Privacy-preserving access control and trust management for multi-authority in IoMT systems

Abstract

Internet of Medical Things (IoMT) devices generate a huge amount of real-time data on a daily basis, which can be analyzed by medical practitioners to optimize diagnosis and treatment. Due to the complexity of devices and users in IoMT systems, robust measures are needed to ensure security and quality of service or information. However, most existing schemes require a trusted central authority to generate secret keys for users, which is often impractical in real-world scenarios. Although many multi-authority access control schemes have been proposed to address this issue, they still lack stronger defense and supervision mechanisms to effectively regulate user access. In this paper, we propose a privacy-preserving multi-authority access control scheme that enables policy hiding and efficiently prevents malicious access attacks. Specifically, multiple untrusted authorities independently generate attribute keys through secure two-party computation and zero-knowledge proofs. Even if multiple authorities collude, they cannot trace secret keys. Furthermore, the scheme enhances privacy by breaking the mapping between attributes and the access matrix. What is more, we also construct a dynamic access control mechanism based on trust management, which can effectively curb persistent access attacks by malicious data users. Our security analysis and experimental results show that the scheme achieves semantic security, resists collusion attacks, and constrains the malicious behavior of data users with minimal online encryption computational costs compared to other schemes.