A Conceptual Reference Architecture for Robust, Leakage-Resilient and Verifiable Access Control in Secure IoT...

Area of Science:

• Cybersecurity and Cryptography
• Internet of Things (IoT) Security
• Distributed Systems

Background:

• Outsourcing IoT data and computation to cloud/fog infrastructure introduces integrity, confidentiality, and privacy risks.
• Current attribute-based encryption (ABE) solutions for fine-grained access control face challenges like single-authority bottlenecks, costly policy updates, weak auditability, and vulnerability to quantum adversaries.
• Existing cryptographic primitives are threatened by future quantum adversaries, necessitating post-quantum security considerations.

Purpose of the Study:

• To propose a conceptual reference architecture for a robust access-control framework for IoT data outsourcing.
• To systematize the composition of existing, standardized cryptographic primitives into a cohesive security solution.
• To provide a precise design for reasoning about security and enabling future implementation studies.

Main Methods:

• Defined a comprehensive system and threat model, including passive, active, colluding, bounded-leakage, and harvest-now-decrypt-later quantum adversaries.
• Instantiated the architecture with decentralized multi-authority ABE, attribute-based proxy re-encryption, a bounded leakage resilient key model, ASCON AEAD, and post-quantum ML-KEM/ML-DSA primitives.
• Incorporated a permissioned, on-chain digest/off-chain payload logging layer for enhanced auditability and specified end-to-end data flow and module interfaces.

Main Results:

• Developed a composable access-control framework integrating diverse cryptographic primitives.
• Addressed limitations of current ABE systems, including single-authority bottlenecks and policy update costs.
• Provided a security rationale and analytical evaluation based on standardized parameters and asymptotic complexity, explicitly stating inherited and future proof requirements.

Conclusions:

• The proposed reference architecture offers a systematic approach to securing IoT outsourcing by composing existing, standardized primitives.
• The design enhances access control against advanced threats, including quantum adversaries, while improving auditability.
• This work provides a clear, honestly scoped design foundation for future prototype development and implementation studies in IoT security.