In the Internet of things (IoT), the flow and sharing of data between different devices has become a trend. However, determining how to ensure the controlled flow and sharing of data is an urgent problem to address to ensure data security and privacy in the IoT environment. To address the above problem, we propose a provenance‐based data flow control mechanism (PDFC) that includes flow control and further control to realize data flow control and further control after flow. The mechanism implements both direct and indirect control of data flow based on provenance data, which reduces the risk of indirect leakage. As data flow and are shared between different devices, the provenance data become increasingly large, consequently, indirect control on the provenance data takes increasing amounts of time, seriously affecting control efficiency. To improve the control efficiency of data flow, the provenance data are simplified according to the type of operation generating the data and the association degree of data and their provenance data. To reduce the storage space occupied by the provenance data and improve the efficiency of querying the provenance data, we propose a provenance tree that records the relationship between data and their provenance data. A theoretical analysis demonstrates the security and effectiveness of PDFC, which can solve the fine‐grained controlled sharing problem in IoT. Using the data flow in a smart healthcare system as an example, we demonstrate the implementation and optimization method of PDFC, and the result shows PDFC has obvious flexibility and performance advantages.

The development of online social networks allows users to communicate with each other and share their resources when and where. However, in the process of data dissemination, the user loses control of the private information if the user shares resources into the social network, which may lead to privacy leakage. In order to solve the above problems, the paper proposes an extended access control mechanism for online social networks. This mechanism not only controls the operation rights of direct users, but also controls the assignable rights of indirect users, achieving the purpose of extended authorization. In this paper, the attribute modeled as a five-tuple is defined in detail, and requirement of each attribute is described. Furthermore, we assign different weights to different operation types of resources, and judge whether the resource operation is satisfied by calculating the degree of trust and the weight, thus determine user's permissions. Finally, through case analysis and scheme comparison, we prove that the extended authorization mechanism can effectively control the spread of information and protect user's privacy.

No abstract