An Efficient and Fine-Grained Big Data Access Control Scheme With Privacy-Preserving Policy

Efficient and fine-grained access control with fully-hidden policies for cloud-enabled IoT

Data access control is an effective way to ensure the data security in the cloud. Due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Ciphertext-Policy Attribute-based Encryption (CP-ABE) is regarded as one of the most suitable technologies for data access control in cloud storage, because it gives data owners more direct control on access policies. However, it is difficult to directly apply existing CP-ABE schemes to data access control for cloud storage systems because of the attribute revocation problem. In this paper, we design an expressive, efficient and revocable data access control scheme for multi-authority cloud storage systems, where there are multiple authorities co-exist and each authority is able to issue attributes independently. Specifically, we propose a revocable multi-authority CP-ABE scheme, and apply it as the underlying techniques to design the data access control scheme. Our attribute revocation method can efficiently achieve both forward security and backward security. The analysis and simulation results show that our proposed data access control scheme is secure in the random oracle model and is more efficient than previous works.

WSN-integrated cloud computing (WCC) has become a promising cloud service architecture, in which sensors and mobile devices are utilized as the data collecting and processing nodes for the cloud service model, while cloud servers can provide computing services and storage services with high performance and reliability. However, since cloud servers are not fully trusted, and sensors and mobile devices have very limited computing capability and storage capacity, WCC brings forth new challenges for data confidentiality, data integrity and access control when sensors store important data for sharing in the WCC environment. Moreover, there are still no proper solutions for fine-grained, efficient and secure data access control in WCC. To solve this issue, we propose a fine-grained and lightweight data access control scheme for WCC, namely FLAC, which includes a ciphertext-policy attribute-based encryption algorithm for data confidentiality and fine-grained data access control, and an attribute-based signature algorithm for data integrity and the many-read-many-write case of data access. By delegating most computation intensive tasks to cloud services, FLAC enables resource constrained sensors and mobile devices to perform security operations rapidly. The security assessment and performance evaluation demonstrate that FLAC is secure, highly efficient and well suited for WSN applications.

Cloud offers flexible and cost effective storage for big data but the major challenge is access control of big data processing. CP-ABE is a desirable solution for data access control in cloud. However, in CP-ABE the access policy may leak user's private information. To address this issue, Hidden Policy CP-ABE schemes proposed but those schemes still causing data leakage problem because the access policies are partially hidden and create more computational cost. In this paper, we propose a New Hidden Policy Ciphertext Policy Attribute Based Encryption (HP-CP-ABE) to ensure Big Data Access Control with Privacy-preserving Policy in Cloud. In proposed method, we used Multi Secret Sharing Scheme(MSSS) to reduce the computational overhead, while encryption and decryption process. We also applied mask technique on each attribute in access policy and embed the access policy in ciphertext, to protect user's private information from access policy. The security analysis shows that HP-CP-ABE is more secure and preserve the access policy privacy. Performance evaluation shows that our schemes takes less computational cost than existing scheme.

Today a large volume of data is stored in cloud that requires fine grained accessibility for heterogeneous users. Cipher-text policy attribute based encryption (CP-ABE) has evolved into a promising solution for secure data storage with fine grained access control. In CP-ABE, the ciphertext is associated with an access policy (set of rules) and users can access the data if their attributes satisfies the access policy. However, existing CP-ABE schemes fail to perform in presence of large number of users and hierarchical relationships among them. Moreover, a majority of the CP-ABE schemes require large computational overhead for light weight applications. In this paper, we present a hierarchical attribute based cryptosystem by introducing hierarchical dependency between the users and thereby achieving multi-layer verification for fine grained data access. Moreover, our proposed cryptosystem is seamless to user revocation. The efficiency and security of our proposed cryptosystem have been analyzed and reported. Further we implement the proposed cryptosystem in Charm to demonstrate its practicality.

Electronic health record (EHR) stores not only the patient’s health-related data but also the sensitive individual information. Consequently, data security and access privacy are the greatest concern of EHR applications while sharing the data through the cloud. Ciphertext policy attribute-based encryption (CP-ABE) is one of the popular one-to-many encryption schemes, which helps to attain fine-grained access control in cloud domain. In CP-ABE, since the access policy is attached to the ciphertext, anyone with the ciphertext can see the data owner’s policy that may cause privacy leakage. In this paper, we proposed a CP-ABE cryptosystem that supports access policy obfuscation and outsourced decryption enabling efficient and secure operations in cloud environment. Linear secret sharing (LSS) scheme is used for supporting any monotonic access structures, thereby improving the access policy’s expressiveness. We have incorporated prime-order bilinear group and matrix-based LSS scheme that increases the computational efficiency of the cryptosystem. Finally, we have evaluated the performance of our CP-ABE cryptosystem using practical implementation utilizing Charm framework.

Scalable and secure access control policy update for outsourced big data

Designing lightweight security protocols for cloud-based Internet-of-Things (IoT) applications for battery-limited mobile devices, such as smart phones and laptops, is a topic of recent focus. Ciphertext-policy attribute-based encryption (CP-ABE) is a viable solution, particularly for cloud deployment, as an encryptor can “write” the access policy so that only authorized users can decrypt and have access to the data. However, most existing CP-ABE schemes are based on the costly bilinear maps, and require long decryption keys, ciphertexts and incur significant computation costs in the encryption and decryption (e.g. costs is at least linear to the number of attributes involved in the access policy). These design drawbacks prevent the deployment of CP-ABE schemes on battery-limited mobile devices. In this paper, we propose a new RSA-based CP-ABE scheme with constant size secret keys and ciphertexts (CSKC) and has $\mathcal {O}(1)$ time-complexity for each decryption and encryption. Our scheme is then shown to be secure against a chosen-ciphertext adversary, as well as been an efficient solution with the expressive AND gate access structures (in comparison to other related existing schemes). Thus, the proposed scheme is suitable for deployment on battery-limited mobile devices.

In ciphertext-policy attribute-based encryption, there might be different levels of overlapping in the access policies of different data objects outsourced by the same data owner. This paper proposes a soft set decision-making method and cluster percolation method-based policy clustering by using policy similarity for CP-ABE, aiming to merge the duplicated access policy pieces to reduce repeated computations during the encryption process of corresponding data objects. Firstly, the access policies are clustered using either the soft set decision-making or the cluster percolation method. Secondly, the access policies within the same cluster are integrated for further encryption of corresponding data objects as a whole, thereby preventing redundant computations during the encryption process and thus reducing computational overhead. Theoretical analysis and experimental results demonstrate the feasibility and effectiveness of the proposed approach in this paper.

Cipher text-Policy Attribute Based Encryption (CP-ABE) is a promising cryptographic primitive for fine-grained access control of shared data. However, when CP-ABE is used to control outsourced data sharing, it confronts two obstacles. Firstly, the data owner must trust the attributes authority, secondly, the issue of attribute revocation of CP-ABE schemes, which suffers from such problems as different granularities of revocation, poor scalability and high computational complexity, is cumbersome. In this paper, we propose a new CP-ABE scheme that the data owners can fully control their outsourced shared data. We also resolve the issue of revocation including the entire user access privilege and just partial access right of the user, i.e., a subset of his/her attributes. Our proposed solution can achieve minimal overload by integrating CP-ABE with the access control of system. In addition, the data owners and the attributes authority can delegate most of laborious tasks to revocation proxy severs with the technique of proxy re-encryption. Finally, we present the quantitative test and analysis on the performance of our proposed scheme.

For enterprise systems running on public clouds in which the servers are outside the control domain of the enterprise, access control that was traditionally executed by reference monitors deployed on the system servers can no longer be trusted. Hence, a self-contained security scheme is regarded as an effective way for protecting outsourced data. However, building such a scheme that can implement the access control policy of the enterprise has become an important challenge. In this paper, we propose a self-contained data protection mechanism called RBAC-CPABE by integrating role-based access control (RBAC), which is widely employed in enterprise systems, with the ciphertext-policy attribute-based encryption (CP-ABE). First, we present a data-centric RBAC (DC-RBAC) model that supports the specification of fine-grained access policy for each data object to enhance RBAC’s access control capabilities. Then, we fuse DC-RBAC and CP-ABE by expressing DC-RBAC policies with the CP-ABE access tree and encrypt data using CP-ABE. Because CP-ABE enforces both access control and decryption, access authorization can be achieved by the data itself. A security analysis and experimental results indicate that RBAC-CPABE maintains the security and efficiency properties of the CP-ABE scheme on which it is based, but substantially improves the access control capability. Finally, we present an implemented framework for RBAC-CPABE to protect privacy and enforce access control for data stored in the cloud.

We consider the problem of outsourced computation that operates on encrypted inputs supplied by multiple independent parties. To facilitate fine-grained access control, it would be desirable if each party could encrypt her input under an appropriate access policy. Moreover, a party should only be authorized to decrypt the result of a computation performed on a set of encrypted inputs if his credentials satisfy the composition of all input policies. There has been limited success so far achieving homomorphic encryption in the functional setting; that is, for primitives such as Ciphertext-Policy Attribute Based Encryption (CP-ABE) and Identity Based Encryption (IBE). We introduce a new primitive that captures homomorphic encryption with support for access policies and policy composition. We then present a generic construction using CP-ABE and multikey Fully-Homomorphic encryption (FHE). Furthermore, we show that a CP-ABE scheme that is homomorphic for circuits of polylogarithmic depth in some parameter m implies a CP-ABE scheme that is homomorphic for circuits of arity m and unbounded depth.

A secure and efficient access control scheme with attribute revocation and merging capabilities for fog-enabled IoT

Organizations usually rely on stringent access control mechanisms where access policies are an important asset. Their storage or transmission in plaintext can compromise sensitive access rules. It is important in dynamic environments where access decisions are made in real time such as Zero Trust (ZT). Existing ZT approaches were found to oversee the aspect of securing these policies. This investigation presents a Multi-layer Access Policy Encryption System for ZT systems (MAPE-ZT). The first stage uses the trapdoor index to generate a secure index to find the applicable access policies. Advanced Encryption Standard-256 is used in counter mode for the encryption of the policies. They are re-encrypted using the Ciphertext-Policy Attribute-Based Encryption (CP-ABE) to allow decryption based on a matching set of attributes. Various experiments using quantitative metrics, including comparison with baseline access control systems simulation, scalability evaluation, storage overhead, etc., highlight the efficacy of the MAPE-ZT and establish new benchmarks. The result count entropy for the policies ranged 3.84–4.21 for different scales of policies. The evaluation in different scales of systems shows that the MAPE-ZT reduces various observable patterns even if the deployment size grows. Its unique design of securing policies makes this approach scalable for multi-domain integration.

Mobile cloud computing (MCC) is embracing rapid development these days and able to provide data outsourcing and sharing services for cloud users with pervasively smart mobile devices. Although these services bring various conveniences, many security concerns such as illegally access and user privacy leakage are inflicted. Aiming to protect the security of cloud data sharing against unauthorized accesses, many studies have been conducted for fine‐grained access control using ciphertext‐policy attribute‐based encryption (CP‐ABE). However, a practical and secure data sharing scheme that simultaneously supports fine‐grained access control, large university, key escrow free, and privacy protection in MCC with expressive access policy, high efficiency, verifiability, and exculpability on resource‐limited mobile devices has not been fully explored yet. Therefore, we investigate the challenge and propose an Efficient and Multiauthority Large Universe Policy‐Hiding Data Sharing (EMA‐LUPHDS) scheme. In this scheme, we employ fully hidden policy to preserve the user privacy in access policy. To adapt to large scale and distributed MCC environment, we optimize multiauthority CP‐ABE to be compatible with large attribute universe. Meanwhile, for the efficiency purpose, online/offline and verifiable outsourced decryption techniques with exculpability are leveraged in our scheme. In the end, we demonstrate the flexibility and high efficiency of our proposal for data sharing in MCC by extensive performance evaluation.