Access Control with Hidden Policies and Credentials for Service Computing

In a services computing environment, a large amount of sensitive data is hosted by service providers. As the owners of data might have different security requirements for their data, many systems allow each data item to have its own access control policy. For privacy and security reasons, some data owners and clients might want their access control policies and credentials to remain secret to the service providers which handle the access control of the data. That is, the service providers cannot comprehend the contents of the access control policies and the credentials. This paper proposed a role-based access control scheme. It uses cryptographic techniques to obscure data's access control policies and clients' credentials. The scheme is efficient as the policy enforcement process only uses the information available on the service provider that carries out the access control. A prototype of the scheme has been implemented and the execution time of the scheme were measured.