New Constructions of Hierarchical Attribute-Based Encryption for Fine-Grained Access Control in Cloud Computing

One primary challenge of enforcing access control in cloud computing is how to ensure access with high efficiency while preserving data security. This paper proposes a fine-grained access control method for cloud resources. The basic idea is to use XACML as access control language and to optimize policies by data fragmentation and policy refinement algorithms. Through data fragmentation, the accessible resources are divided into disjoint data blocks, and each of them will be combined with a set of policy rules. This helps to refine the policy and to avoid data leakage caused by rule conflicting on the resource intersections. Finally, the disjoint data blocks and the optimized policy are distributed in the three-layered cloud, and the decision to a request is made by rule matching on a specific resource rather than traversing the whole policy rules. Experiments show that our proposal enjoys higher efficiency in cloud-based access control.

The access structure of a general circuit can represent the access control policy flexibility and has broad applications in the field of dense data access control. All previous proposals are declared to support fined-grain access control for encrypted data and secure sharing in cloud. However, these schemes have their limitations, as the circuit nodes can only output layer by layer, and the circuit depth of the access structure implemented in the system is a fixed value. In addition, recent results show that these schemes have serious security defects, such as unresisting collusion attacks and vulnerability of the ciphertext stored in cloud. This article aims at solving the problems mentioned above and a scheme with improved efficiency and security is proposed. In the presented scheme, the circuit access structure with any depth less than or equal to the maximum depth is realized through equivalent conversion of circuit. By modifying the parameter form of shares, we solved the limitation that the previous scheme could only output layer by layer upward, and realized that each node could output to any node with a depth greater than its own across layers. This scheme greatly reduces the redundant computational overhead and improves the encryption and decryption efficiency.

In the cloud, for achieving access control and keeping data confidential, the data owners could adopt attribute-based encryption to encrypt the stored data. Users with limited computing power are however more likely to delegate the mask of the decryption task to the cloud servers to reduce the computing cost. As a result, attribute-based encryption with delegation emerges. Still, there are caveats and questions remaining in the previous relevant works. For instance, during the delegation, the cloud servers could tamper or replace the delegated ciphertext and respond a forged computing result with malicious intent. They may also cheat the eligible users by responding them that they are ineligible for the purpose of cost saving. Furthermore, during the encryption, the access policies may not be flexible enough as well. Since policy for general circuits enables to achieve the strongest form of access control, a construction for realizing circuit ciphertext-policy attribute-based hybrid encryption with verifiable delegation has been considered in our work. In such a system, combined with verifiable computation and encrypt-then-mac mechanism, the data confidentiality, the fine-grained access control and the correctness of the delegated computing results are well guaranteed at the same time. Besides, our scheme achieves security against chosen-plaintext attacks under the k-multilinear Decisional Diffie-Hellman assumption. Moreover, an extensive simulation campaign confirms the feasibility and efficiency of the proposed solution.

Security concerns have been rapidly increasing because of repeated security incidents such as unexpected personal information leakage. Since XML [38] has been playing an important role in IT systems and applications, a big surge of requirements for legislative compliance is driving enterprises to protect their XML data for secure data management as well as privacy protection, and the access control mechanism is a central control point. In this chapter, we are concerned with fine-grained (element- and attribute-level) access control for XML database systems, rather than with document-level access control. We use the term XML access control to address such fine-grained access control. The XML access control deals with XML data and access control policies as well as schema definitions, e.g. XML Schema [40], and queries, e.g. XQuery [36]. The scope of XML access control is not limited to a specific application but covers broader areas that involve XML-based transactional systems such as e-commerce applications (Commerce XML [7] etc.), medical and health record applications (HL7 [16] etc.), and newspaper article distribution and applications (NewsML [17] etc.).

Hierarchical attribute-based encryption and scalable user revocation for sharing data in cloud servers

Based on mutual authentication, the session key is established for communication nodes on the open network. In order to satisfy fine-grained access control for cloud storage, the two-party attribute-based key agreement protocol (TP-AB-KA) was proposed. However, the existing TP-AB-KA protocol is high in the cost of computation and communication and is not unfit for application in a mobile cloud setting because mobile devices are generally resource constrained. To solve the above issue, we propose a TP-AB-KA protocol with constant-size ciphertext and key. Our TP-AB-KA protocol is provable security in the standard model. The concrete proof is given under the augmented multisequence of exponents' decisional Diffie-Hellman (aMSE-DDH) hypothesis in the attribute-based BJM model (AB-BJM). Compared with the existing TP-AB-KA protocols, the computation cost and communication cost of our protocol are largely reduced.

The mode of outsourcing brings about new challenges for data security and access control in cloud computing. Ciphertext-Policy Attribute-based Encryption (CP-ABE) is considered to be a powerful tool for protecting data confidentiality in cloud storage system. Due to the large scale of cloud, there are many independent domains. It is impossible for a single authority to issue attributes to all of the users. In addition, single authority could be the bottleneck of system. Attribute revocation has always been the primary difficulty in ABE. In this paper, we propose a multi-authority cloud access scheme with mixed access structure to support universal attribute and more flexible access control in multi-authority cloud storage system. After adding owner-defined attribute to traditional access structure, owner can decide which user has the right to access data. Two kinds of revocation methods can provide real-time privilege updating in multi-authority system. Detailed security analysis shows that the proposed MMACS scheme meets the security requirements under existing security models. Performance evaluation also demonstrates its highly efficient in attribute revocation.

In this paper,a fast access control applied to Hadoop cloud computing using the fingerprint identiication and face recognition is introduced.This study employed a way of low-capacity Linux embedded platform linked to Hadoop via Ethernet,WiFi or 3G.At client side,JamVM virtual machine is utilized to from the J2ME environment,and GNU Classpath is viewed as Java Class Libraries.In order to verify effectiveness and efficiency in access control for cloud computing,the rapid face and fingerprint identification has been accomplished successfully within 2.2 seconds to exactly perform the subject identity under the cross-examination.The experimental results show that the one we proposed outperforms two alternative methods.

Regardless of all the inherent features, Object-Oriented Databases (OODBs) are unable to come up with provable security. The emergence of diversified computing paradigms like Grid & Cloud Computing and Online Social Interaction Platforms has significantly driven the need of OODB technologies with reliable security features. This paper serves to improve the authorization issues within OODBs, by providing an annotation based Fine-Grained Access Control solution. The approach involves realization of Fine-Grained Access Control (FGAC) model for providing granular level access control in Object Oriented Databases.KeywordsObject-Oriented TechnologiesImplicit AuthorizationAnnotationsFiner GranularityLeast Privileges

Nowadays, several universities and institutions make profit from the information technologies to enhance and develop their educational strategies and attract more learners. Therefore, distance learning (e-learning) and learning-on-the-go are technologies adopted by universities and service providers to afford more flexible education system. In fact, e-learning is gaining popularity worldwide and the number of learners enrolled in on-line courses is growing. This trend is explained mainly by the opportunities provided by Cloud Computing. In the cloud based educational context, the security factor in sharing the educational content is important and poses several security challenges, such as fine-grained access control and security preservation of content learning. Moreover, there is emergence of the new concept of User-Fog-Cloud architecture to bring closer the services to the client. In this paper, a new fog computing e-learning scheme is provided. Specifically, the proposed solution extends learning content from the cloud to the edge of the network. It can improve the efficiency of learning data analysis, reduces the encryption burden in terms of computation cost on user's devices by offloading part of encryption cost to fog servers and provides fine grained access control to learning content by encrypting the course and the exam with different cryptographic techniques like IBBE and CP-ABE. Further, we present a profile matching mechanism that helps teachers to find colleagues within their vicinity in an efficient and secure way. Security analysis shows that our scheme can achieve data confidentiality, fine-grained access control, collusion resistance and unforgeability. Performance evaluations demonstrate the efficiency of our solution, especially in terms of encryption computation costs.

Due to the increasing need for data sharing in the age of big data, how to achieve data access control and implement user permission revocation in the blockchain environment becomes an urgent problem. To solve the above problems, we propose a novel blockchain-based data sharing scheme (BDSS) with fine-grained access control and permission revocation in this paper, which regards the medical environment as the application scenario. In this scheme, we separate the public part and private part of the electronic medical record (EMR). Then, we use symmetric searchable encryption (SSE) technology to encrypt these two parts separately, and use attribute-based encryption (ABE) technology to encrypt symmetric keys which used in SSE technology separately. This guarantees better fine-grained access control and makes patients to share data at ease. In addition, we design a mechanism for EMR permission grant and revocation so that hospital can verify attribute set to determine whether to grant and revoke access permission through blockchain, so it is no longer necessary for ciphertext re-encryption and key update. Finally, security analysis, security proof and performance evaluation demonstrate that the proposed scheme is safe and effective in practical applications.

Cloud computing plays a major role in sharing data and resources to other devices through data outsourcing. During sharing resources, it is a challenging task to provide access control and secure write operations. The main issue is to provide secure read and write operations collaboratively and to reduce computational overload by effective key management. In this paper, a secure and an efficient data collaboration scheme blowfish hybridized weighted attribute-based Encryption (BH-WABE ) for secure data writing and proficient access control has been proposed. Here, weight is assigned to each attribute based on its importance and data are encrypted using access control policies. The cloud service provider stores the outsourced data and an attribute authority revokes or updates the attributes by assigning different attributes based on the weight. The receiver can access the data file corresponding to its weight in order to reduce the computational overload. The proposed BH-WABE provides collusion resistance, multiauthority security and fine-grained access control in terms of security, reliability, and efficiency. The performance is compared with the conventional hybrid attribute-based encryption (HABE) scheme in terms of data confidentiality, flexible access control, data collaboration, full delegation, partial decryption, verification, and partial signing.

During interaction with today’s internet services and platform ecosystems, consumer data is often harvested and shared without their consent; that is, consumers seized to be the sovereigns of their own data with the proliferation of the internet. Due to the rapid and abundant nature of interactions in today’s platform ecosystems, manual consent management is impractical. To support development of semi-automated solutions for reestablishing data sovereignty, we investigate the use of policy definition languages as machine-readable and enforceable mechanisms for fostering data sovereignty. We conducted a realist literature review of the capabilities of policy definition languages developed for pertinent application scenarios (e.g., for access control in cloud computing). We consolidate extant literature into a framework of the chances and challenges of leveraging policy definition languages as central building blocks for data sovereignty in platform ecosystems.

The fine-grained access control (FGAC) is important to Web applications. However, it can be circumvented by indirect access such as inferring sensitive data from insensitive data. In the previous FGAC studies, the inference information leakage is not well controlled. In addition, the soundness property, which requires that the results of a query under the FGAC should be the subset of the results of the query without the FGAC over the same database states, can not be held for all SQL statements. Moreover, without soundness information leakage would occur in databases in some situations. In this paper, we divide the approaches which implement FGAC with query modification into two types: the first, the FGAC policy is executed over the results obtained from the query issued by a user; the second, the query issued by a user is executed over the results obtained from the FGAC policy. Then we introduce three types of information leakages of FGAC, which is implemented by using the first approach, and analyze why the existing approaches can not hold soundness for all SQL statements. A novel approach is proposed to control the information leakages and satisfy the soundness property for all SQL statements. Then we implement our approach in DM DBMS with query modification and analyze the test results.

In a ciphertext-policy attribute-based encryption (CP-ABE) scheme, a user may have multiple attributes, and each attribute may be shared simultaneously by many users. The decryption key of an attribute can thus be shared by many users who all possess the attribute. For monetary gain, a malicious authorized user may reveal his/her decryption key to a third party, and it is difficult to trace the owner of primitive secret key from an exposed key. At the same time, this situation may also limit commercial applications of CP-ABE systems. To solve these problems and enable fine-grained access control for the encrypted data, we propose a traceable CP-ABE scheme with attribute-level user revocation for cloud storage (TUR-CPABE). Our scheme enjoys four advantages. First, it has the ability to trace malicious users who have leaked key information from the system. Second, it supports attribute-level user revocation for malicious users and allows ABE fine-grained access control. Third, it allows secret key updates and ciphertext updates to resist collusion attacks between users. Fourth, outsourcing encryption, decryption and attribute revocation are used to reduce the computational burden on data owners, data users and the trust authority, respectively. In addition, our scheme has been proven to be secure against chosen plaintext attacks under a selective access policy based on decisional q – BDHE assumption in the standard model.