In today’s world, Cyber-Physical Systems (CPS) play a key role in areas like smart homes, transportation, and healthcare, where lightweight IoT devices are used to monitor and control activities. As the number of IoT devices keeps growing, so does the amount of data they generate. This calls for scalable computing and storage solutions, which are often provided using fog and cloud technologies. However, applying secure and efficient access control in these decentralized and resource-limited environments is still a major challenge. Ciphertext-Policy Attribute-Based Encryption (CP-ABE) allows fine-grained access control, but existing multi-authority schemes do not support dynamic update in user attributes–something that is important in real-life CPS, where user roles often change. Also, the heavy computations required in CP-ABE can slow down low-power IoT devices. To solve these issues, we propose SAMIT , a CP-ABE scheme with multiple authorities that supports efficient attribute updates and is designed for embedded systems. Our scheme uses fog nodes to handle complex computations, reducing the load on resource-constrained IoT devices. Security and performance results show that SAMIT is secure and suitable for CPS with limited device resources.

The explosion of data generated by IoT devices encouraged the introduction of paradigm fog computing, which facilitates computation and analysis at the edge. Alongside fog, cloud computing co-exists for facilities such as massive storage, large processing capability, etc. However, storage and computation of data at different levels increase the risk of data security, which persuades the need for a proper access control scheme. Ciphertext-policy attribute-based encryption (CP-ABE) is a well-known cryptographic mechanism that provides data confidentiality and fine-grained access control. Unfortunately, the existing CP-ABE schemes are not well suited for the cloud-fog-IoT environment as they do not provide functionalities like key-escrow resistance, attribute update, attribute revocation, user revocation, and outsourcing of expensive operations with verifiable outsourced decryption, simultaneously in a single scheme. Therefore, this paper proposes a CP-ABE scheme named ACS-FIT, which supports key-escrow resistance, attribute update, user revocation, attribute revocation, and outsourcing of expensive operations with verifiable outsourced decryption functionalities altogether. The scheme is efficient as the expensive encryption and decryption operations are outsourced to fog nodes leaving only a small and constant amount of computation for the IoT devices. Additionally, the task of attribute update and revocation is also outsourced to a third party. The cost incurred during attribute update and revocation are also efficient as only those components are updated which are associated with the affected attributes. Meanwhile, the user holds a constant size key which remains unchanged during any update. The security analysis proves that the proposed scheme is secure against Chosen-Plaintext Attack under Decisional Bilinear Diffie-Hellman assumption. The performance analysis shows that the proposed scheme is efficient and suitable for IoT devices.