Secure audit logging is essential for cloud forensics, yet existing schemes suffer from fundamental limitations. Classical hash-chaining, pairing-based, and RSA/ECC-based logging lose evidential validity under key compromise and quantum attacks, while blockchain-assisted approaches rely on pre-quantum primitives and periodic verification, leaving temporal windows exploitable by insiders. This paper presentsPost-Quantum Attribute-Based Logging (PQ-ABL), a quantum-resilient forensic logging framework with continuous integrity assurance. PQ-ABL employs lattice-based CP-ABE to enforce fine-grained, post-quantum access control, while log payloads are efficiently protected using AES-GCM. Integrity is achieved through an epoch-driven verification model that anchors a single Merkle root per epoch on the blockchain, enabling linear-time$O(N)$full-epoch validation, constant-time$O(1)$local record consistency checking after epoch validation, and$O(\log N)$standalone record membership verification, without requiring per-record authentication proofs during epoch validation. The key contribution is an integrity design that decouples post-quantum authorization from verification cost, eliminating forensic blind spots inherent in periodic anchoring. Security analysis proves confidentiality and integrity under standard lattice hardness assumptions. Experimental results show that PQ-ABL reduces verification latency by 31.8% and computation cost by 38.6% compared with existing post-quantum and blockchain-based logging schemes.

The rapid proliferation of Internet of Things (IoT) in healthcare has transformed the management of Electronic Health Records (EHRs), but also introduced critical challenges in secure retrieval, dynamic revocation, and verifiable integrity over encrypted data. Existing Searchable Encryption (SE) and Attribute-Based Searchable Encryption (ABSE) models remain limited: (i) most support only exact or prefix keyword matching and cannot handle flexible wildcard or substring queries common in medical search; (ii) revocation is coarse-grained, often requiring costly key redistribution or ciphertext re-encryption; and (iii) integrity verification either incurs heavy blockchain overhead or exposes access structures, undermining privacy. To address these gaps, we proposeMK-WISE, a secure and efficient multi-keyword wildcard ABSE framework for IoT–EHR systems. MK-WISE integrates an Index–Wildcard Tree (IWT) with Substring Bloom Filters (SBF) to enable expressive wildcard and substring queries, employs a puncturable PRF–based revocation workflow with edge-local enforcement, hierarchical key updates, and optional blockchain anchoring, and incorporates homomorphic MACs for lightweight correctness and completeness verification. Security analysis proves that MK-WISE achieves confidentiality, keyword privacy, unlinkability, and revocability under standard assumptions. Experimental results demonstrate that MK-WISE significantly outperforms state-of-the-art schemes in trapdoor generation, search scalability, and revocation cost, achieving millisecond-level revocation without user disruption. These results highlight MK-WISE as a practical and comprehensive solution for privacy-preserving EHR retrieval in IoT-enabled healthcare.

The exchange of Electronic Health Records (EHRs) among healthcare institutions is essential for providing comprehensive patient care and advancing medical research. However, current systems face several challenges, including data silos, interoperability issues, and high computational costs associated with cross-domain data sharing. To address these limitations, this paper presents SSX-EHRs, a novel blockchain-based access control model designed for secure, scalable, and efficient EHR sharing across regions. We propose a distributed architecture of regional blockchains that stores encrypted EHRs in the cloud while maintaining their corresponding indexes on the blockchain. This architecture supports dynamic updates through a Merkle tree structure, enabling the addition of new EHRs without the need to rebuild the entire dataset, while ensuring data integrity through fast Merkle proofs. To enhance user authentication, we incorporate self-sovereign identity (SSI) with an improved zk-SNARKs protocol, which leverages a universal setup to minimize communication costs and optimize authentication for cross-domain environments. Additionally, we introduce a dynamic proxy re-encryption (D-PRE) mechanism that adaptively re-encrypt the ciphertext based on the load sharing. Through comparative analysis and experiments, our results demonstrate that SSX-EHRs achieves higher efficiency in handling larger datasets, improves query response times, and minimizes latency compared to existing solutions.

Sharing data in industrial cloud requires both secure and flexibility management of data shared among users in the industry. Users should have ability to access authorized portion of data from smart edge devices with integrated secure protocol for interacting with cloud storage. Among cryptographic-based access control solutions, ciphertext-policy attribute-based encryption (CP-ABE) is recognized as a suitable solution for supporting secure and fine-grained data access control for outsourced data. However, the attribute revocation is a major drawback of CP-ABE since it introduces subsequent costs such as ciphertext re-encryption, user key re-generation, and key re-distribution. Existing revocable CP-ABE based access control models have focused on minimizing the cost of communication and computation cost for ciphertext re-encryption. Unfortunately, the key update issue is subject to re-key generation as traditional CP-ABE does. In essence, key update becomes crucial when there are a high number of users accessing shared data in the cloud. In this paper, we propose a lightweight access control model featured with the efficient key updating scheme. Finally, the performance evaluation is conducted to demonstrate the efficiency of our proposed scheme.

This paper proposes a cryptographic-based access control that supports secure and efficient signcryption and decryption feature for data owners and data users in mobile cloud environment. At a core construct of our proposed scheme, a dual encryption based on AES encryption and ciphertext policy attribute-based encryption (CP-ABE) and dual proxy model are integrated. In our model, data owners can encrypt and digitally sign a file by using AES key and their private key stored in the mobile devices respectively. The hash value calculation and CP-ABE encryption are outsourced to the delegated proxy called signcryption proxy. In the similar way, data users can use their mobile devices to decrypt the ciphertext encrypted by the AES key while the computing task of CP-ABE decryption is outsourced to another proxy called decryption proxy. Therefore, most extensive costs for digital signing, encryption, and decryption are offloaded to the proxies located in the cloud. This renders the confidentiality, authenticity, and non-repudiation along with the fine-grained access control for mobile cloud environment where both data owners and data users can use the mobile devices to share and access the data via cloud platform. In addition, we conducted performance evaluation to substantiate that our proposed scheme is efficient in practice.

This paper proposes an e-document workflow system called “WorkTrue” that supports secure, fine-grained access control and multiple digital signings for e-document workflow management implemented on cloud. We apply a ciphertext policy attribute-based encryption (CP-ABE) to enable the access control with data privacy-preserving for all signed documents stored in the cloud server. In addition, we present a dynamic workflow scheduling algorithm to dynamically schedule the workflow tasks to be run by VM instances (VMIs) from a single VM in a cloud. In our experiment, we developed a WorkTrue prototype as a proof of concept for validating its functionality. We also conducted performance evaluation to substantiate that our WorkTrue is efficient in practice.

In this paper, we propose an access control model featured with the efficient key update function in data outsourcing environment. Our access control is based on the combination of Ciphertext Policy - Attribute-based Encryption (CP-ABE) and Role-based Access Control (RBAC). The proposed scheme aims to improve the attribute and key update management of the original CP-ABE. In our scheme, a user's key is incorporated into the attribute certificate (AC) which will be used to decrypt the ciphertext encrypted with CP-ABE policy. If there is any change (update or revoke) of the attributes appearing in the key, the key in the AC will be updated upon the access request. This significantly reduces the overheads in updating and distributing keys of all users simultaneously compared to the existing CP-ABE based schemes. Finally, we conduct the experiment to evaluate the performance of our proposed scheme to show the efficiency of our proposed scheme.

In this paper, we propose a Very Lightweight Proxy Re-Encryption (VL-PRE) scheme to efficiently support attribute-based revocation and policy update in the collaborative data sharing in cloud systems. To this end, we propose three-phase VL-PRE protocol including re-encryption key generation, re-encryption key update, and re-encryption key renewal for supporting the optimized attribute revocation and policy update. Finally, we conduct the experiments to evaluate the performance of our VL-PRE and show that it supports the attribute revocation management through resource-constrained mobile devices with a practical and scalable manner.

Existing access control solutions applying Cipher text Policy Attribute based Encryption (CP-ABE) scheme usually rely on the static access enforcement based on the access control policy. In real-world scenario, the static pattern of access control policy may not be sufficient to effectively respond the security problems or advanced access control requirements. In this paper, we enhance our collaborative access control model: C-CP-ARBE, to be capable to support a more rigorous access control with security constraints and preventive access policy (PAP) enforcement feature. To this end, we design constraints specification model and PAP enforcement scheme in multi-authority cloud storage systems. We employ Multi-Agent System (MAS) to automate the authentication and authorization function as well as to increase the performance of overall cryptographic processes. As of MAS concept, the scalability and separation of security functions of our access control system are enhanced. Finally, we present the experiments to demonstrate the improved efficiency and practicality of our proposed scheme.

This paper proposes the design and development framework of collaborative access control for OLAP queries spanning over multi-data warehouse (DW). The approach is based on PKI Authentication and Privilege Management Infrastructure (PMI); it presents a binding model of DW user identification and privilege of fact and dimensional access. To integrate several security policies from DWs, we employ the XACML policy integration to serve interoperation and authorization management. In our approach, we apply the multi-agent system to automate flexible and effective management of user authentication, role delegation as well as system accountability. Finally, the implementation details of the prototype A-Cold (Access Control of web-OLAP over multiple DWs) is presented to demonstrate our research idea.