Access Authentication Research Articles

A Consortium Blockchain-Based Access Control Framework With Dynamic Orderer Node Selection for 5G-Enabled Industrial IoT

5G-enabled Industrial Internet of Things (IIoT) deployment will bring more severe security and privacy challenges, which puts forward higher requirements for access control. Blockchain-based access control method has become a promising security technology, but it still faces high latency in consensus process and weak adaptability to dynamic changes in network environment. This article proposes a novel access control framework for 5G-enabled IIoT based on consortium blockchain. We design three types of chaincodes for the framework named policy management chaincode (PMC), access control chaincode (ACC), and credit evaluation chaincode (CEC). The PMC and ACC are deployed on the same data channel to implement the management of access control policies and the authorization of access. The CEC deployed on another channel is used to add behavior records collected from IIoT devices and calculate the credit value of IIoT domain. Specifically, we design a two-step credit-based Raft consensus mechanism, which can select the orderer nodes dynamically to achieve fast and reliable consensus based on historical behavior records stored in the ledger. Furthermore, we implement the proposed framework on a real-world testbed and compare it with the framework based on practical Byzantine fault tolerance consensus. The experiment results show that our proposed framework can maintain lower consensus cost time with 100 ms level and achieves four to five times throughput with lower hardware resource consumption and communication consumption. Besides, our design also improves the security and robustness of the access control process.

Secure Data Access Privacy Preserving Using Cloud Services

Notwithstanding the huge computational advantages, re-appropriating information to the public internet, furthermore avoiding end-users, quick authority towards the systems which using their information, which inescapable gets up to the minute privacy tasks. Circulated registering allows different pros and unrivalled comfort for the cloud users to obtain the needed permission of cloud gave that the close by establishment limits need not be thought of. While getting to information, there may be a co-employable connection between various customers which assembles sharing and exchanging of data, a grim cycle. The viewpoint on present privacy courses of action is basically on confirmation to catch that the information of an independent can’t be moved nearer illegitimately, anyway there arose an insurance problem when a user interest for information splitting into various customers between cloud specialist. The customer security may be uncovered by tried induction appeal itself, if data permission approval for the users is gained or loosed. In the introduced structure, an assurance saving affirmation show is used to hinder the above security bothers. According to this Method, control of data through shared induction is cultivated by route toward convey baffling permission appeal that offers security to the cloud users. Permission authority relies upon credits so the cloud customers can simply get to their own endorsed data fields. Advanced encryption standard estimation is used to achieve data lack of clarity and data protection. The proposed system oversaw secure assurance saving data access authority is appealing for various customer in cloud consistent limit.

Blockchain-Enabled Access Management System for Edge Computing

In the post-cloud era, edge computing is a new computing paradigm with data processed at the edge of the network, which can process the data close to the end-user in real time and offload the cloud task intelligently. Meanwhile, the decentralization, tamper-proof and anonymity of blockchain technology can provide a new trusted computing environment for edge computing. However, it does raise considerable concerns of security, privacy, fault-tolerance and so on. For example, identity authentication and access control rely on third parties, heterogeneous devices and different vendors in IoT, leading to security and privacy risks, etc. How to combine the advantages of the two has become the highlight of academic research, especially the issue of secure resource management. Comprehensive security and privacy involve all aspects of platform, data, application and access control. In. this paper, the architecture and behavior of an Access Management System (AMS) in a proof of concept (PoC) prototype are proposed with a Color Petri Net (CPN) model. The two domains of blockchain and edge computing are organically connected by interfaces and interactions. The simulation of operation, activity and role association proves the feasibility and effectiveness of the AMS. The instances of platform business access control, data access control, database services, IOT hub service are run on Advantech WISE-PaaS through User Account and Authentication (UAA). Finally, fine-grained and distributed access control can be realized with the help of a blockchain attribute. Namely, smart contracts are used to register, broadcast, and revoke access authorization, as well as to create specific transactions to define access control policies.

Recursive Filtering for Time-Varying Discrete Sequential Systems Subject to Deception Attacks: Weighted Try-Once-Discard Protocol

In this article, recursive filtering is investigated for time-varying discrete sequential systems (DSSs) under weighted try-once-discard (WTOD) protocols, which are employed to govern the access authorization of a shared network in order to remit the communication burden. A transmission model, dependent on a Bernoulli distributed white sequence, is developed to describe the phenomenon of deception attacks. In light of the adopted protocol and the attack model, a recursive algorithm with the form of Riccati-like difference equations is developed to optimize the filtering performance in the mean square sense. Furthermore, by resorting to the mathematical induction, the convergence of the proposed recursive algorithm is discussed profoundly. Finally, a simulation example is presented to verify the availability of the designed recursive filter.

Research on the communication mechanism between entities based on end-to-end credible state assessment

In the information age, with the development of internet technology, there are more and more various business services, at the same time, network security issues are also increasing. However, traditional protection methods are gradually hard to cope with the complex network environment. Aiming at the credible connection establishment and data communication problems that need to be solved urgently in the credible network, an interentity communication mechanism based on end-to-end credibility assessment is proposed. This mechanism combines trusted computing with network access control mechanisms, integrates network access authority control technology, server identity authentication technology, communication subject measurement technology and network link transparent encryption technology, adopts real-time monitoring of terminal status, dynamic adjustment of access authorities, optimized network access control mechanism and data transmission method, to against security issues of the network communication. After security analysis, this mechanism improves the security of the connection and communication between the terminal and the network. It can effectively avoid security threats to information systems, and make the service of the information system safe and reliable.

Fine Grained Decentralized Access Control With Provable Data Transmission and User Revocation in Cloud

Cloud computing started a new era for IT enterprises. It allows the movement of application from local to remote location, massive data storage. Owner has access to centralized or decentralized data storage server, where data management handled by remote vendor. But, the heterogeneous and dynamic nature of cloud introduces security challenges. Among them, access control and integrity checking are most important which incur high consideration. Attribute-based encryption is one of the access control technique which allows integration of access policies, attributes, and encrypted data. In this paper, a new fine-grained decentralized data access control technique with user revocation has been proposed. Here, service provider is responsible for verifying the user authenticity. The proposed schema supports integrity checking and user revocation. The integrity checking proof validates that the user data is intact and revocation mechanism will help to revoke the user in linear time. Moreover, the proposed access control and authentication schemes are decentralized and comparable to other approaches.

Enhancing the security of memory in cloud infrastructure through in‐phase change memory data randomisation

As a promising alternative to dynamic RAM, phase change memory (PCM) suffers from limited write endurance. Therefore, many research proposals on PCM security or reliability have focussed on the possible threat of wear-out attacks from malicious applications. However, it is also found that the non-volatile nature and the programming behaviour of PCM bring other security challenges to the memory system. The authors examine the potential risk of information leakage and theft in memory management for PCM-based cloud server or multitenant systems. By observing the influence of process variation (PV) on PCM cell programming, they propose a fast and efficient in-memory data obfuscation mechanism to defend against memory attacks or information leakage during page reallocation mandated by OS. With the capabilities of in-memory data randomisation, the proposed SecuRAM avoids the long write latency of PCM cells to erase the content, and achieves higher data initialisation efficiency than conventional software solutions. Second, the proposed SecuRAM also provides a novel solution of fast in-memory hardware fingerprinting and random number generation, which are common and essential security functions in encryption or access authentication to protect confidential memory data from attackers. Two novel techniques are proposed to generate signatures and random numbers: the first is based on partial programming, which works in the same way as bulk data randomisation; the second is loop-counting, which is an overhead-free method by reusing the cell programming mechanism in iterate-write PCM devices. Through evaluation, SecuRAM shows a much better performance and energy-efficiency than conventional measures for PCM memory.

Data Membership Identification using Bloom Filter in Cloud Storage for Effective Resource Allocation

Cloud computing has recently been the buzz word that had changed the entire software industry with its PaaS, IaaS and SaaS architecture model. The legacy systems operational in the organizations across different industries have been using the database that had an overhead in terms of cost of data storage, runtime operation and frequent data maintenance. Cloud database concept had challenged the existing storage and operational norms of data. In the distributed environment, resources used in the cloud databases need to identify whether the requested data belongs to the data nodes of a cluster. With databases began to be ubiquitous, the data storage needed to satisfy heterogeneous data structures rather the unstructured data storage support is looked for. The Use of Bloom's filter for data membership identification is the novel approach and can effectively improve the resource organization strategy on cloud. Dynamic resource organization can further improve the query efficiency as well. The concern raised during this is the data privacy which can also be ascertain by maintaining the data access authority levels. Bloom filter uses less memory space against the large dataset to store it's information. A Bloom filter is proposed to be used to determine whether an element is part of a reference set. It is a very compact hash-based data structure with efficient look-up times and a manageable risk of giving false positives.

Artificial intelligence in cyber security: research advances, challenges, and opportunities

In recent times, there have been attempts to leverage artificial intelligence (AI) techniques in a broad range of cyber security applications. Therefore, this paper surveys the existing literature (comprising 54 papers mainly published between 2016 and 2020) on the applications of AI in user access authentication, network situation awareness, dangerous behavior monitoring, and abnormal traffic identification. This paper also identifies a number of limitations and challenges, and based on the findings, a conceptual human-in-the-loop intelligence cyber security model is presented.

Performance Analysis of Transport Time and Legal Stability through Smart OTP Access System for SMEs in Connected Industrial Parks

According to data from the National Police Agency, 75.5 percent of dead traffic accidents in Korea are truck accidents. About 1,000 people die in cargo truck accidents in Korea every year, and two to three people die in cargo truck accidents every day. In the survey, Korean cargo workers answer poor working conditions as an important cause of constant truck accidents. COVID 19 is increasing demand for non-face-to-face logistics. The inefficiency of the Korean transportation system is leading to excessive work burden for small logistics The inefficiency of the Korean transportation system is causing excessive work burden for small individual carriers. The inefficiency of the Korean transportation system is also evidenced by the number of deaths from logistics industry disasters that have risen sharply since 2020. Small and medium-sized Korean Enterprises located in CIPs (Connected Industrial Parks) often do not have smart access certification systems. And as a result, a lot of transportation time is wasted at the final destination stage. In the logistics industry, time is the cost and time is the revenue. The logistics industry is the representative industry in which time becomes money. The smart access authentication system architecture proposed in this paper allows small logistics private carriers to improve legal stability, and SMEs (Small and Medium-sized Enterprises) in CIPs to reduce logistics transit time. The CIPs smart access system proposed in this paper utilizes the currently active Mobile OTP (One Time Password), which can significantly reduce system design costs, significantly reduce the data capacity burden on individual cell phone terminals, and improve the response speed of individual cell phone terminals. It is also compatible with the OTP system, which was previously used in various ways, and the system reliability through the long period of use of the OTP system is also high. User customers can understand OTP access systems more easily than other smart access systems.

A Smart-Contract-Based Access Control Framework for Cloud Smart Healthcare System

In current healthcare systems, electronic medical records (EMRs) are always located in different hospitals and controlled by a centralized cloud provider. However, it leads to single point of failure as patients being the real owner lose track of their private and sensitive EMRs. Hence, this article aims to build an access control framework based on smart contract, which is built on the top of distributed ledger (blockchain), to secure the sharing of EMRs among different entities involved in the smart healthcare system. For this, we propose four forms of smart contracts for user verification, access authorization, misbehavior detection, and access revocation, respectively. In this framework, considering the block size of ledger and huge amount of patient data, the EMRs are stored in cloud after being encrypted through the cryptographic functions of elliptic curve cryptography (ECC) and Edwards-curve digital signature algorithm (EdDSA), while their corresponding hashes are packed into blockchain. The performance evaluation based on a private Ethereum system is used to verify the efficiency of proposed access control framework in the real-time smart healthcare system.

Corporate Bodies: Access Points and Authority Control

The concept of authorship is central to how libraries organize their collections. But libraries do not only collect resources created by individuals, they also collect documents issued by organizations. Library catalogers use the concept of a “corporate body” to treat organizations as authors for the purpose of making their documents discoverable to users. This essay looks at the key features of establishing authorized access points (AAPs) and applying authority control for corporate bodies. It examines how practices with regard to corporate bodies have changed over time and considers the changes catalogers might expect to see in the future.

E-commerce process reengineering for customer privacy protection

Privacy leakage is a major hidden danger for the healthy and orderly development of e-commerce. In this paper, we analyse the current situation of the information leakage. The main reason lies in that the customer information is stored and displayed in plaintext during the e-commerce process. We present a customer privacy protection platform on the basis of the analysis, where such technical measures as information segmentation, data encryption and access authorisation are taken. With the customer privacy protection platform, the customer information is not stored and displayed in plaintext any more, which is replaced with two-dimensional code or barcode. The traceability helps to prevent the leakage and abuse of the consumer information as much as possible. Thus, the traditional operation process of e-commerce is then reengineered and the customer information is only used on demand.

A Novel Revocable and Identity-Based Conditional Proxy Re-Encryption Scheme With Ciphertext Evolution for Secure Cloud Data Sharing

Proxy re-encryption (PRE), with the unique ciphertext transformation ability, enables various ciphertext authorization applications to be implemented efficiently. However, most existing PRE schemes mainly focus on access authorization while ignoring the situation where the key needs to be changed and the ciphertext needs to be evolved, making the scheme's practicability and security inadequate. Moreover, the few schemes that simultaneously combine ciphertext authorization, key update, and ciphertext evolution are not satisfactory in terms of security. For solving this problem, based on Xiong et al.'s scheme, this paper proposes an improved revocable and identity-based conditional proxy re-encryption scheme with ciphertext evolution (RIB-CPRE-CE) for secure and efficient cloud data sharing. The proposed scheme inherits the characteristics of multi-use, constant ciphertext length, fine-grained authorization, collision-resistance security, and chosen ciphertext attack (CCA) security from the original method. Also, it supports updating ciphertext to adapt to the new key after changing the identity (key) or achieves authorization revocation by evolving ciphertext. Two new algorithms, URKeyGen and UpReEnc, have been integrated into the original delegation scheme to support ciphertext evolution. The formal definition, security model, concrete construction, and security analysis of RIB-CPRE-CE have been presented. The comparison and analysis show that the proposed scheme is practical and secure. Although it adds a ciphertext evolution function for supporting key update and delegation revocation, its efficiency and security are not reduced. The proposed scheme can also be used in other access authorization systems that need to change the key or revoke the authorization. It has certain practicability and security.

E-commerce Process Reengineering for Customer Privacy Protection

Privacy leakage is a major hidden danger for the healthy and orderly development of e-commerce. In this paper, we analyse the current situation of the information leakage. The main reason lies in that the customer information is stored and displayed in plaintext during the e-commerce process. We present a customer privacy protection platform on the basis of the analysis, where such technical measures as information segmentation, data encryption and access authorisation are taken. With the customer privacy protection platform, the customer information is not stored and displayed in plaintext any more, which is replaced with two-dimensional code or barcode. The traceability helps to prevent the leakage and abuse of the consumer information as much as possible. Thus, the traditional operation process of e-commerce is then reengineered and the customer information is only used on demand.

MODELS AND METHODS OF IMPROVING THE EFFICIENCY OF WIRELESS ACCESS OF TELECOMMUNICATION SYSTEMS AND NETWORKS

The peculiarities of construction of complex information and telecommunication systems of special purpose are researched in the work, the general and special requirements to the applied telecommunication technologies are substantiated on the example of the automated territorially distributed system of the uniform regional operative and dispatching centers. To take into account certain properties of the generated authorization keys, a comprehensive model of authorization and authentication of wireless access is proposed for the security assessment of telecommunication systems and networks. The proposed territorial distribution systems of unified regional operational control centers for special purposes are based on the deployment of wireless telecommunication systems and must meet the basic requirements of users with high mobility. Consider the capabilities of these systems in terms of fulfilling special requirements for ensuring the security of national information resources, personal data, information with limited access and the security of communication protocols, etc. An analysis is carried out in the specification of IEEE 802.16 series standards on the use of various cryptographic protection mechanisms designed to provide various security services and security in wireless telecommunication networks, representing various attacks aimed at disrupting the operation of authentication and authorization protocols. The communication protocols used in the deployment and use of wireless telecommunication systems that provide an increased level of security, especially regarding the issues of unauthorized interception of transmitted data and unauthorized access to various telecommunication resources, and violations associated with false authentication of devices in relation to users of certain elements of telecommunication systems. Basic models of wireless telecommunication systems are proposed, which are deployed in accordance with the IEEE 802.16 specification and can be used to build various information systems for special purposes, including geographically distributed systems of unified regional operational control centers in Ukraine.

Design and Implementation of a Most Secure Cryptographic Scheme for Lightweight Environment using Elliptic Curve and Trigonohash Technique

The Internet of Things (IoT) is a rising development and is an organization of all gadgets that can be gotten to through the web. As a central advancement of the IoT, wireless sensor networks (WSN) can be used to accumulate the vital environment parameters for express applications. In light of the resource limitation of sensor devices and the open idea of remote channel, security has become an enormous test in WSN. Validation as an essential security service can be used to guarantee the authenticity of data access in WSN. The proposed three factor system using one way hash function is depicted by low computational cost, and limit overhead, while achieving all other benefits. Keys are made from secret key for meeting for improving the security. We differentiated the arrangement's security and execution with some lightweight plans. As shown by the examination, the proposed plan can give more prominent security incorporates low overhead of correspondence. Encryption and unscrambling is done using numerical thoughts and by using the possibility of hash function. Mathematical thoughts are lightweight and update the security up by a staggering degree by diminishing the chances of cryptanalysis. When contrasted with different calculations, the proposed calculation gives better execution results.

Development of Wearable System to Help Preventing the Spread of Covid-19 in Public Indoor Area

Smart wearables as a part of the Internet of Things nowadays gaining confidence in our daily lives because of its accessibility and simplicity. Today, with the outbreak of Coronavirus around the world, a smart wearable device can become another solution to help slowing the virus spreading by ensuring public health and social measures. In this paper, a system consisting of distance detector and touchless door access is proposed to help the personal, physical and social distancing measures practice in a public indoor area. A BLE positioning method based on RSSI localization is used to ensure the physical distancing around the user. WPA2 and MAC address-based authentication for the touchless door access is used to restrict and trace the visitor of the indoor area. The system is implemented in ESP microcontroller. A proof of concept is conducted to see if the functionality of the system already satisfied the public health and social measures practice. The results show that only registered devices can give a signal to open the door and the device can guarantee the physical distance around the user with 4.51% error in indoor area.

Use it or Share It: A New Default Policy for Spectrum Management

The conventional wisdom that spectrum is scarce, particularly mid-band spectrum, persists despite the reality that most federal and commercial bands remain grossly underutilized and amenable to more intensive, shared use. Yet eight years after a 2012 report by the President’s Council of Advisers on Science and Technology (PCAST) recommended that spectrum sharing should be “the new normal,” important but limited progress has been made. Conceptually, use-it-or-share-it rules authorize opportunistic access to licensed or federal spectrum that is unused or underutilized. A use-it-or-share-it authorization expands productive use of spectrum without risking harmful interference or undermining the deployment plans of primary licensees. Since 2014 the FCC has adopted a number of world-leading precedents in opportunistic spectrum sharing that all apply a variation of the use-it-or-share-it approach. These precedents and proven new frequency coordination mechanisms can pave the way to an authorization of opportunistic access as the default policy for a far larger number of underutilized and newly-allocated bands. A use-or-share approach promotes important policy goals, including more intensive use of fallow spectrum capacity, lowering barriers of entry to a diverse range of uses and users, facilitating innovation and competition, improving choices and lowering costs for consumers, and promoting service in rural and other underserved areas, helping to narrow the digital divide. Unleashing opportunistic, shared access to unused spectrum also creates a general incentive for licensees to build out more quickly and to make greater efforts to lease or sell unused spectrum, facilitating secondary markets. In addition, because spectrum is a government controlled resource essential for wireless communication, FCC decisions on access to spectrum must be consistent with First Amendment principles. The FCC has begun operationalizing the “scarcity rationale” by applying a balancing approach to determine if interference is unduly “harmful” to the actual performance of incumbent services or systems – and not merely hypothetical, fleeting, or de minimis. The paper closes by examining near-term opportunities to extend shared access to more substantial underutilized federal, commercial and FCC-held bands, including 700 megahertz of mid-band federal spectrum and 700 megahertz in two very underutilized licensed bands.

Survey on Delegated and Self-Contained Authorization Techniques in CPS and IoT

Authentication, authorization, and digital identity management are core features required by secure digital systems. In this, authorization is a key component for regulating the detailed access credentials with respect to required service resources. Authorization, therefore, plays a significant role in the trust management of autonomous devices and services. Due to the heterogeneous nature of cyber-physical systems and the Internet of Things, several authorization techniques using different access control models, accounts, groups, tokens, and delegations have both strengths and weaknesses. Many studies exist in the literature that focus on other main security requirements, such as authentication, identity management, and confidentiality. However, there is a need for a comprehensive review of different authorization techniques in cyber-physical systems and the Internet of Things. A specific target of this paper is authorization in the cyber-physical system and Internet of Things networks with non-constrained devices in an industrial context with mobility, subcontractors, and autonomous machines that are able to carry out advanced tasks on behalf of others. We study the different authorization techniques using our three-dimensional classification, including access control models, subgranting models, and authorization governance. We focus on the state of the art of authorization subgranting, including delegation techniques by access control/authorization server and self-contained authorization using a new concept of power of attorney. Comparisons are performed with respect to several parameters, such as type of communication, method of authorization, control of expiration, and use of techniques such as public key certificate, encryption techniques, and tokens. The results show the differences and similarities of server-based and power of attorney-based authorization subgranting. The most common standards are also analyzed in light of those classifications.