Search

Lately, many cloud-based applications proposed Attribute-Based Encryption (ABE) as an all-in-one solution for achieving confidentiality and access control. Within this paradigm, data producers store the encrypted data on a semi-trusted cloud server, and users, holding decryption keys issued by a key authority, can decrypt data according to some access control policy. To be used in practical cases, any ABE scheme should implement a key revocation mechanism which assures that a compromised decryption key cannot be used anymore to decrypt data. Yu et al. (INFOCOM 2010) introduced an ABE scheme with revocation capabilities that enjoys several unique advantages, such as reactivity and efficiency. In the scheme, the cloud server is entitled to update keys and ciphertexts in order to achieve revocation. Unfortunately, the cloud server retains the power to undo the revocation of a key (revocation undoing attack) so endangering confidentiality. In this paper, we propose a revocable ABE scheme that still ensures the advantages of Yu et al.'s scheme, but it also resists to the revocation undoing attack. We formally prove the security of our scheme and show through simulations that the user experiences a slightly higher computational cost with respect to Yu et al.'s scheme.

Traditional malware propagation control schemes do not prevent device-to-device (D2D) malware spread, have high time cost, and may result in low probability of detecting compromised devices. Moreover, the unprecedented scale and heterogeneity of Internet of Things (IoT) devices make these schemes inapplicable to IoT networks. Therefore, to rectify these issues, this article presents a secure patching framework for IoT with different network isolation levels to efficiently mitigate and control malware propagation. It uses remote attestation to detect compromised devices with a high probability and identify the origin of malicious activities. It also proposes virtual patching of devices via physical unclonable functions (PUFs) to contain the malware spread. The isolation levels are based on the susceptible, exposed, infected, and resistant (SEIR) model that act as an access control list to quantify device operation and mitigate D2D malware spread. We present a security analysis based on the access control logic model. A performance evaluation with a comparative analysis is also discussed using the SEIR model. These analyses confirm the reduction in patching time and superior performance of our framework, i.e., with 10% of initially infected devices, IoT-Proctor had a reduction rate of malware five times faster than the existing techniques.

Smart body area networks (SmartBAN) is an emerging wireless body area networks (WBAN) standard proposed by the European Telecommunications Standards Institute (ETSI). This paper first examines the potential of SmartBAN medium access control (MAC) layer with scheduled access to support a myriad of WBAN applications, having diverse data rate requirements. Extra scheduled access slots can be allocated to high date rate sensor nodes for managing their data rate requirements. High data rate sensor nodes can also be re-assigned to use the available time slots of low data rate sensor nodes in Inter-Beacon Interval (IBI) by the central hub. But these two schemes incorporate different physical (PHY) and MAC layer overheads related to frame transmission, frame acknowledgement and slot re-assignment. This redundant overhead transmission results in high overhead energy consumption and reduced effective throughput. Therefore, an innovative and flexible enhanced throughput and reduced overhead (FETRO) MAC protocol for scheduled access is proposed in this article. In the proposed scheme, the sensor node data rate requirements are considered while assigning the scheduled access slot duration by allowing minimal changes in the base-line standard implementation. This infers the provision of scheduled access slots with variable slot durations within an IBI. We also evaluate the existing techniques of extra slot allocation and slot re-assignment in SmartBAN as well as the proposed FETRO MAC protocol with variable slot length. The proposed FETRO MAC scheme results in optimizing both the overall throughput and normalized overhead energy consumption per kilo bits per second (Kbps). Additionally, the impact of various WBAN channel models over these throughput management approaches is also investigated. The proposed FETRO MAC protocol with variable slot duration gives an average reduction of 65.5% and 59.16%, respectively, in the hub and nodes normalized overhead energy consumption per Kbps outcomes, as compared to the de-facto SmartBAN MAC scheduling strategies.

In a cloud environment, traditional approaches are used to encrypt any data by using 0 and 1 that increase data security issues because of the presence of numerous malicious users and hackers over the internet. Deoxyribonucleic Acid (DNA) computing can be one of the best solutions to improve data security in which data are encrypted using the DNA bases: Thymine (T), Guanine (G), Cytosine (C) and Adenine (A). Along with data security, access control is another major issue of a cloud environment as the searching time of the owner of any data, the system overheard and the accessing time of a file or data are high during data access. A novel DNA computing based secure and fast Access Control Model (ACM) is proposed in this paper to solve all these major problems. In the proposed scheme, the Cloud Service Provider (CSP) keeps a table or list for fast data accessing. Here, a 1024-bit DNA computing based random key is generated by using the user's secret information, and the same key is utilized for data encryption. Theoretical analysis along with many experimental results prove the efficiency and effectiveness of the proposed access control model over some well-known existing models.

With the rapid advances in computing and information technologies, traditional access control models have become inadequate in terms of capturing fine-grained, and expressive security requirements of newly emerging applications. An attribute-based access control (ABAC) model provides a more flexible approach for addressing the authorization needs of complex and dynamic systems. While organizations are interested in employing newer authorization models, migrating to such models pose as a significant challenge. Many large-scale businesses need to grant authorization to their user populations that are potentially distributed across disparate and heterogeneous computing environments. Each of these computing environments may have its own access control model. The manual development of a single policy framework for an entire organization is tedious, costly, and error-prone. In this paper, we present a methodology for automatically learning ABAC policy rules from access logs of a system to simplify the policy development process. The proposed approach employs an unsupervised learning-based algorithm for detecting patterns in access logs and extracting ABAC authorization rules from these patterns. In addition, we present two policy improvement algorithms, including rule pruning and policy refinement algorithms to generate a higher quality mined policy. Finally, we implement a prototype of the proposed approach to demonstrate its feasibility.

An access control mechanism plays a critical role in new node deployment within a resource-constrained Wireless Sensor Networks. The deployment of a new node is inevitable either due to the outage of power or nodes getting compromised due to the adversary’s attacks. The access control scheme prevents malicious node deployment and also allows a new node to establish a shared key with its neighbors for secure communication. Besides having low communication and computational overheads, an access control mechanism must suffice to specific security and functional requirements for their practical implementations. In this paper, a provable and practical access control scheme based on Elliptical Curve Cryptography (ECC) has been presented. The proposed access control scheme supports node privacy while addressing all other major functional and security requirements. The formal validation of the proposed scheme has been carried out using automated validation of internet security protocols and applications (AVISPA) and Scyther tools. A comparative study of the proposed scheme with the existing schemes has been carried out on various security and functional requirements suggesting a better trade-off. Finally, practical experimentation on TinyOS and MICAz motes has been carried out to provide detailed energy analysis and test-bed implementation of the proposed scheme.

The technological advancement in the field of IoT and cloud computing along with the use of handheld gadgets generate huge amount of data. To process and share these data with fine-grained access control while maintaining confidentiality using cloud servers is a challenging task. Individuals as well as the organizations apprehend to use public cloud to share their private data due to security issues. Ciphertext-policy-attribute-based-encryption(CPABE) achieves one-to-many encryption with data confidentiality and fine-grained access control. Due to the computational intensive operations of encryption and decryption the performance of CPABE as a solution in resource-constraint environment is not encouraging enough. Some of the existing models use the resources of cloud servers to carry out outsourced computation either with compromised security or with communication-overhead. To reduce the computational time of encryption and decryption we propose a scheme LIKC which incorporates the outsourcing mechanism using a proxy server. With the imploration the computation time get reduced without compromising the security. It also supports attribute-revocation to support flexible data sharing. The proposed model is implemented using python charm crypto. The output reveals that LIKC is able to produce promising results in comparison to the data sharing models for this study.

Sensitive Health Information (SHI) is a developing patient-centric model of medical data exchange, which is frequently outsourced to be stored at third party servers. Though, there have been various privacy issues as SHI could be disclosed to the unauthorised and third parties. This is a promising method to encrypt the SHI before outsourcing to assure the patients’ control over access to their own SHI. However, challenges like scalability in key management and flexible access have remained the most significant issues toward achieving fine-grained, cryptographically data access control. In this paper, the authors proposed a novel patient-centric system model for access control to SHIs stored in semi-honest servers. For fine-grained and scalable access control for SHIs, authors have proposed an encryption technique which is an improvement over RSA techniques to encrypt every patient’s SHI file. To different from previous works in secure data transmission, the authors focus on the data owner and divide users into several domains in SHI, which greatly decrease the key management complexity for data owners and users. Comprehensive analytical and experimental results are presented which reflect the efficiency of the proposed approach.

Cloud computing is considered as one of the most prominent paradigms in the information technology industry, since it can significantly reduce the costs of hardware and software resources in computing infrastructure. At the first sight, by merely storing the shared data as plaintext in the cloud storage and protect them using an appropriate access control would be a nice solution. Therefore, encryption is mandatory, and the shared data will need to be stored as a ciphertext using an appropriate access control. However, in practice, some of these employees may be malicious and may want to deviate from the required sharing policy. The existing protection in the literature has been explored to allow only legitimate recipients to decrypt the contents stored in the cloud storage, but unfortunately, no existing work deals with issues raised due to the presence of malicious data publishers. In this work, we present a new direction of research that can cope with the presence of malicious data publishers. We resolve the aforementioned problem by proposing the notion of Sanitizable Access Control System (SACS) to solve the aforementioned problem.

Cloud-based Internet of Things (IoT) management services are a promising means of ingesting data from globally dispersed devices. In this setting, it is important to regulate access to data managed by potentially untrusted cloud servers. Attribute-based encryption (ABE) is a highly effective tool for access control. However, applying ABE to IoT environments shows limitations in the following three aspects: First, the demands for storage resources increase in proportion to the complexity of the access control policies. Second, the computation cost of ABE is onerous for resource-limited devices. Lastly, ABE alone is intractable to prevent illegal key-sharing which leads to unauthorized access to data. In this paper, we propose an efficient and secure cloud-based IoT data management scheme using ABE. First, we remove the storage-side dependency on the complexity of the access control policies. Second, a substantial part of computationally intensive operations is securely outsourced to the cloud servers. Lastly, unauthorized access to data via illegal key-sharing is strictly forbidden. Our security analysis and experimental results show the security and practicability of the proposed scheme.

The pervasive, ubiquitous, and heterogeneous properties of IoT make securing IoT systems a very challenging task. More so when access and storage are performed through a cloud-based IoT system. IoT data stored on cloud should be encrypted to ensure data privacy. It is also crucial to allow only authorized entities to access and decrypt the encrypted data. In this work, we propose a ciphertext-policy attribute-based encryption (CP-ABE) scheme that enables fine-grained access control of encrypted IoT data on cloud. CP-ABE is regarded as a highly promising approach to provide flexible and fine-grained access control, which is very much suited to secure cloud based IoT systems. We first present an access control system model of CloudIoT platform by using ABE. Based on the presented system model, we construct a ciphertext-policy hiding CP-ABE scheme, which guarantees the privacy of the users. We further construct a white-box traceable CP-ABE scheme with accountability in order to address the user key abuse and authorization center key abuse. Experiment illustrates the proposed systems are efficient.

The rapid development of cloud computing and Internet of Things enables widely use of Internet of Vehicles (IoV) and drives a revolutionary change for intelligent transport system. The advent of 5G and fog computing architectures also facilitates applications of IoV and makes the enormous IoV data outsourcing and sharing in cloud and fog more convenient. However, the data outsourcing and sharing will incur many security concerns to IoV including data leakage and breach as the users cannot direct control their data. To guarantee IoV data security, a novel scheme is proposed for IoV data sharing with high efficiency. In our scheme, we utilize ciphertext-policy attribute-based encryption (CP-ABE) to achieve confidentiality and fine-grained access control for IoV data shared in cloud and fog. Nevertheless, as another intrinsic feature in IoV environment, the dynamicity in a group of connected vehicles brings some challenges to our scheme. To deal with this situation, we bring forward a concept of auditable user revocation for CP-ABE to adapt to the dynamic vehicle groups. Moreover, online/offline and verifiable outsourcing techniques are leveraged to improve the efficiency and guarantee the correctness of decryption. At the end, we demonstrate the security and efficiency for our scheme by giving detailed security analysis and performance evaluation with extensive experiments.

Surveillance drones, called as unmanned aerial vehicles (UAV), are aircrafts that are utilized to collect video recordings, still images, or live video of the targets, such as vehicles, people or specific areas. Particularly in battlefield surveillance, there is high possibility of eavesdropping, inserting, modifying or deleting the messages during communications among the deployed drones and ground station server (GSS). This leads to launch several potential attacks by an adversary, such as main-in-middle, impersonation, drones hijacking, replay attacks, etc. Moreover, anonymity and untarcebility are two crucial security properties that need to be maintained in battlefield surveillance communication environment. To deal with such a crucial security problem, we propose a new access control protocol for battlefield surveillance in drone-assisted Internet of Things (IoT) environment, called ACPBS-IoT. Through the detailed security analysis using formal and informal (non-mathematical), and also the formal security verification under automated software simulation tool, we show the proposed ACPBS-IoT can resist several potential attacks needed in battlefield surveillance scenario. Furthermore, the testbed experiments for various cryptographic primitives have been performed for measuring the execution time. Finally, a detailed comparative study on communication and computational overheads, and security as well as functionality features reveals that the proposed ACPBS-IoT provides superior security and more functionality features, and better or comparable overheads than other existing competing access control schemes.

International audience; With Cloud/Fog Computing being a paradigm combination of IoT context and Edge Computing extended with Cloud/Fog, business process in it involves dataflows among multilayers and multi-nodes, possibly provided by multi-organizations. Achieving end-to-end trustworthiness over the whole dataflow in such a Cloud/Fog Computing context is a challenging issue, nonetheless a necessary pre-condition for a successful business process on intra-/inter- organizational level. This paper investigates technical conundrums related to this target and proposes a policy-based approach for trustworthiness governance. An architectural layout is proposed with according modules, by carrying out two methodologies. One resides in tracing data derivation and maintaining security-level over the whole dataflow, handling data aggregation with several protocols. The other is to express data owner trustworthiness requirements with an enhanced attribute-based access control policy model and to evaluate data accessing nodes’ trustworthiness-related properties. Experiments show that processing time per attribute pair drops as the scales of policies increase, suggesting good scaling property of the system.

Considered as a promising fine-grained access control mechanism for data sharing without a centralized trusted third-party, the access policy in a plaintext form may reveal sensitive information in the traditional CP-ABE method. To address this issue, a hidden policy needs to be applied to the CP-ABE scheme, as the identity of a user cannot be accurately confirmed when the decryption key is leaked, so the malicious user is traced and revoked as demanded. In this paper, a CP-ABE scheme that realizes revocation, white-box traceability, and the application of hidden policy is proposed, and such ciphertext is composed of two parts. One is related to the access policy encrypted by the attribute value, and only the attribute name is evident in the access policy. Another is related to the revocation information and updated when revoking, where the revocation information is generated by the binary tree related to users. The leaf node value of a binary tree in the decryption key is used to trace the malicious user. From experimental results, it is shown that the proposed scheme is proven to be IND-CPA secure under the chosen plaintext attacks and selective access policy based on the decisional q-BDHE assumption in the standard model, efficient, and promising.

As an innovative technique for cloud storage services, attribute based encryption (ABE) enables fine-grained access control over encrypted data in many cloud computing applications. However, there exist two main drawbacks that restrict the development of ABE. One is that most of the existing user revocation mechanisms cannot achieve high efficiency, immediacy and robustness simultaneously. Another is that the decryption of ABE contains expensive pairing operations which often grow with the complexity of access policy. In this work, we propose a practical server-aided revocable fine-grained access control mechanism with the help of cloud's storage, computing and management capabilities, which not only achieves efficient fine-grained attribute based access control, but also actualizes immediate and robust user revocation. Moreover, most of the complicated operations in decryption are outsourced to the public cloud server, leaving one exponentiation for the users. At last, we implement our proposed mechanism with Charm framework. The benchmark results demonstrate the high efficiency and practicality of our proposed mechanism.

Cloud storage as one of the most important services of cloud computing facilitates cloud users to outsource their data to the cloud for storage and share them with authorized users. In cloud storage, secure deduplication has been investigated as it can eliminate the redundancy over the encrypted data to reduce storage space and communication overhead. Regarding the security and privacy, many existing secure deduplication schemes generally focus on achieving the following properties: data confidentiality, tag consistency, access control and resistance to brute force attacks. However, as far as we know, none of them can achieve these four requirements at the same time. To overcome this shortcoming, in this paper, we propose an efficient secure deduplication scheme that supports user-defined access control. Specifically, by allowing only the cloud service provider to authorize data access on behalf of data owners, our scheme can maximally eliminate duplicates without violating the security and privacy of cloud users. Detailed security analysis shows that our authorized secure deduplication scheme achieves data confidentiality and tag consistency while resisting brute-force attacks. Furthermore, extensive simulations demonstrate that our scheme outperforms the existing competing schemes, in terms of computational, communication and storage overheads as well as the effectiveness of deduplication.

Healthcare Internet-of-Things (IoT) is an emerging paradigm that enables embedded devices to monitor patients' vital signals and allows these data to be aggregated and outsourced to the cloud. The cloud enables authorized users to store and share data to enjoy on-demand services. Nevertheless, it also causes many security concerns because of the untrusted network environment, dishonest cloud service providers and resource-limited devices. To preserve patients' privacy, existing solutions usually apply cryptographic tools to offer access controls. However, fine-grained access control among authorized users is still a challenge, especially for lightweight and resource-limited end-devices. In this paper, we propose a novel healthcare IoT system fusing advantages of attribute-based encryption, cloud and edge computing, which provides an efficient, flexible, secure fine-grained access control mechanism with data verification in healthcare IoT network without any secure channel and enables data users to enjoy the lightweight decryption. We also define the formal security models and present security proofs for our proposed scheme. The extensive comparison and experimental simulation demonstrate that our scheme has better performance than existing solutions.

The Internet of Things (IoT) enables new services, such as smart home and smart healthcare integrating various resources of networked devices. However, managing IoT resources is very challenging because a device may have multiple different resources and the service accesses subsets of the resources in multiple devices. To simplify the resource management, the existing IoT frameworks provide resource models and protocols for manufacturers and programmers, but their access granularity is too coarse grained causing overprivilege problems, or too fine grained causing management overheads. To avoid the overprivilege problems without the management overheads, this work proposes a new composable and flexible resource management scheme and implements its prototype compiler-runtime framework called ComFlex. The ComFlex compiler allows manufacturers to register their devices as composition of fine-grained resources by inheriting the existing interfaces of the resources, and programmers to define their own access granularity as a virtual resource that consists of the fine-grained resources of multiple devices. The ComFlex runtime supports fine-grained access control without additional overheads by mapping the fine-grained resources of the virtual resource into physical resources of different devices. To evaluate the ComFlex framework, this work implements 52 resources on 14 devices and six IoT services with ComFlex and an existing fine-grained resource management scheme. Compared to the existing scheme, the ComFlex framework supports the IoT services with 40.2% fewer lines of code and 80.9% less discovery time, without any overprivilege problem and response time delay.

The industrial Internet of Things (IIoT) supports recent developments in data management and information services, as well as services for smart factories. Nowadays, many mature IIoT cloud platforms are available to serve smart factories. However, due to the semicredibility nature of the IIoT cloud platforms, how to achieve secure storage, access control, information update and deletion for smart factory data, as well as the tracking and revocation of malicious users has become an urgent problem. To solve these problems, in this article, a blockchain-enhanced security access control scheme that supports traceability and revocability has been proposed in IIoT for smart factories. The blockchain first performs unified identity authentication, and stores all public keys, user attribute sets, and revocation list. The system administrator then generates system parameters and issues private keys to users. The domain administrator is responsible for formulating domain security and privacy-protection policies, and performing encryption operations. If the attributes meet the access policies and the user's ID is not in the revocation list, they can obtain the intermediate decryption parameters from the edge/cloud servers. Malicious users can be tracked and revoked during all stages if needed, which ensures the system security under the Decisional Bilinear Diffie–Hellman (DBDH) assumption and can resist multiple attacks. The evaluation has shown that the size of the public/private keys is smaller compared to other schemes, and the overhead time is less for public key generation, data encryption, and data decryption stages.

With the rapid development of information and network technology, hospital information systems (HIS) has also become a hot research area. However, data could be subjected to the threat of security attacks, leakage, tampering, and forgery during medical data transmissions, data storage, and sharing based on public networks and cloud environments. The immutability, decentralization and anonymity of the blockchain provided new ways for solving the aforementioned problems. This paper proposes a complete medical information system model based on blockchain technology, to realize the goal of safe storage and sharing of medical data. A data collection system based on Internet of Things (IoT) was also developed that can simultaneously collect data from different types of non-invasive medical instruments to realize real-time collection of patient health record during surgery (SHR). This system designed an anonymous medical data sharing scheme based on cloud servers and proxy re-encryption algorithm to improve the security of private medical data sharing. The system was implemented based on the permissioned blockchain architecture Hyperledger Fabric, and a dual-channel Fabric deployment architecture and medical chaincode were designed for data management and access control. We also carried out computing overhead test, performance test and safety evaluation on the system, and the test results meet the requirements of actual medical production environment. The research work of this paper provides means for remote diagnosis and treatment, data mining and other practical applications based on the medical data on the blockchain.

Internet of Things (IoT) devices facilitate intelligent service delivery in a broad range of settings, such as smart offices, homes and cities. However, the existing IoT access control solutions are mainly based on conventional identity management schemes and use centralized architectures. There are known security and privacy limitations with such schemes and architectures, such as the single-point failure or surveillance (e.g., device tracking). Hence, in this paper, we present an architecture for capability-based IoT access control utilizing the blockchain and decentralized identifiers to manage the identity and access control for IoT devices. Then, we propose a protocol to provide a systematic view of system interactions, to improve security. We also implement a proof-of-concept prototype of the proposed approach and evaluate the prototype using a real-world use case. Our evaluation results show that the proposed solution is feasible, secure, and scalable.

The trend towards the Internet of Things (IoT) technology promises the growth of home and organizational automation in the world. Due to the large amount of IoT data stored in the semi-trust cloud server, the IoT is vulnerable to cyberattacks. Therefore, the privacy violation of outsourced data is an obstacle to efficient IoT data storage. Searchable encryption is a promising solution for secure storage and selective data retrieval. However, achieving desired privacy, performance, and attributes such as dynamics, access control, scalability, and fair arbitration is still a challenge in searchable encryption schemes. In this paper, we propose a fair and dynamic multi-owner searchable encryption scheme wherein dynamics does not leak the sensitive information. In the proposed scheme, the verifiability and fair arbitration, respectively, prevent the malicious cloud servers and malicious users from having any motivation to disrupt the accuracy of the exchanged data. Generating a single trapdoor corresponding to the conjunctive keyword query, a client can search over all documents stored in the cloud, the owner of which has allowed the client to access. We also prove that our scheme is secure against the keyword guessing attack in the standard model. Finally, evaluating the performance of the proposed scheme on a real dataset, we demonstrate its efficiency as well.

With the evolution of the Internet of Vehicles (IoV), there has been an overwhelming increase in the number of connected vehicles in recent times. Due to this reason, massive amounts of data generated by connected vehicles makes traditional host-centric approach inevitable in IoV ecosystem. Moreover, the existing TCP/IP based congestion control mechanisms cannot be directly applied in IoV environment as there is a requirement of content sharing among vehicles with reduced delay and high throughput. So, in this article, 1 1. This article is an extended version of paper entitled “Deep Learning-based Content Centric Data Dissemination Scheme for Internet of Vehicles“ published in IEEE ICC, 20-24 May 2018, Kansas City, USA DiLSe: A Lattice-based Secure and Dependable Data Dissemination Scheme for Social Internet of Vehicles is designed, which works in three modules. The first module, i.e., deep learning based content centric data dissemination scheme, works in three phases. 1) In the first phase, the connection probability of vehicles is computed to identify stable and reliable connections using Weiner process model. 2) In the second phase, a convolutional neural network based scheme is presented for estimating the social relationship score among vehicle-to-vehicle pair. 3) In the third phase, a content centric data dissemination scheme is presented. However, the mobility of vehicles in IoV ecosystem gives them the liberty to move in/out of the network without IP assignment. This makes it necessary to replicate the content at each node for providing fault tolerance. So, in the second module, a data replication scheme for fault tolerance in IoV network is designed, which is followed by an access control mechanism for read/right access for network content in third module. Finally, in the last module, a crucial lattice-based exchange and authentication scheme using blockchain is also designed for handling secure communication in IoV ecosystem. The proposed scheme is evaluated on a highway topology using extensive simulations. The results obtained prove the efficacy of the proposed scheme concerning various performance metrics.

Policy-based access control systems are crucial for secure information sharing in collaborative applications. However, policy management needs to be flexible in order to adapt to different environments and be able to support policy evolution. However, when dealing with large sets of evolving policies, it is critical that policies meet certain policy quality requirements. Policy sets must be complete, free of inconsistencies, and relevant. In this paper, we propose a framework to analyze policies to determine whether they meet such requirements. Our framework uses provenance techniques to collect comprehensive data about actions which were either triggered due to a network context or a user (i.e., a human or a device) action. The framework includes two approaches for policy analysis: structure-based and classification-based. For the structure-based approach, we designed tree structures to organize and assess the policy set efficiently. For the classification-based approach, we employed the classification techniques to learn the characteristics of policies and predict their quality. In addition, the framework includes the policy evolution module which mainly consists of recommendation and re-evaluation services for policy changes which both aim at fulfilling the policy quality requirements. The analysis framework has been implemented and experimental results from the prototype are reported.

The evolution of cyber–physical system (CPS) benefits from substantial supports of many cutting-edge technologies. However, as a significant medium to bridge virtual and reality parts, the dependability of various network components is facing unprecedented challenges and threats. In this article, we propose a smart collaborative balancing (SCB) scheme to dynamically adjust the orchestration of network functions and efficiently optimize the workflow patterns. First, mathematical models of bandwidth allocation for multiuser with appropriate probability distribution are established. Matrix operations are utilized to solve the relevant issues based on individual congestion windows. Invasion defense mechanisms are also provided and discussed. Second, specific procedures of collaboration among different network components are presented. The capabilities of CPS, in terms of bandwidth allocation and invasion defense, are guaranteed via novel queueing policies and access control mechanisms. Third, we build a comprehensive prototype including multiple domains and users for validations. Experimental results in two scenarios illustrate that SCB not only supports service reliability of end hosts with different priorities, but also resists malicious attacks which are targeting the corresponding terminals inside domains. Compared to the benchmarks in software defined networks and traditional Internet, our scheme performs better in both available resource management and abnormal flow recognition aspects.

Over the past few years, the Internet of Things (IoT) has played a crucial role in designing e-health systems. An IoT-enabled e-health system allows different entities to examine a patient's health condition anywhere and anytime. However, the deployment of e-health systems in an IoT environment faces various security and privacy challenges. The authentication of participating entities, the confidentiality of information transferred through an insecure channel, and access control are essential issues to be resolved. To settle these challenges, we found many authentication protocols for e-health systems based on the discrete logarithm and integer factorization problems. However, quantum attacks expose all these protocols. In this article, we propose a lattice-based authentication and access control (LAAC) protocol for IoT-enabled e-health systems to mitigate the quantum attacks. We prove that LAAC is robust with the hardness assumption of the inhomogeneous small integer solution problem. Moreover, we provide provable security analysis of LAAC. Besides, performance evaluation shows it is reasonable to execute LAAC in an IoT device.

Very recently, a number of intelligent applications have evolved in smart cities such as smart grid, smart parking, smart waste management, smart manufacturing, smart home, and smart health, making our cities more smarter. In the context of smart health, smart devices are employed to collect and transmit biomedical information to a medical server, allowing medical practitioners to give better and improved healthcare services. However, considering the sensitive nature of the medical data, any illegal access may have devastating effects on the patient's health condition. A lightweight privacy-preserving authentication and fine-grained access control scheme for smart health known as PAASH is proposed. In PAASH, a new ultraefficient certificateless signature scheme with compact aggregation is developed to achieve source authentication and data integrity. To achieve efficient user authorization and data confidentiality, a privacy-preserving access control technique using the developed aggregate signature and ciphertext-policy attribute-based encryption (CP-ABE) is implemented. An analysis of PAASH reveals that it can provide desirable privacy and security measures in smart health. Moreover, the formal security demonstrated in the random oracle model (ROM) shows that PAASH is semantically secure under the intractability of the Discrete Logarithm Problem (DLP). The performance evaluation shows that PAASH is par excellence practically suitable for smart health.

A Large-Scale Heterogeneous Network (LS-HetNet) integrates different networks into one uniform network system to provide seamless one-world network coverage. In LS-HetNet, various devices use different technologies to access heterogeneous networks and generate a large amount of data. For dealing with a large number of access requirements, these data are usually stored in the HetNet Domain Management Server (HDMS) of the current domain, and HDMS uses a centralized Authentication/Authorization/Auditing (AAA) scheme to protect the data. However, this centralized method easily causes the data to be modified or disclosed. To address this issue, we propose a blockchain-empowered AAA scheme for accessing data of LS-HetNet. Firstly, the account address of the blockchain is used as the identity authentication, and the access control permission of data is redesigned and stored on the blockchain, then processes of AAA are redefined. Finally, the experimental model on Ethereum private chain is built, and the results show that the scheme is not only secure but also decentral, without tampering and trustworthiness.

The current security method of Internet-of-Vehicles (IoV) systems is rare, which makes it vulnerable to various attacks. The malicious and unauthorized nodes can easily invade the IoV systems to destroy the integrity, availability, and confidentiality of information resources shared among vehicles. Indeed, access control mechanism can remedy this. However, as a static method, it cannot timely response to these attacks. To solve this problem, we propose an intelligent edge-chain-enabled access control framework with vehicle nodes and roadside units (RSUs) in this study. In our scenario, vehicle nodes act as lightweight nodes, whereas RUSs serve as full and edge nodes to provide access control services. Considering the low accuracy of risk prediction due to limited training sets, we leverage a generative adversarial networks (GANs) to convert the risk prediction to a sequence generation. Moreover, aiming at the problems of gradient disappearance and mode collapse existed in the original GANs, we devise a Wasserstein combined GANs (WCGANs). Simulation results demonstrate that WCGAN has higher prediction accuracy than the original GANs. Additionally, it can also improve the accuracy of access control of risk prediction-based access control (RPBAC) model.

To design an energy-efficient Medium Access Control (MAC) protocol for the Underwater Wireless Sensor Networks (UWSNs) is an urgent research issue since depleted batteries cannot be recharged or replaced in the underwater environment. Moreover, the underwater acoustic channels are affected by hindrances such as long propagation delay and limited bandwidth, which appear in the design of the MAC protocol for the UWSNs. The available MAC protocols for the terrestrial wireless sensor networks exhibit low performance in energy efficiency, throughput and reliability in the UWSNs, and cannot be used in the UWSNs directly because of their unique characteristics. This paper proposes a synchronous duty-cycled reservation-based MAC protocol named Ordered Contention MAC (OCMAC) protocol. The basic mechanism of this protocol is to schedule data transmission by transmitters through the scheduling of Ready To Send (RTS) frames. The protocol eliminates the possible collision during data transmission and improves communication efficiency. The paper analyzes the performance in energy efficiency, throughput and reliability of the protocol by modeling the queuing behavior of OCMAC with a Markov Chain process. Furthermore, the analytical model is validated through a simulation study. The analysis results demonstrated that while providing good throughput and reliability, OCMAC can achieve energy saving.

With the rapid development of cloud computing, the ensuing security issues have become increasingly prominent. In this context, attribute-based encryption (ABE) has gradually attracted widespread attentions due to its unique attribute matching mechanism. At the same time, mobile devices have put forward higher requirements for the design and deployment of ABE schemes. Therefore, in this paper, we propose an original hybrid cloud multi-authority ciphertext-policy attribute-based encryption (HCMACP-ABE) scheme. Specifically, we utilize the LSSS (Linear Secret-Sharing Schemes) access structure to realize secure access control, while the private cloud is responsible for maintaining the user’s authorization list and verifying the user. Finally, we prove that our proposal achieves IND-CCA secure and is efficient in a mobile hybrid cloud environment.

Purpose This paper aims to design a secure and seamless system that ensures quick sharing of health-care data to improve the privacy of sensitive health-care data, the efficiency of health-care infrastructure, effective treatment given to patients and encourage the development of new health-care technologies by researchers. These objectives are achieved through the proposed system, a “privacy-aware data tagging system using role-based access control for health-care data.” Design/methodology/approach Health-care data must be stored and shared in such a manner that the privacy of the patient is maintained. The method proposed, uses data tags to classify health-care data into various color codes which signify the sensitivity of data. It makes use of the ARX tool to anonymize raw health-care data and uses role-based access control as a means of ensuring only authenticated persons can access the data. Findings The system integrates the tagging and anonymizing of health-care data coupled with robust access control policies into one architecture. The paper discusses the proposed architecture, describes the algorithm used to tag health-care data, analyzes the metrics of the anonymized data against various attacks and devises a mathematical model for role-based access control. Originality/value The paper integrates three disparate topics – data tagging, anonymization and role-based access policies into one seamless architecture. Codifying health-care data into different tags based on International Classification of Diseases 10th Revision (ICD-10) codes and applying varying levels of anonymization for each data tag along with role-based access policies is unique to the system and also ensures the usability of data for research.

Purpose The rapid technological growth, changes in consumer demands, products’ built-in obsolescence, presence of more non-repairable parts, shorter lifespan, etc., lead to the generation of e-waste at an unprecedented rate. Although a number of research proposals and business products to manage e-waste exist in the literature, they lack in many aspects such as incomplete coverage of product’s life cycle, access control, payment channels (in few cases), incentive mechanisms, scalability issues, and missing experimental validation. The purpose of this paper is to introduce a novel blockchain-based e-waste management system aiming to mitigate the above-mentioned downsides and limitations of the existing proposals. Design/methodology/approach This paper proposes a robust and reliable e-waste management system by leveraging the power of blockchain technology, which captures the complete life cycle of e-products commencing from their manufacturing as new products to their disposal as e-waste and their recycling back into raw materials. Findings While the use of blockchain technology increases accountability, transparency and trust in the system, the proposal overcomes various challenges and limitations of the existing systems by providing seamless interactions among various agencies. Originality/value This paper presents a prototype implementation of the system as a proof-of-concept using solidity on the Ethereum platform and this paper performs experimental evaluations to demonstrate its feasibility and effective performance in terms of execution gas cost and transaction throughput.

Large commercial buildings are complex cyber-physical systems containing expensive and critical equipment that ensure the safety and comfort of their numerous occupants. Yet occupant and visitor access to spaces and equipment within these buildings are still managed through unsystematic, inefficient, and human-intensive processes. As a standard practice, long-term building occupants are given access privileges to rooms and equipment based on their organizational roles, while visitors have to be escorted by their hosts. This approach is conservative and inflexible. In this paper, we describe a methodology that can flexibly and securely manage building access privileges for long-term occupants and short-term visitors alike, taking into account the risk associated with accessing each space within the building. Our methodology relies on blockchain smart contracts to describe, grant, audit, and revoke fine-grained permissions for building occupants and visitors, in a decentralized fashion. The smart contracts are specified through a process that leverages the information compiled from Brick and BOT models of the building. We illustrate the proposed method through a typical application scenario in the context of a real office building and argue that it can greatly reduce the administration overhead, while, at the same time, providing fine-grained, auditable access control., Comment: 26 pages

The rapid developments in the Internet of Medical Things (IoMT) help the smart healthcare systems to deliver more sophisticated real-time services. At the same time, IoMT also raises many privacy and security issues. Also, the heterogeneous nature of these devices makes it challenging to develop a common security standard solution. Furthermore, the existing cloud-centric IoMT healthcare systems depend on cloud computing for electrical health records (EHR) and medical services, which is not suggestible for a decentralized IoMT healthcare systems. In this article, we have proposed a blockchain-based novel architecture that provides a decentralized EHR and smart-contract-based service automation without compromising with the system security and privacy. In this architecture, we have introduced the hybrid computing paradigm with the blockchain-based distributed data storage system to overcome blockchain-based cloud-centric IoMT healthcare system drawbacks, such as high latency, high storage cost, and single point of failure. A decentralized selective ring-based access control mechanism is introduced along with device authentication and patient records anonymity algorithms to improve the proposed system’s security capabilities. We have evaluated the latency and cost effectiveness of data sharing on the proposed system using Blockchain. Also, we conducted a logical system analysis, which reveals that our architecture-based security and privacy mechanisms are capable of fulfilling the requirements of decentralized IoMT smart healthcare systems. Experimental analysis proves that our fortified-chain-based H-CPS needs insignificant storage and has a response time in the order of milliseconds as compared to traditional centralized H-CPS while providing decentralized automated access control, security, and privacy.

Fifth Generation mobile networks (5G) promise to make network services provided by various Service Providers (SP) such as Mobile Network Operators (MNOs) and third-party SPs accessible from anywhere by the end-users through their User Equipment (UE). These services will be pushed closer to the edge for quick, seamless, and secure access. After being granted access to a service, the end-user will be able to cache and share data with other users. However, security measures should be in place for SP not only to secure the provisioning and access of those services but also, should be able to restrict what the end-users can do with the accessed data in or out of coverage. This can be facilitated by federated service authorization and access control mechanisms that restrict the caching and sharing of data accessed by the UE in different security domains. In this paper, we propose a Data Caching and Sharing Security (DCSS) protocol that leverages federated authorization to provide secure caching and sharing of data from multiple SPs in multiple security domains. We formally verify the proposed DCSS protocol using ProVerif and applied pi-calculus. Furthermore, a comprehensive security analysis of the security properties of the proposed DCSS protocol is conducted.

Recently, the concept of a decentralized data marketplace is getting much attention to exchange user data. Multi-authority attribute-based encryption (ABE), which can provide flexibility and user-centric access control, is previously widely used in decentralized data sharing applications and also becoming a foundation to build decentralized data trading applications. It is known that users in a multi-authority ABE system can collude by sharing their secret information for malicious purposes. To address this issue, the collusion-resistant multi-authority ABE model was introduced in which a unique global identifier (GID) is issued by the central authority (CA) to each user. Unfortunately, such approach cannot be used directly to build a decentralized data marketplace as (a) such intervention of the CA is directly against the main motivation of the decentralized trading platform and, mostly importantly, (b) the CA can exploit its full knowledge on users’ GID to launch various attacks against users. Motivated by these observations, this paper introduces a novel user collusion-resistant decentralized multi-authority ABE scheme for privacy preserving data trading systems. In the existing multi-authority ABE systems, users utilize his/her GID that is solely assigned by the CA to generate his/her secret keys throughout the collaboration with authorities and a user can compute multi-authority keys by combining the secret keys (stem from the same GID) in various ways. In the proposed system, the CA only has a partial knowledge of users’ GIDs, and thus, users’ privacy can be protected. On the other hand, we set the user’s own partial GID as a secret which can be used to withdraw his/her deposit to discourage any possible collusion among users.

Cloud computing has become increasingly popular among users and businesses around the world. Although cryptographic techniques can provide data protection for users in public cloud, several issues also remain problematic, such as secure data group dissemination and fine-grained access control of time-sensitive data. In this paper, we propose an identity-based data group sharing and dissemination scheme in public cloud, in which data owner could broadcast encrypted data to a group of receivers at one time by specifying these receivers’ identities in a convenient and secure way. In order to achieve secure and flexible data group dissemination, we adopt attribute-based and timed-release conditional proxy re-encryption to guarantee that only data disseminators whose attributes satisfy the access policy of encrypted data can disseminate it to other groups after the releasing time by delegating a re-encryption key to cloud server. The re-encryption conditions are associated with attributes and releasing time, which allows data owner to enforce fine-grained and timed-release access control over disseminated ciphertexts. The theoretical analysis and experimental results show our proposed scheme makes a tradeoff between computational overhead and expressive dissemination conditions.

The new paradigm of fog computing was extended from conventional cloud computing to provide computing and storage capabilities at the edge of the network. Applied to vehicular networks, fog-enabled vehicular computing is expected to become a core feature that can accelerate a multitude of services including crowd-sensing. Accordingly, the security and privacy of vehicles joining the crowd-sensing system have become important issues for cyber defense and smart policing. In addition, to satisfy the demand of crowd-sensing data users, fine-grained access control is required. In this paper, we propose a secure and privacy-preserving crowd-sensing scheme for fog-enabled vehicular computing. The proposed architecture is made by a double layer of fog nodes that is used to generate crowd-sensing tasks for vehicles, then collect, aggregate and analyze the data based on user specifications. To ensure data confidentiality and fined-grained access control, we make use of ciphertext-policy attribute-based encryption with access update policy (CP-ABE-UP), which is a well-known one-to-many encryption technique. The policy update algorithm allows the fog nodes to outsource the crowd-sensing data to other fog nodes or to data users directly. We also adopted the ID-based signature tied to pseudonymous techniques to guarantee the authentication and privacy-preservation of the entities in the system. From the upper fog layer to the data user, we show that an information-centric networking (ICN) approach can be applied to maximize the network resources and enhance the security by avoiding unauthorized and unauthenticated data owners. The security analysis confirms that our approach is secure against known attacks, whereas the simulation results show its efficiency in terms of communication with little computational overhead.

Interference management for Small Cell (SC) networks has drawn great attention from both academia and industry due to its importance in Long-Term Evolution (LTE) and emerging 5G networks. Although various approaches have been proposed in the literature, many of them face practical limitations such as showing gains only in specific scenarios, relying on ideal fronthaul, or becoming computationally intractable as the network size increases. In this paper, a novel framework is proposed for interference management in centralized SC networks by jointly utilizing graph theory and optimization theory. It extends the classic center-edge frequency reuse schemes into a more fine-grained scale, thus capturing the complex interference relationships in SC networks. The cell-level resource partition can be semi-statically updated according to the traffic dynamics while existing Medium Access Control (MAC) schedulers can be used for subframe-level resource allocation, not requiring fiber fronthaul. LTE system-level simulation results show that the proposed scheme can significantly improve both cell edge and mean user throughput with practical complexity.

Modern day medical systems are closely integrated and interconnected with other systems, such as those comprising Internet-of-Medical Things (IoMT) devices that facilitate remote healthcare services, say during pandemics (e.g., COVID-19). Attribute-based encryption (ABE) is a promising cryptographic primitive to support fine-grained access control in the ciphertext environment; in other words, ABE can potentially be used to ensure data confidentiality and user privacy in the IoMT ecosystem. In this article, we propose an efficient partially-policy-hidden and large universe ABE scheme with public traceability to construct a practical IoMT system (hereafter referred to as PTIoMT). The system is designed to achieve the following features: 1) the access policy is partially hidden: only nonsensitive attribute labels/names are displayed, while sensitive attribute values are hidden in the encrypted electronic health records (EHRs); 2) the number of the attributes is independent of the public parameters and, thus, can be arbitrarily large; 3) any user who discloses the decryption key can be efficiently tracked; and 4) fewer bilinear pairing operations are required during the decryption process. The security analysis and performance evaluation demonstrate the security and efficiency of PTIoMT.

In Wireless Sensor Networks (WSNs), equally spaced timing for Medium Access Control (MAC) is fundamental to guarantee throughput maximization from all nodes. This motivated the so called desynchronization problem and its solution based on the fast Nesterov method. In this letter, we tackle the problem of constructing centralized and distributed versions of the optimal fixed-parameter Nesterov that are resilient to attacks to a subset of nodes. By showing a relationship between the variance of the attacker signal and how further away a node is, we are able to present a distributed algorithm that has minimal added complexity and performs the detection and isolation of the faulty node. Simulations are provided illustrating the successful detection and highlighting that without a correction mechanism (dependent on additional assumptions), there is a residual error that is not eliminated.

Once defined, the access control policies and regulations would never be changed in a running and state transition process. However, it will give attackers the possibility of discovering vulnerabilities in the system, and the control systems lack the ability of dynamic perception of security state and risk, causing the systems to be exposed to risks. In this article, a dynamic Bell–LaPadula (BLP) model is proposed. The conditional random field (CRF) is introduced into the BLP model to optimize the rules. First, the model formalizes the security attributes, states of system, transition rules, and constraint models on the basis of the state transition of CRFs. After the historical system access logs are processed as the original dataset, a feature selection method is proposed to extract the requests and current states as feature vectors. Second, this article presents a rules training algorithm based on L-BFGS to implement the study and training of datasets, and then marks the logs in the test set through Viterbi algorithm automatically. On the base of these, a rule generation algorithm is proposed to dynamically adjust the access control rules based on the current security status and events of the system. Third, the security of CRFs-BLP is proved by theoretical analysis. Finally, the validity and accuracy of the model are verified by estimating the value of the precision, recall, and $F1$ -score. As the system threats are shown to be decreased obviously from these experiments, this dynamic model can decrease the vulnerabilities and risk effectively.

Objective. The purpose of the article is to analyse the existing methodology used to assess the efficiency of automated information security systems by studying open literature sources, international and industry standards of the Russian Federation on information security of automated systems, guidelines and orders of the Federal Service for Technical and Expert Control of Russia, as well as departmental orders, instructions and regulations on information security at informatization facilities of internal affairs bodies. The analysis results in identifying the advantages and disadvantages of the specified methodology, as well as the possibilities of its use when conducting a quantitative assessment of the efficiency of access control subsystems of information security systems at the informatization facilities of internal affairs bodies. Methods. To achieve this goal, the method for system analysis of approaches used to assess the efficiency of information security tools and systems has been applied. Results. The paper presents results of analysing the main approaches used to assess the efficiency of tools and systems for information security of automated systems. The paper determines the relationship between the efficiency indicator of access control subsystems of information security systems and the main disadvantage of their use in protected automated systems of internal affairs bodies. The paper substantiates main directions of improving the existing methodology, proposes methods and indicators for quantifying the efficiency of access control subsystems (including those modified on the basis of using new information and communication technologies) of information security systems in protected automated systems of internal affairs bodies. Conclusion. The results obtained can be used to quantify the security level of existing automated systems and those being developed at informatization facilities of internal affairs bodies.

The key features of 5G network (i.e., high bandwidth, low latency, and high concurrency) along with the capability of supporting big data platforms with high mobility make it valuable in coping with emerging medical needs, such as COVID-19 and future healthcare challenges. However, enforcing the security aspect of a 5G-based smart healthcare system that hosts critical data and services is becoming more urgent and critical. Passive security mechanisms (e.g., data encryption and isolation) used in legacy medical platforms cannot provide sufficient protection for a healthcare system that is deployed in a distributed manner and fail to meet the need for data/service sharing across "cloud-edge-terminal" in the 5G era. In this article, we propose a security awareness and protection system that leverages zero-trust architecture for a 5G-based smart medical platform. Driven by the four key dimensions of 5G smart healthcare including "subject" (i.e., users, terminals, and applications), "object" (i.e., data, platforms, and services), "behavior," and "environment," our system constructs trustable dynamic access control models and achieves real-time network security situational awareness, continuous identity authentication, analysis of access behavior, and fine-grained access control. The proposed security system is implemented and tested thoroughly at industrial-grade, which proves that it satisfies the needs of active defense and end-to-end security enforcement of data, users, and services involved in a 5G-based smart medical system.

IoT devices often collect data and store the data in the cloud for sharing and further processing. A natural solution for secure access is directly using the device owner?s identity as the private key to generate a signature for data authentication. However this will simultaneously expose this identity. Attribute based signature (ABS), which takes the signer?s attributes instead of his/her identity as the private key, can realize data authentication while preserving the signer?s identity privacy. In ABS, there are multiple authorities that issue different private keys for signers based on their various attributes, and a central authority is usually established to manage all these attribute authorities. However, one security concern is that if the central authority is compromised, the whole system will be broken. In this paper, we present an outsourced decentralized multi-authority attribute based signature (ODMA-ABS) scheme. The proposed ODMAABS achieves attribute privacy and stronger authority-corruption resistance than existing multi-authority attribute based signature schemes. In addition, the overhead to generate a signature is further reduced by outsourcing expensive computation to a signing cloud server. We provide extensive security analysis and experimental simulation of the proposed scheme. We also propose an access control scheme that is based on ODMA-ABS.

Because of the importance of digital images and their extensive application to digital watermarking, block chain, access control, identity authentication, distributive storage in the cloud and so on, image secret sharing (ISS) is attracting ever-increasing attention. Share authentication is an important issue in its practical application. However, most ISS schemes with share authentication ability require a dealer to participate in the authentication (namely, dealer participatory authentication). In this paper, we design an ISS for a $(k,n)$ -threshold with separate share authentication abilities of both dealer participatory authentication and dealer nonparticipatory authentication. The advantages of polynomial-based ISS and visual secret sharing (VSS) are skillfully fused to achieve these two authentication abilities without sending a share by using a screening operation. In addition, the designed scheme has the characteristics of low decryption (authentication) complexity, lossless decryption and no pixel expansion. Experiments and theoretical analyses are performed to show the effectiveness of the designed scheme.

Wi-Fi Direct (WFD) has attracted much attention in recent years as a device-to-device communication technology that enables the sharing and diffusion of information in disaster areas that lack existing communication infrastructures. In WFD, mobile devices such as smartphones and tablets establish communication groups (a wireless local area network (WLAN)), and transmit and/or receive data by Wi-Fi among devices autonomously. However, WFD is not effective for spreading data throughout a wide range because it randomly selects communication partners and needs to wait uselessly for random lengths of time to maintain access control. Thus, we propose a novel and efficient information diffusion method exploiting WFD and delay-tolerant networking (DTN). This method involves a unique virtual cell design based on device locations and enables efficient information diffusion without interference by assigning communication times to the virtual cells. As there is no deterministic means of evaluating multihop communication exploiting WFD and a mathematical model is needed to quantitatively indicate the performance of our method, we further construct a performance evaluation model using the reaction–diffusion model, which is a partial differential equation used to mathematically describe the spread of epidemic diseases. The effectiveness of this proposed diffusion method is evaluated exploiting the constructed model.

The rapid development of wearable sensors and the 5G network empowers traditional medical treatment with the ability to collect patients’ information remotely for monitoring and diagnosing purposes. Meanwhile, the health-related mobile apps and devices also generate a large amount of medical data, which is critical for promoting disease research and diagnosis. However, medical data is too sensitive to share, which is also a common issue for IoT (Internet of Things) data. The traditional centralized cloud-based medical data sharing schemes have to rely on a single trusted third party. Therefore, the schemes suffer from single-point failure and lack of privacy protection and access control for the data. Blockchain is an emerging technique to provide an approach for managing data in a decentralized manner. Especially, the blockchain-based smart contract technique enables the programmability for participants to access the data. All the interactions are authenticated and recorded by the other participants of the blockchain network, which is tamper resistant. In this paper, we leverage the K-anonymity and searchable encryption techniques and propose a blockchain-based privacy-preserving scheme for medical data sharing among medical institutions and data users. To be specific, the consortium blockchain, Hyperledger Fabric, is adopted to allow data users to search for encrypted medical data records. The smart contract, i.e., the chaincode, implements the attribute-based access control mechanisms to guarantee that the data can only be accessed by the user with proper attributes. The K-anonymity and searchable encryption ensure that the medical data is shared without privacy leaking, i.e., figuring out an individual patient from queries. We implement a prototype system using the chaincode of Hyperledger Fabric. From the functional perspective, security analysis shows that the proposed scheme satisfies security goals and precedes others. From the performance perspective, we conduct experiments by simulating different numbers of medical institutions. The experimental results demonstrate that the scalability and performance of our scheme are practical.