Flexible Access Control Policies Research Articles

ProChain: A privacy-preserving blockchain-based supply chain traceability system model

The inherent immutability of blockchain technology offers a promising solution for product supply chain traceability. However, the open and transparent nature of the blockchain raises concerns about the vulnerability of shared product information and the identity information of participants in the supply chain to falsification. To address these concerns, we propose a privacy-preserving blockchain-based scheme for supply chain traceability. Our approach leverages zero-knowledge proof technology to enable participants to enter the system using a one-time pseudonym, thereby protecting their identity information. Additionally, we propose a secure and reliable method for sharing product information by using attribute encryption technology to encrypt product information stored in the blockchain. We set flexible access control policies for product information ciphertext through smart contracts. To validate our approach, we implemented a system prototype named ProChain on the Hyperledger Fabric platform. Our evaluation results demonstrate the effectiveness of our scheme in protecting the identity information of manufacturers and the shared product information of all participants in the traceability system.

A Secure Data-Sharing Scheme for Privacy-Preserving Supporting Node–Edge–Cloud Collaborative Computation

The node–edge–cloud collaborative computation paradigm has introduced new security challenges to data sharing. Existing data-sharing schemes suffer from limitations such as low efficiency and inflexibility and are not easily integrated with the node–edge–cloud environment. Additionally, they do not provide hierarchical access control or dynamic changes to access policies for data privacy preservation, leading to a poor user experience and lower security. To address these issues, we propose a data-sharing scheme using attribute-based encryption (ABE) that supports node–edge–cloud collaborative computation (DS-ABE-CC). Our scheme incorporates access policies into ciphertext, achieving fine-grained access control and data privacy preservation. Firstly, considering node–edge–cloud collaborative computation, it outsources the significant computational overhead of data sharing from the owner and user to the edge nodes and the cloud. Secondly, integrating deeply with the “node–edge–cloud” scenario, the key distribution and agreement between all entities embedded in the encryption and decryption process, with a data privacy-preserving mechanism, improve the efficiency and security. Finally, our scheme supports flexible and dynamic access control policies and realizes hierarchical access control, thereby enhancing the user experience of data sharing. The theoretical analysis confirmed the security of our scheme, while the comparison experiments with other schemes demonstrated the practical feasibility and efficiency of our approach in node–edge–cloud collaborative computation.

Janus: Hierarchical Multi-Blockchain-Based Access Control (HMBAC) for Multi-Authority and Multi-Domain Environments

Although there are several access control systems in the literature for flexible policy management in multi-authority and multi-domain environments, achieving interoperability and scalability, without relying on strong trust assumptions, is still an open challenge. We present HMBAC, a distributed fine-grained access control model for shared and dynamic multi-authority and multi-domain environments, along with Janus, a practical system for HMBAC policy enforcement. The proposed HMBAC model supports: (a) dynamic trust management between different authorities; (b) flexible access control policy enforcement, defined at the domain and cross-domain level; (c) a global source of truth for all entities, supported by an immutable, audit-friendly mechanism. Janus implements the HMBAC model and relies on the effective fusion of two core components. First, a Hierarchical Multi-Blockchain architecture that acts as a single access point that cannot be bypassed by users or authorities. Second, a Multi-Authority Attribute-Based Encryption protocol that supports flexible shared multi-owner encryption, where attribute keys from different authorities are combined to decrypt data distributedly stored in different authorities. Our approach was implemented using Hyperledger Fabric as the underlying blockchain, with the system components placed in Kubernetes Docker container pods. We experimentally validated the effectiveness and efficiency of Janus, while fully reproducible artifacts of both our implementation and our measurements are provided.

Dual Fine-Grained Public-Key Searchable Encryption from Lattices

Fine-grained public key encryption with keyword search (PEKS), allowing users to search on encrypted data with flexible access control policy, has been widely studied recently due to its promising application to real-world scenarios such as cloud computing. However, most of the existing fine-grained PEKS schemes are either only able to support single access control (e.g., attribute-based access control) or susceptible to being attacked or compromised by quantum computers in or after a short time. In this paper, we propose a fine-grained PEKS scheme that o ers dual access control based on lattice. In particular, we first define a dual fine-grained PEKS primitive against chosen keyword attacks under selective security. Subsequently, we adapt the key homomorphic technique and noise rerandomization technique to design a concrete scheme. Particularly, the keyword space in our construction is unlimited. Then, we present a formal security proof against chosen keyword attacks on the learning with errors (LWE) problem in the standard model. Moreover, we demonstrate the theoretical performance and experimental result of our proposed scheme. Finally, we discuss that our scheme can be easily extended to support conjunctive keywords and delegation without incurring complex operations.

BCST-APTS: Blockchain and CP-ABE Empowered Data Supervision, Sharing, and Privacy Protection Scheme for Secure and Trusted Agricultural Product Traceability System

Blockchain provides new technologies and ideas for the construction of agricultural product traceability system (APTS). However, if data is stored, supervised, and distributed on a multiparty equal blockchain, it will face major security risks, such as data privacy leakage, unauthorized access, and trust issues. How to protect the privacy of shared data has become a key factor restricting the implementation of this technology. We propose a secure and trusted agricultural product traceability system (BCST-APTS), which is supported by blockchain and CP-ABE encryption technology. It can set access control policies through data attributes and encrypt data on the blockchain. This can not only ensure the confidentiality of the data stored in the blockchain, but also set flexible access control policies for the data. In addition, a whole-chain attribute management infrastructure has been constructed, which can provide personalized attribute encryption services. Furthermore, a reencryption scheme based on ciphertext-policy attribute encryption (RE-CP-ABE) is proposed, which can meet the needs of efficient supervision and sharing of ciphertext data. Finally, the system architecture of the BCST-APTS is designed to successfully solve the problems of mutual trust, privacy protection, fine-grained, and personalized access control between all parties.

Lattice-based public key searchable encryption with fine-grained access control for edge computing

As a bridge between cloud computing platforms and the Internet of Things (IoT) devices, edge computing provides various on-demand data services to reduce latency and network congestion. To ensure data security in edge computing, sensitive data should be encrypted before being outsourced to edge servers. Public key encryption with keyword search (PEKS) can provide search service for encrypted data. Nevertheless, most existing PEKS schemes are susceptible to quantum attacks because their security assumptions are based on traditional hardness assumptions. Moreover, many lattice-based PEKS schemes only apply to the single-user scenario, limiting the range of applications. In this paper, we present an efficient lattice-based public key searchable encryption with fine-grained access control for edge computing. Our scheme achieves post-quantum security and highly flexible access control policies for multi-user applications, by utilizing the learning with errors (LWE) assumption and subset predicate encryption. The security proof illustrates that our proposed scheme is secure under chosen plaintext attacks and chosen keyword attacks. Finally, extensive experiments on real-world datasets illustrate that our encryption algorithm is faster than existing approaches.

RETRACTED: Privacy preserving and data transpiration in multiple cloud using secure and robust data access management algorithm

Nowadays, privacy preserving is playing important role in cloud computing where content based privacy is challengeable task in un-trusted cloud environment. Based on literature studies, the method has key complexities and access polices authentication issues. The system need to concentrate to bring strong encryption function and efficient key distribution polices to meet future challenges. The method need to address the real time application in cloud environments minimal computation cost, inherent defects in key management and flexible access control policy. Current approaches have still believe in user identity, mutual privacy and key agreement session wise among content owner, Trusted client, and cloud service provider. The Proposed work focused on designing a framework named Secure and Robust Data Access Management (SRDAM) Algorithm proposed to maintain enhanced privacy, secure data transportation, and data access managements. Proposed algorithm consolidates validating cloud service providers and after that considers the property necessity of cloud user and cloud service provider (CSP).Proposed SRDAM Algorithm reduces the 1.79 s Data uploading time (DUT), Data 1.80 s Downloading Time (DDT) and 11.02 s Communication Overhead (CO) for document, images and video for conventional methodologies.

Challenges and Opportunities in Applying Semantics to Improve Access Control in the Field of Internet of Things

The increased number of IoT devices results in continuously generated massive amounts of raw data. Parts of this data are private and highly sensitive as they reflect owner’s behavior, obligations, habits, and preferences. In this paper, we point out that flexible and comprehensive access control policies are “a must” in the IoT domain. The Semantic Web technologies can address many of the challenges that the IoT access control is facing with today. Therefore, we analyze the current state of the art in this area and identify the challenges and opportunities for improved access control in a semantically enriched IoT environment. Applying semantics to IoT access control opens a lot of opportunities, such as semantic inference and reasoning, easy data sharing, data trading, new approaches to authentication, security policies based on a natural language and enhances the interoperability using a common ontology.

A novel access control protocol using proxy signatures for cloud-based health information exchange

Health Information Exchange (HIE) allows various providers to electronically share patient health information, enhancing healthcare delivery through coordinated patient care. A primary concern in HIEs is the need for explicit authorization of information exchange in an auditable manner. However, we find that existing approaches for authorization in health information systems exhibit several drawbacks in meeting the needs of HIE, with non-cryptographic approaches lacking a secure and reliable mechanism for access policy enforcement, while cryptographic approaches being too expensive, complex and limited in specifying policies. This paper aims to overcome these drawbacks by presenting a simple and efficient patient-centric authorization protocol for information sharing in cloud-based HIE systems. The proposed protocol is built using a novel trapdoor hash-based proxy signature scheme, and ensures that the authorization is authentic with respect to both providers and patients, and complies with the established access control policies. Features of the proposed protocol include auditability, non-interactive and on-demand operation, and specification and secure/reliable enforcement of flexible access control policies. A detailed security and performance analysis shows that the proposed protocol is provably secure against forgery under the discrete log assumption, and achieves the best overall performance compared to other well-known schemes in the literature.

Efficient Attribute-Based Comparable Data Access Control

With the proliferation of mobile devices in recent years, there is a growing concern regarding secure data storage, secure computation, and fine-grained access control in data sharing for these resource-constrained devices in a cloud computing environment. In this work, we propose a new efficient framework named Constant-size Ciphertext Policy Comparative Attribute-Based Encryption (CCP-CABE) with the support of negative attributes and wildcards. It embeds the comparable attribute ranges of all the attributes into the user’s key, and incorporates the attribute constraints of all the attributes into one piece of ciphertext during the encryption process to enforce flexible access control policies with various range relationships. Accordingly, CCP-CABE achieves the efficiency because it generates constant-size keys and ciphertext regardless of the number of involved attributes, and it also keeps the computation cost constant on lightweight mobile devices. We further discuss how to extend CCP-CABE to fit a scenario with multiple attribute domains, such that the decryption proceeds from the least privileged attribute domain to the most privileged one to help protect the privacy of the access policy. We provide security analysis and performance evaluation to demonstrate their efficiency at the end.

A Hybrid Attribute based RBAC Model

In an open and distributed network, role-based access control (RBAC) model has the following deficiencies: Firstly, it is unable to provide flexible access control policy, and the granularity of authorization is too large. Secondly, the allocation and management of roles are too cumbersome, which leads to low efficiency of access control. To deal with these problems, we present a hybrid attribute based RBAC (HA-RBAC) model. In this paper, we deeply research the mapping relationships of roles and attributes, propose a combination of static-attribute-based roles and dynamic-attribute-based rules to simplify the management of access control policy and downsize the access control system, while we formally define the construction of HA-RBAC model and access control algorithm. Comparative analysis and simulation experiments show that this model can not only adapt to the role of fine-grained division and simplify policy management, but also improve the efficiency of access control, and reduce system consumption.

A secure file sharing service for distributed computing environments

Distributed cryptographic file systems enable file sharing among their users and need the adoption of a key management scheme for the distribution of the cryptographic keys to authorized users according to their specific degree of trust. In this paper we describe the architecture of a basic secure file sharing facility relying on a multi-party threshold-based key-sharing scheme that can be overlaid on top of the existing stackable networked file systems, and discuss its application to the implementation of distributed cryptographic file systems. It provides flexible access control policies supporting multiple combination of roles and trust profiles. A proof of concept prototype implementation within the Linux operating system framework demonstrated its effectiveness in terms of performance and security robustness.

Distributed access control policies for spectrum sharing

ABSTRACTCognitive radio is a novel wireless communication technology that allows for adaptive configuration of the reception parameters of a terminal, based on the information collected from the environment. Cognitive radio technology can be used in innovative spectrum management approaches such as spectrum sharing, where radio frequency spectral bands can be shared among various users through a dynamic exclusive‐use spectrum access model. Spectrum sharing can be applied to various scenarios in the commercial, public safety and military domain. In some scenarios, spectrum sharing demands a mechanism for expressing and enforcing access control policies for the allocation of resources including spectral bands. The access control polices should state what are the available resources (e.g., transmission/reception bandwidths), what are the users that are allowed to access them and under what conditions. However, because of the intrinsically highly dynamic nature of specific scenarios (e.g., public safety, military), where parties with various levels of authority may suddenly appear, it may be difficult to establish in advance what are the most suitable access control policies. Trust negotiation is a well‐known approach for expressing and enforcing distributed access control policies that depend on two or more parties. In this work, we present a trust negotiation‐based framework that allows for the definition of highly expressive and flexible distributed access control policies for the allocation of spectrum resources. Copyright © 2012 John Wiley & Sons, Ltd.

Design and Implementation of a Group Key Server-Based Cryptographic File System

Network storage techniques facilitate data sharing but also introduce new vulnerabilities. Cryptographic file systems provide the confidentiality and integrity of file data stored on servers that are not under users′ direct control by cryptographic methods. The key management schemes for current shared cryptographic file systems cannot satisfy the security, flexibility and efficiency requirements simultaneously. This paper proposes a cryptographic file system called CKS-CFS. A trusted Group Key Server (GKS) is introduced to manage file encryption keys in a centralized manner and to enable the employment of flexible access control policies. The computation and storage requirement for GKS is reduced through the use of access control blocks and lockboxes so that the function of GKS can be implemented by hardware to provide strong security. The overhead of revocation is reduced by block granularity encryption and key versioning technique. The authors have implemented a prototype of GKS-CFS based on Luster and evaluated its performance. Compared with other systems, the cryptographic cost in common file operations in GKS-CFS is reduced by an order of magnitude by avoiding the usage of public-key cryptography; Bonnie++ benchmark test shows that the performance of sequential read/write and random file operations are reduced on average by 42.0% and 8.4% respectively.

Flexible access control policy for SCOOP

Abstract The SCOOP model extends Eiffel to support the construction of concurrent applications with little more effort than sequential ones. The model provides strong safety guarantees: mutual exclusion and atomicity at the routine level, and FIFO scheduling of clients’ calls. Unfortunately, in the original proposal of the model (SCOOP_97) these guarantees come at a high price: they entail locking all the arguments of a feature call, even if the corresponding objects are never used by the feature. In most cases, the amount of locking is higher than necessary. Additionally, a client that holds a lock on a given processor cannot relinquish it temporarily when the lock is needed by one of its suppliers. This increases the likelihood of deadlocks; additionally, some interesting synchronisation scenarios, e.g. separate callbacks, cannot be implemented. We propose two refinements of the access control policy for SCOOP: a type-based mechanism to specify which arguments of a routine call should be locked, and a lock passing mechanism for safe handling of complex synchronisation scenarios with mutual locking of several separate objects. When combined, these refinements increase the expressive power of the model, give programmers more control over the computation, and enable more potential parallelism, thus reducing the risk of deadlock.

Patients’ attitudes towards sharing their health information

The current policies of the governments of Australia and New Zealand encourage the use of electronic information systems to exchange patient information between various stakeholders. This research investigated (1) the attitudes of patients toward sharing their medical information and (2) whether patients considered themselves to be well-informed about the uses that are made of their information. A questionnaire survey of adult primary-care patients was conducted in five clinics within a medium sized New Zealand city. Outcome measures were the proportions of respondents willing to share different categories of their information with different classes of recipients. Patients' evaluations of their knowledge about the uses made of their information were also collected. Over 200 responses were collected from five clinics. Respondents' attitudes toward sharing their information were found to be influenced by three factors. (1) Identity of recipient: whilst respondents were generally willing to have their information shared between health professionals, they were increasingly unwilling for it to be distributed to other stakeholders, such as administrators, researchers or other government departments. (2) Level of anonymity: respondents were more prepared to share anonymous information. (3) Type of information: respondents were increasingly unwilling to share their information as it takes on a more personal nature. Respondents were also found to be very poorly informed about the use of their information, 90% of respondents indicated that they had either incomplete or no knowledge of how their information was shared and 79% had no knowledge of the uses of their National Health Index (NHI) number. The findings also indicate that respondents would prefer to be consulted about the distribution of their information. These findings indicate that many respondents were unwilling to have their personal information distributed other than for purposes of clinical care and a sizeable proportion of the respondents would like to be consulted before their information is released. The high level of interest and concern that this research revealed among respondents, suggests that more attention should be directed towards ensuring that patients are fully informed about current information sharing practices. The findings also imply that the design and development of future systems should also incorporate sophisticated and flexible access control policies that can be adapted to meet the preferences of individual patients.

Flexible access control policy specification with constraint logic programming

We show how a range of role-based access control (RBAC) models may be usefully represented as constraint logic programs, executable logical specifications. The RBAC models that we define extend the "standard" RBAC models that are described by Sandhu et al., and enable security administrators to define a range of access policies that may include features, like denials of access and temporal authorizations, that are often useful in practice, but which are not widely supported in existing access control models. Representing access policies as constraint logic programs makes it possible to support certain policy options, constraint checks, and administrator queries that cannot be represented by using related methods (like logic programs). Representing an access control policy as a constraint logic program also enables access requests and constraint checks to be efficiently evaluated.

An authentication architecture for healthcare information systems

The medical community is moving towards an environment where automated patient medical records and electronically interconnected healthcare facilities are prevalent. The primary reason is that the electronic healthcare record, coupled with the electronic networking of hospitals, can provide healthcare organizations with more efficient, seamless service, resulting in higher quality care and reduced costs. The information contained in electronic records is an important and valuable asset of a healthcare organization. Thus, it needs to be protected to ensure its confidentiality, integrity and availability. A critical point in security is to set up efficient and flexible access control policies and procedures for protecting information. However, user authentication remains a prerequisite for really secure information services especially in distributed systems. In this paper, an authentication architecture for healthcare environments is presented. The proposed authentication architecture is based on a particular authentication protocol, which exploits the benefits of symmetric and asymmetric cryptography in order to provide a simple and self-confident authentication system.