Enhancing Data Security and Access Control in Cloud Environment using Modified Attribute Based Encryption Mechanism

The rapid adoption of cloud computing has transformed the way data is stored, shared, and accessed across organizationsand individuals. Despite its scalability and cost efficiency, cloud storage introduces serious security and privacy challenges, particularly when sensitive data is outsourced to third-party cloud service providers. Traditional access control mechanisms often rely on the cloud provider’s trustworthiness, which may expose data to unauthorized access, insider threats, and data breaches. To address these concerns, CryptCloud+ is proposed as a secure and expressive data access control framework that enforces fine-grained authorization directly through cryptographic techniques. CryptCloud+ focuses on ensuring data confidentiality while enabling flexible and policy-driven access control over encrypted cloud data. The system leverages encryption-based access control, where data is encrypted before being uploaded to the cloud, and only authorized users possessing valid cryptographic credentials can decrypt and access the data. This approach eliminates the need to trust the cloud service provider, as all sensitive operations related to data access are handled at the client side. A key contribution of CryptCloud+ is its support for expressive access policies, allowing data owners to define complex rules based on user attributes such as roles, departments, access levels, or time constraints. These policies enable fine grained access control without requiring data owners to manage individual permissions manually. The framework ensures that users can access only the data they are authorized for, while unauthorized users, including cloud administrators, are unable to infer any meaningful information from the encrypted data. The proposed system is implemented using Python, taking advantage of its robust cryptographic libraries, simplicity, and integration capabilities. Python-based modules handle key generation, encryption, decryption, and policy enforcement, making the system modular and easy to extend. The implementation demonstrates how secure key management and attribute-based access enforcement can be achieved efficiently in a real-world cloud environment. CryptCloud+ also addresses scalability and performance concerns by minimizing computation overhead during data access. Encryption and decryption operations are optimized to ensure that system performance remains practical even as the number of users and data files increases. Experimental results indicate that the framework maintains strong security guarantees while providing acceptable response times for authorized users. In addition to security, the system enhances usability by allowing seamless data sharing among multiple users without re encrypting data for each individual. This significantly reduces management complexity for data owners while preserving strict access control policies. The system design ensures compatibility with existing cloud storage services, making itadaptable to various deployment scenarios. Overall, CryptCloud+ presents a secure, flexible, and effiient solution for cloud data access control. By combining cryptographic enforcement with expressive policy definition and Python-based implementation, the frameworkstrengthens data security, protects user privacy, and improves trust in cloud storage systems. The proposed model demonstrates the feasibility of practical, cryptography-driven access control for modern cloud environments.

Storing an organization’s database at an external service provider has become extremely common. This popular practice is called as Database Outsourcing, in which, data encryption, crypto key, and access control are very important security issues, especially if the data owner wishes to publish his data for external use. In this paper, implementation & present performance of statistical analysis of approaches for encrypting/decrypting data using FPE, FF1 with less computation and resource time, implementation of access control through selective encryption and providing secure access and sharing services for multi user’s data using key distribution in the client side and access control lists is discussed. The primary goal of this paper is no requirement of re-distribution of keys or re-encryption of data for any administrative actions (updating access rights or adding/deleting users).

In this paper, a variety of cloud service combinations is used to form the control core of a smart home, realize data forwarding, storage, and analysis in the cloud, and complete the remote management of smart home devices. This paper studies the secure access control of smart home data combined with the blockchain technology and password technology to realize the secure and efficient access control of smart home data. The system can achieve the goal of independent research and development. Aiming at the problem that the access control of a smart home is generally managed by third‐party authorized institutions and there is an unauthorized access, a blockchain‐based smart home (BSH) access control scheme is proposed. The scheme extends the attribute‐based access control model (ABAC) and applies the blockchain technology to the smart home ABAC model to realize fine‐grained access control. In the scheme, the resource provider first publishes the access control policy of the resource to the blockchain. If the resource visitor wants to access the resource, he needs to submit an access request to the blockchain and use an SM2 threshold signature to process the transaction proposal. The endorsement peer node in the blockchain runs the access control policy smart contract to decide whether to grant access rights. This scheme can ensure that resource providers can participate in all the processes of access control and avoid the risk of unauthorized access caused by the centralized management of the third party. Finally, the simulation experiment is carried out on the Hyperledger Fabric alliance chain development platform. The results show that the BSH access control scheme has good applicability in the smart home scenario.

Achieving security-by-design through ontology-driven attribute-based access control in cloud environments

Hierarchical attribute-based encryption and scalable user revocation for sharing data in cloud servers

JCDC: A blockchain-based framework for secure data storage and circulation in JointCloud

Protecting personal sensitive data security in the cloud with blockchain

In a Decentralized Identifier (DID), the Holder does not depend on a third party but controls self-identity information and is authenticated by the Verifier. Therefore, the Verifier can request verification data for access control from the Verifiable Data Registry (VDR) and credentials to authenticate the Holder. Data access control should be used when requesting data access such that only authorized Verifiers can access it. Consequently, studies on secure and efficient data access control have been conducted, and among them a scheme using Ciphertext Policy Attribute-based Encryption (CP-ABE) is underway. However, when the CP-ABE scheme is applied to the DID, the Holder’s extended Self-Sovereign Identity (SSI), which proves that the Holder has approved access to the Holder’s data stored in the VDR, is not ensured. Furthermore, the VDR does not verify the Verifier’s data access rights, resulting in unauthorized verification and illegal access to data by the user. And issue infringement of the Holder’s privacy, where Verifiers can infer the Holder by sharing and connecting the same DID-based Verifiable Presentations (VPs) of the Holder. Also, it leads to overheads in the amount of computation and search time for encryption/decryption. Therefore, in this paper, we propose a data access control for secure authentication by solving the security vulnerabilities of CP-ABE and using a CP-ABE-based dual Verifiable Credential (VC) scheme in DID.

Disclosure of sensitive data leads to identity theft and violation of privacy. The untrusted cloud service provider (CSP) may try to disclose/misuse the data. It is necessary to provide access control and security over the outsourced and shared data to hide it from the CSP and unauthorized users. Traditional access control schemes are prone to security threats in the cloud environment. Attribute-based access control schemes (ABAC) are well suited for the cloud environment. Attribute-based encryption (ABE) is a promising cryptographic solution to provide fine-grained access control over the shared data. It selectively shares the data among the users and hides data from the CSP and unauthorized users. It preserves the privacy of users and the security of data being shared. Users can decrypt the data only if their attributes are satisfied with the access policy associated in the ciphertext. This paper presents a comprehensive survey of the ABE schemes. Taxonomy, performance comparison, and applications of ABE schemes are dealt with. The taxonomy and performance comparison help the selection of the most suitable ABE scheme based on specific usage scenarios. Thus, the survey opens up very interesting avenues for further research in this area, which are also discussed.

The Internet of Things (IoT) connects many objects and allows continuous communication and data sharing has emerged as a revolutionary technology. However, expanding IoT devices has raised concerns regarding data security and access control. Traditional access control mechanisms face challenges in managing access rights, particularly in scenarios where multiple users with the same roles try to access several resources which may lead to conflicting roles. Additionally, there is also an overhead of system performance using traditional approaches. In existing studies, the main problem of conflict roles is not addressed or not even identified appropriately. This paper proposes a framework to address these challenges using blockchain technology and role-based access control with a smart contract implementation on the hyperledger fabric framework. The proposed methodology introduces a role management system that resolves conflicts based on predefined rules and user preferences. It employs a consensus mechanism to determine access permissions, ensuring fairness and accountability. The findings demonstrate that applying the suggested framework eliminates conflicting problems, improves system security and also provides better results in response times of twelve seconds on average for thirty-five concurrent user requests. It also provides a secure and transparent access control framework which improves response time and provides security based on roles.

Cloud Service Providers (CSPs) allow data owners to migrate their data to resource-rich and powerful cloud servers and provide access to this data by individual users. Some of this data may be highly sensitive and important and CSPs cannot always be trusted to provide secure access. It is also important for end users to protect their identities against malicious authorities and providers, when they access services and data. Attribute-Based Encryption (ABE) is an end-to-end public key encryption mechanism, which provides secure and reliable fine-grained access control over encrypted data using defined policies and constraints. Since, in ABE, users are identified by their attributes and not by their identities, collecting and analyzing attributes may reveal their identities and violate their anonymity. Towards this end, we define a new anonymity model in the context of ABE. We analyze several existing anonymous ABE schemes and identify their vulnerabilities in user authorization and user anonymity protection. Subsequently, we propose a Privacy-Preserving Access Control Scheme (PACS), which supports multi-authority, anonymizes user identity, and is immune against users collusion attacks, authorities collusion attacks and chosen plaintext attacks. We also propose an extension of PACS, called Statistical Privacy-Preserving Access Control Scheme (SPACS), which supports statistical anonymity even if malicious authorities and providers statistically analyze the attributes. Lastly, we show that the efficiency of our scheme is comparable to other existing schemes. Our analysis show that SPACS can successfully protect against Collision Attacks and Chosen Plaintext Attacks.

With the improvements in mobile healthcare em-boldened by the ubiquity of mobile devices, personal health records are increasingly being outsourced to remote servers to enjoy customer-centric health services. Multi-authority ciphertext-policy attribute-based encryption has been proposed and adopted mainly in recent years, thanks to its flexibility, to guarantee data security, privacy, and fine-grained access control over distant cloud data. However, its practicality still faces three main drawbacks: key escrow, high encryption, and decryption costs, and finally, improper implementation of user and attribute revocations. We introduce in this paper a revocable outsourcing multi-authority attribute-based access control for medical data in the mobile cloud. The advantages of our construction are multifold. First, the expensive encryption operation is outsourced to a semi-honest cloud storage server and is verifiable. Second, the costly decryption operation in current schemes exhibits lower computation in our work and is partially outsourced to the cloud. Third, user and attribute revocations are performed by the semi-trusted cloud storage server, therefore, saving resources on end computing devices. Fourth, our scheme is secure and verifiable under the decisional bilinear Diffie-Hellman assumption.

One enhanced secure access scheme for outsourced data

Efficient decentralized multi-authority attribute based encryption for mobile cloud data storage

Cloud Service Providers supply services to clients in terms of their demands. They need to be constantly under monitoring for their services with respect to consensus agreements between clients and service providers. A Third Party Auditor or TPA as a trusted organization appears to be necessary to monitor executing agreements of cloud services. Using a third party as an extra component creates cost overheads for clients in a cloud environment. Thus, introducing a cost efficient framework for a cloud environment which includes a third party is an eminent achievement to make a TPA feasible and practical in cloud environments. In this paper, we propose a TPA framework for monitoring service level agreements between cloud service providers and cloud clients using several cloud resources. This framework employs different types of service deployments from various cloud service providers excluding the cloud service provider which is being monitored. Then, we demonstrate that the framework can mitigate costs of a third party auditor in a cloud environment. Simulations of trends for costs exhibits cost efficiency of at least forty percent over ten years when a TPA follows our proposed framework in comparison to other frameworks. Finally, we provide an analysis to compare characteristics of our framework with other frameworks and discuss the advantages of our proposed framework. Our results indicate that TPA as a component of the framework not only reduces overall costs of its presentation in a cloud environment but additionally improves management efficiency and security.