Revocable and Efficient Blockchain-Based Fine-Grained Access Control Against EDoS Attacks in Cloud Storage

Qingyang Zhang; Chang Xu; Hong Zhong; Chengjie Gu; Jie Cui

doi:10.1109/TC.2024.3398502

IEEE Transactions on Computers

Revocable and Efficient Blockchain-Based Fine-Grained Access Control Against EDoS Attacks in Cloud Storage

Aug. 2024, pp. 2012-2024, vol. 73

DOI Bookmark: 10.1109/TC.2024.3398502

Authors

Qingyang Zhang, Key Laboratory of Intelligent Computing and Signal Processing of Ministry of Education, School of Computer Science and Technology, Anhui University, Hefei, China
Chang Xu, Key Laboratory of Intelligent Computing and Signal Processing of Ministry of Education, School of Computer Science and Technology, Anhui University, Hefei, China
Hong Zhong, Key Laboratory of Intelligent Computing and Signal Processing of Ministry of Education, School of Computer Science and Technology, Anhui University, Hefei, China
Chengjie Gu, School of Public Security and Emergency Management, Anhui University of Science and Technology, Hefei, China
Jie Cui, Key Laboratory of Intelligent Computing and Signal Processing of Ministry of Education, School of Computer Science and Technology, Anhui University, Hefei, China

Keywords

Cloud Computing, Blockchains, Security, Servers, Access Control, Encryption, Industrial Internet Of Things, Access Control, Ciphertext Policy Attributed Based Encryption, Cloud Storage Service, E Do S Attacks, Blockchain, Cloud Server, Access Policy, Fine Grained Access Control, Theoretical Analysis, User Data, Symmetric Encryption, Data Owner, Malicious Users, Attribute Based Encryption, Decoding, Internet Of Things, System Architecture, Computational Overhead, Central Authority, Secret Key, Public Key, Denial Of Service, Access Structure, Binary Tree, Communication Overhead, Smart Contracts, Blockchain Technology, Unauthorized Users, Distributed Denial Of Service, Internet Of Things Systems, Industrial Internet Of Things, Cloud Providers, Probabilistic Polynomial Time, Key Generation, Cloud Environment

Abstract

Users have become accustomed to storing data on the cloud using ciphertext policy attribute-based encryption (CP-ABE) for fine-grained access control. However, this encryption method does not consider the ability of malicious users to launch thousands of file download requests when launching an economic denial of sustainability attack (EDoS), which may be more expensive for data owners. Existing solutions typically use a cloud server to verify the download permissions of the data users. However, cloud servers are not completely trusted and cloud server providers and colluding data users can still launch an EDoS attack. With our scheme, using CP-ABE, a blockchain is introduced for verifying the download permission of data users. In addition, we propose a new mechanism to solve the problem of malicious user revocations under EDoS attacks by updating the ciphertext and symmetric encryption technology. A formal security proof has demonstrated that the proposed scheme is suitable for plaintext attack security. Theoretical and experimental analyses show that our scheme performs more efficiently than previous methods.

Like what you’re reading?

Already a member?

Get this article FREE with a new membership!

References

[1]Q. Zhang, L. Cheng, and R. Boutaba, “Cloud computing: State-of-the-art and research challenges,” J. Internet Serv. Appl., vol. 1, no. 1, pp. 7–18, 2010.

[2]J. Cui, B. Li, H. Zhong, G. Min, Y. Xu, and L. Liu, “A practical and efficient bidirectional access control scheme for cloud-edge data sharing,” IEEE Trans. Parallel Distrib. Syst., vol. 33, no. 2, pp. 476–488, Feb.2022.

[3]Z. Zhang, W. Zhang, and Z. Qin, “Fully constant-size CP-ABE with privacy-preserving outsourced decryption for lightweight devices in cloud-assisted IoT,” Secur. Commun. Netw., vol. 2021, pp. 1–16, 2021.

[4]S. Agrawal and M. Chase, “FAME: Fast attribute-based message encryption,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., 2017, pp. 665–682.

[5]S. Potluri, M. Mangla, S. Satpathy, and S. N. Mohanty, “Detection and prevention mechanisms for DDoS attack in cloud computing environment,” in Proc. 11th Int. Conf. Comput., Commun. Netw. Technol. (ICCCNT),Piscataway, NJ, USA: IEEE Press, 2020, pp. 1–6.

[6]M. A. S. Monge, J. M. Vidal, and G. M. Pérez, “Detection of economic denial of sustainability (EDoS) threats in self-organizing networks,” Comput. Commun., vol. 145, pp. 284–308, Sep.2019.

[7]K. Xue, W. Chen, W. Li, J. Hong, and P. Hong, “Combining data owner-side and cloud-side access control for encrypted cloud storage,” IEEE Trans. Inf. Forensics Secur., vol. 13, no. 8, pp. 2062–2074, Aug.2018.

[8]J. Ning, X. Huang, W. Susilo, K. Liang, X. Liu, and Y. Zhang, “Dual access control for cloud-based data storage and sharing,” IEEE Trans. Dependable Secure Comput., vol. 19, no. 2, pp. 1036–1048, Mar./Apr.2020.

[9]K. Y. Yap, H. H. Chin, and J. J. Klemes, “Blockchain technology for distributed generation: A review of current development, challenges and future prospect,” Renewable Sustain. Energy Rev., vol. 175, 2023, Art. no. 113170.

[10]C. Yuan, M. Xu, X. Si, and B. Li, “Blockchain with accountable CP-ABE: How to effectively protect the electronic documents,” in Proc. IEEE 23rd Int. Conf. Parallel Distrib. Syst. (ICPADS), Piscataway, NJ, USA: IEEE Press, 2017, pp. 800–803.

[11]Y. Rahulamathavan, R. C.-W. Phan, M. Rajarajan, S. Misra, and A. Kondoz, “Privacy-preserving blockchain based IoT ecosystem using attribute-based encryption,” in Proc. IEEE Int. Conf. Adv. Netw. Telecommun. Syst. (ANTS), Piscataway, NJ, USA: IEEE Press, 2017, pp. 1–6.

[12]H. Cui, R. H. Deng, Y. Li, and B. Qin, “Server-aided revocable attribute-based encryption,” in Comput. Secur. 21st Eur. Symp. Res. Comput. Secur., Heraklion, Greece. Berlin, Germany: Springer-Verlag, 2016, pp. 570–587.

[13]J. Ning, X. Dong, Z. Cao, L. Wei, and X. Lin, “White-box traceable ciphertext-policy attribute-based encryption supporting flexible attributes,” IEEE Trans. Inf. Forensics Secur., vol. 10, no. 6, pp. 1274–1288, Jun.2015.

[14]M. Bayat, H. R. Arkian, and M. R. Aref, “A revocable attribute based data sharing scheme resilient to DoS attacks in smart grid,” Wireless Netw., vol. 21, no. 3, pp. 871–881, 2015.

[15]J. Idziorek, M. Tannian, and D. Jacobson, “Attribution of fraudulent resource consumption in the cloud,” in Proc. IEEE 5th Int. Conf. Cloud Comput., Piscataway, NJ, USA: IEEE Press, 2012, pp. 99–106.

[16]M. H. Sqalli, F. Al-Haidari, and K. Salah, “EDoS-shield-a two-steps mitigation technique against EDoS attacks in cloud computing,” in Proc. 4th IEEE Int. Conf. utility cloud Comput., Piscataway, NJ, USA: IEEE Press, 2011, pp. 49–56.

[17]S. Ding, J. Cao, C. Li, K. Fan, and H. Li, “A novel attribute-based access control scheme using blockchain for IoT,” IEEE Access, vol. 7, pp. 38 431–38 441, 2019.

[18]A. Z. Ourad, B. Belgacem, and K. Salah, “Using blockchain for iot access control and authentication management,” in Proc. Internet Things: 3rd Int. Conf., (SCF), Seattle, WA, USA. Berlin, Germany: Springer-Verlag, 2018, pp. 150–164.

[19]K. Yu, L. Tan, M. Aloqaily, H. Yang, and Y. Jararweh, “Blockchain-enhanced data sharing with traceable and direct revocation in IIoT,” IEEE Trans. Ind. Inform., vol. 17, no. 11, pp. 7669–7678, Nov.2021.

[20]J. Wan, J. Li, M. Imran, D. Li , “A blockchain-based solution for enhancing security and privacy in smart factory,” IEEE Trans. Ind. Inform., vol. 15, no. 6, pp. 3652–3660, Jun.2019.

[21]J. Huang, L. Kong, G. Chen, M.-Y. Wu, X. Liu, and P. Zeng, “Towards secure industrial IoT: Blockchain system with credit-based consensus mechanism,” IEEE Trans. Ind. Inform., vol. 15, no. 6, pp. 3680–3689, Jun.2019.

[22]C. Lee, S. Zhang, and K. Ng, “Development of an industrial internet of things suite for smart factory towards re-industrialization,” Adv. Manuf., vol. 5, no. 4, pp. 335–343, 2017.

[23]J. Li, Y. Shi, and Y. Zhang, “Searchable ciphertext-policy attribute-based encryption with revocation in cloud storage,” Int. J. Commun. Syst., vol. 30, no. 1, 2017, Art. no. e2942.

[24]X. Yan and H. Meng, “Ciphertext policy attribute-based encryption scheme supporting direct revocation,” J. Commun., vol. 37, no. 5, pp. 44–50, 2016.

[25]C. Bai, Y. Zhang, H. Ma, and Z. Liu, “Expressive ciphertext-policy attribute-based encryption with direct user revocation,” Int. J. Embedded Syst., vol. 9, no. 6, pp. 495–504, 2017.

[26]C. Ge, W. Susilo, J. Baek, Z. Liu, J. Xia, and L. Fang, “Revocable attribute-based encryption with data integrity in clouds,” IEEE Trans. Dependable Secure Comput., vol. 19, no. 5, pp. 2864–2872, Sep./Oct.2022.

[27]J. Hur and D. K. Noh, “Attribute-based access control with efficient revocation in data outsourcing systems,” IEEE Trans. Parallel Distrib. Syst., vol. 22, no. 7, pp. 1214–1221, Jul.2011.

[28]V. Goyal, O. Pandey, A. Sahai, and B. Waters, “Attribute-based encryption for fine-grained access control of encrypted data,” in Proc. 13th ACM Conf. Comput. Commun. Secur., 2006, pp. 89–98.

[29]L. Luu, D.-H. Chu, H. Olickel, P. Saxena, and A. Hobor, “Making smart contracts smarter,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., 2016, pp. 254–269.

[30]D. Han, N. Pan, and K.-C. Li, “A traceable and revocable ciphertext-policy attribute-based encryption scheme based on privacy protection,” IEEE Trans. Dependable Secure Comput., vol. 19, no. 1, pp. 316–327, Jan./Feb.2022.

[31]D. A. McGrew and J. Viega, “The security and performance of the galois/counter mode (GCM) of operation,” in Proc. Int. Conf. Cryptol., Berlin, Heidelberg: Springer-Verlag, 2004, pp. 343–355.

[32]J. Chen, R. Gay, and H. Wee, “Improved dual system ABE in prime-order groups via predicate encodings,” in Annu. Int. Conf. Theory Appl. Cryptograph. Techn., Springer-Verlag, 2015, pp. 595–624.

[33]C.-I. Fan, V. S.-M. Huang, and H.-M. Ruan, “Arbitrary-state attribute-based encryption with dynamic membership,” IEEE Trans. Comput., vol. 63, no. 8, pp. 1951–1961, Aug.2014.

EDoS-Shield - A Two-Steps Mitigation Technique against EDoS Attacks in Cloud Computing
2011 IEEE 4th International Conference on Utility and Cloud Computing (UCC 2011)
Fine-Grained Access Control Scheme Based on Cloud Storage
2017 International Conference on Computer Network, Electronic and Automation (ICCNEA)
Method for providing secure and private fine-grained access to outsourced data
2015 IEEE 40th Conference on Local Computer Networks (LCN 2015)
VOD-ADAC: Anonymous Distributed Fine-Grained Access Control Protocol with Verifiable Outsourced Decryption in Public Cloud
IEEE Transactions on Services Computing
Flexible and Fine-Grained Attribute-Based Data Storage in Cloud Computing
IEEE Transactions on Services Computing
EDoS-ADS: An Enhanced Mitigation Technique Against Economic Denial of Sustainability (EDoS) Attacks
IEEE Transactions on Cloud Computing
Revocable, Decentralized Multi-Authority Access Control System
2018 IEEE/ACM International Conference on Utility and Cloud Computing Companion (UCC Companion)
Expressive Data Sharing and Self-Controlled Fine-Grained Data Deletion in Cloud-Assisted IoT
IEEE Transactions on Dependable and Secure Computing
Efficient Fine-Grained Data Sharing Based on Proxy Re-Encryption in IIoT
IEEE Transactions on Dependable and Secure Computing
Blockchain Based Multi-Authority Fine-Grained Access Control System With Flexible Revocation
IEEE Transactions on Services Computing

Revocable and Efficient Blockchain-Based Fine-Grained Access Control Against EDoS Attacks in Cloud Storage

Authors

Keywords

Abstract

References

Related Articles