MAPE-ZT: A Multi-Layer Access Policy Encryption System for Zero Trust Architectures

How to control the access of the huge amount of big data becomes a very challenging issue, especially when big data are stored in the cloud. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising encryption technique that enables end-users to encrypt their data under the access policies defined over some attributes of data consumers and only allows data consumers whose attributes satisfy the access policies to decrypt the data. In CP-ABE, the access policy is attached to the ciphertext in plaintext form, which may also leak some private information about end-users. Existing methods only partially hide the attribute values in the access policies, while the attribute names are still unprotected. In this paper, we propose an efficient and fine-grained big data access control scheme with privacy-preserving policy. Specifically, we hide the whole attribute (rather than only its values) in the access policies. To assist data decryption, we also design a novel attribute bloom filter to evaluate whether an attribute is in the access policy and locate the exact position in the access policy if it is in the access policy. Security analysis and performance evaluation show that our scheme can preserve the privacy from any linear secret-sharing schemes access policy without employing much overhead.

Electronic health record (EHR) stores not only the patient’s health-related data but also the sensitive individual information. Consequently, data security and access privacy are the greatest concern of EHR applications while sharing the data through the cloud. Ciphertext policy attribute-based encryption (CP-ABE) is one of the popular one-to-many encryption schemes, which helps to attain fine-grained access control in cloud domain. In CP-ABE, since the access policy is attached to the ciphertext, anyone with the ciphertext can see the data owner’s policy that may cause privacy leakage. In this paper, we proposed a CP-ABE cryptosystem that supports access policy obfuscation and outsourced decryption enabling efficient and secure operations in cloud environment. Linear secret sharing (LSS) scheme is used for supporting any monotonic access structures, thereby improving the access policy’s expressiveness. We have incorporated prime-order bilinear group and matrix-based LSS scheme that increases the computational efficiency of the cryptosystem. Finally, we have evaluated the performance of our CP-ABE cryptosystem using practical implementation utilizing Charm framework.

Scalable and secure access control policy update for outsourced big data

Today a large volume of data is stored in cloud that requires fine grained accessibility for heterogeneous users. Cipher-text policy attribute based encryption (CP-ABE) has evolved into a promising solution for secure data storage with fine grained access control. In CP-ABE, the ciphertext is associated with an access policy (set of rules) and users can access the data if their attributes satisfies the access policy. However, existing CP-ABE schemes fail to perform in presence of large number of users and hierarchical relationships among them. Moreover, a majority of the CP-ABE schemes require large computational overhead for light weight applications. In this paper, we present a hierarchical attribute based cryptosystem by introducing hierarchical dependency between the users and thereby achieving multi-layer verification for fine grained data access. Moreover, our proposed cryptosystem is seamless to user revocation. The efficiency and security of our proposed cryptosystem have been analyzed and reported. Further we implement the proposed cryptosystem in Charm to demonstrate its practicality.

For enterprise systems running on public clouds in which the servers are outside the control domain of the enterprise, access control that was traditionally executed by reference monitors deployed on the system servers can no longer be trusted. Hence, a self-contained security scheme is regarded as an effective way for protecting outsourced data. However, building such a scheme that can implement the access control policy of the enterprise has become an important challenge. In this paper, we propose a self-contained data protection mechanism called RBAC-CPABE by integrating role-based access control (RBAC), which is widely employed in enterprise systems, with the ciphertext-policy attribute-based encryption (CP-ABE). First, we present a data-centric RBAC (DC-RBAC) model that supports the specification of fine-grained access policy for each data object to enhance RBAC’s access control capabilities. Then, we fuse DC-RBAC and CP-ABE by expressing DC-RBAC policies with the CP-ABE access tree and encrypt data using CP-ABE. Because CP-ABE enforces both access control and decryption, access authorization can be achieved by the data itself. A security analysis and experimental results indicate that RBAC-CPABE maintains the security and efficiency properties of the CP-ABE scheme on which it is based, but substantially improves the access control capability. Finally, we present an implemented framework for RBAC-CPABE to protect privacy and enforce access control for data stored in the cloud.

Lattice-based Attribute-based encryption is a well-known cryptographic mechanism that can resist quantum attacks and has the ability of fine-grained access control, and it has a wide range of application scenarios in current Internet of Thing (IoT) era. However, lack of efficiency and existing the problem of large ciphertext expansion rate are the main disadvantages impede the applications of this mechanism. Thus, we propose an efficient and practical ciphertext policy attribute-based encryption (CP-ABE) scheme from lattices in the paper. In this scheme, to make the secret key reusable, we adjust access tree and propose a basic access tree structure, which can be converted from disjunctive normal form, and combine it with a light post-quantum scheme of Kyber. In addition, the compression method and plaintext expansion method are introduced to optimize the scheme. Our CP-ABE scheme is secure against chosen plaintext attack under the hardness of module learning with errors problem. We implement our scheme and compare it with three recent related schemes in terms of security, function and communication cost. Experiments and comparisons show that our CP-ABE scheme has advantages in high encryption efficiency, small matrix dimension, small key sizes, and low ciphertext expansion rate, which has some merit in practice.

Designing lightweight security protocols for cloud-based Internet-of-Things (IoT) applications for battery-limited mobile devices, such as smart phones and laptops, is a topic of recent focus. Ciphertext-policy attribute-based encryption (CP-ABE) is a viable solution, particularly for cloud deployment, as an encryptor can “write” the access policy so that only authorized users can decrypt and have access to the data. However, most existing CP-ABE schemes are based on the costly bilinear maps, and require long decryption keys, ciphertexts and incur significant computation costs in the encryption and decryption (e.g. costs is at least linear to the number of attributes involved in the access policy). These design drawbacks prevent the deployment of CP-ABE schemes on battery-limited mobile devices. In this paper, we propose a new RSA-based CP-ABE scheme with constant size secret keys and ciphertexts (CSKC) and has $\mathcal {O}(1)$ time-complexity for each decryption and encryption. Our scheme is then shown to be secure against a chosen-ciphertext adversary, as well as been an efficient solution with the expressive AND gate access structures (in comparison to other related existing schemes). Thus, the proposed scheme is suitable for deployment on battery-limited mobile devices.

Mobile cloud computing (MCC) is embracing rapid development these days and able to provide data outsourcing and sharing services for cloud users with pervasively smart mobile devices. Although these services bring various conveniences, many security concerns such as illegally access and user privacy leakage are inflicted. Aiming to protect the security of cloud data sharing against unauthorized accesses, many studies have been conducted for fine‐grained access control using ciphertext‐policy attribute‐based encryption (CP‐ABE). However, a practical and secure data sharing scheme that simultaneously supports fine‐grained access control, large university, key escrow free, and privacy protection in MCC with expressive access policy, high efficiency, verifiability, and exculpability on resource‐limited mobile devices has not been fully explored yet. Therefore, we investigate the challenge and propose an Efficient and Multiauthority Large Universe Policy‐Hiding Data Sharing (EMA‐LUPHDS) scheme. In this scheme, we employ fully hidden policy to preserve the user privacy in access policy. To adapt to large scale and distributed MCC environment, we optimize multiauthority CP‐ABE to be compatible with large attribute universe. Meanwhile, for the efficiency purpose, online/offline and verifiable outsourced decryption techniques with exculpability are leveraged in our scheme. In the end, we demonstrate the flexibility and high efficiency of our proposal for data sharing in MCC by extensive performance evaluation.

In today’s increasingly complex cybersecurity landscape, traditional perimeter-based security models are no longer sufficient to protect sensitive data and systems. Security-sensitive organizations, such as those in finance, healthcare, and government, are facing heightened risks from insider threats, credential misuse, and sophisticated cyberattacks. This paper proposes an AI-enabled framework for implementing Zero Trust Architecture (ZTA) and Continuous Access Governance (CAG) to enhance identity and access management (IAM) and strengthen organizational security posture. The Zero Trust model operates under the principle of “never trust, always verify,” ensuring that access is continuously evaluated based on contextual risk, user behavior, and real-time analytics. The proposed framework integrates artificial intelligence (AI) and machine learning (ML) to enable adaptive authentication, real-time anomaly detection, and dynamic access controls. By continuously analyzing user activity patterns, device trustworthiness, location data, and behavioral anomalies, the system can proactively identify and respond to access risks. This AI-driven approach facilitates granular access control, policy enforcement, and role-based access reviews in compliance with regulations such as GDPR, HIPAA, and NIST guidelines. Moreover, the framework supports Continuous Access Governance by automating identity lifecycle management, conducting real-time entitlement reviews, and ensuring least privilege access across hybrid IT environments. It enhances visibility, auditability, and compliance monitoring through intelligent dashboards and risk scoring mechanisms. Use cases from high-security sectors are examined to demonstrate the practical application and benefits of the proposed model. The findings underscore the importance of embedding AI into Zero Trust and access governance strategies to enable faster threat response, reduce human error, and adapt to evolving security challenges. The paper concludes with a roadmap for implementation, highlighting key enablers such as data integration, AI model training, and cross-functional collaboration. By adopting this AI-enabled framework, organizations can fortify their defenses, minimize access-related risks, and ensure resilient cybersecurity operations in an era of digital transformation.

In the cloud, for achieving access control and keeping data confidential, the data owners could adopt attribute-based encryption to encrypt the stored data. Users with limited computing power are however more likely to delegate the mask of the decryption task to the cloud servers to reduce the computing cost. As a result, attribute-based encryption with delegation emerges. Still, there are caveats and questions remaining in the previous relevant works. For instance, during the delegation, the cloud servers could tamper or replace the delegated ciphertext and respond a forged computing result with malicious intent. They may also cheat the eligible users by responding them that they are ineligible for the purpose of cost saving. Furthermore, during the encryption, the access policies may not be flexible enough as well. Since policy for general circuits enables to achieve the strongest form of access control, a construction for realizing circuit ciphertext-policy attribute-based hybrid encryption with verifiable delegation has been considered in our work. In such a system, combined with verifiable computation and encrypt-then-mac mechanism, the data confidentiality, the fine-grained access control and the correctness of the delegated computing results are well guaranteed at the same time. Besides, our scheme achieves security against chosen-plaintext attacks under the k-multilinear Decisional Diffie-Hellman assumption. Moreover, an extensive simulation campaign confirms the feasibility and efficiency of the proposed solution.

With the advent of wearable devices and smart health care, the wearable health care technology for obtaining Patient Centric Data (PCD) has gained popularity in recent years. To establish access control over encrypted data in health records, Ciphertext Policy-Attribute Based Encryption (CP-ABE), is used. The most critical element is granting secure access to the generated information. However, with growing complexity of access policy, computational overhead of encryption and decryption process also increases. As a result, ensuring data access control as well as efficiency in PCD collected by wearables is crucial and challenging. This paper proposes and demonstrates a proof-of-work for the Merkle-based access tree using notion of hiding the sensitive access policy attributes.

Cyber risks on IoT platforms and zero trust solutions

In this work, an oblivious transfer with complex access control scheme that is constructed based on ciphertext policy attribute based encryption (CP-ABE) scheme is proposed. In this scheme, the database server can enforce fine grained access control for each record where the authorized user is allowed to access, but the unauthorized user cannot, whereas it learns neither which record a user accesses, nor which attributes a user has. This scheme has the advantages as follows: First, it allows the expressive access control policies where access structures are based on linear secret sharing scheme that directly supports AND, OR and Threshold gates. Second, the communication complexity in this scheme is constant in the numbers of records which have been accessed. Third, this scheme is constructed in prime order bilinear group. Fourth, this scheme is secure in the standard model. To the best of our knowledge, this scheme is the first to obtain these features simultaneously.

Zero Trust has become a key paradigm of the cybersecurity, anticipating the motto of never trust, always verify. Although it is increasingly being adopted in critical domains, traditional Zero Trust implementations use mostly fixed policies and fixed access control policies, thus making them poorly suited to deal with threat that is environments that are more dynamic. At the same time, the introduction of the innovative artificial intelligence (AI) functionality in cybersecurity demonstrated the potential of automating detection, increasing flexibility, and offering 24/7 safety. However, the introduction of AI to security systems raises legitimate questions about privacy of data, transparency, and compliance with the regulations. The paper suggests a smart Zero Trust framework that combines intelligent threat modeling, based on AI, with privacy- focused controls, which would remain flexible to changing threats and maintain user-confidence and privacy of data. Through a comprehensive literature review, we will create a conceptual framework that demonstrates the role of AI in enhancing adaptive threat detection and prevention in Zero Trust. Privacy preserving systems such as federated learning, differential privacy, and encryption-based access controls are also examined in the paper as the basis of having a trustworthy deployment. The practicality and effectiveness of the proposed approach are evidenced by a case-study deployment to a simulated cloud-based enterprise context, showing that detection accuracy, policy enforcement as well as compliance assurance are greatly improved compared to the conventional models. The results therefore aid in the development of cybersecurity by suggesting a smart Zero Trust architecture that supports flexibility, effectiveness and privacy and therefore leading to sustainable and reliable digital ecosystems.

Under the assumption of honest-but-curious cloud service provider, various cryptographic techniques have been used to address the issues of data access control and confidentiality in public cloud storage. Among which, attribute-based encryption (ABE) has been shown to be an attractive scheme. Although the technique of ABE brings in various benefits, its onerous overhead should not be ignored. In this article, based on an improved LSSS (linear secret sharing scheme) matrix expression integrated in CP-ABE (Ciphertext-Policy Attribute-Based Encryption) algorithm, we present an efficient and secure attribute-based access control scheme for the scenarios where multiple data are shared and encrypted with frequently used sub-policies. In the scheme, a user can store the parameters about a specific sub-policy in his/her first decryption, which can be reused in the subsequent data decryptions whose embedded access policies include the same sub-policy so as to significantly reduce the computation cost. Our proposed scheme is proved to be semantically secure under chosen plaintext attacks and can well preserve the confidentiality of the data sharing system. Our analysis and experimentation also show that our scheme does significantly reduce the decryption time and while trades in only very little storage overhead, and thus effectively promotes the efficiency.