Research on ABAC Access Control Based on Big Data Platform

In the environment of big data,the traditional access control lacks effective and flexible access mechanism.Based on attribute access control,this paper proposes a HBMC-ABAC big data access control framework.It solves the problems of difficult authority change,complex management,over-authorization and lack of authorization in big data environment.At the same time,binary mapping codes are proposed to solve the problem of low efficiency of policy retrieval in traditional ABAC.Through experimental analysis,the results show that our proposed HBMC-ABAC model can meet the current large and complex environment of big data.

Review of Access Control Model

Access control is one of the core problems in data management system.In this paper,the system requirements were described in three aspects:the traditional access control model,the access control model in the Internet era and the access control model in the cloud computing environment.Meanwhile,the corresponding major models were listed and their characteristics and problems were analyzed.Finally,the development trend of the corresponding model was proposed.

A Dynamic Access Control Method for SDN

Aiming at the problem that network topology changes frequently in SDN (Software Defined Network) environment and it is difficult to implement fine-grained access control, utilizing the characteristics of SDN transfer control separation and software programming, the ABAC model (Attribute-Based Access Control) is extended by introducing security level, and the security level is defined for the attributes of subject and object to establish the access mapping relationship based on mandatory access rules. At the same time, with secure access path as SDN access control attribute, a dynamic generation method of access control path based on PSO (Particle Swarm Optimization) algorithm is designed to ensure the security of access data flow. The prototype system experiments show that the proposed method takes into account the fine-grained and dynamic requirements of SDN access control, and improves the access security of SDN while ensuring the access efficiency.

Ether-IoT:A Realtime Lightweight and Scalable Blockchain-Enabled Cache Algorithm for IoT Access Control

Several unique characteristics of Internet of Things(IoT)devices,such as distributed deployment and limited storage,make it challenging for standard centralized access control systems to enable access control in today’s large-scale IoT ecosystem.To solve these challenges,this study presents an IoT access control system called Ether-IoT based on the Ethereum Blockchain(BC)infrastructure with Attribute-Based Access Control(ABAC).Access Contract(AC),Cache Contract(CC),Device Contract(DC),and Policy Contract(PC)are the four central smart contracts(SCs)that are included in the proposed system.CC offers a way to save user characteristics in a local cache system to avoid delays during transactions between BC and IoT devices.AC is the fundamental program users typically need to run to build an access control technique.DC offers a means for storing the resource data created by devices and a method for querying that data.PC offers administrative settings to handle ABAC policies on users’behalf.Ether-IoT,combined with ABAC and the BC,enables IoT access control management that is decentralized,fine-grained and dynamically scalable.This research gives a real-world case study to illustrate the suggested framework’s implementation.In the end,a simulation experiment is performed to evaluate the system’s performance.To ensure data integrity in dispersed systems,the results show that Ether-IoT can sustain high throughput in contexts with a large number of requests.

Novel dynamic anti-collusion ciphertext policy attribute-based encryption scheme in 5G D2D environment

To share data securely with secure attribute revocation,anti-collusion,and dynamic user management in the 5G device-to-device(D2D)environment,a novel dynamic anti-collusion ciphertext policy attribute-based encryption(NDA-CP-ABE)scheme in the 5G D2D environment is proposed.On the basis of the ciphertext policy attribute-based encryption algorithm,fine-grained access control and secure attribute revocation are realized,and the confidentiality of data is guaranteed.A polynomial function is adopted in the ciphertext generation phase to realize dynamic user management.A random number is used to prevent a collusion attack among the legitimate user equipment(UE),revoked UE,and external network attackers.Finally,on the basis of the Diffie-Hellman problem,the NDA-CP-ABE scheme is formally proved,and the simulation performances are compared with those of similar schemes.The results show that data can be securely shared through a D2D channel with secure attribute revocation,anti-collusion,and dynamic user management.Moreover,compared with similar schemes,the NDA-CP-ABE scheme has higher efficiency in encryption,decryption,and storage.

Attribute-Based Secure Data Sharing with Efficient Revocation in Fog Computing

Fog computing is a concept that extends the paradigm of cloud computing to the network edge. The goal of fog computing is to situate resources in the vicinity of end users. As with cloud computing, fog computing provides storage services. The data owners can store their confidential data in many fog nodes, which could cause more challenges for data sharing security. In this paper, we present a novel architecture for data sharing in a fog environment. We explore the benefits of fog computing in addressing one-to-many data sharing applications. This architecture sought to outperform the cloud-based architecture and to ensure further enhancements to system performance, especially from the perspective of security. We will address the security challenges of data sharing, such as fine-grained access control, data confidentiality, collusion resistance, scalability, and the issue of user revocation. Keeping these issues in mind, we will secure data sharing in fog computing by combining attributebased encryption and proxy re-encryption techniques. Findings of this study indicate that our system has the response and processing time faster than classical cloud systems. Further, experimental results show that our system has an efficient user revocation mechanism, and that it provides high scalability and sharing of data in real time with low latency.

访问控制日志驱动的ABAC策略自动提取与优化增强

为解决基于属性的访问控制(ABAC)策略自动提取的低质量问题,提出一种基于访问控制日志驱动的ABAC策略自动提取与优化增强方法。首先,构建集成学习模型,将用户行为和权限分配映射为策略逻辑树,识别访问授权决策的关联性及潜在规律,初步生成策略;其次,通过单属性优化和规则二元约简两种方法深度优化策略,简化策略结构并压缩策略规模;最后,提出基于误差度量的规则冲突解决方法,以增强互斥、完备的ABAC策略,并进一步基于多目标优化的策略性能平衡算法实现不同场景需求的最优模型选择。分别在平衡数据集和稀疏数据集上进行测试和验证,实验结果表明,该方法在平衡数据集上的准确性最高可达96.69%,可将策略规模压缩至原来的19.7%。在稀疏数据集上的准确性最高可达87.74%,可将策略规模压缩至原来的23%。此方法兼顾策略的预测精度与结构的简洁性,同时适用于平衡日志和稀疏日志,确保访问控制系统在实际应用中能够实现高效、安全的访问授权管理。

Authorized Attribute-Based Encryption Multi-Keywords Search with Policy Updating

Attribute-based encryption is cryptographic techniques that provide flexible data access control to encrypted data content in cloud storage.Each trusted authority needs proper management and distribution of secret keys to the user’s to only authorized user’s attributes.However existing schemes cannot be applied multiple authority that supports only a single keywords search compare to multi keywords search high computational burden or inefficient attribute’s revocation.In this paper,a ciphertext policy attribute-based encryption(CP-ABE)scheme has been proposed which focuses on multi-keyword search and attribute revocation by new policy updating feathers under multiple authorities and central authority.The data owner encrypts the keywords index under the initial access policy.Moreover,this paper addresses further issues such as data access,search policy,and confidentiality against unauthorized users.Finally,we provide the correctness analysis,performance analysis and security proof for chosen keywords attack and search trapdoor in general group model using DBDH and DLIN assumption.

An attribute-based access control scheme using blockchain technology for IoT data protection

With the wide application of the Internet of Things(IoT),storing large amounts of IoT data and protecting data privacy has become a meaningful issue.In general,the access control mechanism is used to prevent illegal users from accessing private data.However,traditional data access control schemes face some non-ignorable problems,such as only supporting coarse-grained access control,the risk of centralization,and high trust issues.In this paper,an attribute-based data access control scheme using blockchain technology is proposed.To address these problems,attribute-based encryption(ABE)has become a promising solution for encrypted data access control.Firstly,we utilize blockchain technology to construct a decentralized access control scheme,which can grant data access with transparency and traceability.Furthermore,our scheme also guarantees the privacy of policies and attributes on the blockchain network.Secondly,we optimize an ABE scheme,which makes the size of system parameters smaller and improves the efficiency of algorithms.These optimizations enable our proposed scheme supports large attribute universe requirements in IoT environments.Thirdly,to prohibit attribute impersonation and attribute replay attacks,we design a challenge-response mechanism to verify the ownership of attributes.Finally,we evaluate the security and performance of the scheme.And comparisons with other related schemes show the advantages of our proposed scheme.Compared to existing schemes,our scheme has more comprehensive advantages,such as supporting a large universe,full security,expressive policy,and policy hiding.

Automated extraction of attributes from natural language attribute-based access control(ABAC)Policies

The National Institute of Standards and Technology(NIST)has identified natural language policies as the preferred expression of policy and implicitly called for an automated translation of ABAC natural language access control policy(NLACP)to a machine-readable form.To study the automation process,we consider the hierarchical ABAC model as our reference model since it better reflects the requirements of real-world organizations.Therefore,this paper focuses on the questions of:how can we automatically infer the hierarchical structure of an ABAC model given NLACPs;and,how can we extract and define the set of authorization attributes based on the resulting structure.To address these questions,we propose an approach built upon recent advancements in natural language processing and machine learning techniques.For such a solution,the lack of appropriate data often poses a bottleneck.Therefore,we decouple the primary contributions of this work into:(1)developing a practical framework to extract authorization attributes of hierarchical ABAC system from natural language artifacts,and(2)generating a set of realistic synthetic natural language access control policies(NLACPs)to evaluate the proposed framework.Our experimental results are promising as we achieved-in average-an F1-score of 0.96 when extracting attributes values of subjects,and 0.91 when extracting the values of objects’attributes from natural language access control policies.

一种ABAC静态策略冲突检测算法

在分布式计算环境下,传统基于属性的静态访问控制策略多存在扩展性差、难以实现等问题。针对上述问题,提出一种基于策略属性分解的冲突检测算法。该算法对策略属性进行分解,构造策略属性分解图,判断策略属性值之间的相交关系,根据静态策略冲突的定义进行策略冲突检测,从而提高策略冲突检测算法的可扩展性和易实现性。实验结果表明,该算法对静态策略冲突的检测率接近85%。

基于改进CP-ABE算法的ABAC机制研究

为解决基于属性的访问控制(ABAC)机制下的数据安全问题,从访问体系结构和形式化定义两方面对ABAC机制进行研究,并进行了仿真和性能分析。通过与传统CP-ABE算法进行比较,提出一种适用于ABAC环境的改进CP-ABE算法,给出了改进算法的形式化定义。与传统CP-ABE算法相比,该算法在ABAC环境下具有更低的存储消耗和更高的效率。

基于ABAC的Web Services访问控制研究

为解决Web Services访问控制问题,分析了传统访问控制模型在Web Services应用中的不足,给出了面向Web Services的基于属性的访问控制模型ABAC(Attribute Based Access Control)的定义,设计了ABAC访问控制架构,并利用可扩展的访问控制标记语言XACMLe(Xtensible Access Control Markup Language)实现了细粒度的Web Services访问控制系统。系统的应用有效保护了Web Services资源。

Automated extraction of attributes from natural language attribute-based access control(ABAC)Policies

The National Institute of Standards and Technology(NIST)has identified natural language policies as the preferred expression of policy and implicitly called for an automated translation of ABAC natural language access control policy(NLACP)to a machine-readable form.To study the automation process,we consider the hierarchical ABAC model as our reference model since it better reflects the requirements of real-world organizations.Therefore,this paper focuses on the questions of:how can we automatically infer the hierarchical structure of an ABAC model given NLACPs;and,how can we extract and define the set of authorization attributes based on the resulting structure.To address these questions,we propose an approach built upon recent advancements in natural language processing and machine learning techniques.For such a solution,the lack of appropriate data often poses a bottleneck.Therefore,we decouple the primary contributions of this work into:(1)developing a practical framework to extract authorization attributes of hierarchical ABAC system from natural language artifacts,and(2)generating a set of realistic synthetic natural language access control policies(NLACPs)to evaluate the proposed framework.Our experimental results are promising as we achieved-in average-an F1-score of 0.96 when extracting attributes values of subjects,and 0.91 when extracting the values of objects’attributes from natural language access control policies.

基于深度学习的ABAC访问控制策略自动化生成技术

针对访问控制策略的自动化生成问题,提出了一种基于深度学习的ABAC访问控制策略生成框架,从自然语言文本中提取基于属性的访问控制策略,该技术能够显著降低访问控制策略生成的时间成本,为访问控制的实施提供有效支持。将策略生成问题分解为访问控制语句识别和访问控制属性挖掘两项核心任务,分别设计了BiGRU-CNN-Attention和AM-BiLSTM-CRF这2个神经网络模型来实现访问控制策略语句识别和访问控制属性挖掘,从而生成可读、可执行的访问控制策略。实验结果表明,与基准方法相比,所提方法具有更好的性能。特别是在访问控制策略语句识别任务中平均F1-score指标能够达到0.941,比当前的state-of-the-art方法性能提高了4.1%。

基于日志的富语义ABAC 策略挖掘

为了解决大规模环境下的细粒度访问控制问题,挖掘出易于人工阅读、契合主体行为模式、精确完备的基于属性的访问控制(ABAC)策略,从而为安全管理员进行策略构建、维护和优化提供有力支撑,提出基于日志的富语义ABAC策略挖掘方法.该方法基于频繁模式挖掘算法,从访问日志和属性数据中挖掘契合主体行为模式的ABAC策略.对策略进行正确性和语义质量分析获得富语义ABAC策略集.通过交叉验证方法对策略集的精确性和完备性进行验证,算法在公开数据集上的F1得分为0.8375,在手写数据集上的F1得分为0.9394.在手写数据集上的验证表明,算法可以在较小训练集上得到比现有算法更高质量的策略集,所得授权规则在易读性方面有所提升.

ABAC策略语义表示和决策方法

为解决开放式系统环境中基于属性的访问控制(Attribute-Based Access Control,ABAC)策略语义层次上的表示和决策问题,提出了ABAC策略的本体表示方法。该方法基于ABAC策略模型到描述逻辑定义的映射,使用语义Web规则语言(SWRL)处理系统内部关系定义。在此基础上,提出了基于封闭世界和实例实现推理的策略决策框架。最后从可靠性和完备性两方面说明了决策方法的正确性,验证实验表明了方法在实际应用中的适用性。

基于智能合约与ABAC的访问控制方案

大数据环境下,访问控制技术是确保数据安全共享的重要手段之一。针对传统集中式访问控制模型存在的授权粒度较粗、灵活性不足与扩展性差等问题,以区块链技术为基础,结合智能合约与基于属性的访问控制(Attribute-Based Access Control, ABAC)模型提出一种动态、灵活与细粒度的访问控制方案。首先,将用户信息以区块链中的交易为载体进行存储,保证数据的不可篡改、不可伪造与可追溯;其次,采用3种不同类型的智能合约分别对用户属性、访问策略以及信誉进行管理,实现全程透明、动态与细粒度的访问控制;再次,通过将信誉评估机制引入ABAC模型中,为不同的节点分配不同的访问权限,防止未经授权的访问并动态检查恶意节点;最后,通过搭建一个以太坊私有链实现本方案,仿真实验验证了该方案的有效性。

智能电网中基于MQTT协议的ABAC访问控制方案

在智能电网环境中,电力运营商和消费者通过智能电表进行大量高精度的用电数据的实时监测,用户机密数据持续暴露于未经授权的访问,在这种传统通信模式下,智能电表对家庭用户能源消耗的细粒度测量造成了严重的隐私安全问题,而现有的静态访问控制方法并不满足智能电网环境基于上下文的动态访问特性。针对此问题,提出一种基于物联网通信协议(MQTT协议)的访问控制方案,通过在MQTT协议中对树型结构的主题列表设计基于ABAC访问控制模型的动态上下文授权策略,并在WSO2系统使用XACML策略语言实现了提出的访问控制方案。性能评估结果表明,该方案能在较低的通信开销内支持动态的访问控制,以解决智能电网中用户的用电信息未经授权而泄露的隐私安全问题。

一种ABAC中合理属性值指派计算方法

为实体(如用户、主体、客体等)指派合理的属性值是基于属性的访问控制模型实施与安全性的关键.针对现有属性管理权限委派中在属性值划分上缺乏相应客观依据及方法,提出一个基于有向图的属性值计算方法.该方法把来自一个属性内或多个属性之间的关系定义为前提关系,构造得到一个以属性为顶点、前提关系为有向边的有向图.该方法计算属性值的过程分为三步,首先,搜索有向图中与目标属性相关的所有前提关系;第二步,代入属性值确定各个前提关系对目标属性的函数约束;第三步,按照目标属性的函数约束形式分为三种分别聚合,计算得到属性值满足的函数.实验结果验证其与一般的计算方法相比,平均时间加速比可达到3倍以上.