A new data-centric authentication and authorization mechanism for multilayer systems

Since sensitive data is shared by third parties with the rapid progress of the Internet and cloud technologies, there will be a need for encryption to store these data. There are many methods in the literature to prevent unauthorized access of sensitive data. In this study, to provide access control, new multi-layer access control model in which Role-Based and Attribute-Based Access Control models are used together is presented. The suggested system is an approach that is based on secure sharing and storage of data on the network. Identity based encryption (IBE) and identity based signature (IBS) mechanisms are used for user authentication. At the same time, the Ciphertext-policy Attribute-Based Encryption (CP-ABE) mechanism is used for authorization based on the user-specified attributes on the system. The authentication and authorization mechanism is used for smooth start-up, secure data import and secure data sharing. Revocation is used for authority management which is the biggest problem of such systems. This mechanism provides the controls for situations such as changing the user's attributes in the system or revoking of user authorization. However, if same data is encrypted several times by many users causes unnecessary growth of storage space. To prevent this, a whole mechanism has been proposed by using the deduplication, Convergent Encryption method. Thus, it is shown that the system is obtained with lower bandwidth cost.