A deep learning access controlmodel based on user preferences is proposed to address the issue of personal privacy leakage in social networks.Firstly,socialusers andsocialdata entities are extractedfromthe social netw...A deep learning access controlmodel based on user preferences is proposed to address the issue of personal privacy leakage in social networks.Firstly,socialusers andsocialdata entities are extractedfromthe social networkandused to construct homogeneous and heterogeneous graphs.Secondly,a graph neural networkmodel is designed based on user daily social behavior and daily social data to simulate the dissemination and changes of user social preferences and user personal preferences in the social network.Then,high-order neighbor nodes,hidden neighbor nodes,displayed neighbor nodes,and social data nodes are used to update user nodes to expand the depth and breadth of user preferences.Finally,a multi-layer attention network is used to classify user nodes in the homogeneous graph into two classes:allow access and deny access.The fine-grained access control problem in social networks is transformed into a node classification problem in a graph neural network.The model is validated using a dataset and compared with other methods without losing generality.The model improved accuracy by 2.18%compared to the baseline method GraphSAGE,and improved F1 score by 1.45%compared to the baseline method,verifying the effectiveness of the model.展开更多
The Internet of Things(IoT)access controlmechanism may encounter security issues such as single point of failure and data tampering.To address these issues,a blockchain-based IoT reputation value attribute access cont...The Internet of Things(IoT)access controlmechanism may encounter security issues such as single point of failure and data tampering.To address these issues,a blockchain-based IoT reputation value attribute access control scheme is proposed.Firstly,writing the reputation value as an attribute into the access control policy,and then deploying the access control policy in the smart contract of the blockchain system can enable the system to provide more fine-grained access control;Secondly,storing a large amount of resources fromthe Internet of Things in Inter Planetary File System(IPFS)to improve system throughput;Finally,map resource access operations to qualification tokens to improve the performance of the access control system.Complete simulation experiments based on the Hyperledger Fabric platform.Fromthe simulation experimental results,it can be seen that the access control system can achieve more fine-grained and dynamic access control while maintaining high throughput and low time delay,providing sufficient reliability and security for access control of IoT devices.展开更多
Several unique characteristics of Internet of Things(IoT)devices,such as distributed deployment and limited storage,make it challenging for standard centralized access control systems to enable access control in today...Several unique characteristics of Internet of Things(IoT)devices,such as distributed deployment and limited storage,make it challenging for standard centralized access control systems to enable access control in today’s large-scale IoT ecosystem.To solve these challenges,this study presents an IoT access control system called Ether-IoT based on the Ethereum Blockchain(BC)infrastructure with Attribute-Based Access Control(ABAC).Access Contract(AC),Cache Contract(CC),Device Contract(DC),and Policy Contract(PC)are the four central smart contracts(SCs)that are included in the proposed system.CC offers a way to save user characteristics in a local cache system to avoid delays during transactions between BC and IoT devices.AC is the fundamental program users typically need to run to build an access control technique.DC offers a means for storing the resource data created by devices and a method for querying that data.PC offers administrative settings to handle ABAC policies on users’behalf.Ether-IoT,combined with ABAC and the BC,enables IoT access control management that is decentralized,fine-grained and dynamically scalable.This research gives a real-world case study to illustrate the suggested framework’s implementation.In the end,a simulation experiment is performed to evaluate the system’s performance.To ensure data integrity in dispersed systems,the results show that Ether-IoT can sustain high throughput in contexts with a large number of requests.展开更多
Currently,data security and privacy protection are becoming more and more important.Access control is a method of authorization for users through predefined policies.Token-based access control(TBAC)enhances the manage...Currently,data security and privacy protection are becoming more and more important.Access control is a method of authorization for users through predefined policies.Token-based access control(TBAC)enhances the manageability of authorization through the token.However,traditional access control policies lack the ability to dynamically adjust based on user access behavior.Incorporating user reputation evaluation into access control can provide valuable feedback to enhance system security and flexibility.As a result,this paper proposes a blockchain-empowered TBAC system and introduces a user reputation evaluation module to provide feedback on access control.The TBAC system divides the access control process into three stages:policy upload,token request,and resource request.The user reputation evaluation module evaluates the user’s token reputation and resource reputation for the token request and resource request stages of the TBAC system.The proposed system is implemented using the Hyperledger Fabric blockchain.The TBAC system is evaluated to prove that it has high processing performance.The user reputation evaluation model is proved to be more conservative and sensitive by comparative study with other methods.In addition,the security analysis shows that the TBAC system has a certain anti-attack ability and can maintain stable operation under the Distributed Denial of Service(DDoS)attack environment.展开更多
In the education archive sharing system,when performing homomorphic ciphertext retrieval on the storage server,there are problems such as low security of shared data,confusing parameter management,and weak access cont...In the education archive sharing system,when performing homomorphic ciphertext retrieval on the storage server,there are problems such as low security of shared data,confusing parameter management,and weak access control.This paper proposes an Education Archives Sharing and Access Control(EduASAC)system to solve these problems.The system research goal is to realize the sharing of security parameters,the execution of access control,and the recording of system behaviors based on the blockchain network,ensuring the legitimacy of shared membership and the security of education archives.At the same time,the system can be combined with most homomorphic ciphertext retrieval schemes running on the storage server,making the homomorphic ciphertext retrieval mechanism controllable.This paper focuses on the blockchain access control framework and specifically designs smart contracts that conform to the business logic of the EduASAC system.The former adopts a dual-mode access control mechanism combining Discretionary Access Control(DAC)and Mandatory Access Control(MAC)and improves the tagging mode after user permission verification based on the Authentication and Authorization for Constrained Environments(ACE)authorization framework of Open Authorization(OAuth)2.0;the latter is used in the system to vote on nodes to join requests,define access control policies,execute permission verification processes,store,and share system parameters,and standardize the behavior of member nodes.Finally,the EduASAC system realizes the encryption,storage,retrieval,sharing,and access control processes of education archives.To verify the performance of the system,simulation experiments were conducted.The results show that the EduASAC system can meet the high security needs of education archive sharing and ensure the system’s high throughput,low latency,fast decision-making,and fine-grained access control ability.展开更多
Cloud computing belongs to a set of policies,protocols,technologies through which one can access shared resources such as storage,applications,net-works,and services at relatively low cost.Despite the tremendous advan...Cloud computing belongs to a set of policies,protocols,technologies through which one can access shared resources such as storage,applications,net-works,and services at relatively low cost.Despite the tremendous advantages of cloud computing,one big threat which must be taken care of is data security in the cloud.There are a dozen of threats that we are being exposed to while avail-ing cloud services.Insufficient identity and access management,insecure inter-faces and Applications interfaces(APIs),hijacking,advanced persistent threats,data threats,and many more are certain security issues with the cloud platform.APIs and service providers face a huge challenge to ensure the security and integ-rity of both network and data.To overcome these challenges access control mechanisms are employed.Traditional access control mechanisms fail to monitor the user operations on the cloud platform and are prone to attacks like IP spoofing and other attacks that impact the integrity of the data.For ensuring data integrity on cloud platforms,access control mechanisms should go beyond authentication,identification,and authorization.Thus,in this work,a trust-based access control mechanism is proposed that analyzes the data of the user behavior,network beha-vior,demand behavior,and security behavior for computing trust value before granting user access.The method that computes thefinal trust value makes use of the fuzzy logic algorithm.The trust value-based policies are defined for the access control mechanism and based on the trust value outcome the access control is granted or denied.展开更多
As a new form of network,the Internet of things(IoT)is becoming more widely used in people’s lives.In this paper,related theoretical research and practical applications of the IoT are explored.The security of the IoT...As a new form of network,the Internet of things(IoT)is becoming more widely used in people’s lives.In this paper,related theoretical research and practical applications of the IoT are explored.The security of the IoT has become a hot research topic.Access controls are methods that control reasonable allocations of data and resources and ensure the security of the IoT.However,most access control systems do not dynamically assign users’rights.Additionally,with some access control systems,there is a risk of overstepping other user’s authority,and there may exist a central authority that is a single point of failure.Therefore,to solve these problems,this paper proposes a Task-Attribute-Based Access Control scheme for the IoT via blockchain that combines the access control technologies of both the IoT and blockchain.This model,which merges the advantages of task-based access controls and attribute-based access controls,is perfectly integrated with blockchain technology.This model uses hash functions and digital signature algorithms to ensure the authenticity and integrity of the data,and it can dynamically allocate users’minimum privileges and thus perfectly solves the single point of failure problem.The model is implemented using a Geth client and solidity code,and the simulation results demonstrate the effectiveness of the model.展开更多
Experience is a sociological concept and builds over time. In a broader sense, the human-centered equivalents of experience and trust apply to D2D interaction. Ubiquitous computing (UbiComp) embeds intelligence and co...Experience is a sociological concept and builds over time. In a broader sense, the human-centered equivalents of experience and trust apply to D2D interaction. Ubiquitous computing (UbiComp) embeds intelligence and computing capabilities in everyday objects to make them effectively communicate, share resources, and perform useful tasks. The safety of resources is a serious problem. As a result, authorization and access control in UbiComp is a significant challenge. Our work presents experience as an outcome of history (HI), reliability (RL), transitivity (TR), and Ubiquity (UB). This experience model is easily adaptable to a variety of self-regulating context-aware access control systems. This paper proposes a framework for Experience-Based Access Control (EX-BAC) with all major services provided by the model. EX-BAC extends attribute-based access control. It uses logical device type and experience as context parameters for policy design. When compared with the state-of-the-art, EX-BAC is efficient with respect to response time.展开更多
With the rapid development of computer technology, cloud-based services have become a hot topic. They not only provide users with convenience, but also bring many security issues, such as data sharing and privacy issu...With the rapid development of computer technology, cloud-based services have become a hot topic. They not only provide users with convenience, but also bring many security issues, such as data sharing and privacy issue. In this paper, we present an access control system with privilege separation based on privacy protection(PS-ACS). In the PS-ACS scheme, we divide users into private domain(PRD) and public domain(PUD) logically. In PRD, to achieve read access permission and write access permission, we adopt the Key-Aggregate Encryption(KAE) and the Improved Attribute-based Signature(IABS) respectively. In PUD, we construct a new multi-authority ciphertext policy attribute-based encryption(CP-ABE) scheme with efficient decryption to avoid the issues of single point of failure and complicated key distribution, and design an efficient attribute revocation method for it. The analysis and simulation result show that our scheme is feasible and superior to protect users' privacy in cloud-based services.展开更多
Traditional multi-level security(MLS)systems have the defect of centralizing authorized facilities,which is difficult to meet the security requirements of modern distributed peer-to-peer network architecture.Blockchai...Traditional multi-level security(MLS)systems have the defect of centralizing authorized facilities,which is difficult to meet the security requirements of modern distributed peer-to-peer network architecture.Blockchain is widely used in the field of access control with its decentralization,traceability and non-defective modification.Combining the blockchain technology and the Bell-LaPadula model,we propose a new access control model,named BCBLPM,for MLS environment.The“multi-chain”blockchain architecture is used for dividing resources into isolated access domains,providing a fine-grained data protection mechanism.The access control policies are implemented by smart contracts deployed in each access domain,so that the side chains of different access domains storage access records from outside and maintain the integrity of the records.Finally,we implement the BC-BLPM prototype system using the Hyperledger Fabric.The experimental and analytical results show that the model can adapt well to the needs of multi-level security environment,and it has the feasibility of application in actual scenarios.展开更多
In order to solve the problems of data sharing security and policy conflict in multicloud storage systems(MCSS), this work designs an attribute mapping mechanism that extends ciphertext policy attribute-based encrypti...In order to solve the problems of data sharing security and policy conflict in multicloud storage systems(MCSS), this work designs an attribute mapping mechanism that extends ciphertext policy attribute-based encryption(CP-ABE), and proposes a multi-authority CP-ABE access control model that satisfies the need for multicloud storage access control. The mapping mechanism mainly involves the tree structure of CP-ABE and provides support for the types of attribute values. The framework and workflow of the model are described in detail. The effectiveness of the model is verified by building a simple prototype system, and the performance of the prototype system is analyzed. The results suggest that the proposed model is of theoretical and practical significance for access control research in MCSS. The CP-ABE has better performance in terms of computation time overhead than other models.展开更多
In the security and privacy fields,Access Control(AC)systems are viewed as the fundamental aspects of networking security mechanisms.Enforcing AC becomes even more challenging when researchers and data analysts have t...In the security and privacy fields,Access Control(AC)systems are viewed as the fundamental aspects of networking security mechanisms.Enforcing AC becomes even more challenging when researchers and data analysts have to analyze complex and distributed Big Data(BD)processing cluster frameworks,which are adopted to manage yottabyte of unstructured sensitive data.For instance,Big Data systems’privacy and security restrictions are most likely to failure due to the malformed AC policy configurations.Furthermore,BD systems were initially developed toped to take care of some of the DB issues to address BD challenges and many of these dealt with the“three Vs”(Velocity,Volume,and Variety)attributes,without planning security consideration,which are considered to be patch work.Some of the BD“three Vs”characteristics,such as distributed computing,fragment,redundant data and node-to node communication,each with its own security challenges,complicate even more the applicability of AC in BD.This paper gives an overview of the latest security and privacy challenges in BD AC systems.Furthermore,it analyzes and compares some of the latest AC research frameworks to reduce privacy and security issues in distributed BD systems,which very few enforce AC in a cost-effective and in a timely manner.Moreover,this work discusses some of the future research methodologies and improvements for BD AC systems.This study is valuable asset for Artificial Intelligence(AI)researchers,DB developers and DB analysts who need the latest AC security and privacy research perspective before using and/or improving a current BD AC framework.展开更多
Data privacy is important to the security of our society,and enabling authorized users to query this data efficiently is facing more challenge.Recently,blockchain has gained extensive attention with its prominent char...Data privacy is important to the security of our society,and enabling authorized users to query this data efficiently is facing more challenge.Recently,blockchain has gained extensive attention with its prominent characteristics as public,distributed,decentration and chronological characteristics.However,the transaction information on the blockchain is open to all nodes,the transaction information update operation is even more transparent.And the leakage of transaction information will cause huge losses to the transaction party.In response to these problems,this paper combines hierarchical attribute encryption with linear secret sharing,and proposes a blockchain data privacy protection control scheme based on searchable attribute encryption,which solves the privacy exposure problem in traditional blockchain transactions.The user’s access control is implemented by the verification nodes,which avoids the security risks of submitting private keys and access structures to the blockchain network.Associating the private key component with the random identity of the user node in the blockchain can solve the collusion problem.In addition,authorized users can quickly search and supervise transaction information through searchable encryption.The improved algorithm ensures the security of keywords.Finally,based on the DBDH hypothesis,the security of the scheme is proved in the random prediction model.展开更多
Efficient response speed and information processing speed are among the characteristics of mobile edge computing(MEC).However,MEC easily causes information leakage and loss problems because it requires frequent data e...Efficient response speed and information processing speed are among the characteristics of mobile edge computing(MEC).However,MEC easily causes information leakage and loss problems because it requires frequent data exchange.This work proposes an anonymous privacy data protection and access control scheme based on elliptic curve cryptography(ECC)and bilinear pairing to protect the communication security of the MEC.In the proposed scheme,the information sender encrypts private information through the ECC algorithm,and the information receiver uses its own key information and bilinear pairing to extract and verify the identity of the information sender.During each round of communication,the proposed scheme uses timestamps and random numbers to ensure the freshness of each round of conversation.Experimental results show that the proposed scheme has good security performance and can provide data privacy protection,integrity verification,and traceability for the communication process of MEC.The proposed scheme has a lower cost than other related schemes.The communication and computational cost of the proposed scheme are reduced by 31.08% and 22.31% on average compared with those of the other related schemes.展开更多
Internet of Things(IoT)devices facilitate intelligent service delivery in a broad range of settings,such as smart offices,homes and cities.However,the existing IoT access control solutions are mainly based on conventi...Internet of Things(IoT)devices facilitate intelligent service delivery in a broad range of settings,such as smart offices,homes and cities.However,the existing IoT access control solutions are mainly based on conventional identity management schemes and use centralized architectures.There are knowm security and privacy limitations with such schemes and architectures,such as the single-point failure or surveillance(e.g.,device tracking).Hence,in this paper,we present an architecture for capability-based IoT access control utilizing the blockchain and decentralized identifiers to manage the identity and access control for IoT devices.Then,we propose a protocol to provide a systematic view of system interactions,to improve security.We also implement a proof-of-concept prototype of the proposed approach and evaluate the prototype using a real-world use case.Our evaluation results show that the proposed solution is feasible,secure,and scalable.展开更多
Access control is one of the core problems in data management system.In this paper,the system requirements were described in three aspects:the traditional access control model,the access control model in the Internet ...Access control is one of the core problems in data management system.In this paper,the system requirements were described in three aspects:the traditional access control model,the access control model in the Internet era and the access control model in the cloud computing environment.Meanwhile,the corresponding major models were listed and their characteristics and problems were analyzed.Finally,the development trend of the corresponding model was proposed.展开更多
针对IEEE802.11e Medium Access Control层的QoS机制高负载时存在远端节点冲突和低优先级业务资源被耗尽的问题,提出在牺牲较小带宽的基础上增加一条忙音信道,取代CTS帧在数据信道上的广播,减少远端节点的冲突.仿真结果表明,该方案具有...针对IEEE802.11e Medium Access Control层的QoS机制高负载时存在远端节点冲突和低优先级业务资源被耗尽的问题,提出在牺牲较小带宽的基础上增加一条忙音信道,取代CTS帧在数据信道上的广播,减少远端节点的冲突.仿真结果表明,该方案具有较小的冲突概率,有效地减少了远端节点冲突.同时提出一个解决公平性问题的新思路:在避退时间发送忙音抢占信道,以期提高低优先级业务的接入概率.展开更多
Access control has made a long way from 1960s. With the advent changes of technologies pertaining to location transparency in storage of data, there arises different access control scenarios. Cloud storage, the predom...Access control has made a long way from 1960s. With the advent changes of technologies pertaining to location transparency in storage of data, there arises different access control scenarios. Cloud storage, the predominant storage that is being in use currently, also paves way to various access control problems. Though there are various access control mechanisms such as RBAC, ABAC, they are designed on the user’s perspective such as the role held by the user or other attributes assigned to the user. A new access control mechanism called object relationship based access control (RoBAC) has been developed based on the relations held among the users. The policy decision of access control is based on the relationship among the classes followed in the Java programming. Results have shown that this model best suits various scenarios in the cloud environment, and it also shows that the time for making decision either to allow or to deny is reduced compared to the existing system.展开更多
The traditional centralized data sharing systems have potential risks such as single point of failures and excessive working load on the central node.As a distributed and collaborative alternative,approaches based upo...The traditional centralized data sharing systems have potential risks such as single point of failures and excessive working load on the central node.As a distributed and collaborative alternative,approaches based upon blockchain have been explored recently for Internet of Things(IoTs).However,the access from a legitimate user may be denied without the pre-defined policy and data update on the blockchain could be costly to the owners.In this paper,we first address these issues by incorporating the Accountable Subgroup Multi-Signature(ASM)algorithm into the Attribute-based Access Control(ABAC)method with Policy Smart Contract,to provide a finegrained and flexible solution.Next,we propose a policy-based Chameleon Hash algorithm that allows the data to be updated in a reliable and convenient way by the authorized users.Finally,we evaluate our work by comparing its performance with the benchmarks.The results demonstrate significant improvement on the effectiveness and efficiency.展开更多
Policy conflicts may cause substantial economic losses.Although a large amount of effort has been spent on detecting intra-domain policy conflict,it can not detect conflicts of heterogeneous policies.In this paper,con...Policy conflicts may cause substantial economic losses.Although a large amount of effort has been spent on detecting intra-domain policy conflict,it can not detect conflicts of heterogeneous policies.In this paper,considering background knowledge,we propose a conflict detection mechanism to search and locate conflicts of heterogeneous policies.First,we propose a general access control model to describe authorization mechanisms of cloud service and a translation scheme designed to translate a cloud service policy to an Extensible Access Control Markup Language(XACML)policy.Then the scheme based on Multi-terminal Multi-data-type Interval Decision Diagram(MTMIDD)and Extended MTMIDD(X-MTMIDD)is designed to represent XACML policy and search the conflict among heterogeneous policies.To reduce the rate of false positives,the description logic is used to represent XACML policy and eliminate false conflicts.Experimental results show the efficiency of our scheme.展开更多
基金supported by the National Natural Science Foundation of China Project(No.62302540)The Open Foundation of Henan Key Laboratory of Cyberspace Situation Awareness(No.HNTS2022020)+2 种基金Natural Science Foundation of Henan Province Project(No.232300420422)The Natural Science Foundation of Zhongyuan University of Technology(No.K2023QN018)Key Research and Promotion Project of Henan Province in 2021(No.212102310480).
文摘A deep learning access controlmodel based on user preferences is proposed to address the issue of personal privacy leakage in social networks.Firstly,socialusers andsocialdata entities are extractedfromthe social networkandused to construct homogeneous and heterogeneous graphs.Secondly,a graph neural networkmodel is designed based on user daily social behavior and daily social data to simulate the dissemination and changes of user social preferences and user personal preferences in the social network.Then,high-order neighbor nodes,hidden neighbor nodes,displayed neighbor nodes,and social data nodes are used to update user nodes to expand the depth and breadth of user preferences.Finally,a multi-layer attention network is used to classify user nodes in the homogeneous graph into two classes:allow access and deny access.The fine-grained access control problem in social networks is transformed into a node classification problem in a graph neural network.The model is validated using a dataset and compared with other methods without losing generality.The model improved accuracy by 2.18%compared to the baseline method GraphSAGE,and improved F1 score by 1.45%compared to the baseline method,verifying the effectiveness of the model.
文摘The Internet of Things(IoT)access controlmechanism may encounter security issues such as single point of failure and data tampering.To address these issues,a blockchain-based IoT reputation value attribute access control scheme is proposed.Firstly,writing the reputation value as an attribute into the access control policy,and then deploying the access control policy in the smart contract of the blockchain system can enable the system to provide more fine-grained access control;Secondly,storing a large amount of resources fromthe Internet of Things in Inter Planetary File System(IPFS)to improve system throughput;Finally,map resource access operations to qualification tokens to improve the performance of the access control system.Complete simulation experiments based on the Hyperledger Fabric platform.Fromthe simulation experimental results,it can be seen that the access control system can achieve more fine-grained and dynamic access control while maintaining high throughput and low time delay,providing sufficient reliability and security for access control of IoT devices.
基金This work was supported by Universiti Kebangsaan Malaysia under“Dana Pecutan Penerbitan FTSM 2022,Dana Softam 2022”。
文摘Several unique characteristics of Internet of Things(IoT)devices,such as distributed deployment and limited storage,make it challenging for standard centralized access control systems to enable access control in today’s large-scale IoT ecosystem.To solve these challenges,this study presents an IoT access control system called Ether-IoT based on the Ethereum Blockchain(BC)infrastructure with Attribute-Based Access Control(ABAC).Access Contract(AC),Cache Contract(CC),Device Contract(DC),and Policy Contract(PC)are the four central smart contracts(SCs)that are included in the proposed system.CC offers a way to save user characteristics in a local cache system to avoid delays during transactions between BC and IoT devices.AC is the fundamental program users typically need to run to build an access control technique.DC offers a means for storing the resource data created by devices and a method for querying that data.PC offers administrative settings to handle ABAC policies on users’behalf.Ether-IoT,combined with ABAC and the BC,enables IoT access control management that is decentralized,fine-grained and dynamically scalable.This research gives a real-world case study to illustrate the suggested framework’s implementation.In the end,a simulation experiment is performed to evaluate the system’s performance.To ensure data integrity in dispersed systems,the results show that Ether-IoT can sustain high throughput in contexts with a large number of requests.
基金supported by NSFC under Grant No.62341102National Key R&D Program of China under Grant No.2018YFA0701604.
文摘Currently,data security and privacy protection are becoming more and more important.Access control is a method of authorization for users through predefined policies.Token-based access control(TBAC)enhances the manageability of authorization through the token.However,traditional access control policies lack the ability to dynamically adjust based on user access behavior.Incorporating user reputation evaluation into access control can provide valuable feedback to enhance system security and flexibility.As a result,this paper proposes a blockchain-empowered TBAC system and introduces a user reputation evaluation module to provide feedback on access control.The TBAC system divides the access control process into three stages:policy upload,token request,and resource request.The user reputation evaluation module evaluates the user’s token reputation and resource reputation for the token request and resource request stages of the TBAC system.The proposed system is implemented using the Hyperledger Fabric blockchain.The TBAC system is evaluated to prove that it has high processing performance.The user reputation evaluation model is proved to be more conservative and sensitive by comparative study with other methods.In addition,the security analysis shows that the TBAC system has a certain anti-attack ability and can maintain stable operation under the Distributed Denial of Service(DDoS)attack environment.
基金supported by the Fundamental Research Funds for the Central Universities.Nos.3282023017,328202251.RL H received the grant.
文摘In the education archive sharing system,when performing homomorphic ciphertext retrieval on the storage server,there are problems such as low security of shared data,confusing parameter management,and weak access control.This paper proposes an Education Archives Sharing and Access Control(EduASAC)system to solve these problems.The system research goal is to realize the sharing of security parameters,the execution of access control,and the recording of system behaviors based on the blockchain network,ensuring the legitimacy of shared membership and the security of education archives.At the same time,the system can be combined with most homomorphic ciphertext retrieval schemes running on the storage server,making the homomorphic ciphertext retrieval mechanism controllable.This paper focuses on the blockchain access control framework and specifically designs smart contracts that conform to the business logic of the EduASAC system.The former adopts a dual-mode access control mechanism combining Discretionary Access Control(DAC)and Mandatory Access Control(MAC)and improves the tagging mode after user permission verification based on the Authentication and Authorization for Constrained Environments(ACE)authorization framework of Open Authorization(OAuth)2.0;the latter is used in the system to vote on nodes to join requests,define access control policies,execute permission verification processes,store,and share system parameters,and standardize the behavior of member nodes.Finally,the EduASAC system realizes the encryption,storage,retrieval,sharing,and access control processes of education archives.To verify the performance of the system,simulation experiments were conducted.The results show that the EduASAC system can meet the high security needs of education archive sharing and ensure the system’s high throughput,low latency,fast decision-making,and fine-grained access control ability.
文摘Cloud computing belongs to a set of policies,protocols,technologies through which one can access shared resources such as storage,applications,net-works,and services at relatively low cost.Despite the tremendous advantages of cloud computing,one big threat which must be taken care of is data security in the cloud.There are a dozen of threats that we are being exposed to while avail-ing cloud services.Insufficient identity and access management,insecure inter-faces and Applications interfaces(APIs),hijacking,advanced persistent threats,data threats,and many more are certain security issues with the cloud platform.APIs and service providers face a huge challenge to ensure the security and integ-rity of both network and data.To overcome these challenges access control mechanisms are employed.Traditional access control mechanisms fail to monitor the user operations on the cloud platform and are prone to attacks like IP spoofing and other attacks that impact the integrity of the data.For ensuring data integrity on cloud platforms,access control mechanisms should go beyond authentication,identification,and authorization.Thus,in this work,a trust-based access control mechanism is proposed that analyzes the data of the user behavior,network beha-vior,demand behavior,and security behavior for computing trust value before granting user access.The method that computes thefinal trust value makes use of the fuzzy logic algorithm.The trust value-based policies are defined for the access control mechanism and based on the trust value outcome the access control is granted or denied.
基金supported in part by the National Key Research and Development Project of China(No.2017YFB0802302)the Science and Technology Support Project of Sichuan Province(No.2016FZ0112,No.2017GZ0314,No.2018GZ0204)+2 种基金the Academic and Technical Leaders Training Funding Support Projects of Sichuan Province(No.2016120080102643)the Application Foundation Project of Sichuan Province(No.2017JY0168)the Science and Technology Project of Chengdu(No.2017-RK00-00103-ZF,No.2016-HM01-00217-SF).
文摘As a new form of network,the Internet of things(IoT)is becoming more widely used in people’s lives.In this paper,related theoretical research and practical applications of the IoT are explored.The security of the IoT has become a hot research topic.Access controls are methods that control reasonable allocations of data and resources and ensure the security of the IoT.However,most access control systems do not dynamically assign users’rights.Additionally,with some access control systems,there is a risk of overstepping other user’s authority,and there may exist a central authority that is a single point of failure.Therefore,to solve these problems,this paper proposes a Task-Attribute-Based Access Control scheme for the IoT via blockchain that combines the access control technologies of both the IoT and blockchain.This model,which merges the advantages of task-based access controls and attribute-based access controls,is perfectly integrated with blockchain technology.This model uses hash functions and digital signature algorithms to ensure the authenticity and integrity of the data,and it can dynamically allocate users’minimum privileges and thus perfectly solves the single point of failure problem.The model is implemented using a Geth client and solidity code,and the simulation results demonstrate the effectiveness of the model.
文摘Experience is a sociological concept and builds over time. In a broader sense, the human-centered equivalents of experience and trust apply to D2D interaction. Ubiquitous computing (UbiComp) embeds intelligence and computing capabilities in everyday objects to make them effectively communicate, share resources, and perform useful tasks. The safety of resources is a serious problem. As a result, authorization and access control in UbiComp is a significant challenge. Our work presents experience as an outcome of history (HI), reliability (RL), transitivity (TR), and Ubiquity (UB). This experience model is easily adaptable to a variety of self-regulating context-aware access control systems. This paper proposes a framework for Experience-Based Access Control (EX-BAC) with all major services provided by the model. EX-BAC extends attribute-based access control. It uses logical device type and experience as context parameters for policy design. When compared with the state-of-the-art, EX-BAC is efficient with respect to response time.
基金financially supported by the National Natural Science Foundation of China(No.61303216,No.61272457,No.U1401251,and No.61373172)the National High Technology Research and Development Program of China(863 Program)(No.2012AA013102)National 111 Program of China B16037 and B08038
文摘With the rapid development of computer technology, cloud-based services have become a hot topic. They not only provide users with convenience, but also bring many security issues, such as data sharing and privacy issue. In this paper, we present an access control system with privilege separation based on privacy protection(PS-ACS). In the PS-ACS scheme, we divide users into private domain(PRD) and public domain(PUD) logically. In PRD, to achieve read access permission and write access permission, we adopt the Key-Aggregate Encryption(KAE) and the Improved Attribute-based Signature(IABS) respectively. In PUD, we construct a new multi-authority ciphertext policy attribute-based encryption(CP-ABE) scheme with efficient decryption to avoid the issues of single point of failure and complicated key distribution, and design an efficient attribute revocation method for it. The analysis and simulation result show that our scheme is feasible and superior to protect users' privacy in cloud-based services.
文摘Traditional multi-level security(MLS)systems have the defect of centralizing authorized facilities,which is difficult to meet the security requirements of modern distributed peer-to-peer network architecture.Blockchain is widely used in the field of access control with its decentralization,traceability and non-defective modification.Combining the blockchain technology and the Bell-LaPadula model,we propose a new access control model,named BCBLPM,for MLS environment.The“multi-chain”blockchain architecture is used for dividing resources into isolated access domains,providing a fine-grained data protection mechanism.The access control policies are implemented by smart contracts deployed in each access domain,so that the side chains of different access domains storage access records from outside and maintain the integrity of the records.Finally,we implement the BC-BLPM prototype system using the Hyperledger Fabric.The experimental and analytical results show that the model can adapt well to the needs of multi-level security environment,and it has the feasibility of application in actual scenarios.
基金supported in part by the Basic Public Welfare Research Program of Zhejiang Province under Grant LGF19F020006 LGF20G030001 GF20G030006the NSFC-Zhejiang Joint Fund for the Integration of Industrialization and Informatization under Grant U1509219。
文摘In order to solve the problems of data sharing security and policy conflict in multicloud storage systems(MCSS), this work designs an attribute mapping mechanism that extends ciphertext policy attribute-based encryption(CP-ABE), and proposes a multi-authority CP-ABE access control model that satisfies the need for multicloud storage access control. The mapping mechanism mainly involves the tree structure of CP-ABE and provides support for the types of attribute values. The framework and workflow of the model are described in detail. The effectiveness of the model is verified by building a simple prototype system, and the performance of the prototype system is analyzed. The results suggest that the proposed model is of theoretical and practical significance for access control research in MCSS. The CP-ABE has better performance in terms of computation time overhead than other models.
文摘In the security and privacy fields,Access Control(AC)systems are viewed as the fundamental aspects of networking security mechanisms.Enforcing AC becomes even more challenging when researchers and data analysts have to analyze complex and distributed Big Data(BD)processing cluster frameworks,which are adopted to manage yottabyte of unstructured sensitive data.For instance,Big Data systems’privacy and security restrictions are most likely to failure due to the malformed AC policy configurations.Furthermore,BD systems were initially developed toped to take care of some of the DB issues to address BD challenges and many of these dealt with the“three Vs”(Velocity,Volume,and Variety)attributes,without planning security consideration,which are considered to be patch work.Some of the BD“three Vs”characteristics,such as distributed computing,fragment,redundant data and node-to node communication,each with its own security challenges,complicate even more the applicability of AC in BD.This paper gives an overview of the latest security and privacy challenges in BD AC systems.Furthermore,it analyzes and compares some of the latest AC research frameworks to reduce privacy and security issues in distributed BD systems,which very few enforce AC in a cost-effective and in a timely manner.Moreover,this work discusses some of the future research methodologies and improvements for BD AC systems.This study is valuable asset for Artificial Intelligence(AI)researchers,DB developers and DB analysts who need the latest AC security and privacy research perspective before using and/or improving a current BD AC framework.
基金The National Natural Science Foundation of China(No.61462060,No.61762060)The Network and Information Security Innovation Team of Gansu Provincial Department of Education Lanzhou University of Technology(No.2017C-05).
文摘Data privacy is important to the security of our society,and enabling authorized users to query this data efficiently is facing more challenge.Recently,blockchain has gained extensive attention with its prominent characteristics as public,distributed,decentration and chronological characteristics.However,the transaction information on the blockchain is open to all nodes,the transaction information update operation is even more transparent.And the leakage of transaction information will cause huge losses to the transaction party.In response to these problems,this paper combines hierarchical attribute encryption with linear secret sharing,and proposes a blockchain data privacy protection control scheme based on searchable attribute encryption,which solves the privacy exposure problem in traditional blockchain transactions.The user’s access control is implemented by the verification nodes,which avoids the security risks of submitting private keys and access structures to the blockchain network.Associating the private key component with the random identity of the user node in the blockchain can solve the collusion problem.In addition,authorized users can quickly search and supervise transaction information through searchable encryption.The improved algorithm ensures the security of keywords.Finally,based on the DBDH hypothesis,the security of the scheme is proved in the random prediction model.
基金partially supported by the National Natural Science Foundation of China under Grant 62072170 and Grant 62177047the Fundamental Research Funds for the Central Universities under Grant 531118010527+1 种基金the Science and Technology Key Projects of Hunan Province under Grant 2022GK2015the Hunan Provincial Natural Science Foundation of China under Grant 2021JJ30141.
文摘Efficient response speed and information processing speed are among the characteristics of mobile edge computing(MEC).However,MEC easily causes information leakage and loss problems because it requires frequent data exchange.This work proposes an anonymous privacy data protection and access control scheme based on elliptic curve cryptography(ECC)and bilinear pairing to protect the communication security of the MEC.In the proposed scheme,the information sender encrypts private information through the ECC algorithm,and the information receiver uses its own key information and bilinear pairing to extract and verify the identity of the information sender.During each round of communication,the proposed scheme uses timestamps and random numbers to ensure the freshness of each round of conversation.Experimental results show that the proposed scheme has good security performance and can provide data privacy protection,integrity verification,and traceability for the communication process of MEC.The proposed scheme has a lower cost than other related schemes.The communication and computational cost of the proposed scheme are reduced by 31.08% and 22.31% on average compared with those of the other related schemes.
文摘Internet of Things(IoT)devices facilitate intelligent service delivery in a broad range of settings,such as smart offices,homes and cities.However,the existing IoT access control solutions are mainly based on conventional identity management schemes and use centralized architectures.There are knowm security and privacy limitations with such schemes and architectures,such as the single-point failure or surveillance(e.g.,device tracking).Hence,in this paper,we present an architecture for capability-based IoT access control utilizing the blockchain and decentralized identifiers to manage the identity and access control for IoT devices.Then,we propose a protocol to provide a systematic view of system interactions,to improve security.We also implement a proof-of-concept prototype of the proposed approach and evaluate the prototype using a real-world use case.Our evaluation results show that the proposed solution is feasible,secure,and scalable.
文摘Access control is one of the core problems in data management system.In this paper,the system requirements were described in three aspects:the traditional access control model,the access control model in the Internet era and the access control model in the cloud computing environment.Meanwhile,the corresponding major models were listed and their characteristics and problems were analyzed.Finally,the development trend of the corresponding model was proposed.
文摘针对IEEE802.11e Medium Access Control层的QoS机制高负载时存在远端节点冲突和低优先级业务资源被耗尽的问题,提出在牺牲较小带宽的基础上增加一条忙音信道,取代CTS帧在数据信道上的广播,减少远端节点的冲突.仿真结果表明,该方案具有较小的冲突概率,有效地减少了远端节点冲突.同时提出一个解决公平性问题的新思路:在避退时间发送忙音抢占信道,以期提高低优先级业务的接入概率.
文摘Access control has made a long way from 1960s. With the advent changes of technologies pertaining to location transparency in storage of data, there arises different access control scenarios. Cloud storage, the predominant storage that is being in use currently, also paves way to various access control problems. Though there are various access control mechanisms such as RBAC, ABAC, they are designed on the user’s perspective such as the role held by the user or other attributes assigned to the user. A new access control mechanism called object relationship based access control (RoBAC) has been developed based on the relations held among the users. The policy decision of access control is based on the relationship among the classes followed in the Java programming. Results have shown that this model best suits various scenarios in the cloud environment, and it also shows that the time for making decision either to allow or to deny is reduced compared to the existing system.
基金supported by the National Natural Science Foundation of China under Grant 61972148。
文摘The traditional centralized data sharing systems have potential risks such as single point of failures and excessive working load on the central node.As a distributed and collaborative alternative,approaches based upon blockchain have been explored recently for Internet of Things(IoTs).However,the access from a legitimate user may be denied without the pre-defined policy and data update on the blockchain could be costly to the owners.In this paper,we first address these issues by incorporating the Accountable Subgroup Multi-Signature(ASM)algorithm into the Attribute-based Access Control(ABAC)method with Policy Smart Contract,to provide a finegrained and flexible solution.Next,we propose a policy-based Chameleon Hash algorithm that allows the data to be updated in a reliable and convenient way by the authorized users.Finally,we evaluate our work by comparing its performance with the benchmarks.The results demonstrate significant improvement on the effectiveness and efficiency.
基金This work has been funded by the National Natural Science Foundation of China(No.U1836203)the Shandong Provincial Key Research and Development Program(2019JZZY20127).
文摘Policy conflicts may cause substantial economic losses.Although a large amount of effort has been spent on detecting intra-domain policy conflict,it can not detect conflicts of heterogeneous policies.In this paper,considering background knowledge,we propose a conflict detection mechanism to search and locate conflicts of heterogeneous policies.First,we propose a general access control model to describe authorization mechanisms of cloud service and a translation scheme designed to translate a cloud service policy to an Extensible Access Control Markup Language(XACML)policy.Then the scheme based on Multi-terminal Multi-data-type Interval Decision Diagram(MTMIDD)and Extended MTMIDD(X-MTMIDD)is designed to represent XACML policy and search the conflict among heterogeneous policies.To reduce the rate of false positives,the description logic is used to represent XACML policy and eliminate false conflicts.Experimental results show the efficiency of our scheme.
