** Ecole nationale Supérieure d’Informatique (Alger). Contrôle d’accès basé sur la « Preuve de Coexistence d’objets » pour l’IoT Lyes Touati *, Hamed Hellaoui ** and Yacine Challal ** * Sorbonne universités, Université de technologie de Compiègne, CNRS, Heudiasyc. ** Ecole nationale Supérieure d’Informatique (Alger). Journées Non Thématiques ResCom Inria Sophia Antipolis, France 12/01/2017 ANR-11-IDEX-0004-02 www.labexms2t.fr

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) Plan Introduction State of the art Ciphertext-Policy Attribute-Based Encryption (CP-ABE) Threshold grouping proofs based Access Control for IoT Conclusion

Introduction Grouping proofs: It is a concept that aims to provide a proof that a group of entities are simultaneously present at the same zone. Threshold grouping proofs: It is a generalization of the grouping proofs concept by allowing to precise a number threshold of entities.

Introduction Examples of grouping proofs concept applications It could be used in order to enhance the access control: Access to buildings. NFC Payment. … Secure Location Access k-out-of-N objects must be present.

State of the art State of the art Concept of grouping proofs is introduced in [J. Saito, et al. 2005] by using a timestamps. Simultaneity is compromised. In [Leonid Bolotnyy, et. al. 2007], a construction of a circular chain while polling tags is proposed. Scalability issues => (Simultaneity compromised) In [Fuentes et al. 2015], The set of devices is divided into several subsets. Each subset is polled in unpredictable manner (many rounds). High execution time

Background Ciphertext-Policy Attribute-Based Encryption (CP-ABE) scheme [J. Bethencourt et. al. 2007] Asymmetric encryption mechanism. Powerful tool to implement access control. Fine-grained access control. Private keys are constructed on a set of attributes. Ciphertexts are encrypted under access policies. Attribute Authority is a responsible for defining system settings and generating private keys.

Background Background Ciphertext-Policy Attribute-Based Encryption (Operation)  OR Director AND Doctor Cardiology  MSK PK      Attribute Authority Alice SKSarah: “Doctor” “Director” SKKevin: “Doctor” “Neurology” Sarah Kevin

CP-ABE based Threshold Grouping proofs: Threshold grouping proof based Access Control for IoT CP-ABE based Threshold Grouping proofs: Network Model Entities: We consider a group of N entities. Proxy: It is responsible of relating the group of entities in order to construct the proof. It is semi-trusted: trusted for the entities, and (might be) malicious for the verifier. Verifier: It is responsible for generating the challenge and verifying the proof. Attributes Authority: It is responsible for configuring the system by creating Public and Master keys.

CP-ABE based Threshold Grouping proofs: Threshold grouping proof based Access Control for IoT CP-ABE based Threshold Grouping proofs: Overview We use CP-ABE in order to provide grouping proofs in IoT We split the private key into many elements shared by entities. A verifier will encrypt a random message which is the challenge The group of entities will try to decrypt the message using the part of the secret key. Decrypting the message is a proof of the co-existance of the entities.

CP-ABE based Threshold Grouping proofs: Threshold grouping proof based Access Control for IoT CP-ABE based Threshold Grouping proofs: Construction > System Configuration Let consider a group of N entities GE = {E1, E2, …, EN}. Running key generation primitive to generate SK associated to S = {attribute_1, …, attribute_N}. 𝑆𝐾=(𝐷= 𝑔 (𝛼+𝑟)/𝛽 , ∀ 𝑗 ∈𝑆: 𝐷 𝑗 = 𝑔 𝑟 . 𝐻(𝑗) 𝑟 𝑗 ; 𝐷 ′ 𝑗 = 𝑔 𝑟 𝑗 ) The element 𝐷 is sent to the proxy. Each couple ( 𝐷 𝑗 , 𝐷′ 𝑗 ) is given to the corresponding entity Ej of the group holding the attribute_j.

CP-ABE based Threshold Grouping proofs: Threshold grouping proof based Access Control for IoT CP-ABE based Threshold Grouping proofs: Construction > Challenge/Response γ=(𝑘−𝑜𝑢𝑡−𝑜𝑓−𝑁 ( 𝑎𝑡𝑡𝑟𝑖𝑏𝑢𝑡𝑒_1; 𝑎𝑡𝑡𝑟𝑖𝑏𝑢𝑡𝑒_2;…; 𝑎𝑡𝑡𝑟𝑖𝑏𝑢𝑡𝑒_𝑁)).

CP-ABE based Threshold Grouping proofs: Threshold grouping proof based Access Control for IoT CP-ABE based Threshold Grouping proofs: Construction > Group dynamics Adding an entity: Construct a couple (D (N+1), D’ (N+1)) for the new entity (Attribute Authority, Entity_N+1). Add the new attribute in the access policy (Verifier).

CP-ABE based Threshold Grouping proof: Threshold grouping proof based Access Control for IoT CP-ABE based Threshold Grouping proof: Construction > Group dynamics Removing an entity: Remove the corresponding attribute from the access policy (Verifier).

Threshold grouping proof based Access Control for IoT Advantages Ability to variate the threshold k and therefore the level of security. Ability to variate the importance of the entities (Number of attributes associated). Ability to easily update (add and/or remove) one or more entities from the group

Performance analysis (1/2) Threshold grouping proof based Access Control for IoT Performance analysis (1/2) Number of operations executed n: number of entities in the group k: threshold

Performance analysis (2/2) Settings: PBC library (Configuration: “f”). Threshold grouping proof based Access Control for IoT Performance analysis (2/2) Settings: PBC library (Configuration: “f”). Required Storage Capacity Ni: number of entities in the group i. Ng: number of the groups.

Grouping-proofs is a robust access control technique for IoT. Conclusion Conclusion Grouping-proofs is a robust access control technique for IoT. We have introduced a threshold grouping proofs scheme based on CP-ABE. Our scheme supports dynamic groups of entities with variable weight and adaptive level of security (threshold k).

Thanks ! Questions ?