JSON Fine Grained Access

4.1. JSON-FA Data Elements

The JSON-FA data structure mainly consists of a JSON object that contains the requested access resources and their fine-grained access conditions, including the following fields:¶

• requestId: The identifier of the request.¶
• subject: Identifiers representing the access subject.¶
• operation: indicates the action identifier of the request body, such as "read", "write", "update", and so on.¶
• resource: Indicates the identifier of the accessed resource. Contains a list of information about accessing the resource. The accessed resource object includes the following fields:¶
• • resourceType: Describes the type of the resource, such as files, databases, and so on.¶
  • attributes: is an object that contains the static attributes of the resource, such as file name, file type, creation date, and so on.¶
• condition: Refers to the fine-grained attributes of the access subject, and is an optional field.¶

4.2. JSON-FA Data Structure Example

This example describes the request where User123 submits a request named request123 through an access control server. The request is for read-only access to a specific file named "document.txt". Additionally, when submitting the request, User123 provides fine-grained attributes related to the request, including his role and department.¶

  {
    "requestId": "request23",
    "subject": "user123",
    "operation": "read",
    "resource": {
      "resourceType": "file",
      "attributes": {
        "fileName": "document.txt",
        "fileType": "text/plain"
      }
    }
    "condition": {
      "role": "manager",
      "department": "finance"
    }
  }

5.1. CP-ABE algorithm

Ciphertext-policy Attribute-Based Encryption (CP-ABE) algorithm allows data owners to define access policies based on the attributes of data receivers. These policies are encrypted within the ciphertext, while the receivers' attributes are encoded in their private keys.?Only receivers with attributes that meet the access policies encrypted in the ciphertext can decrypt and access the original data. This encryption method provides fine-grained access control, providing a balance between data security and flexibility.¶

The CP-ABE algorithm works as follows:¶

1. Setup: This step takes an implicit security parameter ? as input. It outputs public parameters PK and master key MK.?The public parameters are made available to all, while the master key is kept secret.¶
2. Encrypt(PK, M, A): Inputs the public parameters PK, a message M, and an access structure A. It encrypts the message M to generate a ciphertext CT. Only data receivers with attributes that meet the access structure can decrypt the message. The access structure A is implicitly contained in the ciphertext.¶
3. Key Generation(MK, S): Inputs the master key MK and a set of attributes S for the data receiver. It outputs a private key SK. The SK is determined by the attribute set S.¶
4. Decrypt(PK, CT, SK): Inputs the public parameters PK, the ciphertext CT containing the access structure A, and the private key SK. If the attribute set S meets the access structure A, it decrypts the ciphertext CT and returns the message M.¶

Algorithm Parameters:¶

1. Security Parameter (?): An input parameter that determines the security level of the algorithm. Typically, a larger value of the security parameter provides higher security, but also increases computational complexity and key length.¶
2. Public parameters (PK) and Master Key (MK): These two crucial parameters are generated during the initialization phase (Setup). The public parameters PK is public and used for encryption operations, while the master key MK is secret and used to generate private keys for data receivers.¶
3. Attribute Set (S): Set by the data owner, defining the attributes of the data receiver, which can be their identity, role, permissions, etc.¶
4. Access Structure (A): Set by the data owner, defining the access control policy that describes the attribute sets which can access the encrypted data. The access structure A is typically represented using an access tree structure, where each node represents an attribute or a set of attributes.¶
5. Plaintext Message (M): The original data that needs to be encrypted. During the encryption phase, the algorithm uses the Public parameters PK, plaintext message M, and access structure A to generate the ciphertext CT.¶
6. Ciphertext (CT): The encrypted data.¶
7. Private Key (SK): Generated based on the data receiver's attributes set S and the master key MK. The private key SK contains the data receiver's attributes and the decryption capabilities associated with those attributes. During the decryption phase, the data receiver uses their own private key to decrypt the ciphertext.¶

5.2. Access Control Process

1. The client sends authentication information to the server to apply for registration and authorization. The server verifies these information and returns a JWT token.¶
2. The request sent by the client includes a JWT token, and the payload of the token contains information about the accessing subject, accessed resources, and attributes. This is represented by the data structure mentioned in 5.2.¶
3. Resource servers set fine-grained access control policies for different resources, which are represented by an Access Control Tree (Access Tree). Each leaf node in the access control tree represents an attribute, while non-leaf nodes are threshold gates/nodes. The data format inside a threshold node is (n, t), indicating that the node has a total of n child nodes, and the node is considered satisfied if at least t child nodes meet the conditions.¶
4. The access control tree provides a precise and convenient way to control access permissions for different accessing subjects to specific resources based on attributes and access rules. It satisfies complex and changing data access requirements while offering a descriptive format for access control.¶
5. The resource server validates the authenticity of the token carried in the request. Once the token is validated, the server parses the payload information to extract the accessing subject, accessed resource, access action, and attribute information.¶
6. Based on the extracted information and the predefined access control policies, the resource server determines whether there is a matching fine-grained access control policy. If a matching policy is found, the server checks if the access conditions are met. If the conditions are satisfied, access is granted; otherwise, access is denied.¶
7. The resource server encrypts the requested resource using the CP-ABE (Ciphertext-Policy Attribute-Based Encryption) algorithm. The encryption process incorporates the access control policy corresponding to the accessed resource. The encrypted ciphertext is then sent back to the client.¶
8. The client generates a decryption private key based on the set of attributes included in the request using the CP-ABE (Ciphertext-Policy Attribute-Based Encryption) algorithm. After receiving the encrypted ciphertext, the client verifies that the attributes in the attribute set can satisfy the access control policy. Only if the attributes meet the policy can the client decrypt and access the resource.¶