On-Device Hybrid Access Control for Personal Data Sharing  using Sensitivity and Trust Parameters

Geocey Shejy; Pallavi Mangrulkar

doi:10.29207/resti.v10i2.7522

Authors

Geocey Shejy D. Y. Patil University
Pallavi Mangrulkar NMIMS University

DOI:

https://doi.org/10.29207/resti.v10i2.7522

Keywords:

ABAC, personally identifiable information, PII, RRBAC, sensitivity, trust

Abstract

Protection of Personally Identifiable Information (PII) is challenging for organisations. Access to sensitive resources, ie, databases and files, can be controlled and restricted by the Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC) and other access control models defined at the organisational level. This work proposes a lightweight on-device PII access control model based on the principle of preserving privacy at the source of data generation. The set of data shared by the user is converted into objects, and the object is treated as a resource to which RBAC, ABAC and Hybrid access controls are applied. Coarse-level access to a set of PII information, in the form of PII objects, on a user device is implemented using RBAC, while fine-grained access is defined and performed using ABAC. Hybrid access, which supports object and attribute-level access control using sensitivity, trust, and Time to Live (TTL) environment, was evaluated. The RBAC, ABAC, and Hybrid models are lightweight, highly reliable, scalable, and efficient to implement on user devices. Three models were tested for scalability up to 1000 objects and a corresponding number of attributes. This model mitigates the risk of PII exposure posed by the data-collecting organisation and enhances user consent for PII sharing.

Downloads

Download data is not yet available.

References

“Ministry of Law and Justice, Government of India. (2023). The Digital Personal Data Protection Act, 2023 (Chapters 2 & 3). The Gazette of India. https://egazette.nic.in/WriteReadData/2023/248107.pdf Accessed April 8, 2025.”

“Office of the Australian Information Commissioner. (2019). Australian Privacy Principle 11 – Security of personal information (Chapter 11). In Australian Privacy Principles guidelines. https://www.oaic.gov.au/privacy/australian-privacy-principles-guidelines/chapter-11-app-11-security-of-personal-information . Accessed April 8, 2025.”

“European Parliament and Council of the European Union. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation), Chapter 3: Rights of the data subject. Official Journal of the European Union, L 119, 1–88. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679 Accessed April 8, 2025.”

O. L. van Daalen, “The right to encryption: Privacy as preventing unlawful access,” Computer Law and Security Review, vol. 49, Jul. 2023, https://doi.org/10.1016/j.clsr.2023.105804

J. Shurson, “A European right to end-to-end encryption?,” Computer Law and Security Review, vol. 55, Nov. 2024, https://doi.org/10.1016/j.clsr.2024.106063

R. L. Rivest, A. Shamir, and L. Adleman. 1978. A method for obtaining digital signatures and public-key cryptosystems. Commun. ACM 21, 2 (Feb. 1978), 120–126. https://doi.org/10.1145/359340.359342

S. Lin, L. Cui, and N. Ke, “End-to-End Encrypted Message Distribution System for the Internet of Things Based on Conditional Proxy Re-Encryption,” Sensors, vol. 24, no. 2, Jan. 2024, https://doi.org/10.3390/s24020438

M. Nabeel, “The Many Faces of End-to-End Encryption and Their Security Analysis,” in Proceedings - 2017 IEEE 1st International Conference on Edge Computing, EDGE 2017, Institute of Electrical and Electronics Engineers Inc., Sep. 2017, pp. 252–259. https://doi.org/10.1109/IEEE.EDGE.2017.47

H. Liu and Y. Wang, “Social Media Use and Privacy Concerns: How do College Students view Internet Privacy and Information Protection,” European Journal of Humanities and Social Sciences, vol. 3, no. 2, pp. 93–102, Apr. 2023, https://doi.org/10.24018/ejsocial.2023.3.2.429

A. Sharma and M. Bantan, “Simulating data breaches: Synthetic datasets for depicting personally identifiable information through scenario-based breaches,” Data Brief, vol. 58, Feb. 2025, https://doi.org/10.1016/j.dib.2024.111207

N. Wongwiwatchai, P. Pongkham, and K. Sripanidkulchai, “Detecting personally identifiable information transmission in android applications using light-weight static analysis,” Comput. Secur., vol. 99, Dec. 2020, https://doi.org/10.1016/j.cose.2020.102011

B. Custers and G. Malgieri, “Priceless data: why the EU fundamental right to data protection is at odds with trade in personal data,” Computer Law and Security Review, vol. 45, Jul. 2022, https://doi.org/10.1016/j.clsr.2022.105683

A. Ammari, E. Allodi, D. Salerno, and G. P. Stella, “An asymmetrical approach to understanding consumer haracteristics in banking trust during the COVID-19 pandemic in Italy,” Res. Int. Bus. Finance, vol. 64, Jan. 2023, https://doi.org/10.1016/j.ribaf.2023.101903

S. Ahmed, K. Bangassa, and S. Akbar, “A study on trust restoration efforts in the UK retail banking industry,” British Accounting Review, vol. 52, no. 1, Jan. 2020, https://doi.org/10.1016/j.bar.2019.100871

“Consumer Financial Protection Bureau. (2017). Consumer protection principles: Consumer-authorized financial data sharing and aggregation. Consumer Financial Protection Bureau. https://www.consumerfinance.gov/data-research/research-reports/consumer-protection-principles-consumer-authorized-financial-data-sharing-and-aggregation Accessed on 23.3.2025.”

“Termly. Data privacy statistics: Understanding consumer concerns and business impact. Termly. https://termly.io/resources/articles/data-privacy-statistics Accessed on 23.3.2025.”

H. Tyagi, R. Kumar, and S. K. Pandey, “A detailed study on trust management techniques for security and privacy in IoT: challenges, trends, and research directions,” High-Confidence Computing, vol. 3, no. 2, Jun. 2023, https://doi.org/10.1016/j.hcc.2023.100127

H. Wang and Y. Song, “Secure Cloud-Based EHR System Using Attribute-Based Cryptosystem and Blockchain,” J. Med. Syst., vol. 42, no. 8, Aug. 2018, https://doi.org/10.1007/s10916-018-0994-6

V. C. Hu et al., “NIST Special Publication 800-162 Guide to Attribute Based Access Control (ABAC) Definition and Considerations”, https://doi.org/10.6028/NIST.SP.800-162

C. Daudén-Esmel, J. Castellà-Roca, and A. Viejo, “Blockchain-based access control system for efficient and GDPR-compliant personal data management,” Comput. Commun., vol. 214, pp. 67–87, Jan. 2024, https://doi.org/10.1016/j.comcom.2023.11.017

Ravi Sandhu, David Ferraiolo, and Richard Kuhn. “The NIST model for role-based access control: towards a unified standard”. In Proceedings of the fifth ACM workshop on Role-based access control (RBAC '00). Association for Computing Machinery, New York, NY, USA, 47–63. 2000, https://doi.org/10.1145/344287.344301

H. Wang and Y. Song, “ Secure Cloud-Based EHR System Using Attribute-Based Cryptosystem and Blockchain. ,” J. Med. Syst., vol. 42, no. 152, 2018 https://doi.org/10.1007/s10916-018-0994-6

A. Sahai and B. Waters, “Fuzzy Identity-Based Encryption,” 2005, https://doi.org/10.1007/11426639_27

V. Goyal, O. Pandey, A. Sahai, and B. Waters, “Attribute-based encryption for fine-grained access control of encrypted data,” in Proceedings of the ACM Conference on Computer and Communications Security, 2006, pp. 89–98. https://doi.org/10.1145/1180405.1180418

Waters, B. (2011). Ciphertext-Policy Attribute-Based Encryption: An Expressive, Efficient, and Provably Secure Realization. In: Catalano, D., Fazio, N., Gennaro, R., Nicolosi, A. (eds) Public Key Cryptography – PKC 2011. PKC 2011. Lecture Notes in Computer Science, vol 6571. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-19379-8_4

“U.S. Department of Labour. Guidance on the Protection of Personally Identifiable Information (PII). Available at: url https://www.dol.gov/general/ppii Last updated: 10/1/2025. Accessed April 8, 2025.”