Distributed and Secure Access Control in P2P Databases

2009

P2P systems are increasingly used for efficient, scalable data sharing. Popular applications focus on massive file sharing. However, advanced applications such as online communities (e.g., medical or research communities) need to share private or sensitive data. Currently, in P2P systems, untrusted peers can easily violate data privacy by using data for malicious purposes (e.g., fraudulence, profiling). To prevent such behavior, the well accepted Hippocratic database principle states that data owners should specify the purpose for which their data will be collected. In this paper, we apply such principles as well as reputation techniques to support purpose and trust in structured P2P systems. Hippocratic databases enforce purpose-based privacy while reputation techniques guarantee trust. We propose a P2P data privacy model which combines the Hippocratic principles and the trust notions. We also present the algorithms of PriServ, a DHT-based P2P privacy service which supports this model and prevents data privacy violation. We show, in a performance evaluation, that PriServ introduces a small overhead.

We propose a new decentralized access control scheme which is used for secure the data storage in clouds. In the proposed scheme, the cloud verifies the authenticity without knowing the user's identity before storing data. Our scheme is also added the feature of access control in which only valid users are able to decrypt the stored information. The scheme prevents replay attacks and supports creation, modification, and reading data stored in the cloud. We also address user revocation. Moreover, our authentication and access control scheme is decentralized and robust, unlike other access control schemes designed for clouds which are centralized. The communication, computation, and storage overheads are comparable to centralized approaches.

2010

As the use of peer-to-peer (P2P) services for distributed file sharing has grown, the need for fine-grained access control (FGAC) has emerged. Existing access control frameworks use an all-or-nothing approach that is inadequate for sensitive content that may be shared by multiple users. In this paper, we propose a FGAC mechanism based on selective encryption techniques. Using this approach, the owner of a file specifies access control policies over various byte ranges in the file. The separate byte ranges are then encrypted and signed with different keys. Users of the file only receive the encryption keys for the ranges they are authorized to read and signing keys for the ranges they are authorized to write. We also propose an optional enhancement of the scheme where a file owner can hide location of the file. Our approach includes a key distribution scheme based on a public key infrastructure (PKI) and access control vectors. We also discuss how policy changes and file modifications are handled in our scheme. We have integrated our FGAC mechanism with the Chord structured P2P network. In this paper, we discuss relevant issues concerning the implementation and integration with Chord and present the performance results for our prototype implementation.

20th International Conference on Advanced Information Networking and Applications - Volume 1 (AINA'06), 2006

With the increasing number of applications and their variety, the need to prevent unauthorised disclosure of data, and to ensure data integrity in distributed systems has led to a heavy reliance on encryption. Typically, the encryption process operates at file or directory level and applies indiscriminately one algorithm to all the data in a file. In this paper, a distributed scheme is proposed whereby secrecy is achieved through file data concealment and file location concealment, within a network of nodes. This involves first the division of a file into fragments, which are encrypted by applying different algorithms, second the random distribution of these fragments to connected nodes, third the generation of metadata for reconstructing the original file and its commitment to a physical medium and finally the deletion of both the original file and its metadata from the local node. Access to the metadata is the only way of retrieving the original file. An evaluation of the scheme is presented with some performance results.

2017 IEEE 30th International Symposium on Computer-Based Medical Systems (CBMS), 2017

Cloud computing offers many advantages as flexibility or resource efficiency and can significantly reduce costs. However, when sensitive data is outsourced to a cloud provider, classified records can leak. To protect data owners and application providers from a privacy breach data must be encrypted before it is uploaded. In this work, we present a distributed key management scheme that handles user-specific keys in a single-tenant scenario. The underlying database is encrypted and the secret key is split into parts and only reconstructed temporarily in memory. Our scheme distributes shares of the key to the different entities. We address bootstrapping, key recovery, the adversary model and the resulting security guarantees.

2003

Confidential data stored on mass storage devices is at risk to be disclosed to persons getting physical or administrator access to the device. Encrypting the data reduces this risk, at the cost of more cumbersome administration. In this publication, we examine the problem of encrypted data storage in a grid computing environment, where storage capacity and data is shared across organizational boundaries. We propose an architecture that allows users to store and share encrypted data in this environment. Access to decryption keys is granted based on the grids data access permissions. The system is therefore usable as an additional security feature together with a classical access control mechanism. Data owners can choose different tradeoffs of security versus efficiency. Storage servers need not to be trusted and common access control models are supported.

Computer …, 2008

Despite the advantages offered by pure Peer to Peer (P2P) networks (e.g. robustness and fault tolerance), a crucial requirement is to guarantee basic security properties, such as content authenticity and integrity, as well as to enforce appropriate access control policies. These mechanisms would pave the way for new models in which content providers can exert some control over the replication and file sharing process. However, the extremely decentralized nature of these environments makes impossible to apply classic solutions that rely on some kind of fixed infrastructure, typically in the form of on line trusted third parties (TTP). In this paper, we introduce a suite of protocols for content authentication and access control in pure P2P networks based on attribute certificates that does not rely on the existence of a public key infrastructure (PKI), privilege management infrastructure (PMI), or any other form of centralized authority. We provide an analysis concerning the efficiency (computational effort and communication overhead) and the security of our proposal.

2009

Online peer-to-peer (P2P) communities such as professional ones (e.g., medical or research) are becoming popular due to increasing needs on data sharing. P2P environments offer valuable characteristics but limited guarantees when sharing sensitive or confidential data. They can be considered as hostile because data can be accessed by everyone (by potentially untrustworthy peers) and used for everything (e.g., for marketing or for activities against the owner's preferences or ethics). In this paper we propose PriServ, a privacy service located on top of distributed hash table (DHT) based P2P systems which prevents data privacy violations. Based on data owner privacy preferences, PriServ uses Hippocratic database principles, takes into account which operations will be realized on shared data (e.g., read, write, disclosure) and uses reputation techniques to increase trust on peers. Several simulation results encourage our ideas and a prototype of PriServ is under development 1 .

Computer Science and Information Systems, 2023

Blockchain technology gained popularity thanks to its decentralized and transparent features. However, it suffers from a lack of privacy as it stores data publicly and has difficulty to handle data updates due to its main feature known as immutability. In this paper, we propose a decentralized data storage and access framework that combines blockchain technology with Distributed Hash Table (DHT), a role-based access control model, and multiple encryption mechanisms. Our framework stores metadata and DHT keys on the blockchain, while encrypted data is managed on the DHT, which enables data owners to control their data. It allows authorized actors to store and read their data in a decentralized storage system. We design REST APIs to ensure interoperability over the Web. Concerning data updates, we propose a pointer system that allows data owners to access their update history, which solves the issue of data updates while preserving the benefits of using the blockchain. We illustrate our solution with a wood supply chain use case and propose a traceability algorithm that allows the actors of the wood supply chain to trace the data and verify product origin. Our framework design allows authorized users to access the data and protects data against linking, eavesdropping, spoofing, and modification attacks. Moreover, we provide a proof-of-concept implementation, security and privacy analysis, and evaluation for time consumption and scalability. The experimental results demonstrate the feasibility, security, privacy, and scalability of the proposed solution.

—Cloud storage has rapidly become a cornerstone of many businesses and has moved from an early adopters stage to an early majority, where we typically see explosive deployments. As companies rush to join the cloud revolution, it has become vital to create the necessary tools that will effectively protect users' data from unauthorized access. Nevertheless, sharing data between multiple users' under the same domain in a secure and efficient way is not trivial. In this paper, we propose Sharing in the Rain – a protocol that allows cloud users' to securely share their data based on predefined policies. The proposed protocol is based on Attribute-Based Encryption (ABE) and allows users' to encrypt data based on certain policies and attributes. Moreover, we use a Key-Policy Attribute-Based technique through which access revocation is optimized. More precisely, we show how to securely and efficiently remove access to a file, for a certain user that is misbehaving or is no longer part of a user group, without having to decrypt and re-encrypt the original data with a new key or a new policy.