Towards Fault-Tolerant Fine-Grained Data Access Control for Smart Grid

WSN-integrated cloud computing (WCC) has become a promising cloud service architecture, in which sensors and mobile devices are utilized as the data collecting and processing nodes for the cloud service model, while cloud servers can provide computing services and storage services with high performance and reliability. However, since cloud servers are not fully trusted, and sensors and mobile devices have very limited computing capability and storage capacity, WCC brings forth new challenges for data confidentiality, data integrity and access control when sensors store important data for sharing in the WCC environment. Moreover, there are still no proper solutions for fine-grained, efficient and secure data access control in WCC. To solve this issue, we propose a fine-grained and lightweight data access control scheme for WCC, namely FLAC, which includes a ciphertext-policy attribute-based encryption algorithm for data confidentiality and fine-grained data access control, and an attribute-based signature algorithm for data integrity and the many-read-many-write case of data access. By delegating most computation intensive tasks to cloud services, FLAC enables resource constrained sensors and mobile devices to perform security operations rapidly. The security assessment and performance evaluation demonstrate that FLAC is secure, highly efficient and well suited for WSN applications.

Distributed sensor data storage and retrieval have gained increasing popularity in recent years for supporting various applications. While distributed architecture enjoys a more robust and fault-tolerant wireless sensor network (WSN), such architecture also poses a number of security challenges especially when applied in mission-critical applications such as battlefield and e-healthcare. First, as sensor data are stored and maintained by individual sensors and unattended sensors are easily subject to strong attacks such as physical compromise, it is significantly harder to ensure data security. Second, in many mission-critical applications, fine-grained data access control is a must as illegal access to the sensitive data may cause disastrous results and/or be prohibited by the law. Last but not least, sensor nodes usually are resource-constrained, which limits the direct adoption of expensive cryptographic primitives. To address the above challenges, we propose, in this paper, a distributed data access control scheme that is able to enforce fine-grained access control over sensor data and is resilient against strong attacks such as sensor compromise and user colluding. The proposed scheme exploits a novel cryptographic primitive called attribute-based encryption (ABE), tailors, and adapts it for WSNs with respect to both performance and security requirements. The feasibility of the scheme is demonstrated by experiments on real sensor platforms. To our best knowledge, this paper is the first to realize distributed fine-grained data access control for WSNs.

Fog computing is a paradigm that extends cloud computing to the edge of the network. It can provide computation and storage services to end devices in Internet of Things (IoT). Attribute-based cryptography is a well-known technology to guarantee data confidentiality and fine-grained data access control. However, its computational cost in encryption and decryption phase is linear with the complexity of policy. In this paper, we propose a secure and fine-grained data access control scheme with ciphertext update and computation outsourcing in fog computing for IoT. The sensitive data of data owner are first encrypted using attribute-based encryption with multiple policies and then outsourced to cloud storage. Hence, the user whose attributes satisfy the access policy can decrypt the ciphertext. Based on the attribute-based signature technique, authorized user whose attributes integrated in the signature satisfy the update policy can renew the ciphertext. Specifically, most of the encryption, decryption, and signing computations are outsourced from end devices to fog nodes, and thus, the computations for data owners to encrypt, end users to decrypt, re-encrypt, and sign are irrelevant to the number of attributes in the policies. The security analysis shows that the proposed scheme is secure against known attacks, and the experimental results show that the fog nodes perform most of the computation operations of encryption, decryption, and signing, and hence, the time of encryption for data owner, decryption, re-encryption, and signing for users is small and constant.

Personal health record (PHR) is an emerging patient-centric model of health information exchange, which is often outsourced to be stored at a third party, such as cloud providers. However, there have been wide privacy concerns as personal health information could be exposed to those third party servers and to unauthorized parties. To assure the patients' control over access to their own PHRs, it is a promising method to encrypt the PHRs before outsourcing. Yet, issues such as risks of privacy exposure, scalability in key management, flexible access, and efficient user revocation, have remained the most important challenges toward achieving fine-grained, cryptographically enforced data access control. In this paper, we propose a novel patient-centric framework and a suite of mechanisms for data access control to PHRs stored in semitrusted servers. To achieve fine-grained and scalable data access control for PHRs, we leverage attribute-based encryption (ABE) techniques to encrypt each patient's PHR file. Different from previous works in secure data outsourcing, we focus on the multiple data owner scenario, and divide the users in the PHR system into multiple security domains that greatly reduces the key management complexity for owners and users. A high degree of patient privacy is guaranteed simultaneously by exploiting multiauthority ABE. Our scheme also enables dynamic modification of access policies or file attributes, supports efficient on-demand user/attribute revocation and break-glass access under emergency scenarios. Extensive analytical and experimental results are presented which show the security, scalability, and efficiency of our proposed scheme.

DNA similarity search has proven to be an essential demand in human genomic researches. Since DNA sequences contain many sensitive personal information, the acquisition and dissemination of DNA data have been tightly controlled and restricted by authorities. Although the problem of private DNA similarity query has been an active research issue, the latest research findings are still inadequate in terms of security, functionality and efficiency. In this paper, we propose an Efficient DNA Similarity Search scheme (EDSS) which can achieve fine-grained query and data access control over encrypted cloud data. Our original contributions are fourfold. First, we creatively put forward a private edit distance approximation algorithm to realize the efficient and high accurate DNA similarity query. Second, we classify the whole DNA sequences and design a multiple genes search strategy to achieve complicated logic query such as mixed “AND” and “NO” operations on genes. Third, the proposed scheme can also efficiently support data access control by employing a novel polynomial based design. Finally, security analysis and extensive experiments demonstrate the high security and efficiency of EDSS compared with existing schemes.

Several existing access control solutions mainly focus on preserving confidentiality of stored data from unauthorized access and the storage provider. Moreover, to keep sensitive user data confidential against untrusted
\nservers, existing solutions usually apply cryptographic methods by disclosing data decryption keys only to authorized users. However, these solutions inevitably introduce a heavy computation overhead on the data owner
\nfor key distribution and data management when fine-grained data access control is desired. In addition, access
\ncontrol policies as well as users’ access patterns are also considered as sensitive information that should be
\nprotected from the cloud. In this paper, we propose PAbAC, a novel privacy preserving Attribute-based framework, that combines attribute-based encryption and attribute-based signature mechanisms for securely sharing
\noutsourced data via the public cloud. Our proposal is multifold. First, it ensures fine-grained cryptographic access control enforced at the data owner’s side, while providing the desired expressiveness of the access control
\npolicies. Second, PAbAC preserves users’ privacy, while hiding any identifying information used to satisfy
\nthe access control. Third, PAbAC is proven to be highly scalable and efficient for sharing outsourced data in
\nremote servers, at both the client and the cloud provider side.

Software defined networking (SDN) separates the data layer and the control layer to achieve logical centralization, scalability and programmability. In hierarchical software defined networking (HSDN), controllers are classified into the upper controller- Root Controller (RC) and the lower controller- Local Controller (LC) to improve the scalability of the network. HSDN effectively relieve the workload of controllers. However, the features of HSDN puts forward higher requirements of data privacy protection and access control. Because RC stores global network data, it must ensure authorized access and prevent the forged data. The attribute-based encryption scheme can provide fine-grained data access control and data privacy protection of controllers at the same time. When LC accesses data in RC, the algorithm of ciphertext-policy attribute-based encryption with identity authentication (CP-ABE-IA) is presented to protect the data privacy of RC and guarantee the legitimate access of LC. When LC sends message to RC, we propose an algorithm of key-policy attribute based signcryption for multi-access structures (KP-ABSC-MAS). KP-ABSC-MAS provides data privacy protection and verification as well as the authentication of LC.

Dependable and secure computing in medical information systems

How to control the access of the huge amount of big data becomes a very challenging issue, especially when big data are stored in the cloud. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising encryption technique that enables end-users to encrypt their data under the access policies defined over some attributes of data consumers and only allows data consumers whose attributes satisfy the access policies to decrypt the data. In CP-ABE, the access policy is attached to the ciphertext in plaintext form, which may also leak some private information about end-users. Existing methods only partially hide the attribute values in the access policies, while the attribute names are still unprotected. In this paper, we propose an efficient and fine-grained big data access control scheme with privacy-preserving policy. Specifically, we hide the whole attribute (rather than only its values) in the access policies. To assist data decryption, we also design a novel attribute bloom filter to evaluate whether an attribute is in the access policy and locate the exact position in the access policy if it is in the access policy. Security analysis and performance evaluation show that our scheme can preserve the privacy from any linear secret-sharing schemes access policy without employing much overhead.

Conventional encryption schemes are being used over the years for securing outsourced data to cloud. However, this impedes deduplication- the ability to identify and remove duplicate data from storage server. The idea of Convergent Encryption was introduced to overcome this problem which ensures that identical plaintext files will always produce identical ciphertexts and thus enabling deduplication. Nonetheless, this scheme is vulnerable to a side-channel attack called “confirmation-of-a-file” and its variant “learn-the-remaining-information” attack which breach user privacy by observing the deduplication operation. To resolve the above two seemingly contrasting issues, we propose a scheme which blends convergent encryption with a traditional access control scheme for simultaneously achieving confidentiality and deduplication. Both theoretical security analysis and experimental results show that our scheme is semantically secure and resilient against attacks. It incurs minor storage and latency overhead while performing file and block level deduplication. Furthermore, it ensures secure and fine-grained access control of outsourced data by efficiently handling key-management process.

The Edge-Fog-Cloud interplay in the Internet-of-Things (IoT) leads to many exciting data-sharing applications that use access control systems as primary requirements. To ensure a fine-grained data access control for such data-sharings on untrusted storage (e.g., Cloud), Attribute-Based Encryption (ABE) is a promising tool. To address privacy concerns in such ABE-based access control systems, we propose a new Privacy-preserving Distributed data Access control (PDAC) in CloudIoT. Our PDAC improves the previous privacy-preserving distributed ABE systems in three aspects. The first introduces a new user's anonymity approach against the colluding untrusted (honest-but-curious) authorities. The second presents a novel policy-hiding mechanism that efficiently preserves the privacy of policy-forming attributes (metadata) against colluding parties. The third introduces an independent-authorities system for our privacy-preserving improvements, where an authority can join and leave the system without reinitializing other authorities. Moreover, our PDAC offloads the user's computations over the Cloud servers for efficiency enhancement. We prove the security of our PDAC through formal analysis. Then, we present empirical results on different classes of mobile devices, including a laptop and a smartphone.

Blockchain-based eHealth system for auditable EHRs manipulation in cloud environments

Cipher text-Policy Attribute Based Encryption (CP-ABE) is a promising cryptographic primitive for fine-grained access control of shared data. However, when CP-ABE is used to control outsourced data sharing, it confronts two obstacles. Firstly, the data owner must trust the attributes authority, secondly, the issue of attribute revocation of CP-ABE schemes, which suffers from such problems as different granularities of revocation, poor scalability and high computational complexity, is cumbersome. In this paper, we propose a new CP-ABE scheme that the data owners can fully control their outsourced shared data. We also resolve the issue of revocation including the entire user access privilege and just partial access right of the user, i.e., a subset of his/her attributes. Our proposed solution can achieve minimal overload by integrating CP-ABE with the access control of system. In addition, the data owners and the attributes authority can delegate most of laborious tasks to revocation proxy severs with the technique of proxy re-encryption. Finally, we present the quantitative test and analysis on the performance of our proposed scheme.

Personal health record (PHR) is a patient-centric model of health information exchange, which greatly facilitates the storage, access, and share of personal health information. In order to share the valuable resources and reduce the operational cost, the PHR service providers would like to store the PHR applications and health information data in the cloud. The private health information may be exposed to unauthorized organizations or individuals since the patient lost the physical control of their health information. Ciphertext-policy attribute-based signcryption is a promising solution to design a cloud-assisted PHR secure sharing system. It provides fine-grained access control, confidentiality, authenticity, and sender privacy of PHR data. However, a large number of pairing and modular exponentiation computations bring heavy computational overhead during designcryption process. In order to reconcile the conflict of high computational overhead and low efficiency in the designcryption process, an outsourcing scheme is proposed in this paper. In our scheme, the heavy computations are outsourced to ciphertext transformed server, only leaving a small computational overhead for the PHR user. At the same time, the extra communication overhead in our scheme is actually tolerable. Furthermore, theoretical analysis and the desired securing properties including confidentiality, unforgeability, and verifiability have been proved formally in the random oracle model. Experimental evaluation indicates that the proposed scheme is practical and feasible.

Attribute-based encryption (ABE) has been widely studied recently to support fine-grained access control of shared data. Anonymous ABE, which is a relevant notion to ABE, further hides the receivers' attribute information in ciphertexts because many attributes are sensitive and related to the identity of eligible users. However, in existing anonymous ABE work, a user knows whether the attributes and the policy match or not only after repeating decryption attempts. And, the computation overhead of each decryption is high as the computational cost grows with the complexity of the access formula, which usually requires many pairings in most of the existing ABE schemes. As a result, this direct decryption method in anonymous ABE will suffer a severe efficiency drawback.