As for the advancement of IoT and cloud computing in healthcare, outsourcing encrypted Electronic medical records (EMRs) created by the aggregation of medical treatment applications and health data collected from IoT devices enables high accessibility, effective collaboration, and zero computational operation cost. Current applications and research works generally concern the privacy of the finest EMRs that are encrypted with secure and lightweight cryptographic protocols before they are outsourced to the cloud. However, this process does not consider the security and privacy of data collected by IoT devices, where the data being transferred can be leaked before they are aggregated. Furthermore, there are no works that simultaneously address the outsourced encryption, privacy of IoT data transmission and aggregation, and the policy update of the EMRs in the IoT cloud setting. In this paper, we propose an access control scheme called LightMED which provides secure, fine-grained, and scalable EMR sharing in a cloud-based environment integrated with fog computing, CP-ABE, and blockchain technology. We propose a secure IoT data transmission and aggregation method based on lightweight encryption and digital signing. At the core, we introduce outsourced encryption with a privacy-preserving access policy scheme and an outsourced encryption and decryption algorithm leveraged by the collaboration between fog nodes and blockchain. In addition, we introduce a novel lightweight policy update algorithm to enable the data owners of EMRs to effectively manage their policies in a secure and effective manner. Finally, we performed the comparative analysis to illustrate the computation cost and conducted experiments to evaluate the performance of our scheme and related works. The experimental results showed that our scheme outperformed existing works since it yielded least processing cost of both encryption and decryption at end-users’ devices, which demonstrates the higher efficiency and practicality of our scheme.

The electronic know your customer (e-KYC) is a system for the banking or identity provider to establish a customer identity data verification process between relying parties. Due to the efficient resource consumption and the high degree of accessibility and availability of cloud computing, most banks implement their e-KYC system on the cloud. Essentially, the security and privacy of e-KYC related documents stored in the cloud becomes the crucial issue. Existing e-KYC platforms generally rely on strong authentication and apply traditional encryption to support their security and privacy requirement. In this model, the KYC system owner encrypts the file with their host’s key and uploads it to the cloud. This method induces encryption dependency and communication and key management overheads. In this paper, we introduce a novel blockchain-based e-KYC scheme called e-KYC TrustBlock based on the ciphertext policy attribute-based encryption (CP-ABE) method binding with the client consent enforcement to deliver trust, security and privacy compliance. In addition, we introduce attribute-based encryption to enable the privacy preserving and fine-grained access of sensitive transactions stored in the blockchain. Finally, we conduct experiments to show that our system is efficient and scalable in practice.

Existing Single Sign-On (SSO) access control systems typically rely on the traditional protocols requiring additional authentication mechanism and/or identity providers. As the growing demand in outsourcing system resources such as data and applications to the cloud platform, implementing traditional SSO models to support efficient and fine-grained access control for multi-user and multi-application environment is not practical. In this paper, we propose a blockchain-based identification and access management (IAM) scheme called $\text{D}^{2}$ -IAM to provide strong security measures for controlling SSO access to resources in the cloud. At a core of $\text{D}^{2}$ -IAM, core access control processes are done by the smart contracts and blockchain where the access transactions are well retained for the accountability. In our system, the SSO authentication is based on the highest authentication level and the hashed-based token management. Owing to the autonomous authentication management, the communication overhead regarding the interaction with identity providers and third-party verification mechanism for multi-system authentication is minimized. For the authorization system, $\text{D}^{2}$ -IAM enables fine-grained access through the access policy modeled in the document database written and enforced to each customer. Finally, we conducted the experiments on Google cloud to show that our $\text{D}^{2}$ -IAM system is efficient for the implementation. The performance test showed that our proposed system was approximately 4 times efficient than the average processing time of three existing works.

With the employment of IoT technology and cloud computing in healthcare, outsourcing Electronic Health Records (EHRs) generated by IoT devices becomes the critical issue. In fact, as EHRs may be collected by different units within a hospital and traverse intranet or public networks, this introduces vulnerabilities to privacy breaches. Existing research efforts employ cloud-based access control with encryption solutions to secure outsourced EHRs. Nevertheless, in the context of an IoT cloud data-sharing environment, where data originates from numerous devices and user authorization status undergoes frequent changes, a gap persists in achieving a comprehensive and systematic integration of secure IoT data transfer and aggregation, coupled with efficient user revocation procedures. In this research, we proposed a cloud-based access control scheme for outsourced IoT-enabled EHRs. Our proposed scheme achieves fine-graindness, scalable and efficient revocation based on the pseudo-random encryption, symmetric encryption, and ciphertext-policy attribute-based encryption (CP-ABE), and graph-based modeling. In our scheme, we utilized fog computing to transfer the resource-intensive tasks of encrypting and decrypting CP-ABE, while also streamlining communication expenses between IoT devices and cloud storage. Additionally, we implemented an adaptive load sharing algorithm to facilitate effective distribution of workloads among fog nodes. Moreover, we integrate the blockchain as the integrity validation to help checking the integrity of the EHRs in the system. Finally, we provided security analysis, comparative computation analysis and conducted experiments to show that our scheme is secure and efficient in practice.

With rapidly increasing adoption of cloud computing and the advancement of today mobile computing, it is inevitable that mobile devices are used to receive and send the data through the mobile cloud platform. This increases the convenience and flexibility of data access over the cloud computing since data users are able to access the shared data anytime, anywhere via mobile devices. However, using mobile devices in accessing shared data in a cloud where the sensitive data is encrypted is not practical because mobile devices have limited computing resources in dealing with heavy cryptographic operations. In this article, we propose a lightweight collaborative ciphertext policy attribute role-based encryption (LW-C-CP-ARBE) scheme to support a fine-grained and lightweight access control for mobile cloud environment. We apply CP-ABE approach as a core cryptographic access control and introduce a new proxy re-encryption (PRE) protocol to reduce data re-encryption and decryption cost for the mobile users. To this end, the overhead in running the cryptographic operation at the end-user device is small. In addition, we develop secure access policy sharing and re-encryption protocol to enable users having write privilege to update the data and request the proxy to perform data re-encryption. Finally, we present the evaluation and experiments to demonstrate the efficiency and practicality of our system.

Cloud data warehouse (CDW) platforms have been offered by many cloud service providers to provide abundant storage and unlimited accessibility service to business users. Sensitive data warehouse (DW) data consisting of dimension and fact data is typically encrypted before it is outsourced to the cloud. However, the query over encrypted DW is not practically supported by any analytical query tools. The Searchable Encryption (SE) technique is palpable for supporting the keyword searches over the encrypted data. Although many SE schemes have introduced their own unique searching methods based on indexing structure on top of searchable encryption techniques, there are no schemes that support Boolean expression queries essential for the search conditions over the DW schema. In this paper, we propose a secure and verifiable searchable encryption scheme with the support of Boolean expressions. The technical construct of the proposed scheme is based on the combination of Partial Homomorphic Encryption (PHE), B+Tree and Inverted Index, and bitmapping functions to enable privacy-preserving SE with efficient search performance suitable for encrypted DW. To enhance the scalability without requiring a third party to support the verification of search results, we employed blockchain and smart contracts to automate authentication, search index retention, and trapdoor generation. For the evaluation, we conducted comparative experiments to show that our scheme is more proficient and effective than related works.