Privacy-preserving Access Control Scheme Research Articles

Statistical privacy protection for secure data access control in cloud

Cloud Service Providers (CSPs) allow data owners to migrate their data to resource-rich and powerful cloud servers and provide access to this data by individual users. Some of this data may be highly sensitive and important and CSPs cannot always be trusted to provide secure access. It is also important for end users to protect their identities against malicious authorities and providers, when they access services and data. Attribute-Based Encryption (ABE) is an end-to-end public key encryption mechanism, which provides secure and reliable fine-grained access control over encrypted data using defined policies and constraints. Since, in ABE, users are identified by their attributes and not by their identities, collecting and analyzing attributes may reveal their identities and violate their anonymity. Towards this end, we define a new anonymity model in the context of ABE. We analyze several existing anonymous ABE schemes and identify their vulnerabilities in user authorization and user anonymity protection. Subsequently, we propose a Privacy-Preserving Access Control Scheme (PACS), which supports multi-authority, anonymizes user identity, and is immune against users collusion attacks, authorities collusion attacks and chosen plaintext attacks. We also propose an extension of PACS, called Statistical Privacy-Preserving Access Control Scheme (SPACS), which supports statistical anonymity even if malicious authorities and providers statistically analyze the attributes. Lastly, we show that the efficiency of our scheme is comparable to other existing schemes. Our analysis show that SPACS can successfully protect against Collision Attacks and Chosen Plaintext Attacks.

An attack Resistant Privacy-Preserving Access Control Scheme for Outsourced E-pharma Data in Cloud

Key Aggregate Cryptosystem was used to construct a safe and scalable healthcare data exchange system in the cloud (KAC). KAC offered single-key encryption and decryption rights delegation for any group of ciphertexts utilizing an aggregated secret key. However, leakage of delegation keys and a specified bound on number of maximal ciphertext classes were major issues with KAC.The Scalable and Strengthened -KAC (SSKAC) approach was created to decide the number of ciphertext classes using an elliptic curve dynamically while simultaneously boosting the security level of KAC by utilising double encryption. Access control is crucial because the majority of healthcare data is extremely sensitive and should only be accessed by those who are permitted. As a result, SSKAC includes attribute-based access control with anonymous authentication to give access control on health data with anonymous authentication. However, the access policy may expose end-user privacy to an attacker. To tackle this problem,we used the cuckoo filter to disguise the right of entry policy tosafeguard the privacy information of the owner. The inference assault affects medical records. One of the strategies for ensuring data confidentiality from unforeseen data access is inference control. The Individual data privacy is secured through the use of two inference control methods; The Query Set Size Prevention and K-Anonymity.

A Blockchain-Based Privacy-Preserving Publish-Subscribe Model in IoT Multidomain Data Sharing

With the dramatically increasing deployment of intelligent devices, the Internet of Things (IoT) has attracted more attention and developed rapidly. It effectively collects and shares data from the surrounding environment to achieve better IoT services. For data sharing, the publish-subscribe (PS) paradigm provides a loosely coupled and scalable communication model. However, due to the loosely coupled nature, it is vulnerable to many attacks, resulting in some security threats to the IoT system, but it cannot provide the basic security mechanisms such as authentication and confidentiality to ensure the data security. Thus, in order to protect the system security and users’ privacy, this paper presents a secure blockchain-based privacy-preserving access control scheme for the PS system, which adopt the fully homomorphic encryption (FHE) to ensure the confidentiality of the publishing events and leverage the ledger to store the large volume of data events and access crossdomain information. Finally, we analyze the correctness and security of our scheme; moreover, we deploy our proposed prototype system on two computers and evaluate its performance. The experimental results show that our PS system can efficiently achieve the equilibrium between the system cost and the security requirement.

An Efficient, Accountable, and Privacy-Preserving Access Control Scheme for Internet of Things in a Sharing Economy Environment

The Internet of Things (IoT) has set off a new information technology revolution due to its convenience and efficiency. An IoT enables sharing economy, as more people are willing to share their own things (mostly mobile devices) to leverage the under-used value. In such a situation where owners and users are often not familiar with each other, an efficient access control mechanism is needed to deal with the trust issue and support service accountability to help owners accurately get their deserved profits. Besides, in such a sharing economy environment, the mobility of most shared IoT devices and their privacy preserving should also be taken into account. Regrettably, the existing schemes cannot achieve all of the aforementioned goals simultaneously and only few schemes were implemented to evaluate the claimed performance. In this article, we propose an efficient, accountable, and privacy-preserving access control solution for IoT in a sharing economy environment. In our scheme, we utilize the one-time signature to achieve anonymous authentication and let gateways store the signatures as service credentials for accountability. Meanwhile, we adopt the identity-based authentication to exclude malicious gateways and shared devices from the system and design a specialized protocol for those devices moving with the users. We conduct a detailed security analysis to show that our scheme can effectively defend against potential attacks, and also implement a prototype system to demonstrate that our design is indeed an efficient one.

Efficient and privacy preserving access control scheme for fog-enabled IoT

Abstract The fog-to-things paradigm is introduced to mitigate the heavy burden on the edge of cloud-based network due to the centralized processing and storing of the massive volume of IoT data. Fog-enabled IoT architectures ensure small latency and enough computing resource that enables real time devices and applications. However, there still exist security and privacy challenges on data access control for fog-enabled IoT. Ciphertext-policy attribute-based encryption (CP-ABE) can be adopted to realize data access control in cloud-fog computing systems. In this paper, we propose an efficient and privacy preserving outsourced multi-authority access control scheme, named PPO-MACS. All attributes of users are transformed to be anonymous and authenticable to realize privacy preserving. And the verifiable outsourced decryption is introduced to reduce computation overheads on the end user side. Meanwhile, an efficient user revocation method is proposed. Security and performance analysis show that our scheme is secure and highly efficient.

Attribute-based Access Control for ICN Naming Scheme

Information Centric Networking (ICN) is a new network architecture that aims to overcome the weakness of existing IP-based networking architecture. Instead of establishing a connection between the communicating hosts, ICN focuses on the content, i.e., data, transmitted in network. Content copies in ICN can be cached at different locations. The content is out of its owner's control once it is published. Thus, enforcing access control policies on distributed content copies is crucial in ICN. Attribute-Based Encryption (ABE) is a feasible approach to enforce such control mechanisms in this environment. However, applying ABE in ICN faces two challenges: from management perspective, it is complicated to manage attributes in distributed manners; from privacy protection perspective, unlike in traditional networks, the enforced content access policies are public to all the ICN users. Thus, it is desirable that unauthorized content viewers are not able to retrieve the access policy. To this end, a privacy-preserving access control scheme for ICN and its corresponding attribute management solution are presented in this paper. The proposed approach is compatible with existing flat name based ICN architectures.

HB-PPAC: hierarchy-based privacy preserving access control technique in public cloud

Cloud computing is one term that has evolved drastically over the years. It involves deploying groups of remote servers and software that are networked, that will allow centralised data storage and online access to computer services or resources. However, an important problem in public clouds is how to selectively share data based on fine-grained attribute-based access control policies while at the same time assuring confidentiality of the data and preserving the privacy of users from the cloud. Keeping in mind the confidentiality of data that must be provided, many schemes and encryption algorithms have been implemented, but most of those schemes have high computational costs and overload on the data owner. In this paper, we are proposing a hierarchy-based privacy preserving access control scheme, in which data is encrypted and decrypted by the cloud using the blinded encryption and decryption technique that retains the constant computation cost to the owner and the user for any large file size, thus it makes our scheme suitable for energy deficient devices. The experimental result shows that our scheme is more suitable for energy deficient devices without compromising the security of data.

HB-PPAC: hierarchy-based privacy preserving access control technique in public cloud

Cloud computing is one term that has evolved drastically over the years. It involves deploying groups of remote servers and software that are networked, that will allow centralised data storage and online access to computer services or resources. However, an important problem in public clouds is how to selectively share data based on fine-grained attribute-based access control policies while at the same time assuring confidentiality of the data and preserving the privacy of users from the cloud. Keeping in mind the confidentiality of data that must be provided, many schemes and encryption algorithms have been implemented, but most of those schemes have high computational costs and overload on the data owner. In this paper, we are proposing a hierarchy-based privacy preserving access control scheme, in which data is encrypted and decrypted by the cloud using the blinded encryption and decryption technique that retains the constant computation cost to the owner and the user for any large file size, thus it makes our scheme suitable for energy deficient devices. The experimental result shows that our scheme is more suitable for energy deficient devices without compromising the security of data.

Distributed Privacy-Preserving Access Control in Sensor Networks

The owner and users of a sensor network may be different, which necessitates privacy-preserving access control. On the one hand, the network owner need enforce strict access control so that the sensed data are only accessible to users willing to pay. On the other hand, users wish to protect their respective data access patterns whose disclosure may be used against their interests. This paper presents DP <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> AC, a Distributed Privacy-Preserving Access Control scheme for sensor networks, which is the first work of its kind. Users in DP <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> AC purchase tokens from the network owner whereby to query data from sensor nodes which will reply only after validating the tokens. The use of blind signatures in token generation ensures that tokens are publicly verifiable yet unlinkable to user identities, so privacy-preserving access control is achieved. A central component in DP <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> AC is to prevent malicious users from reusing tokens, for which we propose a suite of distributed token reuse detection (DTRD) schemes without involving the base station. These schemes share the essential idea that a sensor node checks with some other nodes (called witnesses) whether a token has been used, but they differ in how the witnesses are chosen. We thoroughly compare their performance with regard to TRD capability, communication overhead, storage overhead, and attack resilience. The efficacy and efficiency of DP <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</sup> AC are confirmed by detailed performance evaluations.