Traditional Access Control Schemes Research Articles

ZT-Access: A combining zero trust access control with attribute-based encryption scheme against compromised devices in power IoT environments

With the rapid development of information technologies in the power industry, a large number of power devices are connected to the Internet, and thus expand the exposure. Attackers could control some devices with weak security capabilities as compromised devices to penetrate the power Internet of Things (IoT). Traditional access control schemes assume that internal devices are trusted in power IoT environments, thus giving the chance of compromised devices to steal sensitive data. In this paper, we propose a combining zero trust access control and attribute-based encryption scheme against compromised devices in Power IoT environments. In order to protect the privacy information, we hide part of the access policy to ensure that the data owner verifies the attribute set of access entities without knowing the complete access policy structure. Meanwhile, we continuously monitor the network behavior of the access entities, and calculate their trust value in real-time, which can avoid access entities with unauthorised attribute sets and abnormal network behavior to gain access permissions. The security analysis shows that our scheme is resistant to malicious access entities including dishonest users and compromised devices. The simulation results show that our scheme can reduce the time cost and increase the interception rate of malicious access entities.

IoT-CCAC: a blockchain-based consortium capability access control approach for IoT.

Access control is a critical aspect for improving the privacy and security of IoT systems. A consortium is a public or private association or a group of two or more institutes, businesses, and companies that collaborate to achieve common goals or form a resource pool to enable the sharing economy aspect. However, most access control methods are based on centralized solutions, which may lead to problems like data leakage and single-point failure. Blockchain technology has its intrinsic feature of distribution, which can be used to tackle the centralized problem of traditional access control schemes. Nevertheless, blockchain itself comes with certain limitations like the lack of scalability and poor performance. To bridge the gap of these problems, here we present a decentralized capability-based access control architecture designed for IoT consortium networks named IoT-CCAC. A blockchain-based database is utilized in our solution for better performance since it exhibits favorable features of both blockchain and conventional databases. The performance of IoT-CCAC is evaluated to demonstrate the superiority of our proposed architecture. IoT-CCAC is a secure, salable, effective solution that meets the enterprise and business’s needs and adaptable for different IoT interoperability scenarios.

BHE-AC: a blockchain-based high-efficiency access control framework for Internet of Things

In this information age, with the emergence of organizations, the number of various resources on the Internet of Things is also increasing. Generally, different users have different access permissions to different resources and most of the existing schemes have realized access control. But most of them are rough and not feasible in many organizations. Moreover, traditional access control schemes adopted a central entity or a trusted third party to centrally manage users’ permissions and access information, which can easily lead to single point of failure. Therefore, a kind of secure, trusted, and fine-grained access control is urgently needed in some large-scale organizations or institutions that maintain thousands of IoT devices. In order to solve the above problems, in this paper, we propose a blockchain-based high-efficiency access control framework called BHE-AC to achieve secure and efficient access to resources for users. In BHE-AC, a registration model is designed to register users and resources, and it can evaluate the ability value for users according to their attributes which is an essential factor when requesting resources. Besides, we represent a blockchain-based token requesting mechanism to compare the capability values of users with requested resources; meanwhile, the mechanism also allows users to request multiple resources at the same time, which can avoid repeated requests. Then, an unforgeable token indicates the users’ access to a specific resource is granted to a requester only if a requester meets the access requirements; from then on, the user can use a token to invoke the resource. Finally, security analysis and experiments of our framework are given in our paper. The experimental results show that BHE-AC can achieve low cost and efficient access.

SFAC:A Smart Contract-Based Fine-Grained Access Control for Internet of Things

With the development of Internet of things, more and more objects are connected to the Internet. It will lead to data leakage caused by arbitrary access easily. Thus, an effective method to prevent data leakage is needed. Traditional access control schemes include role-based access control (RBAC), attribute-based access control (ABAC), and capability-based access control (CapBAC) are all using a central or a third trusted party to manage user information, which is prone to single failure. In order to solve the problems, in this paper, a fine-grained access control scheme based on blockchain technology named SFAC is proposed. In recent years, blockchain technology has been widely studied and applied in various fields. It has the advantages of decentralization, imitation tampering, and traceability, and is a distributed public ledger. Therefore, combined with blockchain, SFAC can not only solve the problem of centralization, but also allow users to request resources in batches, and uses token mechanism to facilitate users’ requests. After the user gets a token, it can directly use the token to revoke resources. Besides, we use a smart contract to implement our proposed scheme and carrying out a series of experiments on the test network of Ethereum. The experimental results show that our SAFC is feasible.

Risk Reduction Privacy Preserving Approach for Accessing Electronic Health Records

In the healthcare field, preserving privacy of the patient's electronic health records has been an elementary issue. Numerous techniques have been emerged to maintain privacy of the susceptible information. Acting as a first line of defence against illegal access, traditional access control schemes fall short of defending against misbehaviour of the already genuine and authoritative users: a risk that can harbour overwhelming consequences upon probable data release or leak. This paper introduces a novel risk reduction strategy for the healthcare domain so that the risk related with an access request is evaluated against the privacy preferences of the patient who is undergoing for the medical procedure. The proposed strategy decides the set of data objects that can be safely uncovered to the healthcare service provider such that unreasonably repeated tests and measures can be avoided and the privacy preferences of the patient are preserved.

Privacy Preserving Risk Mitigation Approach for Healthcare Domain

In the healthcare domain, protecting the electronic health record (EHR) is crucial for preserving the privacy of the patient. To help protect the sensitive data, access control mechanisms can be utilized to restrict access to only legitimate users. However, an issue arises when the authorized users abuse their access privileges and violate privacy preferences of the patients. While traditional access control schemes fall short of defending against the misbehavior of authorized users, risk-aware access control models can provide adaptable access to the system resources based on assessing the risk of an access request. When an access request is deemed risky, but within acceptable thresholds, risk mitigation strategies can be exploited to minimize the risk calculated. This paper proposes a risk-aware, privacy-preserving risk mitigation approach that can be utilized in the healthcare domain. The risk mitigation approach controls the patient’s medical data that can be exposed to healthcare professionals, according to their trust level as well as the risk incurred of such data exposure, by developing a novel Risk Measure formula. The developed Risk Measure is proven to manage the risk effectively. Furthermore, Risk Mitigation Data Disclosure algorithms, RIMIDI0 and RIMIDI1, which utilize the developed risk measures, are proposed. Experimental results show the feasibility and effectiveness of the proposed method in preserving the privacy preferences of the patient. Since the proposed approach exposes the patient’s data that are relevant to the undergoing medical procedure while preserving the privacy preferences, positive outcomes can be realized, which will ultimately bring forth quality healthcare services.