Flexible Access Control Research Articles

Mathematical Modeling of Static Data Attribute Encryption Based on Big Data Technology

Attribute encryption is an effective one to many network communication technologies, which supports flexible access control strategies and is very suitable for fine-grained access control in large-scale information systems. In order to improve the attributes of static data, encryption technology can provide a reliable technical guarantee for network security. This paper presents a mathematical modeling method of static data attribute encryption based on big data technology. The big data redundancy elimination algorithm based on similarity calculation is analyzed. By using static data attribute encryption based on big data technology, the length of encrypted data packets will not increase, and partial redundancy of fragments can be eliminated, which can greatly improve the efficiency of the system. The attribute-based encryption mechanism uses attributes as public keys, and the decryption user is a group; so, the encryption efficiency is very high. It can realize efficient encryption and decryption, as well as flexible access control based on user attributes. This scheme can reflect the importance of attributes; so, it is more practical.

Dynamic Access Control and Trust Management for Blockchain-Empowered IoT

The Internet of Things (IoT), while providing comprehensive interconnection and ubiquitous services, poses security issues by enabling resources sharing among various devices from different untrusted authorities. Blockchain, as a distributed ledger, provides a traceable and verifiable platform to ensure the secure access control in IoT. The existing works based on blockchain may bring up intolerable computing overhead and delay to the lightweight IoT devices. In this article, we propose a dynamic and lightweight attribute-based access control framework for blockchain-empowered IoT, to achieve secure and fine-grained authorization. The proposed scheme allows access to resources by evaluating attributes, operations, and the environment relevant to a request. The access policy is executed through smart contract in blockchain for security and flexibility. To further adapt to IoT device constraints, we design a access control framework based on decentralized application (DApp), which can maintain tamper proof in a timely manner and be adapt to the delay-intolerant application. When delay-intolerant access is required, access can be allowed according to local replica of the blockchain, without a consensus of blockchain network. Considering the time-varying attributes of IoT devices, a trust management scheme is proposed based on the Markov chain to resist the security fluctuation caused by the vulnerability of IoT devices. In the experiments, we deploy our system prototype on Ethereum to evaluate the feasibility and effectiveness of the scheme. The results show the proposed scheme can achieve secure, high throughput, and flexible access control in IoT.

Achieving fine-grained and flexible access control on blockchain-based data sharing for the Internet of Things

The traditional centralized data sharing systems have potential risks such as single point of failures and excessive working load on the central node. As a distributed and collaborative alternative, approaches based upon blockchain have been explored recently for Internet of Things (IoTs). However, the access from a legitimate user may be denied without the pre-defined policy and data update on the blockchain could be costly to the owners. In this paper, we first address these issues by incorporating the Accountable Subgroup Multi-Signature (ASM) algorithm into the Attribute-based Access Control (ABAC) method with Policy Smart Contract, to provide a finegrained and flexible solution. Next, we propose a policy-based Chameleon Hash algorithm that allows the data to be updated in a reliable and convenient way by the authorized users. Finally, we evaluate our work by comparing its performance with the benchmarks. The results demonstrate significant improvement on the effectiveness and efficiency.

Research on Access Control Scheme of System Wide Information Management Based on Attribute Association

System wide information management (SWIM) involves civil aviation system control, intelligence, alarm, traffic, and other data. These data are transmitted in various forms, making SWIM system vulnerable to sensitive information leakage, data tampering, denial, and other security threats. In this article, an attribute-based air traffic management (ATM) information access control scheme is proposed to solve the security threat of SWIM. An improved extensible access control markup language (XACML) authorization model is established, combining linear secret sharing scheme (LSSS) matrix structure and monotone span program (MSP); an attribute association algorithm is designed to establish the attribute association relationship between services and users. Experimental results show that the attribute association algorithm improves the time complexity, but the algorithm can support richer policy representation capability, and the proposed ATM information access control scheme is more efficient and can effectively reduce the space cost. This scheme can achieve more fine-grained and flexible access control.

A Right Transfer Access Control Model of Internet of Things Based on Smart Contract

Sensor nodes play a crucial role in the promotion of development of Internet of Things (IoT). Through this transaction, RO defines access control policies in script form based on ABAC's access control model to grant access right. The identity of all users in the model is identified by address. This paper builds a more flexible right transfer access control model by means of combining the Attribute-Based Access Control model (ABAC) and blockchain technology. Owing to the characteristics of ABAC’s attributes and right association, the massive problems of some sensor nodes can be solved. At the same time, for the sake of addressing the dynamic problems such as node access and right transfer, right transfer contract (TS) and access control contract (CS) are employed on the chain to ensure efficient and safe transmission of rights. To solve on-chain storage problems and ensure transparency of the operation, the idea of Rollup in Ethereum expansion is used to upload the final state of protocol policy and right exchange to the chain. Any user can know the policy and current right transfer status at any time. Finally, comparative and security analysis show that the model presented here can solve IoT devices’ massive and dynamic problems more effectively and it is more secure than the traditional models.

A perfect secret sharing scheme for general access structures

The secret sharing (SS) scheme has been widely used as the de facto paradigm for group key management in cryptography and distributed computation. An SS scheme for a general access structure (GSS) has drawn more and more attention since it allows flexible access control. However, previous solutions to GSS need to either assign multiple shares to each participant or to solve a complex nonlinear integer programming. In this paper, we propose a novel strategy to address the two problems simultaneously based on the Chinese Remainder Theorem (CRT) for a polynomial ring over a finite field. We classify general access structures satisfying the monotone property into the two families of maximum forbidden subsets and minimum qualified subsets conforming to the security condition and the revealing condition. The moduli used in the scheme are pairwise coprime polynomials and can take the irreducible polynomials. To find the degrees of these polynomials, we only need to solve an integer linear programming (ILP) by minimizing the sum of the degrees of all the moduli. The proposed scheme is inherently a weighted SS scheme and may have no solution which commonly exists in all GSS schemes. To ensure a solution, we put forth a preprocessing algorithm which separates the original access structure into several subaccess structures based on graph theory. The proposed scheme only assigns a share for each participant and achieves perfect security. It has good generalization and provides a universal approach to program the scheme construction for SS schemes with general access structures, threshold access structures and weighted access structures.

Dual Fine-Grained Public-Key Searchable Encryption from Lattices

Fine-grained public key encryption with keyword search (PEKS), allowing users to search on encrypted data with flexible access control policy, has been widely studied recently due to its promising application to real-world scenarios such as cloud computing. However, most of the existing fine-grained PEKS schemes are either only able to support single access control (e.g., attribute-based access control) or susceptible to being attacked or compromised by quantum computers in or after a short time. In this paper, we propose a fine-grained PEKS scheme that o ers dual access control based on lattice. In particular, we first define a dual fine-grained PEKS primitive against chosen keyword attacks under selective security. Subsequently, we adapt the key homomorphic technique and noise rerandomization technique to design a concrete scheme. Particularly, the keyword space in our construction is unlimited. Then, we present a formal security proof against chosen keyword attacks on the learning with errors (LWE) problem in the standard model. Moreover, we demonstrate the theoretical performance and experimental result of our proposed scheme. Finally, we discuss that our scheme can be easily extended to support conjunctive keywords and delegation without incurring complex operations.

BCST-APTS: Blockchain and CP-ABE Empowered Data Supervision, Sharing, and Privacy Protection Scheme for Secure and Trusted Agricultural Product Traceability System

Blockchain provides new technologies and ideas for the construction of agricultural product traceability system (APTS). However, if data is stored, supervised, and distributed on a multiparty equal blockchain, it will face major security risks, such as data privacy leakage, unauthorized access, and trust issues. How to protect the privacy of shared data has become a key factor restricting the implementation of this technology. We propose a secure and trusted agricultural product traceability system (BCST-APTS), which is supported by blockchain and CP-ABE encryption technology. It can set access control policies through data attributes and encrypt data on the blockchain. This can not only ensure the confidentiality of the data stored in the blockchain, but also set flexible access control policies for the data. In addition, a whole-chain attribute management infrastructure has been constructed, which can provide personalized attribute encryption services. Furthermore, a reencryption scheme based on ciphertext-policy attribute encryption (RE-CP-ABE) is proposed, which can meet the needs of efficient supervision and sharing of ciphertext data. Finally, the system architecture of the BCST-APTS is designed to successfully solve the problems of mutual trust, privacy protection, fine-grained, and personalized access control between all parties.

Medical data security of wearable tele-rehabilitation under internet of things

The Internet of Things (IoT)-based intelligent medical system contains confidential and sensitive information of patients. Most of the data is related to the patient's medical information and physical information with a high degree of privacy. Therefore, the security and privacy of the data are very important. This study focuses on the privacy protection on information of data of patients during medical data sharing. First, the module structure of the IoT-based telemedicine system is analyzed. A lightweight and fine-grained retrieval and data sharing scheme is designed based on the Wireless Bodyarea Network (WBAN). The Ciphertext Policy Attribute Based Encryption (CP-ABE) scheme is improved mainly by incorporating a partial hidden encryption algorithm, and the improved one is defined as Attribute Partially Hidden Access Control (APHAC). Data users can only access the data when their attributes match the access policy formulated by the data owner. The simulation experiment factors into the storage overhead and computational overhead. The results show that when the number of attributes reaches 100, the APHAC scheme can save about 500 ​ms compared with the traditional CP-ABE scheme. As the number of attributes increases, only this scheme is stable, so it is more suitable for mobile devices. It can be concluded that the encrypted access control strategy proposed in this study avoids the excessive expenditure of end users in computing and storage resources while enabling users to have flexible access control.

Attribute-Based Blind Signature Scheme Based on Elliptic Curve Cryptography

Blind signature is a special digital signature that allows the signer to sign a document without knowing its content. However, in many situations, multiple people need to blindly sign messages. At this time, the traditional blind signature can no longer satisfy the application requirements. To solve this problem, attribute-based cryptography has been combined with the blind signature. The concept of the attribute-based blind signature is generated. At present, all attribute-based blind signature schemes require the support of bilinear pairing technology, which involves several complex pairing and exponential operations in the signature and verification processes, and the computational efficiency is not high. In this paper, we present an attribute-based blind signature scheme based on elliptic curve cryptography (ECC), and the security of new scheme is proved under the intractability of elliptic curve discrete logarithm problem (ECDLP). Our scheme is a key policy attribute-based signature (KP-ABS). The new scheme uses linear secret sharing scheme (LSSS) matrix technology that does not require recursive operation to achieve more flexible and fine-grained access control. In addition, the scheme is based on Elliptic Curve Cryptography (ECC) using scalar multiplication on an elliptic curve instead of a bilinear pairing operation. Our scheme has significant advantages in terms of computational efficiency and storage compared with existing attribute-based blind signature schemes.

Multiple access control scheme for EHRs combining edge computing with smart contracts

To make up the insufficient computing power of remote medical devices and solve the transmission delay problem, edge computing has been widely studied in academic community. The application of edge computing in E-health makes it more convenient for medical providers to view the patient’ electronic health records (EHRs), which not only improves the work efficiency of medical providers, but also provides patients with more personalized treatments. However,there are some security problems in the E-health system, such as EHRs leakage or tampering. Therefore, attribute-based encryption (CP-ABE) is widely used in the access control of EHRS. In order to reduce the computing cost of resource-constrained devices and achieve more flexible fine-grained access control, this paper proposes an effective ABE scheme that outsources part of the computing load to the fog nodes, which safely shares data with lower overheads. It also supports users revocation and attribute revocation. In addition, we combine smart contract and blockchain to share more fine-grained EHRs. The security proof and experimental results show that our scheme has higher efficiency to protect the patients’ EHRs privacy.

A Blockchain-Based CP-ABE Scheme with Partially Hidden Access Structures

Data sharing has become a key technology to break down data silos in the big data era. Ciphertext-policy attribute-based encryption (CP-ABE) is widely used in secure data-sharing schemes to realize flexible and fine-grained access control. However, in traditional CP-ABE schemes, the access structure is directly shared along with the ciphertext, potentially leading to users’ private information leakage. Outsourcing data to a centralized third party can easily result in privacy leakage and single-point bottlenecks, and the lack of transparency in data storage and sharing casts doubts whether users’ data are safe. To address these issues, we propose a blockchain-based CP-ABE scheme with partially hidden access structures (BCP-ABE-PHAS) to achieve fine-grained access control while ensuring user privacy. First, we propose an efficient CP-ABE scheme with partially hidden access structures, where the ciphertext size is constant. To assist data decryption, we design a garbled Bloom filter to help users quickly locate the position of wildcards in the access structure. Then, to improve storage efficiency and system scalability, we propose a data storage scheme that combines blockchain technology and the interplanetary file system, ensuring data integrity. Finally, we employ smart contracts for a transparent data storage and sharing process without third-party participation. Security analysis and performance evaluation show that the proposed BCP-ABE-PHAS scheme can preserve policy privacy with efficient storage and low computational overhead.

A Novel Secure Blockchain Framework for Accessing Electronic Health Records Using Multiple Certificate Authority

Blockchain is a promising technology in the context of digital healthcare systems, but there are issues related to the control of accessing the electronic health records. In this paper, we propose a novel framework based on blockchain and multiple certificate authority that implement smart contracts and access health records securely. Our proposed solution provides the facilities of flexible policies to update a record or invoke the policy such that a patient has complete authority. A novel approach towards multiple certificate’s authority (CA) is introduced in the design through our proposed framework. Our proposed policies and methods overcome the shortcoming and security breaches faced by single certificate authority. Our proposed scheme provides a flexible access control mechanism for securing electronic health records as compared to the existing benchmark models. Moreover, our proposed method provides a re-enrolment facility in the case of a user lost enrolment.

A flexible and adaptive medium access control protocol for improving quality of service in vehicular ad-hoc networks

Designing MAC (Medium Access Control) protocols for VANETs is a difficult task due to the inherently unstable nature of these networks when compared to traditional ad hoc networks (high node speed, position changes that lead to disconnections, signal losses, etc.). In recent years, several standardization efforts have been made by the IEEE in association with the scientific community in this area and they proposed the 1609.4 MAC protocol in the IEEE WAVE (Wireless Access in Vehicular Environments) stack. The aim of our work is to improve the quality of service and overall performances of this 1609.4 MAC protocol by proposing three mechanisms. First, we introduce an equity algorithm that aims to ensure more fairness between nodes. We also adapt the SCH (Service CHannel) interval to the network's needs with a dynamic SCH interval mechanism. Finally, we propose an emergency mechanism that aims to ensure the transmission of critical safety packets when dangerous events occur on the road. The results of our simulations show a significant improvement of the protocol's performances in terms of throughput, packet loss and critical packet delivery rates under several scenarios.

Privacy-Preserving Flexible Access Control for Encrypted Data in Internet of Things

Along with the development of edge computing and the cloud, the Internet of Things (IoT) is affecting and changing people’s lives. Data sharing has played an important role in the IoT, but the leakage of private user information poses a new security threat to the users. Thus, flexible fine-grained access control for such shared data is proposed in this article as an effective and secure method of eliminating vulnerabilities. However, the disclosure of access policies will also expose users’ private information. Recently, Yang <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al.</i> attempted to solve this problem and proposed a framework based on attribute-based encryption for shared data onto IEEE IoT-J(DOI: 10.1109/JIOT.2016.2571718). They hide the access policies by using a bloom filter (BF) and attempt to address privacy preservation in IoT. However, we demonstrate several security weaknesses of their framework and point out its vulnerability to dictionary attacks and access policy guessing attacks. Then, an improved IoT solution is proposed. Under this proposal, the attribute values are stored in BF while the attribute names are embedded in the access policy. The proposed scheme can resist dictionary attacks and access policy guessing attacks. In addition, it simultaneously realizes large attribute sets, an efficient decryption algorithm, and adaptive security. Security analysis and performance evaluations show that the presented scheme achieves higher security and implementation simplicity in the IoT than other currently available schemes.

Lattice-based public key searchable encryption with fine-grained access control for edge computing

As a bridge between cloud computing platforms and the Internet of Things (IoT) devices, edge computing provides various on-demand data services to reduce latency and network congestion. To ensure data security in edge computing, sensitive data should be encrypted before being outsourced to edge servers. Public key encryption with keyword search (PEKS) can provide search service for encrypted data. Nevertheless, most existing PEKS schemes are susceptible to quantum attacks because their security assumptions are based on traditional hardness assumptions. Moreover, many lattice-based PEKS schemes only apply to the single-user scenario, limiting the range of applications. In this paper, we present an efficient lattice-based public key searchable encryption with fine-grained access control for edge computing. Our scheme achieves post-quantum security and highly flexible access control policies for multi-user applications, by utilizing the learning with errors (LWE) assumption and subset predicate encryption. The security proof illustrates that our proposed scheme is secure under chosen plaintext attacks and chosen keyword attacks. Finally, extensive experiments on real-world datasets illustrate that our encryption algorithm is faster than existing approaches.

Federated-Access Management System and Videoconferencing Applications: Results from a Pilot Service during COVID-19 Pandemic

Videoconferencing has become a crucial enabler for sustainable collaboration and learning during the COVID-19 pandemic. However, national regulations often restrict public institutions from introducing commercial videoconferencing services. Open-source software is an attractive option for institutions if it can be protected from potential security threats while ensuring high usability. Unfortunately, to the best of our knowledge, we hardly find available open-source videoconferencing applications in the literature that stress their usability and adopt security-related frameworks. This study presents a federated-access management system called trustHub, which was developed to enable flexible and elaborate access control and protocol-agnostic user authentication. In addition, we introduce two videoconferencing applications that aim to improve the usability of leveraged open-source software. They are prototyped to operate in concert with trustHub to take firm access control and accept various types of identity providers. Consequently, using data collected from trustHub and a prototyped videoconferencing application over a 10-month period, we conduct a comprehensive analysis to understand the usage patterns of federated access and videoconferencing during the pandemic and, thus, verify their feasibility indirectly.

Key Technologies of Security Access Control in Fog Computing Environment

The rapid development of Internet technology has promoted the innovation of mobile communication technology. Following 2G, 3G, and 4G technology, mobile communication has entered the 5G era. At the same time, the trend of interconnection of all things is becoming more and more clear, and the simple cloud computing is gradually changing to more advanced and powerful fog computing. As a near-maturity edge computing model, fog computing is gradually popularized and applied. The security problem is always the most important thing in network technology. Therefore, it is necessary to think about the security access in fog computing environment. This work mainly discussed the security access control technology in fog computing environment, clarified its key parts, and analyzed its effective control technology from two aspects: extended access and hidden access. This work will give users more flexible access control options to thus achieve effective protection of data security and related factors.

Transfer of Secret Data using Re-encryption Technique with Hyperledger Fabric based on Blockchain Technology

The Personal health record system (PHR system) which stores health-records patient's information. PHR system allows the one Hospital to manage and share his/her data with selected other individuals. The originality or tamper resistance feature is crucial for PHR system because it contains sensitive information about patients. Blockchain technology with the personal blockchain becomes a potential, great solution due to its immutability properties. Unfortunately. This work aims to propose a blockchain-based PHR model. The proposed model is built using the Hyper-ledger Fabric concept to support a tamper resistance feature. Re-encryption and other cryptographic techniques Such as Advanced Encryption Standard and Hashing algorithms are employed to preserve privacy. The proposed model include flexible access control, security concerns, auditability. A detailed security analysis of our model shows that the it is provably secure for Security and privacy preserving.

Trust-Based Blockchain Authorization for IoT

Authorization or access control limits the actions a user may perform on a computer system, based on predetermined access control policies, thus preventing access by illegitimate actors. Access control for the Internet of Things (IoT) should be tailored to take inherent IoT network scale and device resource constraints into consideration. However, common authorization systems in IoT employ conventional schemes, which suffer from overheads and centralization. Recent research trends suggest that blockchain has the potential to tackle the issues of access control in IoT. However, proposed solutions overlook the importance of building dynamic and flexible access control mechanisms. In this paper, we design a decentralized attribute-based access control mechanism with an auxiliary Trust and Reputation System (TRS) for IoT authorization. Our system progressively quantifies the trust and reputation scores of each node in the network and incorporates the scores into the access control mechanism to achieve dynamic and flexible access control. We design our system to run on a public blockchain, but we separate the storage of sensitive information, such as user’s attributes, to private sidechains for privacy preservation. We implement our solution in a public Rinkeby Ethereum test-network interconnected with a lab-scale testbed. Our evaluations consider various performance metrics to highlight the applicability of our solution for IoT contexts.