Privacy-preserving Access Control Research Articles

Blockchain-based security-minded information-sharing in precast construction supply chain management with scalability, efficiency and privacy improvements

Blockchain and Interplanetary File System (IPFS) integration holds great promise for enhancing transparency and traceability in precast construction supply chain management (PCSCM). However, such integration faces challenges regarding unauthorized access to confidential data, which can lead to significant consequences, such as financial losses and legal issues. Regarding this gap, this paper proposes a hybrid privacy-preserving access control mechanism for securing blockchain-IPFS information-sharing in PCSCM with confidentiality considerations. Multiple privacy-preserving techniques (e.g., information-sharing channels, symmetric and asymmetric encryption, and lightweight proxy re-encryption) are leveraged. A prototype system demonstrates its feasibility and effectiveness, achieving demonstrably low network latency (millisecond level), efficient encryption (millisecond level), and robust data security within both blockchain and IPFS. This research contributes to a deeper understanding of blockchain-IPFS integration and provides a valuable reference point for future research and practical adoption.

Statistical privacy protection for secure data access control in cloud

Cloud Service Providers (CSPs) allow data owners to migrate their data to resource-rich and powerful cloud servers and provide access to this data by individual users. Some of this data may be highly sensitive and important and CSPs cannot always be trusted to provide secure access. It is also important for end users to protect their identities against malicious authorities and providers, when they access services and data. Attribute-Based Encryption (ABE) is an end-to-end public key encryption mechanism, which provides secure and reliable fine-grained access control over encrypted data using defined policies and constraints. Since, in ABE, users are identified by their attributes and not by their identities, collecting and analyzing attributes may reveal their identities and violate their anonymity. Towards this end, we define a new anonymity model in the context of ABE. We analyze several existing anonymous ABE schemes and identify their vulnerabilities in user authorization and user anonymity protection. Subsequently, we propose a Privacy-Preserving Access Control Scheme (PACS), which supports multi-authority, anonymizes user identity, and is immune against users collusion attacks, authorities collusion attacks and chosen plaintext attacks. We also propose an extension of PACS, called Statistical Privacy-Preserving Access Control Scheme (SPACS), which supports statistical anonymity even if malicious authorities and providers statistically analyze the attributes. Lastly, we show that the efficiency of our scheme is comparable to other existing schemes. Our analysis show that SPACS can successfully protect against Collision Attacks and Chosen Plaintext Attacks.

Combining Blockchain and IoT for Decentralized Healthcare Data Management

The emergence of the Internet of Things (IoT) has resulted in a significant increase in research on e-health. As the amount of patient data grows, it has become increasingly challenging to protect patients' privacy. Patient data is commonly stored in the cloud, making it difficult for users to control and protect their information. Moreover, the recent rise in security and surveillance breaches in the healthcare industry has highlighted the need for a better approach to data storage and protection. Traditional models that rely on third-party control over patients' healthcare data are no longer reliable, as they have proven vulnerable to security breaches. To address these issues, blockchain technology has emerged as a promising solution. Blockchain-based protocols have the potential to provide a secure and efficient system for e-health applications that does not require trust in third-party intermediaries. The proposed protocol outlined in this paper uses a blockchain-based approach to manage patient data securely and efficiently. Unlike Bitcoin, which is primarily used for financial transactions, the protocol described here is designed specifically for e-health applications. It employs a consensus mechanism that is more suitable for resource constrained IoT devices, thereby reducing network costs and increasing efficiency. The proposed protocol also provides a privacy-preserving access control mechanism that enables patients to have more control over their healthcare data. By leveraging blockchain technology, the protocol ensures that only authorized individuals can access the patient's data, which helps prevent data breaches and other security issues. Finally, the security and privacy of the proposed protocol are analysed to ensure that it meets the necessary standards for data protection. The protocol's effectiveness and efficiency are tested under different scenarios to ensure that it can perform reliably and consistently. Finally, the protocol proposed in this paper shows that how blockchain can be used to provide a secure and efficient system that empowers patients to take control of their healthcare data.

Using Blockchain to Achieve Decentralized Privacy in IoT Healthcare

With the advent of the Internet of Things (IoT), e-health has become one of the main topics of research. Due to the sensitivity of patient information, patient privacy seems challenging. Nowadays, patient data is usually stored in the cloud in healthcare programs, making it difficult for users to have enough control over their data. The recent increment in announced cases of security and surveillance breaches compromising patients' privacy call into question the conventional model, in which third-parties gather and control immense amounts of patients' Healthcare data. In this work, we try to resolve the issues mentioned above by using blockchain technology. We propose a blockchain-based protocol suitable for ehealth applications that does not require trust in a third party and provides an efficient privacypreserving access control mechanism. Transactions in our proposed system, unlike Bitcoin, are not entirely financial, and we do not use conventional methods for consensus operations in blockchain like Proof of Work (PoW). It is not suitable for IoT applications because IoT devices have resourcesconstraints. Usage of appropriate consensus method helps us to increase network security and efficiency, as well as reducing network cost, i.e., bandwidth and processor usage. Finally, we provide security and privacy analysis of our proposed protocol.

Context-aware privacy-preserving access control for mobile computing

In mobile and pervasive computing applications, opportunistic connections allow co-located devices to exchange data directly. Keeping data sharing local enables large-scale cooperative applications and empowers individual users to control what and how information is shared. Supporting such applications requires runtime frameworks that allow them to manage the who, what, when, and how of access to resources. Existing frameworks have limited expressiveness and do not allow data owners to modulate the granularity of information released. In addition, these frameworks focus exclusively on security and privacy concerns of data providers and do not consider the privacy of data consumers. We present PADEC, a context-sensitive, privacy-aware framework that allows users to define rich access control rules over their resources and to attach levels of granularity to each rule. PADEC is also characterized by its expressiveness, allowing users to decide under which conditions should which information be shared. We provide a formal definition of PADEC and an implementation based on private function evaluation. Our evaluation shows that PADEC is more expressive than other mechanisms, protecting privacy of both consumers and providers.

An attack Resistant Privacy-Preserving Access Control Scheme for Outsourced E-pharma Data in Cloud

Key Aggregate Cryptosystem was used to construct a safe and scalable healthcare data exchange system in the cloud (KAC). KAC offered single-key encryption and decryption rights delegation for any group of ciphertexts utilizing an aggregated secret key. However, leakage of delegation keys and a specified bound on number of maximal ciphertext classes were major issues with KAC.The Scalable and Strengthened -KAC (SSKAC) approach was created to decide the number of ciphertext classes using an elliptic curve dynamically while simultaneously boosting the security level of KAC by utilising double encryption. Access control is crucial because the majority of healthcare data is extremely sensitive and should only be accessed by those who are permitted. As a result, SSKAC includes attribute-based access control with anonymous authentication to give access control on health data with anonymous authentication. However, the access policy may expose end-user privacy to an attacker. To tackle this problem,we used the cuckoo filter to disguise the right of entry policy tosafeguard the privacy information of the owner. The inference assault affects medical records. One of the strategies for ensuring data confidentiality from unforeseen data access is inference control. The Individual data privacy is secured through the use of two inference control methods; The Query Set Size Prevention and K-Anonymity.

A Blockchain-Based Privacy-Preserving Publish-Subscribe Model in IoT Multidomain Data Sharing

With the dramatically increasing deployment of intelligent devices, the Internet of Things (IoT) has attracted more attention and developed rapidly. It effectively collects and shares data from the surrounding environment to achieve better IoT services. For data sharing, the publish-subscribe (PS) paradigm provides a loosely coupled and scalable communication model. However, due to the loosely coupled nature, it is vulnerable to many attacks, resulting in some security threats to the IoT system, but it cannot provide the basic security mechanisms such as authentication and confidentiality to ensure the data security. Thus, in order to protect the system security and users’ privacy, this paper presents a secure blockchain-based privacy-preserving access control scheme for the PS system, which adopt the fully homomorphic encryption (FHE) to ensure the confidentiality of the publishing events and leverage the ledger to store the large volume of data events and access crossdomain information. Finally, we analyze the correctness and security of our scheme; moreover, we deploy our proposed prototype system on two computers and evaluate its performance. The experimental results show that our PS system can efficiently achieve the equilibrium between the system cost and the security requirement.

Smart contract token-based privacy-preserving access control system for industrial Internet of Things

Due to mobile Internet technology's rapid popularization, the Industrial Internet of Things (IIoT) can be seen everywhere in our daily lives. While IIoT brings us much convenience, a series of security and scalability issues related to permission operations rise to the surface during device communications. Hence, at present, a reliable and dynamic access control management system for IIoT is in urgent need. Up till now, numerous access control architectures have been proposed for IIoT. However, owing to centralized models and heterogeneous devices, security and scalability requirements still cannot be met. In this paper, we offer a smart contract token-based solution for decentralized access control in IIoT systems. Specifically, there are three smart contracts in our system, including the Token Issue Contract (TIC), User Register Contract (URC), and Manage Contract (MC). These three contracts collaboratively supervise and manage various events in IIoT environments. We also utilize the lightweight and post-quantum encryption algorithm-Nth-degree Truncated Polynomial Ring Units (NTRU) to preserve user privacy during the registration process. Subsequently, to evaluate our proposed architecture's performance, we build a prototype platform that connects to the local blockchain. Finally, experiment results show that our scheme has achieved secure and dynamic access control for the IIoT system compared with related research.

Privacy-Preserving Distribution and Access Control of Personalized Healthcare Data

Privacy-Preserving Distribution and Access Control of Personalized Healthcare Data

Blockchain-Enabled Privacy-Preserving Access Control for Data Publishing and Sharing in the Internet of Medical Things

Recently, the rapid developments in the Internet of Medical Things (IoMT) enable smart devices to generate and transmit massive personal electronic medical records (EMRs). However, there are many sensitive attributes in an EMR, which could be accessed by external or internal unauthorized users for malicious purposes. In this article, we present a triple subject purpose-based access control (TS-PBAC) model, which is compatible with a blockchain-enabled reliable transaction network, and design an individual-centric security and privacy-preserving mechanism for access control with different purposes and roles in IoMT scenarios. Specifically, we design hierarchical purpose tree (HPT) and related policies to guarantee the legality of an external user with different purposes. To improve the privacy for sensitive attributes against an internal attacker, we design a local differential privacy (LDP)-based policy and role-based access control scheme in an edge computing paradigm to grant fine-granularity rights for authorized users. In addition, we introduce mutual evaluation metrics to evaluate data quality from a patient-and-medical-service level in an open anonymous network, only using logs kept in the blockchain. We test our approach by real-world EMRs with 100000 patients. The experimental results show that the proposed privacy-preserving scheme can better protect patient’s privacy than traditional access control policies in IoMT environments, and can make reliable and stable access control decisions between data publishers and data requesters with different purposes.

Decentralized Attribute-Based Server-Aid Signature in the Internet of Things

Devices of Internet of Things (IoT) play a significant role in people’s daily life. A large scale of data is generated, collected, and analyzed in these devices, which inevitably faces secure authentication and access control problem. Attribute-based signature (ABS), where a signer signs a message over a set of attributes, plays an elegant tool for privacy-preserving access control and data authentication. In multiauthority ABS scheme, multiple authorities distribute users’ private keys over their different attributes and these attribute authorities are managed by a central authority. Nevertheless, the whole ABS system can be broken if the central authority is compromised. Besides, the multiauthority ABS scheme needs a lot of pairing and exponentiation operations in the verification and signature algorithms. Therefore, it is very expensive for resource-limited devices (e.g., sensors in IoT) to utilize the ABS scheme. In order to solve above problems, we present a decentralized attribute-based server-aid signature (DABSAS) scheme. In the DABSAS scheme, a server can help users execute heavy computation in the signature and verification algorithms. The proposed scheme provides anonymity and unforgeability. In addition, our scheme mitigates the burden of the signature and verification phase. The proposed scheme is proved secure under the well-known computational co-Diffie–Hellman (co-CDH) assumption. Compared with the existing schemes, the presented DABSAS scheme is efficient.

Delegated Anonymous Credentials With Revocation Capability for IoT Service Chains (DANCIS)

This article deals with providing privacy-preserving access control in Internet of Things (IoT) systems. Here, a user/IoT device requests access to services provided by other IoT devices and multiple requests are combined to a request-specific service chain. An anonymous delegated credential-based system architecture is proposed, where the requester’s identity is not exposed to the services. The article presents the proposed architecture’s various components including the security aspects. Various options for implementing the architecture on resource-full and resource-constrained services are presented. A prototype of the proposed architecture is then implemented using Linux-based containers to emulate the services. Two representative systems, namely, a small-scale home automation system using a short service chain and a large-scale industrial automation system using a long service chain are considered. Timing measurements from the implementation are presented to demonstrate that the architecture is feasible and can be adapted for practical use in large-scale IoT systems.

Circuitree: A Datalog Reasoner in Zero-Knowledge

Driven by the increased consciousness in data ownership and privacy, zero-knowledge proofs (ZKPs) have become a popular tool to convince a third party of the truthfulness of a statement without disclosing any further information. As ZKPs are rather complex to design, frameworks that transform high-level languages into ZKPs have been proposed. We propose Circuitree, a Datalog reasoner in zero-knowledge. Datalog is a high-level declarative logic language that is generally used for querying. Furthermore, as a logic language, it can also be used to solve logic problems. An application using Circuitree can efficiently generate ZKPs, based on Datalog rules and encrypted data, to prove that a certain conclusion follows from a Datalog ruleset and encrypted input data. Compared to existing frameworks, which generally use their own limited imperative languages, Circuitree uses an existing high-level declarative language. We point out several applications for Circuitree, including EU Digital COVID Certificates and privacy-preserving access control for peer-to-peer (p2p) networks. Circuitree’s performance is evaluated for access control in a p2p network. First results show that our approach allows for fast proofs and proof verification for this application.

Ensuring Privacy Preservation Access Control Mechanism in Cloud based on Identity based Derived Key

Cloud computing is a dominant technology that involves massive amounts of data storage and access via the internet. Because there is a large amount of data stored in data centers, it is critical to implement appropriate access control mechanisms over data stored in a cloud. Today, there are numerous access control mechanisms available to provide confidentiality, privacy, and data origin authentication in a cloud environment. The available access control techniques may have a higher computational overhead and lack security concerns. In this paper, we designed and implemented a privacy-preserving access control in cloud computing using derived key identity-based encryption. The proposed method may reduce computational overhead while generating the key while also increasing the robustness of cryptographic keys. During the key generation pro-cess, the trusted key canter (TKC) is involved. The experimental results show that the proposed method reduces computational overhead and provides an easy way to implement an access control mechanism in a cloud environment.

Security and Privacy of Patient Information in Medical Systems Based on Blockchain Technology

The essence of “blockchain” is a shared database in which information stored is un-falsifiable, traceable, open, and transparent. Therefore, to improve the security of private information in medical systems, this article uses blockchain technology to design a method to protect private information in medical systems and effectively realize anti-theft control of private information. First, the Patient-oriented Privacy Preserving Access Control model is introduced into the access control process of private information in medical systems. Next, a private information storage platform is built by using blockchain technology, and information transmission is realized using standard cryptographic algorithms. In this process, file authorization contracts are also used to guarantee the security of private information and further prevent theft of medical private information. Our simulation results show that the storage response time of this method is kept below 1,000 ms, and the maximum information throughput rate reaches 550 kbit/s, which indicates that this method has strong performance in information storage and transmission efficiency. Moreover, the reliability and bandwidth utilization of data transmission across domains is higher, so the method has higher information security control performance and superior overall performance.

FX Job Recruitment

In this project present a secure and privacy-preserving access control to users, which guarantee any member in a group to anonymously utilize the cloud resource. Moreover, the real identities of data owners can be revealed by the group manager when disputes occur. In this project provide rigorous security analysis, and perform extensive simulations to demonstrate the efficiency of our scheme in terms of storage and computation overhead. Cloud computing provides an economical and efficient solution for sharing group resource among cloud users. Unfortunately, sharing data in a multi-job portal manner while preserving data and identity privacy from an un trusted cloud is still a challenging issue, due to the frequent change of the membership . The major aims of this method a secure multi-owner data sharing scheme. It implies that any user in the group can securely share data with others by the un trusted cloud. This scheme is able to support dynamic groups. Efficiently, specifically, new granted users can directly decrypt data files uploaded before their participation without contacting with data owners. User revocation can be easily achieved through a novel revocation list without updating the secret Keys of the remaining users. The size and computation overhead of encryption are constant and Independent with the number of revoked users. Job portal is developed for creating an interactive job vacancy for candidates. This web application is to be conceived in its current form as a dynamic site-requiring constant updates both from the seekers as well as the companies. On the whole the objective of the project is to enable jobseekers to place their resumes and companies to publish their vacancies.

PAASH: A privacy-preserving authentication and fine-grained access control of outsourced data for secure smart health in smart cities

Very recently, a number of intelligent applications have evolved in smart cities such as smart grid, smart parking, smart waste management, smart manufacturing, smart home, and smart health, making our cities more smarter. In the context of smart health, smart devices are employed to collect and transmit biomedical information to a medical server, allowing medical practitioners to give better and improved healthcare services. However, considering the sensitive nature of the medical data, any illegal access may have devastating effects on the patient's health condition. A lightweight privacy-preserving authentication and fine-grained access control scheme for smart health known as PAASH is proposed. In PAASH, a new ultraefficient certificateless signature scheme with compact aggregation is developed to achieve source authentication and data integrity. To achieve efficient user authorization and data confidentiality, a privacy-preserving access control technique using the developed aggregate signature and ciphertext-policy attribute-based encryption (CP-ABE) is implemented. An analysis of PAASH reveals that it can provide desirable privacy and security measures in smart health. Moreover, the formal security demonstrated in the random oracle model (ROM) shows that PAASH is semantically secure under the intractability of the Discrete Logarithm Problem (DLP). The performance evaluation shows that PAASH is par excellence practically suitable for smart health.

Privacy preservation of electronic health records with adversarial attacks identification in hybrid cloud

An increasing trend in healthcare organizations to outsource EHRs’ data to the cloud highlights new challenges regarding the privacy of given individuals. Healthcare organizations outsource their EHRs data in a hybrid cloud that elevates the problem of security and privacy in terms of EHRs’ access to an unlimited number of recipients in a hybrid cloud environment. In this paper, we investigated the need for a privacy-preserving access control model for the hybrid cloud. A comprehensive and exploratory analysis of privacy-preserving solutions with the help of taxonomy for cloud-based EHRs is described in this work. We have formally identified the existence of internal access control and external privacy disclosures in outsourcing system architecture for hybrid cloud. Then, we proposed a privacy-preserving XACML based access control model (PPX-AC) that supports fine-grained access control with the multipurpose utilization of EHRs alongside state-of-the-art privacy mechanism. Our proposed approach invalidates the identified security and privacy attacks. We have formally verified the proposed privacy-preserving XACML based access control model (PPX-AC) with the invalidation of identified privacy attacks using High-Level Petri Nets (HLPN). Moreover, property verification of the proposed model in SMT-lib and Z3 solver and implementation of the model proves its effectiveness in terms of privacy-aware EHRs access and multipurpose usage.

An Efficient, Accountable, and Privacy-Preserving Access Control Scheme for Internet of Things in a Sharing Economy Environment

The Internet of Things (IoT) has set off a new information technology revolution due to its convenience and efficiency. An IoT enables sharing economy, as more people are willing to share their own things (mostly mobile devices) to leverage the under-used value. In such a situation where owners and users are often not familiar with each other, an efficient access control mechanism is needed to deal with the trust issue and support service accountability to help owners accurately get their deserved profits. Besides, in such a sharing economy environment, the mobility of most shared IoT devices and their privacy preserving should also be taken into account. Regrettably, the existing schemes cannot achieve all of the aforementioned goals simultaneously and only few schemes were implemented to evaluate the claimed performance. In this article, we propose an efficient, accountable, and privacy-preserving access control solution for IoT in a sharing economy environment. In our scheme, we utilize the one-time signature to achieve anonymous authentication and let gateways store the signatures as service credentials for accountability. Meanwhile, we adopt the identity-based authentication to exclude malicious gateways and shared devices from the system and design a specialized protocol for those devices moving with the users. We conduct a detailed security analysis to show that our scheme can effectively defend against potential attacks, and also implement a prototype system to demonstrate that our design is indeed an efficient one.

Privacy-preserving access control for public wireless LAN utilizing the bitcoin blockchain

Privacy-preserving access control for public wireless LAN utilizing the bitcoin blockchain