Trust Access Control Research Articles

A Dynamic Sandbox Detection Technique in a Private Cloud Environment

In specific private cloud scenarios, how to defend against malicious software and ensure data security is one of the current research hotspots, and sandbox is an important detection method. This paper proposes a dynamic behavior detection technique based on sandboxing, which real-time monitors and analyzes malicious software behavior. By improving the sandbox behavior weight, integrating virtual resources, and designing fine-grained access control, the detection accuracy and efficiency are enhanced based on zero trust access control system. The simulated attacks are identified on the testing platform, drawing knowledge graphs, achieving effective discovery and tracing. Meanwhile, this paper verified through experiments that the system consumption of the detection method is within an acceptable range, expanding the detection range and reducing the missed detection rate.

Trusted access control mechanism for data with blockchain-assisted attribute encryption

In the growing demand for data sharing, how to realize fine-grained trusted access control of shared data and protect data security has become a difficult problem. Ciphertext policy attribute-based encryption (CP-ABE) model is widely used in cloud data sharing scenarios, but there are problems such as privacy leakage of access policy, irrevocability of user or attribute, key escrow, and trust bottleneck. Therefore, we propose a blockchain-assisted CP-ABE (B-CP-ABE) mechanism for trusted data access control. Firstly, we construct a data trusted access control architecture based on the B-CP-ABE, which realizes the automated execution of access policies through smart contracts and guarantees the trusted access process through blockchain. Then, we define the B-CP-ABE scheme, which has the functions of policy partial hidden, attribute revocation, and anti-key escrow. The B-CP-ABE scheme utilizes Bloom filter to hide the mapping relationship of sensitive attributes in the access structure, realizes flexible revocation and recovery of users and attributes by re-encryption algorithm, and solves the key escrow problem by joint authorization of data owners and attribute authority. Finally, we demonstrate the usability of the B-CP-ABE scheme by performing security analysis and performance analysis.

An Efficient Secure Sharing of Electronic Health Records Using IoT-Based Hyperledger Blockchain

Electronic Health Record (EHR) systems are a valuable and effective tool for exchanging medical information about patients between hospitals and other significant healthcare sector stakeholders in order to improve patient diagnosis and treatment around the world. Nevertheless, the majority of the hospital infrastructures that are now in place lack the proper security, trusted access control, and management of privacy and confidentiality concerns that the current EHR systems are supposed to provide. Goal. For various EHR systems, this research proposes a Blockchain-enabled Hyperledger Fabric Architecture as a solution to this delicate issue. The three steps of the suggested system are the secure upload phase, the secure download phase, and authentication. Patient registration, login, and verification make up the authentication step. The administrator grants authorization to read, edit, delete, or revoke the files following user details verification. In the secure upload phase, feature extraction is carried out first, and then a hashed access policy is created from the extracted feature. Next, the hash value is stored in an IoT-based Hyperledger blockchain. The uploaded EHR files are additionally encrypted before being stored on the cloud server. In the secure download step, the physician uses a hashed access policy to send the request to the cloud and decrypts the corresponding files. The experimental findings demonstrate that the system outperformed cutting-edge techniques. The proposed Modified Key Policy Attribute-Based Encryption performs better for the remaining 10 to 25 mb file sizes. This IoT framework compares MKP-ABE with certain efficiency indicators, such as encryption, decryption period, protection level analysis and encrypted memory use, resource use on decryption, upload time, and transfer time, which are present in the KP-ABE, the ECC, RSA, and AES. Here, the IoT device suggested requires 4008 ms for data encryption and 4138 ms for the data decryption.

Secure Routing Strategy Based on Attribute-Based Trust Access Control in Social-Aware Networks

Secure Routing Strategy Based on Attribute-Based Trust Access Control in Social-Aware Networks

Web-Biometrics for User Authenticity Verification in Zero Trust Access Control

Web-Biometrics for User Authenticity Verification in Zero Trust Access Control

An electronic medical record access control model based on intuitionistic fuzzy trust

Electronic Medical Records (EMR), as the core data of medical big data, has improved the efficiency of medical services in the process of sharing and use, but a series of data privacy leakage problems have emerged. Access control technology can ensure users' legitimate and appropriate access to data resources, but traditional access control has many limitations such as static and coarse-grained, which is difficult to meet in the dynamic and complex healthcare environment. We create a model to solve the privacy leakage problem of healthcare big data. The model utilizes the Latent Delicacy Allocation (LDA) topic model to quickly search documents and extract the topic probability distributions between the target patient and other patients' electronic medical records, which improves the efficiency of medical record document analysis; Calculating physician access similarity, we quantify physician access behavior to more accurately describe physician access behavior in the form of data. We combined the intuitionistic fuzzy theory with the trust evaluation method to create a novel trust evaluation method-- Intuitionistic Fuzzy Trust Evaluation Method, which can reflect the uncertainty characteristics that exist in the physician's diagnostic and treatment process when quantifying the trust of the access by using this method, and it is more flexible and practical, which enhances the accuracy of the quantification of the trust. Improving the traditional trust aggregation method by adding a time window and time decay function, the optimized method improves the accuracy of trust aggregation, and the experimental results are more in line with the actual law. We created a new intuitionistic fuzzy trust access control model using a relative entropy-based intuitionistic fuzzy clustering algorithm and a reward and punishment mechanism to achieve adaptive and dynamic access control for physician access behavior. Experiments show that the access control model based on intuitionistic fuzzy trust proposed in this article achieves 95% correctness in identifying user access behaviors and 94.29% correctness in identifying excessive user access behaviors. Experiments have proved that this model has obvious advantages over other models in the process of privacy protection of electronic medical record systems and has certain control effects.

Attribute and User Trust Score-Based Zero Trust Access Control Model in IoV

The Internet of Vehicles (IoV) is an innovative area of interest in modern mobility that is rapidly evolving while facing complex challenges. Traditional IoV networks are susceptible to intrusion threats, which can lead to data leakage and seizure of vehicle control by attackers, thereby endangering vehicle users’ privacy and personal safety. An Attribute and User Trust Score-based Zero Trust Access Control Model (AU-ZTAC) is proposed, combining the zero-trust and attribute-based access control models to meet network protection requirements while achieving fine-grained dynamic access control and incorporating trust evaluation in the access control process to better reflect users’ intent. Experimental results demonstrate the effectiveness and feasibility of trust assessment through the proposed model. A comparison with the classical schemes illustrates that AU-ZTAC allows for more flexible and fine-grained access control in complex access control environments while improving IoV security.

Adjusting counting-based secret-sharing via personalized passwords and email-authentic reliability

Counting-based secret-sharing (CBSS) is a current cybersecurity technique that provide applicable authentication for multi-participants collaborative trust access control utilization. The CBSS originally assigns its main confidential target key as secret random automatically selected to generate all participants private shares fulfilling trap-door function. CBSS is normally not allowing to entertain user preference in personalizing the passwords causing severe remembrance reliability difficulty. This research addressed this retention personalized challenge by adjusting the CBSS procedure commencing its process by user password selection choice, as for secret shares extraction to generate the target-key, securing the cybersecurity collaborative system. We proposed several algorithms for user-preference secret shares combination based on text and images alternatives, further verified by personal email convenience authentication. The proposals tested this adjusted CBSS reliability comparing overall security, systems number of shares possibilities, and variations functional time complexity as well as PSNR comparing to others for proper validation, noting its novel relevance attraction. The analysis remarked very interesting contribution comparison commented highest randomization secrecy of 95% for proposed model A passwords followed by 39%, 21%, 19% and 5%, for other different images-based passwords models B, C, D, and E, respectively. The work remarked attractive contribution compared to other works providing applicable CBSS real-life current utilization, opening door for promising progressive advancements to come.

Concept of Joint Functioning of Access Control Systems

Modern integrated information and telecommunication systems are upgraded on a continuous basis. Such systems contain both new and old components. The approaches to developing individual components of access control systems are different in the majority of cases. As a rule, modernization of outdated but efficient systems that have been operating without any failures for long periods of time is economically unfeasible. Such an approach requires that different subsystems function based on shared data. This necessitates the coordination of various access control systems in order to ensure proper information security levels. This article examines how joint functioning of various versions of access control systems deployed in IT and telecommunication spheres may be achieved at the stage of their modernization. Potential ways in which information flows may bypass the security policies of one of the access control systems concerned are determined. The authors discuss traditional access control models. For role-based and thematic access control models, specific hypotheses are formulated to comply with security policies when different versions of access control systems work together. The structure of the model assuming that different versions of access control systems operate jointly has been developed. Based on the model, the necessary and sufficient conditions are determined under which unauthorized information flows are prevented. The security theorem for the joint functioning of different versions of access control systems is presented and proved. The results of the study showed that the methodological basis for coordinating access control models applicable to information and telecommunication systems undergoing modernization consists in observing, separately, the equality of information flows between shared objects in each of the versions of the access control systems. The approaches developed in this article can be extended to combined access control systems.

ZT-Access: A combining zero trust access control with attribute-based encryption scheme against compromised devices in power IoT environments

With the rapid development of information technologies in the power industry, a large number of power devices are connected to the Internet, and thus expand the exposure. Attackers could control some devices with weak security capabilities as compromised devices to penetrate the power Internet of Things (IoT). Traditional access control schemes assume that internal devices are trusted in power IoT environments, thus giving the chance of compromised devices to steal sensitive data. In this paper, we propose a combining zero trust access control and attribute-based encryption scheme against compromised devices in Power IoT environments. In order to protect the privacy information, we hide part of the access policy to ensure that the data owner verifies the attribute set of access entities without knowing the complete access policy structure. Meanwhile, we continuously monitor the network behavior of the access entities, and calculate their trust value in real-time, which can avoid access entities with unauthorised attribute sets and abnormal network behavior to gain access permissions. The security analysis shows that our scheme is resistant to malicious access entities including dishonest users and compromised devices. The simulation results show that our scheme can reduce the time cost and increase the interception rate of malicious access entities.

Blockchain-based dynamic trust access control game mechanism

The blockchain-based access control mechanism (BACM) is gradually becoming an essential paradigm for solving dynamic and trusted access control problems in the open network environment. However, since the current open network environment has such features as dynamic variability and the uncertainty of user identity, most of the existing BACM cannot solve the access control problems in the current open network environment in a dynamic, flexible, proactive, efficient, and fine-grained approach. In this paper, we propose a novel BACM scheme to address such problems. Specifically, we first design a new, proactive, and fine-grained access control model, by utilizing the dynamicity and fine-grain of the attribute-based access control model, flexibility shown by the trust evaluation mechanism in evaluating the trust level of users, and proactivity shown by the game evaluation mechanism in curbing malicious users who suddenly launch malicious access requests. Second, based on the above access control model, we propose a dynamic, flexible, and proactive BACM for the current open network environment, exploiting the trustworthiness and transparency that the smart contract and the transaction mechanism in blockchain technology show during program execution. Further, a double sliding storage window is built, guaranteeing accurate data acquisition by BACM while efficiently allowing it to acquire time-sensitive data during the permission management process. Meanwhile, a pre-authorization concept is introduced to improve the efficiency and flexibility of BACM in processing access control problems. Security analysis demonstrates that our proposed BACM scheme satisfies the simple security issue and the simple availability issue. Experiments on a real user trust record dataset demonstrate the high effectiveness of the proposed BACM scheme in evaluating and deciding on access requests and the superiorities over most existing schemes in dynamicity, fine granularity, flexibility, and proactivity.

Dynamic Trust Continuous Evaluation-based Zero-Trust Access Control for Power Grid Cloud Service

The development of power grid cloud service puts forward higher requirements for remote secure access. To realize fine-grained access control of remote secure access of power grid cloud service, this paper proposes a zero-trust access control model for power grid cloud service based on dynamic trust continuous evaluation. The experimental results show that the model proposed in this paper can effectively implement continuous trust evaluation for remote access of PowerCloud services, and achieve zero trust access control, with an exception detection accuracy rate of 97.2% and the incremental learning accuracy rate of over 97% when the behavior model of remote access changes.

Joint Content and Radio Access for the Internet of Things: A Smart-Contract-Based Trusted Framework

Access control plays a fundamental role in securing the Internet of Things (IoT) systems. Recently, blockchain-enabled secure and trusted access control has attracted remarkable attention since it alleviates the centralization concern in traditional frameworks. However, existing designs only deal with access request validation problems whereas overlooks content delivery issues. Considering that radio resources are increasingly stretched with the rapid growth of IoT devices in the 5G era, this may give rise to unacceptably high latencies of legal requests in peak hours. This article addresses this limitation by presenting JCRA, a Joint Content and Radio Access control framework for IoT applications. JCRA deploys access point contracts (APCs) and device contracts (DCs) to manage radio access points (APs) and IoT devices, respectively. The atom access contract (AAC) is responsible for conducting access control according to access policies in DCs as well as radio resource states in APCs. To enable flexible radio resource management that often involves solving optimization models in AAC, we introduce a task offloading scheme, which recruits specialized executor nodes to complete the computation-heavy part off-chain. A Proof-of-Solution-Quality rule is proposed for executor solution validation which ensures the off-chain calculation is trusted. We implement a prototype of JCRA to demonstrate its feasibility. The costs and performance of JCRA are also evaluated in detail.

Zero trust access authorization and control of network boundary based on cloud sea big data fuzzy clustering

With the digital transformation of enterprises, the traditional security defense technology has been unable to meet the security requirements of enterprises, and the data security and privacy protection have brought great challenges to the Internet. Therefore, taking zero trust as the security concept and taking the network boundary as the best practice landing technology architecture, this paper studies the zero trust access authorization and control of network boundary based on cloud big data fuzzy clustering of. Through the network stealth technology, it constructs a virtual boundary for the enterprise, uses the cloud big data fuzzy clustering algorithm to mine the user behavior related data, and designs the trust evaluation mechanism to obtain the user trust level. The dynamic access authorization control mechanism is designed to judge the access requests in and out of the permission boundary. Combined with the user’s trust level, the legal requests and illegal requests are distinguished to complete the zero trust access authorization and control of network boundary. Experimental results show that: the method can accurately control the access authorization of the network boundary, improve the success rate of access authorization and control interaction; the interception rate of illegal access is high, and it has high securit.

A blockchain-based secure storage scheme for medical information

Medical data involves a large amount of personal information and is highly privacy sensitive. In the age of big data, the increasing informatization of healthcare makes it vital that medical information is stored securely and accurately. However, current medical information is subject to the risk of privacy leakage and difficult to share. To address these issues, this paper proposes a healthcare information security storage solution based on hyperledger fabric and the attribute-based access control framework. The scheme first utilizes attribute-based access control, which allows dynamic and fine-grained access to medical information, and then stores the medical information in the blockchain, which can be secured and tamper-proof by formulating corresponding smart contracts. In addition, this solution also incorporates IPFS technology to relieve the storage pressure of the blockchain. Experiments show that the proposed scheme combining access control of attributes and blockchain technology in this paper can not only ensure the secure storage and integrity of medical information but also has a high throughput when accessing medical information

DAG blockchain-based lightweight authentication and authorization scheme for IoT devices

As the extension and expansion of the Internet, the Internet of things (IoT) connects things with the network through information sensing equipment to achieve intelligent identification, positioning, monitoring, management and other functions. With the increasing number of IoT users and devices, the demands for secure communication and data confidentiality are getting higher and higher, and the identity authentication and access control of IoT devices has become a huge challenge. In the IoT environment, the traditional device identity and access management methods based on public key infrastructure (PKI) and blockchain bring the problems of single point failure and scalability. The emergence of decentralized storage system and distributed ledger technology directed acyclic graph (DAG) provide new ideas to solve these problems. In the paper, we use distributed ledger technology IOTA with low energy demand to design a lightweight and scalable mechanism to manage the identity of IoT devices and access control of large-scale IoT data, so as to ensure source reliability and sharing security of IoT data. In the new scheme, IOTA technology is used to realize the functions of registration, update, revocation and retrieval of the identity of IoT devices, which solves the defects caused by centralized management. Inter planetary file system (IPFS) is used to store a large amount of data generated by devices in the IoT, which not only reduces the burden on devices and systems of IoT, but also solves the single point of failure, delay and other problems caused by traditional cloud storage. At the same time, the fog node is used to provide localized computing for a group of IoT devices to solve the problem of limited computing resources of IoT devices. In addition, in order to prevent data abuse caused by unauthorized devices accessing network resources, a trusted access control mechanism is designed to achieve fine-grained access control, access policy update and other functions, so as to better maintain the IoT environment and network security. Finally, the performance of the proposed scheme is evaluated through simulation experiments, and the security and functions of the scheme are analyzed, which proves that the scheme meets the security demands of the IoT environment.

A medical big data access control model based on fuzzy trust prediction and regression analysis

One of the important issues facing HIS (Hospital Information System) in the context of big data is how to ensure that massive data and resources are protected from internal attacks and reduce the abuse of medical information. However, the existing single-value quantitative access control model based on trust or risk may not well reflect the true trust or risk situation because it cannot describe the timeliness and trend of the quantitative value. In response to this problem, we propose an access control model based on the credibility of the requesting user. Quantify the trust based on the user’s historical visit records on the HIS, and introduce the user’s historical behavior trend into the trust evaluation model through the corresponding regression analysis model. Comparative experiments show that in predicting linear, geometric, exponential, and mixed trends, the regression model in this paper is better than existing methods in predicting trust accuracy and predicting trust trends. Different from the working system of trusted access control model proposed in the existing literature, the model in this paper adds “Behavior warning module (BWM)”. The working mode that “User-visit, Early-warning, Trust-evaluation, Access-control” is very effective in reducing information leakage caused by visitors with non-profit purposes (such as curiosity) and purposeless (such as habitual browsing). And this also has a positive effect on improving the overall behavior level of users in the system.

Research on Distributed Dynamic Trusted Access Control Based on Security Subsystem

The flow of data across nodes has become the dominant feature of data sharing in distributed environments with increasingly blurred boundaries, where it is crucial to maintain data access dynamic, trusted, and efficient. However, traditional centralized access control models are not only difficult to apply in distributed environments but also ignore trusted verification of authorized entities. What’s worse, existing access control models rarely consider themselves security, lack independence, at a high risk of being bypassed or tampered with. Thus, we propose in this paper a distributed, dynamic, and trusted access control model, DDTAC-BSS, where the standard Attribute-Based Access Control (ABAC) architecture is modified and extended. To reduce the attack surface, we separate policy enforcement point (PEP) from other core components, they are located in the node system and access control system, respectively. Then, the access control entry point (ACEP) is added as the only interface for the node system to interact with the access control system. Subsequently, the model introduces the entity trusted assessment mechanism to improve the trustworthiness of access control services. Driven by the dynamic attributes, our model can achieve dynamic trusted authorization and fine-grained access control. Moreover, we implement a lightweight, independent, and distributed security subsystem to achieve unified management of policies and decision-making autonomy by message-driven. By considering the independence of the security subsystem, a trusted operating environment is built based on Trusted Execution Environment (TEE) to ensure the security of the access control mechanism itself. The security of our model is proved rigorously based on the non-interference theory. Comprehensive experiments and comparisons have demonstrated the superior functionality, comparable performance, and strong security of our model.

Zt-Access: A Combining Zero Trust Access Control with Attribute-Based Encryption Scheme Against Compromised Devices in Power Iot Environments

Zt-Access: A Combining Zero Trust Access Control with Attribute-Based Encryption Scheme Against Compromised Devices in Power Iot Environments

Ensuring information security by building combined access control and management systems

Ensuring information security by building combined access control and management systems