Privacy-Preserving Attribute-Based Bilateral Access Control With Zero-Knowledge Pre-verification for IIoT

Abstract

In the Industrial Internet of Things (IIoT), secure data sharing via edge computing is pivotal for enabling collaborative manufacturing. However, existing bilateral access control (BAC) schemes suffer from a “Transmit-then-Verify” limitation: full ciphertexts must be transmitted before privilege verification, causing severe bandwidth wastage for gigabyte-level payloads upon decryption failure. Moreover, performing policy matching at honest-but-curious edge nodes (ENs) often necessitates exposing access policies in plaintext, compromising privacy. To bridge this gap, we propose a bandwidth-efficient and privacy-preserving BAC (BE-PBAC) scheme. We introduce a novel “verify-then-transmit” paradigm by integrating a Groth–Sahai (GS) zero-knowledge proof (ZKP) mechanism into the ciphertext header. This empowers the EN to rigorously preverify a user’s decryption eligibility without learning their credentials, effectively intercepting unauthorized requests. Additionally, we design a blinded attribute matching protocol that supports fine-grained policy hiding with explicitly bounded leakage against honest-but-curious ENs. Performance evaluations confirm that BE-PBAC reduces bandwidth consumption by orders of magnitude for unauthorized access attempts while maintaining robust privacy guarantees.