Towards Blockchain-Based Secure Storage and Trusted Data Sharing Scheme for IoT Environment

In this disseration we propose semi-automated top-down policy engineering approaches for attribute-based access control (ABAC) development. Further, we propose a hybrid ABAC policy engineering approach to combine the benefits and address the shortcomings of both top-down and bottom-up approaches. In particular, we propose three frameworks: (i) ABAC attributes extraction, (ii) ABAC constraints extraction, and (iii) hybrid ABAC policy engineering. Attributes extraction framework comprises of five modules that operate together to extract attributes values from natural language access control policies (NLACPs); map the extracted values to attribute keys; and assign each key-value pair to an appropriate entity. For ABAC constraints extraction framework, we design a two-phase process to extract ABAC constraints from NLACPs. The process begins with the identification phase which focuses on identifying the right boundary of constraint expressions. Next is the normalization phase, that aims at extracting the actual elements that pose a constraint. On the other hand, our hybrid ABAC policy engineering framework consists of 5 modules. This framework combines top-down and bottom-up policy engineering techniques to overcome the shortcomings of both approaches and to generate policies that are more intuitive and relevant to actual organization policies. With this, we believe that our work takes essential steps towards a semi-automated ABAC policy development experience.

Personal Health Records (PHR) system has attracted intensive attention due to its universal accessibility and low cost in economics. Because of high cost of storing data and access control, most PHR systems adopt centralized management, where an authoritative management center controls the entire system and PHR data is stored in a trusted third-party service provider. However, there are some disadvantages, such as fully trusting to a control center, suffering from a single point of failure, and data deleting. In this paper, we propose a novel distributed framework based on blockchain and IPFS (Inter Planetary File System), and a suite of mechanisms for data access control to PHR data. Smart Contracts are designed on the blockchain, and all data operations are treated as transactions. The symmetric cryptographic algorithm is used to encrypt the PHR data, and then all encrypted data is stored on IPFS nodes securely in distributed environment. The ciphertext-policy attribute-based encryption (CP-ABE) is used to encrypt the symmetric secret keys, and the corresponding ciphertext is stored and published in IPNS (Inter Planetary Name Space), so as to achieve fine-grained access control. Analytical and experimental results are presented, which show that our framework has ability to provide authenticity, confidentiality, fine-grained access control, forward secrecy, and traceability simultaneously.

We describe a method that centrally manages Attribute-Based Access Control (ABAC) policies and locally computes and enforces decisions regarding those policies for protection of resource repositories in host systems using their native Access Control List (ACL) mechanisms. The method is founded on the expression of an ABAC policy that conforms to the access control rules of an enterprise and leverages the ABAC policy expression by introducing representations of local host repositories into the ABAC policy expression as objects or object attributes. Repositories may be comprised of individual files, directories, or other resources that require protection. The method further maintains a correspondence between the ABAC representations and repositories in local host systems. The method also leverages an ability to conduct policy analytics in such a way as to formulate ACLs for those representations in accordance with the ABAC policy and create ACLs on repositories using the ACLs of their corresponding representations. As the ABAC policy configuration changes, the method updates the ACLs on affected representations and automatically updates corresponding ACLs on local repositories. Operationally, users attempt to access resources in local host systems, and the ABAC policy is enforced in those systems in terms of their native ACLs.

Access control policies are crucial for establishing a secure access control system and are fundamentally based on access control models such as attribute-based access control (ABAC). Moreover, the execution of business process instances is generally recorded within an event log. It is essential to ensure conformance with ABAC policies for the event log at the time of post-execution. To conduct conformance testing of ABAC policies in business process event logs, formalizing these ABAC policies is necessary. However, the formalization is typically carried out manually, which leads to inefficiencies, low maintainability, a high likelihood of errors, and difficulty in detecting the errors. Also, there has been a notable lack of an access control metamodel to support the formalization and conformance testing of ABAC policies, as well as insufficient attention to constructing ABAC policies from existing process logs. This paper presents a model-driven workflow for significantly automating the formalization and conformance testing of ABAC policies in process logs. By leveraging a novel ABAC metamodel and its reusable patterns, the approach addresses the aforementioned issues, demonstrating effectiveness through experiments on a real-world process log.

On the Internet, web applications are served from a centralized location i.e., server, for higher maintainability. However, in the centralized architecture, if there is an occurrence of server failure or crash, the web applications cannot be serve to the end-users until the server goes live again. In addition, in the existing centralized architecture for web hosting services, integrity of the hosted websites entirely relies on the third-party applications which checks for any possible threats in the system. In order to provide data integrity within the system and to overcome the above-mentioned single point of failure, we proposed the decentralized solution for hosting web applications, which provides more data availability to the end-users and maintains the integrity of the data. The proposed model makes use of the Interplanetary File System (IPFS) for storing and retrieving web applications, which provides high availability and reliability. In addition, the proposed model uses the Blockchain Technology for authenticity and confidentiality. The smart contracts are deploy on the Ethereum Block chain, which aids the service provider to manage the hosting service system. The proposed model also comparatively decreases the time taken to transfer the file over the IPFS using optimal path-finding algorithm. The proposed algorithm has a lesser time complexity when compared to the Bitswap protocol used in IPFS. The use of blockchain with IPFS cumulatively provides better authenticity via Ethereum Smart Contracts, which reduces risk and failure.

Driven by information technology, data trading promotes cross-industry collaboration and uncovers value by integrating multi-source data, yet it requires encryption and access controls to address increasing data security challenges. Existing schemes largely rely on attribute-based unilateral access control to protect data, facing challenges such as data source authenticity and requester autonomy. Bilateral access control requires data providers and requesters to define access policies, allowing decryption only when both policies match, often facilitated by cryptographic primitives such as matchmaking encryption (ME). However, the current bilateral schemes still face challenges of sensitive data leakage, unauthorized data access, and single points of failure. To date, no existing scheme has addressed these issues simultaneously. In this paper, we propose a blockchain-based, sanitizable and bilateral access control scheme with privacy-preserving (SBAC-PP) for data trading. Specifically, by extending ME via hash functions and policy-hidden identifiers to achieve a bilateral access control with privacy-preserving. Secondly, by combining access control encryption (ACE), we design a ciphertext sanitization mechanism to prevent unauthorized data access. Furthermore, by integrating SBAC-PP with blockchain (BC) and the interplanetary file system (IPFS), we use smart contracts for trusted matching and pre-decryption, and store encrypted data in IPFS, thereby achieving decentralized data management to avoid single points of failure. Finally, we analyze the security of SBAC-PP and evaluate its performance to demonstrate its efficiency and practicality.

Since the creation of the cryptocurrency Bitcoin, the interest in blockchain technology has increased, entering areas such as loT (Internet of Things) and data sharing. The main objective of this paper is to develop a system that allows the storage of data from loT services in a decentralized network with a blockchain managing transactions through a smart contract. The project was carried out using the blockchain Ethereum, IPFS (InterPlanetary File System) for storage, Solidity language for contract development, NodeJS for coding the simulation of loT devices, web interface and back-end of the solution. The MQTT protocol was used to transport data from the devices. Our main objective was achieved, as the tests carried out show use cases in which this solution has an advantage over the direct storage in the Ethereum blockchain.

Access control policies are dynamic in nature, and therefore require frequent updates to synchronize with the latest organizational security requirements. As these updates are handled, it is important that all user access requests be answered contemporaneously and correctly without any interruption or delay. In this paper, considering the context of Attribute Based Access Control (ABAC), we propose an approach that is capable of immediately materializing any update to the policy and ensuring that it is taken into account for any subsequent access requests. One possibility is to update the policy based on the incoming changes through ABAC policy mining techniques. However, it turns out that no existing mining approach can offer correct enforcement of policies when access requests are entertained during the updates. We provide a formal proof for this surprising result and then propose an approach called δwOP that does not suffer from this problem. Essentially, δwOP keeps track of the needed information from updates and uses this in conjunction with the existing ABAC policy rules to make access decisions. We present the complexity analysis as well as a comprehensive experimental evaluation to demonstrate the efficacy of the proposed approach for different types of changes.

Attribute-Based Access Control (ABAC) is increasingly becoming popular due to its dynamic, flexible, portable, and scalable nature. Under ABAC, security policies (ABAC rules) are stated in terms of the attributes of the subject, the object and the environment. A subject is granted access to an object if their respective attribute values are satisfied against a set of ABAC rules. Typically hierarchical relationships exist among the subjects as well as the objects, where more specific subjects (objects) inherit the attributes from the general ones. As such, if a subject is allowed access to a general object, that subject is allowed to access all of its sub-types. This has been the general understanding and current ABAC enforcement and policy mining approaches follow this approach. However, in this article, we argue that the general understanding of the semantics of the ABAC is not always appropriate. Indeed, under certain semantics, the specific data may be more sensitive than that of its general counterpart. In that situation, if a subject is allowed access to a general type, it should not be allowed access to its sub-type, which is contrary to the current understanding and implementation. This paper is the first attempt in the literature to distinguish these two different ABAC semantics arising from the different semantics of object attributes themselves. We present concrete examples of these two semantics and demonstrate what can go wrong - both anecdotally as well as empirically - if one ignores the underlying semantics and inappropriately uses the existing enforcement and mining algorithms. We then present how existing algorithms can be modified so that no misconfigurations arise and security is ensured.

Recently, most of the Internet of things (IoT) infrastructures are highly centralized with single points of failure, which results in serious security and privacy issues of IoT data. Fortunately, blockchain technique can provide a decentralized and secure IoT framework to deal with security issues based on the characteristics of decentralization, non-tampering, openness, transparency, and traceability. However, the blockchain consensus protocol guarantees the safety and reliability of data, but it also brings problems such as scalability limitations and poor storage extensibility, resulting in the inability to directly integrate blockchain and the IoT in existing conditions. In this article, a private three-tier local blockchain, Three-tier architecture Blockchain (TBchain), is proposed to solve the problem by splitting part of the transactions in the public blockchain and locking them in a higher-level blockchain TBchain. Additionally, the private blockchain TBchain is connected to the public blockchain to build a hierarchical blockchain network to provide privacy protection for the IoT data stored on the blockchain. Finally, we implement an IoT framework based on TBchain and the InterPlanetary File System (IPFS) to realize the decentralized IoT, which guarantees the user’s access control right to personal data. Experimental results show that the IoT framework based on TBchain and IPFS realizes the user’s access control right to personal data by verifying in advance to ensure the confidentiality and security of shared data, and improves the security and privacy of IoT data and transactions. Moreover, we prove that the scalability and storage extensibility of the blockchain is positively correlated with the number of data blocks in TBchain.

Data privacy and data availability remain the major concern in centralized cloud storage, which could be handled effectively through the concept of decentralized data storage. However, the secrecy of data sharing is a rising concern in the decentralized data storage for which the effective access control and data sharing scheme, hash and session key-dependent attribute-based encryption (HS-ABE) is proposed in this research. Accordingly, the multi-level access control and sharing strategy authenticates the genuine requestors and assures access to the requestors upon the authentication of their attribute sets. In this perspective of access control and secure data sharing, Ethereum blockchain, decentralized Interplanetary File System (IPFS), HS-ABE are organized. The data owners (DOs) provide the secret attribute set for the requestors ensuring fine-grained access over the data. The performance of the developed HS-ABE scheme is investigated and compared with the conventional strategies, where the memory usage of the proposed scheme is 5812 Kbps, which proclaims a well-defined secure access control and authentication in the Blockchain-based cloud storage.

[formula omitted]: A blockchain-based secure access control management for the Internet of Things

Git has been the de-facto version control system for the Software Development industry. Although Git is distributed, developers' tools for collaboration, such as GitHub, are centralized entities owned by large corporations such as Microsoft. The centralization creates trust and privacy issues for software development companies (preserving their intellectual property), along with a significant" single point of failure" issue. In addition, such centralized systems are susceptible to Sybil and distributed denial of service (DDoS) attacks due to the presence of malicious individuals. Blockchain technology has many key characteristics (such as decentralization, transparency, immutability, and audibility), solving these centralization issues. However, the requirement of having a storage system to store the user's repositories over the blockchain creates a scalability issue (in terms of storage). Most importantly, it makes data (code) privacy more severe due to its open nature. In this paper, we propose a privacy-preserving decentralized alternative solution and framework named "DCGit" powered by Web3 technologies such as the Ethereum Blockchain and InterPlanetary File System (IPFS) to provide security and scalability yet user-friendly collaboration for software development.

The development of the cloud plays a wide role in commencing secured communication among users. However, privacy and managing large databases is a major problem in a cloud model. This affects the data sharing due to a lack of trust amongst the stakeholders. Thus, we proposed a new blockchain-assisted authentication and access control technique to provide reliable data integrity verification between the cloud owners and the requester without relying on end-users. The proposed blockchain-based authentication and access control mechanism effectively increases the throughput and reduces the cost by addressing the issues of failure in the cloud model. This method integrates the Interplanetary File System (IPFS) and Ethereum blockchain for sharing the data effectively between the cloud owner and the requester. This framework distributes the secret key to the requester and the data is encrypted by adapting data policies to attain access controls over data. The keyword search function on ciphertext is executed on the basis of smart contract and Ethereum blockchain. The proposed Blockchain-based access control and authentication mechanism obtained better results with a genuine user detection rate of 95%, maximum search accuracy of 95%, and minimum responsiveness of 2.25 sec for 500 Blockchain size.

With the advances and innovations in digital technologies, blockchain has empowered advancements in communications and networking, promising to build trust and establish secure decentralized communications networks. Unfortunately, current personal data privacy protection schemes still suffer from explicit storage, lack of data ownership and implementation of fine-grained access control by users, and lack of transparency and auditability of data. In this article, we propose a personal data privacy protection scheme based on consortium blockchain that stores original data encrypted with an improved Paillier homomorphic encryption mechanism, namely PDPChain, where users realize fine-grained access control based on ciphertext policy attribute-based encryption (CP-ABE) on blockchain. In this scheme, consortium blockchain combines distributed private clusters to store the encrypted data, improving data transmission efficiency, and guaranteeing user privacy and security through off-chain storage and on-chain transmission synergy. In addition, it is more lightweight encryption and demarcation, ultimately protecting personal data privacy and providing a secure and trusted way to obtain information for data mining. For the performance testing, data in the form of files are used as an example, and the scheme is designed and simulated on Hyperledger Fabric and InterPlanetary File System. Experimental results show that the improved Paillier encryption mechanism reduces the overall encryption and decryption elapsed time by 25% and encryption elapsed time by 48%. Furthermore, the proposed CP-ABE access control method is adaptive to storing and sharing a massive amount of data. With the increase in the number of access control policies, the overall time-consuming of the scheme does not increase, and the time-consuming of decryption can also be stabilized at about 2 s.