Exploiting Hierarchical Identity-Based Encryption for Access Control to Pervasive Computing Information

Ensuring authorized access control in the IoT is vital for privacy and safety protection. Our study presents the novel IHIBE framework, which combines IOTA (a distributed ledger technology) with hierarchical identity-based encryption (HIBE), thereby enhancing both IoT security and scalability. This approach secures access tokens and policies while reducing the computational demand on data owners. Our empirical findings reveal a significant performance gap, with access rights delegation on the Raspberry Pi 4 exceeding those on AWS by over 250%. Moreover, our analysis uncovers optimal identity policy depths: up to 640 identities on AWS and 640 on the Raspberry Pi 4 for systems with higher tolerable delays, and 320 identities on AWS versus 160 on the Raspberry Pi 4 for systems with lower tolerable delays. The system shows practical viability, exhibiting insignificant operational time differences compared to Zhang et al.’s schemes, particularly in access rights verification processes, with a minimal difference of 33.35%. Our extensive security assessment, encompassing scenarios like encrypted token theft and compromise of authority, affirms the efficacy of our challenge-response and last-word challenge (LWC) mechanisms. This study underscores the importance of platform choice in IoT system architectures and provides insights for deploying efficient, secure, and scalable IoT environments.

Hierarchical attribute-based encryption and scalable user revocation for sharing data in cloud servers

In this paper, a variety of cloud service combinations is used to form the control core of a smart home, realize data forwarding, storage, and analysis in the cloud, and complete the remote management of smart home devices. This paper studies the secure access control of smart home data combined with the blockchain technology and password technology to realize the secure and efficient access control of smart home data. The system can achieve the goal of independent research and development. Aiming at the problem that the access control of a smart home is generally managed by third‐party authorized institutions and there is an unauthorized access, a blockchain‐based smart home (BSH) access control scheme is proposed. The scheme extends the attribute‐based access control model (ABAC) and applies the blockchain technology to the smart home ABAC model to realize fine‐grained access control. In the scheme, the resource provider first publishes the access control policy of the resource to the blockchain. If the resource visitor wants to access the resource, he needs to submit an access request to the blockchain and use an SM2 threshold signature to process the transaction proposal. The endorsement peer node in the blockchain runs the access control policy smart contract to decide whether to grant access rights. This scheme can ensure that resource providers can participate in all the processes of access control and avoid the risk of unauthorized access caused by the centralized management of the third party. Finally, the simulation experiment is carried out on the Hyperledger Fabric alliance chain development platform. The results show that the BSH access control scheme has good applicability in the smart home scenario.

An access control system is a collection of rules used to restrict the visibility, access, and usage of the data resources in an institutional environment. When implemented, these rules provide a policy for achieving the security of the institution, establishing a hierarchy of the employees depending on their rights over the institution’s data resouces. An access control system is based on two fundamental concepts: authentication (that verifyies the user's identity) and authorization (that provides a hierarchy of the employees according to their access rights over the institutional resources). Among the most commonly used access control models we recall Role-Based Access Control (RBAC), in which users with the same role have equal access rights to data resources, Discretionary Access Control (DAC), in which the system owner decides which user has access to system resources, and Mandatory Access Control (MAC), in which a series of rules, with a high level of security established by a predefined authority, are used. In this article, we will study the last two models, namely DAC and MAC, along with their main implementations: Access Control Matrix and the Take-Grant models for DAC, BIBA and Bell-LaPadula for MAC.

There are several security problems arising from the characteristics of IoT, and one of them is weak access control. Traditional access control models require one centralized authority that stores all the information for access control and validates access rights. This single point of failure in IoT access control could lead to situations where a single breach can cause sensitive information leakage across the entire system. Various studies have been conducted to mitigate this security risk by introducing a decentralized architecture based on blockchain technology called BBAC. However, most BBAC models consider only a simple access control situation, which can lead to a “the Greatest privilege problem”. This study proposes a novel access control model that enforces minimum privilege to an access token by the division and modification of access rights. As a result, we contributed to enhancing the practicality of the BBAC and mitigating risks that may arise in the delegation process.

The Internet of things (IoT) is an active, real-world area in need of more investigation. One of the top weaknesses in security challenges that IoTs face, the centralized access control server, which can be a single point of failure. In this paper, Dynamic-IoTrust, a decentralized access control smart contract based aims to overcome distrusted, dynamic, trust and authentication issues for access control in IoT. It also integrates dynamic trust value to evaluate users based on behavior. In particular, the Dynamic-IoTrust contains multiple Main Smart Contract, one Register Contract, and one Judging Contract to achieve efficient distributed access control management. Dynamic-IoTrust provides both static access rights by allowing predefined access control policies and also provides dynamic access rights by checking the trust value and the behavior of the user. The system also provides to detected user misbehavior and make a decision for user trust value and penalty. There are several levels of trusted users to access the IoTs device. Finally, the case study demonstrates the feasibility of the Dynamic-IoTrust model to offer a dynamic decentralized access control system with trust value attribute to evaluate the internal user used IoTs devices.

An access control scheme based on Chinese remainder theorem and time stamp concept

We explore the problem of portable and flexible privacy preserving access rights that permit access to a large collection of digital goods. Privacy-preserving access control means that the service provider can neither learn what access rights a customer has nor link a request to access an item to a particular customer, thus maintaining privacy of both customer activity and customer access rights. Flexible access rights allow a customer to choose a subset of items or groups of items from the repository, obtain access to and be charged only for the items selected. And portability of access rights means that the rights themselves can be stored on small devices of limited storage space and computational capabilities such as smartcards or sensors, and therefore the rights must be enforced using the limited resources available. In this paper, we present and compare two schemes that address the problem of such access rights. We show that much can be achieved if one allows for even a negligible amount of false positives – items that were not requested by the customer, but inadvertently were included in the customer access right representation due to constrained space resources. But minimizing false positives is one of many other desiderata that include protection against sharing of false positives information by unscrupulous users, providing the users with transaction untraceability and unlinkability, and forward compatibility of the scheme. Our first scheme does not place any constraints on the amount of space available on the limited-capacity storage device, and searches for the best representation that meets the requirements. The second scheme, on the other hand, has (modest) requirements on the storage space available, but guarantees a low rate of false positives: with O(mc) storage space available on the smartcard (where m is the number of items or groups of items included in the subscription and c is a selectable parameter), it achieves a rate of false positives of m −c .

Mobile edge computing (MEC) technology is widely used for real‐time and bandwidth‐intensive services, but its underlying heterogeneous architecture may lead to a variety of security and privacy issues. Blockchain provides novel solutions for data security and privacy protection in MEC. However, the scalability of traditional blockchain is difficult to meet the requirements of real‐time data processing, and the consensus mechanism is not suitable for resource‐constrained devices. Moreover, the access control of MEC data needs to be further improved. Given the above problems, a data privacy protection model based on sharding blockchain and access control is designed in this paper. First, a privacy‐preserving platform based on a sharding blockchain is designed. Reputation calculation and improved Proof‐of‐Work (PoW) consensus mechanism are proposed to accommodate resource‐constrained edge devices. The incentive mechanism with rewards and punishments is designed to constrain node behavior. A reward allocation algorithm is proposed to encourage nodes to actively contribute to obtaining more rewards. Second, an access control strategy using ciphertext policy attribute‐based encryption (CP‐ABE) and RSA is designed. A smart contract is deployed to implement the automatic access control function. The InterPlanetary File System is introduced to alleviate the blockchain storage burden. Finally, we analyze the security of the proposed privacy protection model and statistics of the GAS consumed by the access control policy. The experimental results show that the proposed data privacy protection model achieves fine‐grained control of access rights, and has higher throughput and security than traditional blockchain.

The American National Standards Institute (ANSI) has standardized an access control approach, Next Generation Access Control (NGAC), that enables simultaneous instantiation of multiple access control policies. For large complex enterprises this is critical to limiting the authorized access of insiders. However, the specifications describe the required access control capabilities but not the related algorithms. While appropriate, this leave open the important question as to whether or not NGAC is scalable. Existing cubic reference implementations indicate that it does not. For example, the primary NGAC reference implementation took several minutes to simply display the set of files accessible to a user on a moderately sized system. To solve this problem we provide an efficient access control decision algorithm, reducing the overall complexity from cubic to linear. Our other major contribution is to provide a novel mechanism for administrators and users to review allowed access rights. We provide an interface that appears to be a simple file directory hierarchy but in reality is an automatically generated structure abstracted from the underlying access control graph that works with any set of simultaneously instantiated access control policies. Our work thus provides the first efficient implementation of NGAC while enabling user privilege review through a novel visualization approach. These capabilities help limit insider access to information (and thereby limit information leakage) by enabling the efficient simultaneous instantiation of multiple access control policies.

One of the critical requirement in managing security of any computing system is access control, which includes protection and access management to the available resources. This requirement becomes more strict especially in a distributed computing environment that consists of constrained devices such as Machine-to-Machine (M2M). New challenges in access control are identified in a system comprises a group of distributed multiple M2M gateways forming a so called M2M local cloud platform (Vallati et al. in Wirel Trans Commun 87(3):1071–1091, 2016). Scalability is obviously a necessity which is lacking in some existing access control system. In addition, flexibility in managing access from users or entity belonging to other authorization domains as well as delegating access right are not provided as an integrated features. Lately, the capability-based access control has been suggested as method to manage access for M2M as the key enabler of Internet of Things. In this paper, a capability based access control equipped with Elliptic Curve Cryptography based key management is proposed for the M2M local cloud platform. The feasibility of the proposed capability based access control and key management are tested by implementing them within the security manager that is part of the overall component of the platform architecture, and evaluating their performances by a series of experimentations.

The standard ACE framework provides authentication and authorization mechanisms similar to those of the standard OAuth 2.0 framework, but it is intended for use in Internet-of-Things environments. In particular, ACE relies on OAuth 2.0, CoAP, CBOR, and COSE as its core building blocks. In ACE, a non-constrained entity called Authorization Server issues Access Tokens to Clients according to some access control and policy evaluation mechanism. An Access Token is then consumed by a Resource Server, which verifies the Access Token and lets the Client accordingly access a protected resource it hosts. Access Tokens have a validity which is limited over time, but they can also be revoked by the Authorization Server before they expire. In this work, we propose the Usage Control framework as an underlying access control means for the ACE Authorization Server, and we assess its performance in terms of time required to issue and revoke Access Tokens. Moreover, we implement and evaluate a method relying on the Observe extension for CoAP, which allows to notify Clients and Resource Servers about revoked Access Tokens. Through results obtained in a real testbed, we show how this method reduces the duration of illegitimate access to protected resources following the revocation of an Access Token, as well as the time spent by Clients and Resource Servers to learn about their Access Tokens being revoked.

SNMPv3 (D. Partain et al., 1999; R. Presuhn et al., 1999), supports authentication, confidentiality and access control. Access control is based on MIB views, which makes it possible to have fine grained control over who accesses what in a MIB. Different users can be given different access rights. However, as the number of users increase, it becomes very difficult to keep control over all the different access rights. The paper describes a new graphical language called MIB View Modeling Language that provides a tool for easy specification of MTB views. It is a hierarchical language that provides mechanisms for supporting a large number of different users and MIB views.

To avoid too strong a trust on any single user in sensitive applications, access control can be managed in a distributed way. Namely, an access right is distributed among multiple users such that the access is available if and only if certain subsets of the users cooperate. The most common condition for qualified subsets is the threshold condition, which requires that the number of cooperating users must be over a threshold. Access control based on such a condition is called TDAC (threshold distributed access control). In publicly verifiable applications, TDAC must provide public verification such that it is publicly verifiable that the multiple users share the correct access right and any qualified subset of them can obtain the access. Although the existing PVSS (publicly verifiable secret sharing) techniques can be employed to implement PVTDAC (publicly verifiable TDAC), they are not efficient enough for practical applications. In this paper, new sharing and proof techniques are proposed to design an efficient PVTDAC protocol, which is formally illustrated to be secure and publicly verifiable.

The rapid growth of Internet of Things (IoT)-enabled smart home environments has amplified the need for robust, scalable, and context-aware access control mechanisms. Traditional Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC) models offer distinct advantages such as hierarchical simplicity and contextual granularity, respectively, yet exhibit critical limitations when deployed in isolation. To address these constraints, this study proposes and implements a discrete, hybrid RBAC–ABAC access control framework, engineered as a smart contract on the Binance Smart Chain (BSC), to ensure a secure, decentralized model for managing access to IoT resources. The framework leverages blockchain’s inherent strengths cryptographic integrity, immutable message digests, and tamper-resistant audit trails to reinforce data confidentiality and policy enforcement. Validated on a real-world testbed comprising ESP32-based IoT devices, a Raspberry Pi gateway, and a blockchain backend, the proposed system demonstrates enhanced resilience and trust. Quantitative evaluations benchmark the hybrid model against standalone RBAC and ABAC mechanisms across key metrics, including gas consumption, access latency, access decision accuracy, and scalability. The results indicate the hybrid model achieves superior accuracy (97.2%) and scalability (supporting 50 concurrent users and 30 devices), with moderate gas usage (15,000 gwei) and acceptable latency (1.8 seconds). Furthermore, the use of laser-secure transaction protocols and cryptographic primitives within the smart contract enhances the protection of access rights and resource interactions. This hybrid smart contract architecture not only bridges the gap between theoretical access control models and practical blockchain deployments but also sets a foundation for adaptive, secure, and decentralized policy enforcement in next-generation smart homes, particularly in resource-constrained environments.