Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

End to End Secure Data Exchange in Value Chains with Dynamic Policy Updates

Aintzane Mosteiro-Sanchez, Marc Barcelo, Jasone Astorga, Aitor Urbieta

TL;DR

The paper addresses secure end-to-end data exchange in value chains that include IIoT devices, where dynamic policy updates are essential to adapt to evolving collaboration. It introduces an E2E secure system based on Multi-Layered CP-ABE together with AES-GCM to guard data from production to consumption while allowing policy updates without involving resource-constrained field devices. The approach enables data producers to control access via attribute-based policies, support one-to-many sharing, and revoke outdated permissions through timestamped keys and an External CT Engine, all mapped to ENISA’s high-level reference model. Experimental evaluation on ARM-like hardware demonstrates the practicality and scalability of the solution for IIoT platforms, validating its potential to reduce data breach risks in industrial value chains.

Abstract

Data exchange among value chain partners provides them with a competitive advantage, but the risk of exposing sensitive data is ever-increasing. Information must be protected in storage and transmission to reduce this risk, so only the data producer and the final consumer can access or modify it. End-to-end (E2E) security mechanisms address this challenge, protecting companies from data breaches resulting from value chain attacks. Moreover, value chain particularities must also be considered. Multiple entities are involved in dynamic environments like these, both in data generation and consumption. Hence, a flexible generation of access policies is required to ensure that they can be updated whenever needed. This paper presents a CP-ABE-reliant data exchange system for value chains with E2E security. It considers the most relevant security and industrial requirements for value chains. The proposed solution can protect data according to access policies and update those policies without breaking E2E security or overloading field devices. In most cases, field devices are IIoT devices, limited in terms of processing and memory capabilities. The experimental evaluation has shown the proposed solution's feasibility for IIoT platforms.

End to End Secure Data Exchange in Value Chains with Dynamic Policy Updates

TL;DR

The paper addresses secure end-to-end data exchange in value chains that include IIoT devices, where dynamic policy updates are essential to adapt to evolving collaboration. It introduces an E2E secure system based on Multi-Layered CP-ABE together with AES-GCM to guard data from production to consumption while allowing policy updates without involving resource-constrained field devices. The approach enables data producers to control access via attribute-based policies, support one-to-many sharing, and revoke outdated permissions through timestamped keys and an External CT Engine, all mapped to ENISA’s high-level reference model. Experimental evaluation on ARM-like hardware demonstrates the practicality and scalability of the solution for IIoT platforms, validating its potential to reduce data breach risks in industrial value chains.

Abstract

Data exchange among value chain partners provides them with a competitive advantage, but the risk of exposing sensitive data is ever-increasing. Information must be protected in storage and transmission to reduce this risk, so only the data producer and the final consumer can access or modify it. End-to-end (E2E) security mechanisms address this challenge, protecting companies from data breaches resulting from value chain attacks. Moreover, value chain particularities must also be considered. Multiple entities are involved in dynamic environments like these, both in data generation and consumption. Hence, a flexible generation of access policies is required to ensure that they can be updated whenever needed. This paper presents a CP-ABE-reliant data exchange system for value chains with E2E security. It considers the most relevant security and industrial requirements for value chains. The proposed solution can protect data according to access policies and update those policies without breaking E2E security or overloading field devices. In most cases, field devices are IIoT devices, limited in terms of processing and memory capabilities. The experimental evaluation has shown the proposed solution's feasibility for IIoT platforms.
Paper Structure (14 sections, 7 figures, 1 table)

This paper contains 14 sections, 7 figures, 1 table.

Table of Contents

  1. Introduction
  2. State of the Art
  3. Scenario and Requirements
  4. Design Requirements
  5. Proposed System
  6. Multi-Layered CP-ABE
  7. System Design
  8. Industrial High-Level Reference Model
  9. Policy Update and Revocation using Multi-Layered CP-ABE
  10. Experimental evaluation
  11. Testbed Setup
  12. Experiments definition
  13. Discussion of the Results
  14. Conclusions

Figures (7)

  • Figure 1: Value Chain data exchange situation layout
  • Figure 2: Layered encryption. The IIoT devices applies $AP_{1}$. Any other device can apply the following layers.
  • Figure 3: System Design. AP stands for access policy, CT for ciphertext, and nLayers is the number of access policy layers.
  • Figure 4: Components of the proposed system mapped to the ENISA high reference model EuropeanUnionAgencyforNetworkandInformationSecurityENISA2018GoodManufacturing.
  • Figure 7: Total time required to generate $CT_{ABE_{1}}$ and transform it to $CT_{ABE_{2}}$ in three scenarios: One layer in DO (red triangle), one layer in Int. CT Engine (blue dot) and the combined use of DO and Int. CT Engine (orange square).
  • ...and 2 more figures