data owner cannot timely update the shared data all the while. To ensure the timeliness and the authoritative source of the data, some users should be allowed to update the data on behalf of an authoritative data owner without changing data source. However, this allows harmful information to be injected into the data unnoticeably. How to efficiently realize editable cloud-based data sharing supporting malicious user tracing has not been fully explored. To address the problem, we propose a fine-grained and controllably editable cloud-based data sharing scheme with malicious user accountability. The data owner only needs to sign the shared data before uploading it and can specify a fine-grained access control policy about who can update the data and which portions of the data can be updated. The authorized users non-interactively convert signatures of original data into new ones for the updated data, which are indistinguishable from the original signatures. The proposed scheme also supports malicious user accountability in the sense that malicious users who post harmful information can be traced. We demonstrate the security and practicality of our scheme via formal security analysis and extensive experiments.

A blockchain-based secure data-sharing framework for Software Defined Wireless Body Area Networks

In the past few years, blockchain has proven its necessity and unprecedented prospects in providing a secure environment for information exchange between two parties. The integration of the Internet of Things (IoT) with blockchain has enabled a digital transformation in many areas such as healthcare, supply chain, and financial services. Like blockchain, the programmable Software-Defined Network (SDN) is also achieving popularity due to its ability to reduce network management complexity. It is evident that incorporating SDNs with IoT-based healthcare systems can significantly improve healthcare management services. However, there are a number of challenges such as data confidentiality, user-centric design, integrity and privacy that makes it difficult to share sensitive information among different parties in a healthcare system. To overcome these challenges, we propose an architectural framework that incorporates blockchain with Software-Defined Wireless Body Area Networks (SDWBANs) to facilitate secure data sharing. We have also designed and integrated a smart contract based fine-grained access control policy to ensure that only data owners will have full control over their health data. The experimental outcomes show that the proposed model achieves good throughput and incurs a very low overhead in terms of latency compared to traditional cloud-based systems.

Blockchain-Based Internet of Things Access Control Technology in Intelligent Manufacturing

The integration of information systems and physical systems is the development trend of today’s manufacturing industry. Intelligent manufacturing is a new model of manufacturing, based on advanced manufacturing technology with human–machine–material collaboration. Internet of Things technology is the core technology of intelligent manufacturing, and access control technology is one of the main measures to ensure the security of the IoT. In view of the problem that the existing IoT access control model does not support distributed and fine-grained dynamic access control, this paper uses the characteristics of blockchain, such as decentralization and non-tampering, combined with the attribute-based access control (ABAC) method, to propose a distributed access control method, applicable to the IoT environment in the process of intelligent manufacturing. This paper describes a fine-grained access control policy by defining the access control attribute values in a formal language, which supports complex logic operations in the policy and enhances the expressiveness of the model. Distributed access control decision making, using smart contracts for blockchain, improves the decision-making efficiency of the access control model, increases the post-facto audit of the access control behavior, and improves the overall security of IoT data protection. The paper concludes with proof of security and a performance analysis, and the experimental results, such as storage and computing overheads, show that this method can provide fine-grained, dynamic, and distributed access control for devices in intelligent manufacturing, ensuring the security and reliability of access control for IoT devices.

Private Predicate Encryption for Inner Product from Key-Homomorphic Pseudorandom Function

Predicate encryption (PE), formalized by Katz et al., is a new paradigm of public-key encryption that conceptually captures the public-key encryption that supports fine-grained access control policy. Because of the nature of PE, it is used for cloud storage so that users can retrieve encrypted data without revealing any information about the data to cloud servers and other users. Although lots of PE schemes have been studied, the predicate-hiding security is seldom considered; that is, the user’s secret key may leak sensitive information of the predicate. Additionally, the security of the current predicate-hiding PE schemes relies on the discrete logarithm assumption which cannot resist the quantum attacks in the future. In this paper, we propose a generic PE for inner product under symmetric-key setting, called private IPE, from specific key-homomorphic pseudorandom function (PRF). The rigorous proofs are provided to show that the construction is payload-hiding, attribute-hiding, and predicate-hiding secure. With the advantage of the generic construction, if the underlying PRF can resist quantum attacks, then, through our proposed generic construction, a quantum-resistant private IPE can be obtained.

Toward an Ideal Access Control Strategy for Industry 4.0 Manufacturing Systems

Industrial control systems control and supervise our most important and critical infrastructures, such as power utilities, clean water plants and nuclear plants, as well as the manufacturing industries at the base of our economy. These systems are currently undergoing a transformation driven by the Industry 4.0 evolution, characterized by increased connectivity and flexibility. Consequently, the cybersecurity threat landscape for industrial control systems is evolving as well. Current strategies used for access control within industrial control systems are relatively rudimentary. It is evident that some of the emerging cybersecurity threats related to Industry 4.0 could be better mitigated using more fine-grained access control policies. In this article we discuss and describe a number of access control strategies that could be used within manufacturing systems. We evaluate the strategies in a simulation experiment, using a number of attack-scenarios. Moreover, a method is outlined for automatic policy-generation based on engineering-data, which is aligned with one of the best performing strategies.

SEQUOIA: A Middleware Supporting Policy-Based Access Control for Search and Aggregation in Data-Driven Applications

Application-level access control is a top priority when hardening software applications. In particular, run-time customization of access control policies and separation for concerns are becoming increasingly important. While these requirements are generally well-supported for request-response applications, there is a lack of support for data-focused operations, such as search or data aggregation, in a multi-tier architecture. Moreover, an ability to specify fine-grained access control policies is generally lacking for such applications. This puts at risk the security of organizations that employ existing and emerging database technologies and requires solutions that alleviate this issue. This paper approaches this issue through query rewriting. We present Sequoia , a data access middleware that enables attribute-based, application-level access control in data-driven applications. The middleware enforces external access control policies on data-focused operations such as search and aggregation queries by means of query rewriting based on dynamic run-time conditions. Sequoia provides run-time enforcement of policies that is scalable with regard to the database size. This paper presents an extensible architecture for both relational databases and document stores. It discusses the rewriting approach, and provides a formal verification of equivalencyand an extensive evaluation that shows that this approach scales better than the current state of practice and is an important track for future research.

Efficient Data Access Control With Fine-Grained Data Protection in Cloud-Assisted IIoT

The Industrial Internet of Things (IIoT) has provided a promising opportunity to build digitalized industrial systems. A fundamental technology of IIoT is the radio-frequency identification (RFID) technique, which allows industrial participants to identify items and anchor time-series IoT data for them. They can further share the IoT data through the cloud service to enable information exchange and support critical decisions in production operations. Storing IoT data in the cloud, however, requires a data access control mechanism to protect sensitive business issues. Unfortunately, using traditional cryptographic access control schemes for time-series IoT data face severe efficiency and key leakage problems. In this article, we design a secure industrial data access control scheme for cloud-assisted IIoT. Our scheme enables participants to enforce fine-grained access control policies for their IoT data via ciphertext policy-attribute-based encryption (CP-ABE) scheme. Our scheme adopts a hybrid cloud infrastructure for participants to outsource expensive CP-ABE tasks to the cloud service with strong privacy guarantees. Importantly, our scheme guarantees a new privacy notion named item-level data protection for IoT data to prevent key leakage problem. We achieve these goals via several encryption and optimization techniques. Our performance assessments combine system implementation with large-scale emulations and confirm the security and efficiency of our design.

RCBAC: A risk-aware content-based access control model for large-scale text data

Unstructured data (mostly text data) have become a vital part in the era of big data. Hence, it has become increasingly difficult to identify the internal relations among data and describing the access control object during the design of access control (especially fine-grained access control) policies. Furthermore, in recent years, security incidents have frequently occurred due to the leakage of secrets by insiders, in both enterprises and government agencies around the world. Due to dynamic user behavior, it is difficult to determine “curious accesses” and grant authority based on traditional static access control models. Therefore, we need a dynamic access control model that is content-driven and can be used to find curious users in daily practice. This paper proposes a risk-aware content-based access control model (RCBAC) which can be used to solve over-authorization problems and can grant file-level authority to users. Based on the relevance of the data content and the duties of each user, RCBAC can quantify the risk of both the access behavior and the access history; accordingly, each user's access ability can be adjusted dynamically. The experimental results show that the RCBAC model can separate curious users from normal users and limit the access ability of curious users.

Privacy-Preserving Search for a Similar Genomic Makeup in the Cloud

Increasing affordability of genome sequencing and, as a consequence, widespread availability of genomic data opens up new opportunities for the field of medicine, as also evident from the emergence of popular cloud-based offerings in this area, such as Google Genomics [1]. To utilize this data more efficiently, it is crucial that different entities share their data with each other. However, such data sharing is risky mainly due to privacy concerns. In this article, we attempt to provide a privacy-preserving and efficient solution for the “similar patient search” problem among several parties (e.g., hospitals) by addressing the shortcomings of previous attempts. We consider a scenario in which each hospital has its own genomic dataset and the goal of a physician (or researcher) is to search for a patient similar to a given one (based on a genomic makeup) among all the hospitals in the system. To enable this search, we propose a hierarchical index structure to index each hospital’s dataset with low memory requirement. Furthermore, we develop a novel privacy-preserving index merging mechanism that generates a common search index from individual indices of each hospital to significantly improve the search efficiency. We also consider the storage of medical information associated with genomic data of a patient (e.g., diagnosis and treatment). We allow access to this information via a fine-grained access control policy that we develop through the combination of standard symmetric encryption and ciphertext policy attribute-based encryption. Using this mechanism, a physician can search for similar patients and obtain medical information about the matching records if the access policy holds. We conduct experiments on large-scale genomic data and show the high efficiency of the proposed scheme.

RESPOnSE-A Framework for Enforcing Risk-Aware Security Policies in Constrained Dynamic Environments.

The enforcement of fine-grained access control policies in constrained dynamic networks can become a challenging task. The inherit constraints present in those networks, which result from the limitations of the edge devices in terms of power, computational capacity and storage, require an effective and efficient access control mechanism to be in place to provide suitable monitoring and control of actions and regulate the access over the resources. In this article, we present RESPOnSE, a framework for the specification and enforcement of security policies within such environments, where the computational burden is transferred to high-tier nodes, while low-tier nodes apply risk-aware policy enforcement. RESPOnSE builds on a combination of two widely used access control models, Attribute-Based Access Control and Role-Based Access Control, exploiting the benefits each one provides. Moreover, the proposed mechanism is founded on a compensatory multicriteria decision-making algorithm, based on the calculation of the Euclidean distance between the run-time values of the attributes present in the security policy and their ideal values, as those are specified within the established policy rules.

SecureAD: A Secure Video Anomaly Detection Framework on Convolutional Neural Network in Edge Computing Environment

Anomaly detection offers a powerful approach to identifying unusual activities and uncommon behaviors in real-world video scenes. At present, convolutional neural networks (CNN) have been widely used to tackle anomalous events detection, which mainly rely on its stronger ability of feature representation than traditional hand-crafted features. However, massive video data and high cost of CNN model training are a challenge to achieve satisfactory detection results for resource-limited users. In this article, we propose a secure video anomaly detection framework (SecureAD) based on CNN. Specifically, we introduce additive secret sharing to design several calculation protocols for achieving safe CNN training and video anomaly detection. Besides, we propose a Bloom filter based fine-grained access control policy to authenticate legitimate users, without leaking the privacy of raw personal attributes. In addition, edge computing instead of cloud computing is integrated into the architecture to reduce response time between servers and users in an outsourced environment. Finally, we prove that the proposed SecureAD achieves secure video anomaly detection without compromising the privacy of the related data. Also, the simulation results demonstrate the effectiveness and security of our SecureAD.

A Blockchain-Assisted Trust Access Authentication System for Solid

The Solid (Social Linked Data) project focuses on data sharing and privacy security and aims to build a decentralized ecosystem that radically changes the way web applications work today. Our goal is to introduce a “trust access authentication system” to achieve secure authentication and fine-grained access control, thereby promoting the implementation of Solid. Blockchain, equipped with multiple security properties and authentication functions, is a crucial technology. In this paper, we present a blockchain-assisted system for secure authentication in Solid and for implementation of fine-grained access control policies. Specifically, we explore to integrate threshold RSA signatures in a permissioned blockchain system to enable a fault-tolerant distributed signature scheme, thereby enhancing the resilience and robustness of authentication system. Moreover, we utilize smart contract to control transaction flows and manage access control policies automatically. Experimental results show that our proposed trust access authentication system enhances security, scales well, and is efficient and economically feasible.

Data Security for Cloud Datasets With Bloom Filters on Ciphertext Policy Attribute Based Encryption

Cloud data storage environments allow the data providers to store and share large amounts of datasets generated from various resources. However, outsourcing private data to a cloud server is insecure without an efficient access control strategy. Thus, it is important to protect the data and privacy of user with a fine-grained access control policy. In this article, a Bloom Filter-based Ciphertext-Policy Attribute-Based Encryption (BF-CP-ABE) technique is presented to provide data security to cloud datasets with a Linear Secret Sharing Structure (LSSS) access policy. This fine-grained access control scheme hides the whole attribute set in the ciphertext, whereas in previous CP-ABE methods, the attributes are partially hidden in the ciphertext which in turn leaks private information about the user. Since the attribute set of the BF-CP-ABE technique is hidden, bloom filters are used to identify the authorized users during data decryption. The BF-CP-ABE technique is designed to be selective secure under an Indistinguishable-Chosen Plaintext attack and the simulation results show that the communication overhead is significantly reduced with the adopted LSSS access policy.

Hidden Ciphertext Policy Attribute-Based Encryption With Fast Decryption for Personal Health Record System

Since cloud computing has been playing an increasingly important role in real life, the privacy protection in many fields has been paid more and more attention, especially, in the field of personal health record (PHR). The traditional ciphertext-policy attribute-based encryption (CP-ABE) provides the fine-grained access control policy for encrypted PHR data, but the access policy is also sent along with ciphertext explicitly. However, the access policy will reveal the users' privacy, because it contains too much sensitive information of the legitimate data users. Hence, it is important to protect users' privacy by hiding access policies. In most of the previous schemes, although the access policy is hidden, they face two practical problems: 1) these schemes do not support large attribute universe, so their practicality in PHR is greatly limited and 2) the cost of decryption is especially high since the access policy is embedded in the ciphertext. To address these problems, we construct a CP-ABE scheme with efficient decryption, where both the size of public parameters and the cost of decryption are constant. Moreover, we also show that the proposed scheme achieves full security in the standard model under static assumptions by using the dual system encryption method.

A lightweight secure conjunctive keyword search scheme in hybrid cloud

Keyword search over encrypted sensitive data is an essential technique in cloud computing. Many traditional secure retrieval schemes of the encrypted data mainly apply to single file-owner and single retrieval-party scenario, which cannot be used in cloud environment effectively. The emergence of Attribute-Based Encryption (ABE) provides a new solution to deliver secure and multi-parties keyword search over the encrypted data. However, most existing attribute-based keyword search schemes suffer problems, such as, imposed heavy computational burden for file-owner, limited expressive capability of access control policy, supported for single keyword search only, etc. Hence, we present a Lightweight secure Conjunctive Keyword Search scheme in hybrid cloud environment (LCKS) based on ciphertext-policy ABE algorithm, which supports file-owner authorized conjunctive keyword search for multi-parties. By delegating most computational tasks to private cloud servers, LCKS enables file-owners to generate keyword index efficiently while delivering a fine-grained access control policy through adopting an expressive tree structure. Both security analysis and performance evaluation show that LCKS is secure, highly efficient, and well suited for hybrid cloud.

Practical attribute-based encryption: Outsourcing decryption, attribute revocation and policy updating

Attribute-Based Encryption (ABE) offers fine-grained access control policy over encrypted data, and thus applicable in cloud storage to provide authorized data privacy. However, there are some issues that should be solved before deploying ABE in practice. Firstly, as the heavy decryption cost grows with the complexity of access policy, an ABE with outsourcing decryption is preferred to relieve user's computation cost. Secondly, when user's attributes are altered, it is required for ABE supporting attribute revocation to change user's access privilege timely and effectively. Thirdly, in the case of access control policy changed by data owner, policy updating requirement must be met in designing ABE. Therefore, a practical ABE scheme is proposed which can solve aforementioned issues simultaneously. In order to support flexible number of attributes, our scheme also achieves large universe and multiple attribute authorities. The security and performance of the proposed scheme are discussed, followed by extensive experiments to demonstrate its effectiveness and practicability.