Flexible Access Control Research Articles

A new highly efficient MAC protocol for WBAN: exceptional performance in the face of selfish behaviors

Over the last two decades, wireless body area networks (WBANs) have gained significant traction in healthcare applications. These networks facilitate connections among various sensors, which can be integrated into clothing, placed directly on the body, or implanted beneath the skin. While these sensors typically serve a single application, they generate traffic with diverse requirements. Managing this diversity necessitates tailored treatment to meet specific traffic needs while satisfying application requirements such as reliability and timeliness. In this paper, we propose a novel, flexible, and power-efficient medium access control (MAC) protocol designed to seamlessly complement existing solutions. Our protocol, available in two versions as an enhancement to the beacon-enabled mode of IEEE 802.15.4, aims to optimize quality of service (QoS) for periodic traffic applications within WBANs, irrespective of traffic and density conditions, without compromising energy efficiency. Our results demonstrate significant improvements compared to the standardized IEEE 802.15.4-MAC protocol across all test scenarios, even in the presence of selfish behaviors. These findings underscore the protocol’s efficacy in enhancing reliability and efficiency in wireless healthcare systems.

Flexibly expressive and revocable multi-authority KP-ABE scheme from RLWE for Internet of Medical Things

The emergence of the Internet of Medical Things (IoMT) has presented numerous opportunities for the healthcare industry. It is anticipated to enhance the quality and efficiency of medical services, thus enhancing people’s overall quality of life. However, frequently occurring medical data leakage makes the protection of medical data and privacy in IoMT become a critical issue. Among the solutions, attribute-based encryption (ABE) has been a very promising solution due to its flexible and fine-grained access control to encrypted data. However, the majority of current ABE schemes are based on bilinear pairing and are vulnerable to quantum attacks. The available of multi-authority ABE schemes over lattice only support a single policy such as threshold or AND gate, and lack the ability to implement user or attribute revocation in a flexible manner. For the special algebra structure of the lattice based scheme, how to overcome them is still a challenge at present. Aiming at the above, we propose a novel multi-authority key-policy attribute based encryption (RM-KP-ABE) based on the Ring Learning With Errors (RLWE) assumption. It supports multi-valued attributes and {0,1}-LSSS access policy. This scheme allows multiple authorities to participate in key distribution and enables attribute revocation when dynamic users change their situation. {0,1}-LSSS access policy makes the proposal get highly expressive which supports any monotonic boolean formula. Security analysis and performance evaluations demonstrate that our scheme is secure and efficient.

An efficient ciphertext-policy weighted attribute-based encryption with collaborative access for cloud storage

The encryption of user data is crucial when employing cloud storage services to guarantee the security of these data stored on cloud servers. Attribute-based encryption (ABE) scheme is considered a powerful encryption technique that offers flexible and fine-grained access control capabilities. Further, the multi-user collaborative access ABE scheme additionally supports users to acquire access authorization through collaborative works. However, the existing multi-user collaborative access ABE schemes do not consider the different weights of collaboration users. Therefore, using these schemes for weighted multi-user collaborative access results in either redundant attributes or unsuccessful construction of the access control structure. For this, we proposes the special attribute policy (SAP) problem about weighted multi-user collaborative access, and presents an efficient ciphertext-policy weighted attribute-based encryption with collaborative access scheme (CP-WABE-CA), which can provide efficient collaborative access control for multiple users with different weights. In detail, this scheme utilizes a novel weighted access tree to prevent attribute repetition, thereby eliminating redundant attributes and addressing the issue of constructing access control structures. We prove our scheme is resistant against chosen plaintext attack. The experimental results demonstrate that our scheme has significant computational efficiency advantages compared to related works, without increasing storage or communication overhead. Therefore, the CP-WABE-CA scheme can provide an efficient flexible weighted collaborative access control mechanisms for cloud storage.

Flexible and Fine-Grained Access Control for EHR in Blockchain-Assisted E-Healthcare Systems

Flexible and Fine-Grained Access Control for EHR in Blockchain-Assisted E-Healthcare Systems

Revocable and verifiable weighted attribute-based encryption with collaborative access for electronic health record in cloud

The encryption of user data is crucial when employing electronic health record services to guarantee the security of the data stored on cloud servers. Attribute-based encryption (ABE) scheme is considered a powerful encryption technique that offers flexible and fine-grained access control capabilities. Further, the multi-user collaborative access ABE scheme additionally supports users to acquire access authorization through collaborative works. However, the existing multi-user collaborative access ABE schemes do not consider the different weights of collaboration users. Therefore, using these schemes for weighted multi-user collaborative access results in redundant attributes, which inevitably reduces the efficiency of the ABE scheme. This paper proposes a revocable and verifiable weighted attribute-based encryption with collaborative access scheme (RVWABE-CA), which can provide efficient weighted multi-user collaborative access, user revocation, and data integrity verification, as the fundamental cornerstone for establishing a robust framework to facilitate secure sharing of electronic health records in a public cloud environment. In detail, this scheme employs a novel weighted access tree to eliminate redundant attributes, utilizes encryption version information to control user revocation, and establishes Merkle Hash Tree for data integrity verification. We prove that our scheme is resistant against chosen plaintext attack. The experimental results demonstrate that our scheme has significant computational efficiency advantages compared to related works, without increasing storage or communication overhead. Therefore, the RVWABE-CA scheme can provide an efficient and flexible weighted collaborative access control and user revocation mechanism as well as data integrity verification for electronic health record systems.

TRE-DSP: A traceable and revocable CP-ABE based data sharing scheme for IoV with partially hidden policy

With the popularity of the Internet of Vehicles (IoV), a large amount of data is being generated every day. How to securely share data between the IoV operator and various value-added service providers becomes one of the critical issues. Due to its flexible and efficient fine-grained access control feature, Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is suitable for data sharing in IoV. However, there are many flaws in most existing CP-ABE schemes, such as attribute privacy leakage and key misuse. This paper proposes a traceable and revocable CP-ABE-based data sharing with partially hidden policy for IoV (TRE-DSP). A partially hidden access structure is adopted to hide sensitive user attribute values, and attribute categories are sent along with the ciphertext to effectively avoid privacy exposure. In addition, key tracking and malicious user revocation are introduced with broadcast encryption to prevent key misuse. Since the main computation task is outsourced to the cloud, the burden of the user side is relatively low. Analysis of security and performance demonstrates that TRE-DSP is more secure and practical for data sharing in IoV.

FOTA-MAC: A Novel Traffic Adaptive MAC Protocol for Wireless Body Area Networks

Recently, Wireless Body Area Networks (WBANs) have emerged as a significant breakthrough in the healthcare sector due to their immense potential to revolutionize health outcomes. This type of network is able to support a diverse range of applications with traffic rates ranging from several bits per hour up to 10 megabits per second. The challenge lies in accommodating this wide range of applications and meeting their distinct requirements using a single suitably flexible medium access control protocol. In response to this challenge, our paper proposes a novel Traffic Adaptive MAC protocol designed specifically for the regular traffic of WBANs. This innovative protocol dynamically adapts its operation based on the observed traffic, leading to significant efficiency gains compared to the standardized MAC protocols IEEE 802.15.4 and IEEE 802.15.6. Our contribution aims to address the critical need for a tailored and adaptive MAC protocol that can seamlessly handle varying traffic loads within WBANs. By incorporating our protocol, we envision enhanced communication efficiency and improved performance, unlocking new possibilities for healthcare applications and ultimately revolutionizing the healthcare industry.

Traceable Attribute-Based Encryption With Equality Test for Cloud Enabled E-Health System.

The emerging Internet of Things (IoTs) and cloud technologies spark dramatic growth in efficiency and productivity for the conventional e-health sector. However, the extensive applications of the communication network also expose the sensitive medical data to the unprecedented cyber threats. To protect the data privacy in IoTs-based e-health cloud environments, we propose an adaptively secure data sharing scheme with traceability and equality test (T-ABEET). The T-ABEET not only allows flexible access control to the massive data but also provides the functionality of traitor tracing to identity the users who leak their decryption keys. Meanwhile, through carrying out the equality test, the target ciphertext can be retrieved efficiently without revealing anything about the plaintext. Particularly, distinct from previous traceable ABE works, the tracing cost in our T-ABEET scheme keeps constant even with the increasing number of users. Also, by introducing the multi-authority mechanism, our T-ABEET can avoid the inherent key escrow problem of ABE. Furthermore, our T-ABEET is demonstrated adaptively secure under subgroup decision assumption. Finally, performance comparison reveals that our T-ABEET has superior practicality, efficiency, and security in cloud-enabled e-health systems.

A threshold traceable delegation authorization scheme for data sharing in healthcare

In the field of smart healthcare, sharing of electronic data records (EHRs) has become popularity. As cloud computing develops, storing data in the cloud and setting access policies has become a common approach for EHRs data sharing. However, considering the collaborative nature of the diagnosis in healthcare, it is crucial to enhance flexible access control of shared EHRs data using delegation authorization. At the same time, the process of authorization must be achieved under controlled as well as traceable conditions. Attribute-based access control (ABAC) is one solution to address fine-grained access control, but the lack of management of the delegation process in existing solutions makes it difficult to apply ABAC directly in combination with delegation authorization. In this paper, we propose a threshold traceable delegation authorization (TTDA) scheme for EHRs data sharing. By using TTDA scheme, data owner who with limited resources can delegate multiple authorized users to complete authorization operation with a threshold-based manner. In TTDA scheme, we use accountability threshold signatures to help data owner traces the users who execute the authorization. We prove the security of TTDA scheme under the IND-CPA security model. Finally, we conduct sufficient realistic experiments, and the experimental outcomes prove the practicability of TTDA scheme.

ProChain: A privacy-preserving blockchain-based supply chain traceability system model

The inherent immutability of blockchain technology offers a promising solution for product supply chain traceability. However, the open and transparent nature of the blockchain raises concerns about the vulnerability of shared product information and the identity information of participants in the supply chain to falsification. To address these concerns, we propose a privacy-preserving blockchain-based scheme for supply chain traceability. Our approach leverages zero-knowledge proof technology to enable participants to enter the system using a one-time pseudonym, thereby protecting their identity information. Additionally, we propose a secure and reliable method for sharing product information by using attribute encryption technology to encrypt product information stored in the blockchain. We set flexible access control policies for product information ciphertext through smart contracts. To validate our approach, we implemented a system prototype named ProChain on the Hyperledger Fabric platform. Our evaluation results demonstrate the effectiveness of our scheme in protecting the identity information of manufacturers and the shared product information of all participants in the traceability system.

Attribute and User Trust Score-Based Zero Trust Access Control Model in IoV

The Internet of Vehicles (IoV) is an innovative area of interest in modern mobility that is rapidly evolving while facing complex challenges. Traditional IoV networks are susceptible to intrusion threats, which can lead to data leakage and seizure of vehicle control by attackers, thereby endangering vehicle users’ privacy and personal safety. An Attribute and User Trust Score-based Zero Trust Access Control Model (AU-ZTAC) is proposed, combining the zero-trust and attribute-based access control models to meet network protection requirements while achieving fine-grained dynamic access control and incorporating trust evaluation in the access control process to better reflect users’ intent. Experimental results demonstrate the effectiveness and feasibility of trust assessment through the proposed model. A comparison with the classical schemes illustrates that AU-ZTAC allows for more flexible and fine-grained access control in complex access control environments while improving IoV security.

Flexible and secure access control for EHR sharing based on blockchain

With the rapid development of the healthcare industry, many Electronic Health Records (EHRs) have emerged in different healthcare centers. However, lots of personal medical data are stored directly in plaintext at a single healthcare center, which makes it suffer from the single point of failure and brings many security and privacy issues such as privacy information leakage or tampering. The combination of blockchain and attributed-based cryptography can effectively solve the above problems. Therefore, in order to enable flexible fine-grained access control and efficient data retrieval while achieving privacy protection, we employ the ciphertext-policy attributed-based encryption (CP-ABE) and ciphertext-policy attribute-based searchable encryption (CP-ABSE) to propose a hidden policy attribute-based access control scheme. In addition, we combine consortium blockchain and smart contract to provide secure and reliable search and outsourcing decryption. Finally, through the security analysis and experimental results, we demonstrate that our scheme is secure and efficient.

Capability and Blockchain-Based Fine-Grained and Flexible Access Control Model

Currently, integrating blockchain into access control systems has become a new research trend. However, existing access control systems still have problems such as easy confusion of capability authorisation subjects, inflexible capability granting and revocation, insufficient granularity of capability, insecure capability transfer and lack of capability verification. To solve these problems, this work proposes Capability- & Blockchainbased Fine-grained and Flexible Access Control (CB2FAC), defines new capability authorisation rules, and designs an authorisation tree with capability revocation list to meet the needs of flexibility and timeliness of capability revocation. Finally, simulation experiments show that CB2FAC is flexible and secure in granting, revoking, granularity control and verification of capability, and significantly outperforms the existing schemes in terms of performance.

ERSChain: Towards secure and flexible educational resource sharing using consortium blockchain and revocable ciphertext‐policy attribute‐based encryption

SummarySharing high‐quality educational resources has become an effective way to promote educational equity. The traditional educational resource sharing platforms using centralized storage architecture have security issues. Recently, many studies use blockchain to achieve secure sharing of educational resources. However, the existing blockchain‐based educational resource sharing schemes only use blockchain as a storage tool, and have issues such as low sharing efficiency, without considering copyright security, and lack of a trusted sharing environment, which prevents the large‐scale sharing of educational resources. In response, we propose ERSChain, a novel blockchain‐based educational resources sharing solution. First, we put forward a hybrid storage method that keeps the hash value of resource in the blockchain and stores the encrypted resource in the off‐chain, which can alleviate the storage and computing pressure brought by massive educational resources while ensuring the integrity of resources. Second, we construct an efficient revocable ciphertext‐policy attribute‐based encryption algorithm to implement flexible access control and an outsourced decryption algorithm to achieve greater efficiency. Obtaining access to educational resources is possible when user's attributes meet the access policy and the user's identity does not exist in the revocation list. Third, we put forward a credit mechanism to adjust the user's credibility and a credit‐based consensus mechanism to maintain the trusted sharing environment. Finally, security analysis and plentiful of experiments demonstrate that our proposed ERSChain achieves security assurance, has better applicability than similar works, and enables large‐scale sharing of educational resources.

A Review on Dynamic Network Using Flexible Active-Mode Period Scheme for Telemedicine

Challenges associated with transmitter node during the process of intelligent transceiver nodes attempting to be active state after receiving a message outside its time slot schedule which might result in energy depletion through receiver node are the most notable origin of excessive energy consumption in the system. Various methods have been carried out to minimize the overhead cost. In this article, we presented the Dynamic Network using Adaptive Wake-Up Interval Media Access Control (MAC) protocol for Wireless Body Area Networks (WBANs) for telemedicine which could lead to the minimization of the energy consumption in the network and maximization of network lifetime. A Receiver Controlled mechanism balances the number of wake-up periods between Receiver node and Transmitter nodes and estimation of traffic load. This article depicts no earlier examination of dynamic network using Flexible Active-Mode period scheme-based media access control protocol for WBAN. Therefore, this review work could lead to the improvement of dynamic network Flexible Active-Mode –media access control protocols and invigorate a clearer way of finding AWI-Media Access Control protocol problems.

Blockchain-Based Secure Storage and Access Control Scheme for Supply Chain Ecological Business Data: A Case Study of the Automotive Industry.

The reliable circulation of automotive supply chain data is crucial for automotive manufacturers and related enterprises as it promotes efficient supply chain operations and enhances their competitiveness and sustainability. However, with the increasing prominence of privacy protection and information security issues, traditional data sharing solutions are no longer able to meet the requirements for highly reliable secure storage and flexible access control. In response to this demand, we propose a secure data storage and access control scheme for the supply chain ecosystem based on the enterprise-level blockchain platform Hyperledger Fabric. The design incorporates a dual-layer attribute-based auditable access control model for access control, with four smart contracts aimed at coordinating and implementing access policies. The experimental results demonstrate that the proposed approach exhibits significant advantages under large-scale data and multi-attribute conditions. It enables fine-grained, dynamic access control under ciphertext and maintains high throughput and security in simulated real-world operational scenarios.

A Blockchain-Based Trustworthy Model Evaluation Framework for Deep Learning and Its Application in Moving Object Segmentation.

Model evaluation is critical in deep learning. However, the traditional model evaluation approach is susceptible to issues of untrustworthiness, including insecure data and model sharing, insecure model training, incorrect model evaluation, centralized model evaluation, and evaluation results that can be tampered easily. To minimize these untrustworthiness issues, this paper proposes a blockchain-based model evaluation framework. The framework consists of an access control layer, a storage layer, a model training layer, and a model evaluation layer. The access control layer facilitates secure resource sharing. To achieve fine-grained and flexible access control, an attribute-based access control model combining the idea of a role-based access control model is adopted. A smart contract is designed to manage the access control policies stored in the blockchain ledger. The storage layer ensures efficient and secure storage of resources. Resource files are stored in the IPFS, with the encrypted results of their index addresses recorded in the blockchain ledger. Another smart contract is designed to achieve decentralized and efficient management of resource records. The model training layer performs training on users' servers, and, to ensure security, the training data must have records in the blockchain. The model evaluation layer utilizes the recorded data to evaluate the recorded models. A method in the smart contract of the storage layer is designed to enable evaluation, with scores automatically uploaded as a resource attribute. The proposed framework is applied to deep learning-based motion object segmentation, demonstrating its key functionalities. Furthermore, we validated the storage strategy adopted by the framework, and the trustworthiness of the framework is also analyzed.

VC-DCPS: Verifiable Cross-Domain Data Collection and Privacy-Persevering Sharing Scheme Based on Lattice in Blockchain-Enhanced Smart Grids

With the advent of the era of Industry 4.0, blockchain-enhanced Smart Grids have received widespread attention from academics and industry personnel, with its great advantages in high transparency, flexibility and decentralization. However, there are still problems of privacy leakage and inefficiency. In this paper, we propose a cross-domain verifiable data collection and privacy-persevering sharing scheme based on lattice in blockchain-enhanced Smart Grids, called VC-DCPS. Firstly, lattice-based homomorphic encryption and spatial-temporal aggregation technology are utilized to enable cross-domain collection of data, dynamic addition and deletion of users and improvement of efficiency. Secondly, a post-verification method is designed to verify whether the outsourcing cloud executes predetermined operations correctly. Using consensus and incentive mechanisms via smart contract will enable flexible access control and efficient transactions on the blockchain. In addition, formal security analysis shows that the proposed scheme can ensure privacy and enhance security. Finally, performance evaluation and experimental comparison are performed and turn out that the proposed scheme is strong security, high efficiency and low storage overhead.

A Secure Data-Sharing Scheme for Privacy-Preserving Supporting Node–Edge–Cloud Collaborative Computation

The node–edge–cloud collaborative computation paradigm has introduced new security challenges to data sharing. Existing data-sharing schemes suffer from limitations such as low efficiency and inflexibility and are not easily integrated with the node–edge–cloud environment. Additionally, they do not provide hierarchical access control or dynamic changes to access policies for data privacy preservation, leading to a poor user experience and lower security. To address these issues, we propose a data-sharing scheme using attribute-based encryption (ABE) that supports node–edge–cloud collaborative computation (DS-ABE-CC). Our scheme incorporates access policies into ciphertext, achieving fine-grained access control and data privacy preservation. Firstly, considering node–edge–cloud collaborative computation, it outsources the significant computational overhead of data sharing from the owner and user to the edge nodes and the cloud. Secondly, integrating deeply with the “node–edge–cloud” scenario, the key distribution and agreement between all entities embedded in the encryption and decryption process, with a data privacy-preserving mechanism, improve the efficiency and security. Finally, our scheme supports flexible and dynamic access control policies and realizes hierarchical access control, thereby enhancing the user experience of data sharing. The theoretical analysis confirmed the security of our scheme, while the comparison experiments with other schemes demonstrated the practical feasibility and efficiency of our approach in node–edge–cloud collaborative computation.

An extended Attribute-based access control with controlled delegation in IoT

Access control is one of the main concerns for securing the Internet of Things (IoT) due to its inherent features. It is particularly challenging to manage access policies and authorization (rights) propagation in a highly dynamic and scalable environment with a potentially unbound number of connected objects. This paper proposes an Attribute-Capability-Based Access Control (ACapBAC) system for the IoT. ACapBAC enables flexible and dynamic access control with fine-grained controlled delegation. The reliability of the proposed solution is highlighted through both efficiency and security analysis.