Secure Access Control Mechanism Research Articles

A Block Chain-Based Access Control Framework with Privacy Protection in Cloud

Access control is a pivotal aspect of modern computing systems, ensuring that only authorized entities can interact with sensitive data and resources. Traditional access control methods, while effective, face challenges in terms of security, transparency, and scalability. Blockchain technology has emerged as a promising solution to enhance access control in cloud computing environments. Blockchain's inherent features, such as decentralization, immutability, and cryptographic security, offer a unique framework for addressing the limitations of traditional access control systems. In this paper, we explore the integration of blockchain technology with cloud computing to establish a more secure and transparent access control mechanism. By utilizing blockchain, access control policies and permissions can be stored in a tamper-proof and transparent ledger. Scalability is an issue since processing many access control transactions on the blockchain might cause network congestion and sluggish processing. Transactions take time to upload to the blockchain, which can delay real-time access choices. It takes skill to integrate and manage blockchain and cloud technologies together. Choosing the correct consensus mechanism affects system efficiency and security. Consider the costs of establishing and maintaining such a system and the difficulty of fixing faults owing to blockchain immutability. In conclusion, this paper underscores the significance of access control in cloud computing and the limitations of traditional approaches. By harnessing the power of blockchain technology, a more secure, transparent, and scalable access control framework can be established, revolutionizing the way we manage access to sensitive data and resources in complex digital ecosystems.

PT-SSIM: A Proactive, Trustworthy Self-Sovereign Identity Management System

Digital Identity Management (DIM) systems have become challenging, especially given the current progression in ubiquitous environments enclosing cooperative Internet of Things (IoT) devices, individuals, and organizations. Self-Sovereign Identity (SSI) has recently surfaced to manifest the notion of decentralized DIMs enlivened by users autonomy. This paper presents a proactive, trustworthy solution for managing digital users data and identity information without risking its integrity, security, privacy, and confidentiality. Accordingly, we propose a decentralized SSI-enabled cloud storage model that enables secure access control and frequent data integrity checking mechanism. The presented model ensures the resiliency of SSI-enabled operations, including users registration, data identification, external information distribution, integrity checking operations, identity information authentication and verification, and decentralized external and shareable operations.

A dynamic group key agreement scheme for UAV networks based on blockchain

In mobile ad hoc networks (MANETs), group communication is an important communication mode, and group key agreement technology is the key to ensure the security of group communication. Due to the influence of node movement, topology change and network congestion in MANETs, the traditional group key agreement technology has many security and performance problems, such as node authentication, access control, data integrity, topology maintenance, routing protocol and so on. Therefore, we propose a certificateless dynamic group key protocol scheme based on blockchain, which can be used for cluster communication in unmanned aerial vehicle (UAV). In our scheme, blockchain technology is used to realize the agreement of group keys, which protects privacy and ensures the transparency of the agreement process. All nodes can verify the generation process of the group key through the information recorded in the blockchain. Meanwhile, the consensus algorithm of blockchain can ensure that the process of generating group keys is fair and there is no interference from malicious nodes. In addition, we propose a certificateless authentication protocol, which solves the problems of key escrow and batch authentication in traditional group key agreement technology. We have made formal security analysis and performance analysis, and the results show that this scheme is more secure and efficient than the existing certificateless group key protocol. This scheme can solve the problems existing in traditional group key agreement technology, such as key leakage and centralized management, and realize secure access control and key agreement mechanism. Therefore, this scheme is a safe and efficient solution, which can be effectively applied to the communication security of UAV network.

IAM-BDSS: A Secure Ciphertext-Policy and Identity- Attribute Management Data Sharing Scheme Based on Blockchain

Abstract: This paper presents a Ciphertext-policy attribute-based encryption (CP-ABE) is widely recognized as a secure access control mechanism for data sharing. However, the generation of secret keys (SK) in most CP-ABE schemes relies on a centralized authority (CA), which can result in high costs for establishing trust and pose a single point of failure. To address these challenges and leverage the characteristics of blockchain technology, several blockchain-based schemes have been proposed to prevent data disclosure and protect user privacy attributes. In this paper, we propose IAM-BDSS, a novel CP-ABE identity-attribute management data sharing scheme based on blockchain, aimed at ensuring privacy through hidden policies and attributes. Additionally, we introduce a transaction structure to ensure the traceability of parameter transmission within the blockchain system. Through experimental results and security analysis, we demonstrate the effectiveness and feasibility of IAMBDSS.

Cloud Storage Systems with Secure Attribute-Based Access Control

This research presents a novel approach to safe access procedure in cloud storage structure by addressing the challenges associated with managing and distributing complex secret keys. The proposed procedure utilizes attribute-based access control and incorporates a client process, an authentication terminal process, and a storage terminal process. The client generates a main secret key and public parameters for each user using an attribute password mechanism. The authentication terminal maintains user attribute, file attribute, and attribute secret key databases. Access control is determined by constructing an access control string from the attributes of the user, file, and file operation type, enabling fine-grained access control and accommodating large-scale user dynamic expansion. Consequently, the access control costs of the cloud storage structure are significantly reduced, while offering a flexible, effective, and secure access control mechanism for safe storage structure access.

An Authentication and Access Control Model for Healthcare based Cloud Services

Electronic Health Record (EHR) systems are used as an efficient and effective method of exchanging patients’ health information with doctors and other key stakeholders in the health sector to obtain improved patient treatment decisions and diagnoses. As a result, questions regarding the security of sensitive user data are highlighted. To encourage people to move their sensitive health records to cloud networks, a secure authentication and access control mechanism that protects users’ data should be established. Furthermore, authentication and access control schemes are essential in the protection of health data, as numerous responsibilities exist to ensure security and privacy in a network. So, the main goal of our suggested solution is to maintain a secure authentication and access control mechanism for health cloud data. Thus, in this work, Security Secret Key Provider (SSKP) phase is proposed for the E-healthcare-based cloud that consists of two parts. The first is an authentication scheme that is Security Secret Key (SSK) and the second is a modular access control mechanism. We explain the methodology of the proposed approach through appropriate evaluation results, which improves system security and performance by minimizing the time spent to get authentication and access the data. Simulation results indicate that our approach is significantly more effective than existing research.

Privacy-Aware Access Control in IoT-Enabled Healthcare: A Federated Deep Learning Approach

The traditional healthcare is overwhelmed by the processing and storage of massive medical data. The emergence and gradual maturation of Internet-of-Things (IoT) technologies bring the traditional healthcare an excellent opportunity to evolve into the IoT-enabled healthcare of massive data storage and extraordinary data processing capability. However, in IoT-enabled healthcare, sensitive medical data are subject to both privacy leakage and data tampering caused by unauthorized users. In this article, an attribute-based secure access control mechanism, coined (SACM), is proposed for IoT-Health utilizing the federated deep learning (FDL). Specifically, we manage to discover the relationship between users’ social attributes and their trusts, which is the trustworthiness of users rely on their social influences. By applying graph convolutional networks to the social graph with the susceptible–infected–recovered model-based loss function, users’ influences are obtained and then are transformed to their trusts. For each occupation, users’ trusts allow them to access specific medical data only if their trusts are higher than the corresponding threshold. Then, the FDL is applied to obtain the optimal threshold and relevant access control parameters for the improvement of access control accuracy and the enhancement of privacy preservation. The experimental results show that the proposed SACM achieves accurate access control in IoT-enabled healthcare with high data integrity and low privacy leakage.

Improved Data Security in Cloud Environment for Test Automation Framework and Access Control for Industry 4.0

In analyzing project regressions, automation has emerged as a major agenda in managing changes in software which requires minimum manual intervention. For rapid testing environment, software development processes such as Agile, Scrum, and XP processes depend on continuous integration tools. There is no single tool to handle the project automation, and the main challenge is dependency on multiple tools. The proposed automation tool should support configuration, execution, and debugging facility. Integrating the project automation works such as software configuration management tools Mercurial and Git, job scheduling tools like Jenkins and Apache Continuum, test management tools like TestNG and Selenium need tight integration which is a challenge. The existing PKI infrastructure for access control does not share data among the software tools and processes increasing the complexity when an organization needs to leverage the existing cloud services. The proposed approach optimizes the execution time by taking single CSV with input test case and metadata information and efficiently group and executes the tests automatically. The proposed method includes implementation of security access control mechanism for the jobs execution platform in cloud environment.

Secure Multifactor Authentication and Access Control Mechanism for Electronic Bill Service in a 5G Cloud-Fog Hybrid Architecture

The electronic bill service was greatly encouraged by electronic commerce and paperless bills. However, the massive authentication and authorization access requests from users in the electronic bill services cannot be efficiently processed by a conventional client/server-based scheme during the 5G era. This paper proposes a secure multifactor authentication and access control scheme tailored for electronic bill service in a 5G cloud-fog hybrid architecture. The proposed scheme can realize many security properties, including mutual authentication, privacy protection, batch authentication, authorization and revocation of authority, and resistance to multiple protocol attacks. Moreover, the scheme has the desired performance compared to similar schemes. Finally, we used BAN logic and Scyther to analyze and verify the proposed protocol, and the result shows that the proposed scheme is stable and can achieve the previous security goals.

Lightweight and Expressive Fine-Grained Access Control for Healthcare Internet-of-Things

Healthcare Internet-of-Things (IoT) is an emerging paradigm that enables embedded devices to monitor patients vital signals and allows these data to be aggregated and outsourced to the cloud. The cloud enables authorized users to store and share data to enjoy on-demand services. Nevertheless, it also causes many security concerns because of the untrusted network environment, dishonest cloud service providers and resource-limited devices. To preserve patients’ privacy, existing solutions usually apply cryptographic tools to offer access controls. However, fine-grained access control among authorized users is still a challenge, especially for lightweight and resource-limited end-devices. In this paper, we propose a novel healthcare IoT system fusing advantages of attribute-based encryption, cloud and edge computing, which provides an efficient, flexible, secure fine-grained access control mechanism with data verification in healthcare IoT network without any secure channel and enables data users to enjoy the lightweight decryption. We also define the formal security models and present security proofs for our proposed scheme. The extensive comparison and experimental simulation demonstrate that our scheme has better performance than existing solutions.

Authentication and Key Management in Distributed IoT Using Blockchain Technology

The exponential growth in the number of connected devices as well as the data produced from these devices call for a secure and efficient access control mechanism that can ensure the privacy of both users and data. Most of the conventional key management mechanisms depend upon a trusted third party like a registration center or key generation center for the generation and management of keys. Trusting a third party has its own ramifications and results in a centralized architecture; therefore, this article addresses these issues by designing a Blockchain-based distributed IoT architecture that uses hash chains for secure key management. The proposed architecture exploits the key characteristics of the Blockchain technology, such as openness, immutability, traceability, and fault tolerance, to ensure data privacy in IoT scenarios and, thus, provides a secure environment for communication. This article also proposes a scheme for secure and efficient key generation and management for mutual authentication between communication entities. The proposed scheme uses a one-way hash chain technique to provide a set of public and private key pairs to the IoT devices that allow the key pairs to verify themselves at any time. Experimental analysis confirms the superior performance of the proposed scheme to the conventional mechanisms.

An access control model based on matrix domain security label

The large complex organization that needs to strictly implement the ‘Need to Know’ secure principle should establish a multi-level security information identification and access control mechanism. In this paper, it proposes that a large-scale complex organization is a matrix structure; hence, a matrix security label that conforms to the characteristics of the matrix domain shall be established. On the basis of RBAC and MLS Model, this paper supplements the definitions of security label and necessary constraints, and thus forms an improved access control model.

Secure and practical access control mechanism for WSN with node privacy

An access control mechanism plays a critical role in new node deployment within a resource-constrained Wireless Sensor Networks. The deployment of a new node is inevitable either due to the outage of power or nodes getting compromised due to the adversary’s attacks. The access control scheme prevents malicious node deployment and also allows a new node to establish a shared key with its neighbors for secure communication. Besides having low communication and computational overheads, an access control mechanism must suffice to specific security and functional requirements for their practical implementations. In this paper, a provable and practical access control scheme based on Elliptical Curve Cryptography (ECC) has been presented. The proposed access control scheme supports node privacy while addressing all other major functional and security requirements. The formal validation of the proposed scheme has been carried out using automated validation of internet security protocols and applications (AVISPA) and Scyther tools. A comparative study of the proposed scheme with the existing schemes has been carried out on various security and functional requirements suggesting a better trade-off. Finally, practical experimentation on TinyOS and MICAz motes has been carried out to provide detailed energy analysis and test-bed implementation of the proposed scheme.

BCON: Blockchain based access CONtrol across multiple conflict of interest domains

In today's on-demand computing and virtual coalition environment, cross-domain services are acquired and provided. These business domains may belong to either the same or different conflict of interest system. “Transitive access” can cause leakage of information between competitors through some other conflict of interest system's member. Therefore, a secure access control mechanism is required to detect and deny “transitive access” efficiently with minimal trust in externalist. Existing access control mechanisms focused on either single or multiple conflict of interest domains but with no “transitive access”. In addition, these existing mechanisms are centralized with inherited unfair access control and are a single point of failure. Blockchain (BC) is a shared digital ledger encompassing a list of connected blocks stored on a decentralized distributed network that is secured through cryptography. We propose a BC based access control for conflict of interest domains. We have integrated a BC in our architecture to make access control fair, verifiable and decentralized. Users access histories and “transitive accesses” are stored on BC ledger. We propose a novel mechanism called “Transitive Access Checking and Enforcement (TACE)” i.e., “Algorithm.1”. It makes an authorization decision based on BC endorsement that “transitive access” will not occur. “Algorithm.2” verifies and updates users access histories stored at BC before each request approval. Similarly, “Algorithm.3” detects possible future “transitive accesses” and updates Transitive Access Set (TAS) stored at BC after each request approval. The Simple Promela Interpreter (SPIN) model checker is used to verify the proposed mechanisms for “transitive access” detection and prevention. We have identified four conflicting sequences of execution that can cause “transitive access”. Results show that the proposed mechanism is safe against “transitive access” by checking all the four possible conflicting sequences of execution.

Design and analysis of an optimal ECC algorithm with effective access control mechanism for big data

Big data is a high volume data, as it comprises complex and large volume of information. A successful solution is to redistribute the data to a cloud server that has the capacity of storing and processing big data in an effective manner. The main intention of the research is to secure storage of big data and effective access control mechanism. The main stages of the proposed method are map reduce framework, secure storage process and access control mechanism process. Map Reduce is a distributed programming framework used to process big data. In mapper, the input dataset is grouped using hybrid kernel fuzzy c means (HKFCM) clustering algorithm. Finally, the reduced output is fed to the data owner for secure storage. In secure storage process, the suggested method utilizes optimal elliptic curve cryptography (OECC). Here the fundamental values are optimally selected by Modified grasshopper optimization algorithm (MGOA). In the access control mechanism, the effective policy update is proposed along with data storage construction and data deconstruction stage. The routine of the recommended method is assessed using memory and execution time by differentiating the number data size, number cluster size and the number of mapper. The proposed method attains the minimum time and memory utilization when compared to the existing method. The suggested method is implemented in cloud sim with Hadoop Map-reduce framework.

Adaptively Secure Anonymous Identity-based Broadcast Encryption for Data Access Control in Cloud Storage Service

Cloud computing is now a widespread and economical option when data owners need to outsource or share their data. Designing secure and efficient data access control mechanism is one of the most challenging issues in cloud storage service. Anonymous broadcast encryption is a promising solution for its advantages in the respects of computation cost and communication overload. We bring forward an efficient anonymous identity-based broadcast encryption construction combined its application to the data access control mechanism in cloud storage service. The lengths for public parameters, user private key and ciphertext in the proposed scheme are all constant. Compared with the existing schemes, in terms of encrypting and decrypting computation cost, the construction of our scheme is more efficient. Furthermore, the proposed scheme is proved to achieve adaptive security against chosen-ciphertext attack adversaries in the standard model. Therefore, the proposed scheme is feasible for the system of data access control in cloud storage service.

A secure billing protocol over attribute-based encryption in vehicular cloud computing

The integration of cloud computing into vehicular ad hoc networks (VANETs) has allowed the possibility of offering multiple services to the vehicle owners ranging from safety to entertainment services. The ubiquitousness of cloud computing involves a multitude of service providers; thus, an efficient and secure access control mechanism is required. However, rigorous security features need to be addressed for such commercial-based services to be fully adopted. In this paper, we present a secure billing protocol over attribute-based encryption in vehicular cloud computing. We achieve the identity privacy of the vehicles and their requested services through pseudonym techniques. Certificateless signature scheme is used to assure the authentication of legitimate vehicles which can enjoy the provided services. We use attribute-based encryption to guarantee access control based on the purchased services. We make use of hash chain technique to provide authorization through electronic voucher (credits) which a vehicle has to possess in order to purchase a service. Unlike existing protocols in VANETS, the proposed protocol is not built on expensive bilinear pairing operations. We provide the efficiency of the proposed protocol through performance analysis and simulation.

Achieving Secure and Efficient Data Access Control for Cloud-Integrated Body Sensor Networks

Body sensor network has emerged as one of the most promising technologies for e-healthcare, which makes remote health monitoring and treatment to patients possible. With the support of mobile cloud computing, large number of health-related data collected from various body sensor networks can be managed efficiently. However, how to keep data security and data privacy in cloud-integrated body sensor network (C-BSN) is an important and challenging issue since the patients’ health-related data are quite sensitive. In this paper, we present a novel secure access control mechanism MC-ABE (Mask-Certificate Attribute-Based Encryption) for cloud-integrated body sensor networks. A specific signature is designed to mask the plaintext, and then the masked data can be securely outsourced to cloud severs. An authorization certificate composed of the signature and related privilege items is constructed which is used to grant privileges to data receivers. To ensure security, a unique value is chosen to mask the certificate for each data receiver. Thus, the certificate is unique for each user and user revocation can be easily completed by removing the mask value. The analysis shows that proposed scheme can meet the security requirement of C-BSN, and it also has less computation cost and storage cost compared with other popular models.

Secure, Efficient and Fine-Grained Data Access Control Mechanism for P2P Storage Cloud

By combining cloud computing and Peer-to-Peer computing, a P2P storage cloud can be formed to offer highly available storage services, lowering the economic cost by exploiting the storage space of participating users. However, since cloud severs and users are usually outside the trusted domain of data owners, P2P storage cloud brings forth new challenges for data security and access control when data owners store sensitive data for sharing in the trusted domain. Moreover, there are no mechanisms for access control in P2P storage cloud. To address this issue, we design a ciphertext-policy attribute-based encryption (ABE) scheme and a proxy re-encryption scheme. Based on them, we further propose a secure, efficient and fine-grained data Access Control mechanism for P2P storage Cloud named ACPC. We enforce access policies based on user attributes, and integrate P2P reputation system in ACPC. ACPC enables data owners to delegate most of the laborious user revocation tasks to cloud servers and reputable system peers. Our security analysis demonstrates that ACPC is provably secure. The performance evaluation shows that ACPC is highly efficient under practical settings, and it significantly reduces the computation overheads brought to data owners and cloud servers during user revocation, compared with other state-of-the-art revocable ABE schemes.

Trust-based Access Control Model in Multi-domain Environment

Access control is a process which control users to execute some operations of access some network resource according to the users identify of attribution. This paper analyzes current access control model, and extends the RBAC (role based access control) model, and based on which we propose a trust based access control model in Multi-domain environment (MDTRBAC). Design a heap-based trust management mechanism for MD-TRBAC Model, which is used to control the cross-domain access resource among different domains. The MDTRBAC model can provide more security, flexible and dynamic access control mechanism, and therefore improve both the security and the reliable of authorization mechanism.