Data Access Control for Secure Authentication Using Dual VC Scheme Based on CP-ABE in DID

PurposeThe purpose of this paper Computing is a recent emerging cloud model that affords clients limitless facilities, lowers the rate of customer storing and computation and progresses the ease of use, leading to a surge in the number of enterprises and individuals storing data in the cloud. Cloud services are used by various organizations (education, medical and commercial) to store their data. In the health-care industry, for example, patient medical data is outsourced to a cloud server. Instead of relying onmedical service providers, clients can access theirmedical data over the cloud.Design/methodology/approachThis section explains the proposed cloud-based health-care system for secure data storage and access control called hash-based ciphertext policy attribute-based encryption with signature (hCP-ABES). It provides access control with finer granularity, security, authentication and user confidentiality of medical data. It enhances ciphertext-policy attribute-based encryption (CP-ABE) with hashing, encryption and signature. The proposed architecture includes protection mechanisms to guarantee that health-care and medical information can be securely exchanged between health systems via the cloud. Figure 2 depicts the proposed work's architectural design.FindingsFor health-care-related applications, safe contact with common documents hosted on a cloud server is becoming increasingly important. However, there are numerous constraints to designing an effective and safe data access method, including cloud server performance, a high number of data users and various security requirements. This work adds hashing and signature to the classic CP-ABE technique. It protects the confidentiality of health-care data while also allowing for fine-grained access control. According to an analysis of security needs, this work fulfills the privacy and integrity of health information using federated learning.Originality/valueThe Internet of Things (IoT) technology and smart diagnostic implants have enhanced health-care systems by allowing for remote access and screening of patients’ health issues at any time and from any location. Medical IoT devices monitor patients’ health status and combine this information into medical records, which are then transferred to the cloud and viewed by health providers for decision-making. However, when it comes to information transfer, the security and secrecy of electronic health records become a major concern. This work offers effective data storage and access control for a smart healthcare system to protect confidentiality. CP-ABE ensures data confidentiality and also allows control on data access at a finer level. Furthermore, it allows owners to set up a dynamic patients health data sharing policy under the cloud layer. hCP-ABES proposed fine-grained data access, security, authentication and user privacy of medical data. This paper enhances CP-ABE with hashing, encryption and signature. The proposed method has been evaluated, and the results signify that the proposed hCP-ABES is feasible compared to other access control schemes using federated learning.

WSN-integrated cloud computing (WCC) has become a promising cloud service architecture, in which sensors and mobile devices are utilized as the data collecting and processing nodes for the cloud service model, while cloud servers can provide computing services and storage services with high performance and reliability. However, since cloud servers are not fully trusted, and sensors and mobile devices have very limited computing capability and storage capacity, WCC brings forth new challenges for data confidentiality, data integrity and access control when sensors store important data for sharing in the WCC environment. Moreover, there are still no proper solutions for fine-grained, efficient and secure data access control in WCC. To solve this issue, we propose a fine-grained and lightweight data access control scheme for WCC, namely FLAC, which includes a ciphertext-policy attribute-based encryption algorithm for data confidentiality and fine-grained data access control, and an attribute-based signature algorithm for data integrity and the many-read-many-write case of data access. By delegating most computation intensive tasks to cloud services, FLAC enables resource constrained sensors and mobile devices to perform security operations rapidly. The security assessment and performance evaluation demonstrate that FLAC is secure, highly efficient and well suited for WSN applications.

Secure cloud storage, which is an emerging cloud service, is designed to protect the confidentiality of outsourced data but also to provide flexible data access for cloud users whose data is out of physical control. Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is regarded as one of the most promising techniques that may be leveraged to secure the guarantee of the service. However, the use of CP-ABE may yield an inevitable security breach which is known as the misuse of access credential (i.e., decryption rights), due to the intrinsic “all-or-nothing” decryption feature of CP-ABE. In this paper, we investigate the two main cases of access credential misuse: one is on the semi-trusted authority side, and the other is on the side of cloud user. To mitigate the misuse, we propose the first accountable authority and revocable CP-ABE based cloud storage system with white-box traceability and auditing, referred to as CryptCloud±. We also present the security analysis and further demonstrate the utility of our system via experiments.

The rapid adoption of cloud computing has transformed the way data is stored, shared, and accessed across organizationsand individuals. Despite its scalability and cost efficiency, cloud storage introduces serious security and privacy challenges, particularly when sensitive data is outsourced to third-party cloud service providers. Traditional access control mechanisms often rely on the cloud provider’s trustworthiness, which may expose data to unauthorized access, insider threats, and data breaches. To address these concerns, CryptCloud+ is proposed as a secure and expressive data access control framework that enforces fine-grained authorization directly through cryptographic techniques. CryptCloud+ focuses on ensuring data confidentiality while enabling flexible and policy-driven access control over encrypted cloud data. The system leverages encryption-based access control, where data is encrypted before being uploaded to the cloud, and only authorized users possessing valid cryptographic credentials can decrypt and access the data. This approach eliminates the need to trust the cloud service provider, as all sensitive operations related to data access are handled at the client side. A key contribution of CryptCloud+ is its support for expressive access policies, allowing data owners to define complex rules based on user attributes such as roles, departments, access levels, or time constraints. These policies enable fine grained access control without requiring data owners to manage individual permissions manually. The framework ensures that users can access only the data they are authorized for, while unauthorized users, including cloud administrators, are unable to infer any meaningful information from the encrypted data. The proposed system is implemented using Python, taking advantage of its robust cryptographic libraries, simplicity, and integration capabilities. Python-based modules handle key generation, encryption, decryption, and policy enforcement, making the system modular and easy to extend. The implementation demonstrates how secure key management and attribute-based access enforcement can be achieved efficiently in a real-world cloud environment. CryptCloud+ also addresses scalability and performance concerns by minimizing computation overhead during data access. Encryption and decryption operations are optimized to ensure that system performance remains practical even as the number of users and data files increases. Experimental results indicate that the framework maintains strong security guarantees while providing acceptable response times for authorized users. In addition to security, the system enhances usability by allowing seamless data sharing among multiple users without re encrypting data for each individual. This significantly reduces management complexity for data owners while preserving strict access control policies. The system design ensures compatibility with existing cloud storage services, making itadaptable to various deployment scenarios. Overall, CryptCloud+ presents a secure, flexible, and effiient solution for cloud data access control. By combining cryptographic enforcement with expressive policy definition and Python-based implementation, the frameworkstrengthens data security, protects user privacy, and improves trust in cloud storage systems. The proposed model demonstrates the feasibility of practical, cryptography-driven access control for modern cloud environments.

Implementing a trust and secure immunity or vaccine passport verification system is now crucial for many countries. The system typically aims to enable the secure access control and verification of vaccination records which will be used by trusted parties. However, the issues related to the system scalability in supporting a large number of data access requests, the enforcement of the user consent for data sharing, and the flexibility in delegating the access capability to trusted parties have not been resolved by existing works. In this paper, we propose a Universal Vaccine Passport Verification System (UniVAC) to support a decentralized, scalable, secure, and fine-grained, access control for Covid-19 vaccine passport data sharing and verification. At a core of our scheme, we employ the ciphertext policy attribute-based encryption (CP-ABE) to support secure and fine-grained access control and use the blockchain to record access transactions and provide data indexing. Furthermore, we propose a ciphertext retrieval method based on regional blockchain segmentation and introduce the outsourced CP-ABE decryption as a part of the proxy re-encryption (PRE) process to enable scalable and secure ciphertext delivery of the encrypted vaccine passport under the requestor’s public key. Finally, we conducted the extensive experiments in real cloud environment and the results showed that our proposed scheme is more efficient and scalable than related works.

Today a large volume of data is stored in cloud that requires fine grained accessibility for heterogeneous users. Cipher-text policy attribute based encryption (CP-ABE) has evolved into a promising solution for secure data storage with fine grained access control. In CP-ABE, the ciphertext is associated with an access policy (set of rules) and users can access the data if their attributes satisfies the access policy. However, existing CP-ABE schemes fail to perform in presence of large number of users and hierarchical relationships among them. Moreover, a majority of the CP-ABE schemes require large computational overhead for light weight applications. In this paper, we present a hierarchical attribute based cryptosystem by introducing hierarchical dependency between the users and thereby achieving multi-layer verification for fine grained data access. Moreover, our proposed cryptosystem is seamless to user revocation. The efficiency and security of our proposed cryptosystem have been analyzed and reported. Further we implement the proposed cryptosystem in Charm to demonstrate its practicality.

Fog computing is a paradigm that extends cloud computing to the edge of the network. It can provide computation and storage services to end devices in Internet of Things (IoT). Attribute-based cryptography is a well-known technology to guarantee data confidentiality and fine-grained data access control. However, its computational cost in encryption and decryption phase is linear with the complexity of policy. In this paper, we propose a secure and fine-grained data access control scheme with ciphertext update and computation outsourcing in fog computing for IoT. The sensitive data of data owner are first encrypted using attribute-based encryption with multiple policies and then outsourced to cloud storage. Hence, the user whose attributes satisfy the access policy can decrypt the ciphertext. Based on the attribute-based signature technique, authorized user whose attributes integrated in the signature satisfy the update policy can renew the ciphertext. Specifically, most of the encryption, decryption, and signing computations are outsourced from end devices to fog nodes, and thus, the computations for data owners to encrypt, end users to decrypt, re-encrypt, and sign are irrelevant to the number of attributes in the policies. The security analysis shows that the proposed scheme is secure against known attacks, and the experimental results show that the fog nodes perform most of the computation operations of encryption, decryption, and signing, and hence, the time of encryption for data owner, decryption, re-encryption, and signing for users is small and constant.

Cipher text-Policy Attribute Based Encryption (CP-ABE) is a promising cryptographic primitive for fine-grained access control of shared data. However, when CP-ABE is used to control outsourced data sharing, it confronts two obstacles. Firstly, the data owner must trust the attributes authority, secondly, the issue of attribute revocation of CP-ABE schemes, which suffers from such problems as different granularities of revocation, poor scalability and high computational complexity, is cumbersome. In this paper, we propose a new CP-ABE scheme that the data owners can fully control their outsourced shared data. We also resolve the issue of revocation including the entire user access privilege and just partial access right of the user, i.e., a subset of his/her attributes. Our proposed solution can achieve minimal overload by integrating CP-ABE with the access control of system. In addition, the data owners and the attributes authority can delegate most of laborious tasks to revocation proxy severs with the technique of proxy re-encryption. Finally, we present the quantitative test and analysis on the performance of our proposed scheme.

Data access control is an effective way to ensure the data security in the cloud. Due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Ciphertext-Policy Attribute-based Encryption (CP-ABE) is regarded as one of the most suitable technologies for data access control in cloud storage, because it gives data owners more direct control on access policies. However, it is difficult to directly apply existing CP-ABE schemes to data access control for cloud storage systems because of the attribute revocation problem. In this paper, we design an expressive, efficient and revocable data access control scheme for multi-authority cloud storage systems, where there are multiple authorities co-exist and each authority is able to issue attributes independently. Specifically, we propose a revocable multi-authority CP-ABE scheme, and apply it as the underlying techniques to design the data access control scheme. Our attribute revocation method can efficiently achieve both forward security and backward security. The analysis and simulation results show that our proposed data access control scheme is secure in the random oracle model and is more efficient than previous works.

Lattice-based Attribute-based encryption is a well-known cryptographic mechanism that can resist quantum attacks and has the ability of fine-grained access control, and it has a wide range of application scenarios in current Internet of Thing (IoT) era. However, lack of efficiency and existing the problem of large ciphertext expansion rate are the main disadvantages impede the applications of this mechanism. Thus, we propose an efficient and practical ciphertext policy attribute-based encryption (CP-ABE) scheme from lattices in the paper. In this scheme, to make the secret key reusable, we adjust access tree and propose a basic access tree structure, which can be converted from disjunctive normal form, and combine it with a light post-quantum scheme of Kyber. In addition, the compression method and plaintext expansion method are introduced to optimize the scheme. Our CP-ABE scheme is secure against chosen plaintext attack under the hardness of module learning with errors problem. We implement our scheme and compare it with three recent related schemes in terms of security, function and communication cost. Experiments and comparisons show that our CP-ABE scheme has advantages in high encryption efficiency, small matrix dimension, small key sizes, and low ciphertext expansion rate, which has some merit in practice.

Nowadays, many organizations are adopting cloud computing for storing the large amount of organization’s important and private data. Here, it becomes important to mange appropriate access rights to these data as it is stored outside the organization’s boundary and is handled by the third party service providers. The Ciphertext Policy Attribute-based Encryption (CPABE) scheme is the most widely utilized technique that offers encrypted access control. In the existing implementations of CPABE scheme, one of the significant issues that need to be addressed is an efficient revocation mechanism. In this paper a direct and immediate user revocation approach for CPABE scheme is presented. The proposed method offers direct user revocation by maintaining the revocation list and to keep revocation list smaller the validity time is embedded in the user’s secret key. The revoked users are still able to access the previously generated ciphertexts. Hence, ciphertext update process is incorporated and a separate immediate revocation list is maintained so that the revoked users’ access is restricted. Also, in the proposed system the revocation information is embedded in ciphertext as a separate part so the update process of ciphertext is more efficient.KeywordsAttributesRevocationABECPABERevocation listValidity periodCloudAccess structure

In this paper, a variety of cloud service combinations is used to form the control core of a smart home, realize data forwarding, storage, and analysis in the cloud, and complete the remote management of smart home devices. This paper studies the secure access control of smart home data combined with the blockchain technology and password technology to realize the secure and efficient access control of smart home data. The system can achieve the goal of independent research and development. Aiming at the problem that the access control of a smart home is generally managed by third‐party authorized institutions and there is an unauthorized access, a blockchain‐based smart home (BSH) access control scheme is proposed. The scheme extends the attribute‐based access control model (ABAC) and applies the blockchain technology to the smart home ABAC model to realize fine‐grained access control. In the scheme, the resource provider first publishes the access control policy of the resource to the blockchain. If the resource visitor wants to access the resource, he needs to submit an access request to the blockchain and use an SM2 threshold signature to process the transaction proposal. The endorsement peer node in the blockchain runs the access control policy smart contract to decide whether to grant access rights. This scheme can ensure that resource providers can participate in all the processes of access control and avoid the risk of unauthorized access caused by the centralized management of the third party. Finally, the simulation experiment is carried out on the Hyperledger Fabric alliance chain development platform. The results show that the BSH access control scheme has good applicability in the smart home scenario.

Under the assumption of honest-but-curious cloud service provider, various cryptographic techniques have been used to address the issues of data access control and confidentiality in public cloud storage. Among which, attribute-based encryption (ABE) has been shown to be an attractive scheme. Although the technique of ABE brings in various benefits, its onerous overhead should not be ignored. In this article, based on an improved LSSS (linear secret sharing scheme) matrix expression integrated in CP-ABE (Ciphertext-Policy Attribute-Based Encryption) algorithm, we present an efficient and secure attribute-based access control scheme for the scenarios where multiple data are shared and encrypted with frequently used sub-policies. In the scheme, a user can store the parameters about a specific sub-policy in his/her first decryption, which can be reused in the subsequent data decryptions whose embedded access policies include the same sub-policy so as to significantly reduce the computation cost. Our proposed scheme is proved to be semantically secure under chosen plaintext attacks and can well preserve the confidentiality of the data sharing system. Our analysis and experimentation also show that our scheme does significantly reduce the decryption time and while trades in only very little storage overhead, and thus effectively promotes the efficiency.

As a key bridge between the real economy and financial capital, supply chain finance generates core data such as transaction documents, logistics information, and financing contracts, whose secure, trustworthy, and controllable management is crucial.Traditional centralized notarization schemes suffer from single points of failure, risks of data tampering, and high trust costs.Although blockchain offers tamper-evident notarization, limited on-chain storage and throughput constrain its direct use in large-scale data scenarios.To address this tension, this paper investigates a secure data notarization and access control algorithm grounded in an on-chain/off-chain hybrid storage architecture and smart contracts.We first construct a layered data management model: high-value, low-volume data hashes (digital fingerprints) and key access-control policies are anchored on-chain to ensure immutability, while complete large-volume raw data are encrypted and stored off-chain (e.g., in IPFS or distributed databases) to ensure scalability.To tackle potential challenges of on-/off-chain consistency and integrity verification under this hybrid architecture, we design an efficient verification mechanism based on cryptographic commitments, ensuring any tampering with off-chain data can be detected quickly and succinctly.Furthermore, to achieve fine-grained privacy protection and compliant use, we propose a smart-contract-based dynamic access control algorithm.By deploying access-control policies as executable code on-chain, the algorithm performs automated logical checks to deliver precise authorization and comprehensive audit logging, ensuring security and transparency throughout data sharing and circulation.Through theoretical security analysis and prototype experiments, the proposed scheme preserves data immutability and traceability while significantly improving the storage efficiency and processing performance of supply chain finance notarization systems, and it enables flexible and secure access control.The results indicate that the coordinated mechanism of on-chain/off-chain hybrid storage and smart contracts offers a feasible technical pathway for building efficient, trustworthy, and secure supply chain finance infrastructure.

Mobile edge computing (MEC) technology is widely used for real‐time and bandwidth‐intensive services, but its underlying heterogeneous architecture may lead to a variety of security and privacy issues. Blockchain provides novel solutions for data security and privacy protection in MEC. However, the scalability of traditional blockchain is difficult to meet the requirements of real‐time data processing, and the consensus mechanism is not suitable for resource‐constrained devices. Moreover, the access control of MEC data needs to be further improved. Given the above problems, a data privacy protection model based on sharding blockchain and access control is designed in this paper. First, a privacy‐preserving platform based on a sharding blockchain is designed. Reputation calculation and improved Proof‐of‐Work (PoW) consensus mechanism are proposed to accommodate resource‐constrained edge devices. The incentive mechanism with rewards and punishments is designed to constrain node behavior. A reward allocation algorithm is proposed to encourage nodes to actively contribute to obtaining more rewards. Second, an access control strategy using ciphertext policy attribute‐based encryption (CP‐ABE) and RSA is designed. A smart contract is deployed to implement the automatic access control function. The InterPlanetary File System is introduced to alleviate the blockchain storage burden. Finally, we analyze the security of the proposed privacy protection model and statistics of the GAS consumed by the access control policy. The experimental results show that the proposed data privacy protection model achieves fine‐grained control of access rights, and has higher throughput and security than traditional blockchain.