Authentication Access Control Research Articles

Privacy - Preserving Public Authentication for Shared Data in Cloud

Data security is an important in cloud. Access control is major issue to secure the stored data in cloud. Thus the proposing privacy preserving authenticated access control scheme for securing shared data in cloud. In the proposed scheme supports authenticated access control for anonymous user to share data on cloud also additional feature in access control which provides authentication for the user, in which only valid users are able to decrypt the stored information. User authentication and access control scheme are introduced in decentralized, which prevent replay attacks and also supports to creation, , and reading, modification data stored in the cloud. Implementation also provide feature user revocation.

Assessment of In-Cloud Enterprise Resource Planning System Performed in a Virtual Cluster

This paper introduces a high-performed high-availability in-cloud enterprise resources planning (in-cloud ERP) which has deployed in the virtual machine cluster. The proposed approach can resolve the crucial problems of ERP failure due to unexpected downtime and failover between physical hosts in enterprises, causing operation termination and hence data loss. Besides, the proposed one together with the access control authentication and network security is capable of preventing intrusion hacked and/or malicious attack via internet. Regarding system assessment, cost-performance (C-P) ratio, a remarkable cost effectiveness evaluation, has been applied to several remarkable ERP systems. As a result, C-P ratio evaluated from the experiments shows that the proposed approach outperforms two well-known benchmark ERP systems, namely, in-house ECC 6.0 and in-cloud ByDesign.

Research on System Architecture and Fine-Grained Access Control Strategy of Collaborative Development Platform

With 3D Prototype model as its core, collaborative development platform is a closed loop information system focus on the process lifecycle management of requirements analysis、 product design、process design、frock design 、manufacturing execution as well as logistics integrated supporting, issues of system architecture、 information integration and fine-grained access control strategy of collaborative development platform are key research contents in this paper. firstly, a distributed system architecture of collaborative development platform is introduced to achieve flexibility、integration and interoperability. Then information integration solution between collaborative development platform and other information systems based on web service is defined and investigated, an implementation process between enterprise collaborative development platform and enterprise resource planning (ERP) via ontology and web services is presented to demonstrate the feasibility and validity of the proposed information integration solution. Finally, fuzzy trustworthiness-involved role based access control strategy (FT-RBACS) is proposed for collaborative development platform, its formalization expression and numerical algorithm are developed to implement fine-grained authorization management and access control for collaborative development platform.

Hybridization of Bimodal Biometrics for Access Control Authentication

Single biometric trait for authentication is widely used in some application areas where security is of high importance. However, biometric systems are susceptible to noise, intra-class variation, non-universality and spoof attacks. Thus, there is need to use algorithms that overcome all these limitations found in biometric systems. The use of multimodal biometrics can improve the performance of authentication system. This study proposed using both fingerprint and face for authentication in access system. The study integrated fingerprint and face biometric to improve the performance in access control system. Fingerprint biometric, this paper considered restoration of distorted and misaligned fingerprints caused by environmental noise such as oil, wrinkles, dry skin, dirt, displacement etc. The noisy, distorted and/or misaligned fingerprint produced as a 2-D on x-y image, is enhanced and optimized using a hybrid Modified Gabor Filter-Hierarchal Structure Check (MGF-HSC) system model. In face biometric Fast Principal Component Analysis (FPCA) algorithm was used in which different face conditions (face distortions) such as lighting, blurriness, pose, head orientation and other conditions are addressed. The algorithms used improved the quality of distorted and misaligned fingerprint image. They also improved the recognition accuracy of distorted face during authentication. The results obtained showed that the combination of both fingerprint and face improve the overall performance of biometric authentication system in access control.

Infrared Capture of Palm-Vein Blood Vessel Patterns for Human Authentication

Biometric Technology is fast taking over from the conventional use of ID Cards, PINs, Tokens and Passwords. This is becoming essential because of the issues of forgotten passwords, stolen ID Cards, compromised tokens and spoofed PINs. Palm-print authentication for access control has been deployed in so many areas of security concern in developing countries. Even though it is still in the theoretical stage in Nigeria, this paper seeks to evaluate the stages involved in the processing of palm-print images for identification or human authentication. It focuses on the feature extraction stage which is where the required features are separated from the others. T

Applying authentication and network security to in-cloud enterprise resource planning system

The service-oriented hosts in enterprises like enterprise resources planning (ERP) system have always encountered the crucial problem of unexpected down-time or system failure that will cause data loss and system termination. Failover is a challenge issue that cannot be done successfully between physical hosts. Traditional information security using demilitarized zone approach costs a lot. Therefore, this paper introduces in-cloud enterprise resources planning (in-cloud ERP) deployed in the virtual machine cluster together with access control authentication and network security which can resolve the three problems mentioned above. Access control authentication and network security have been implemented in the cloud computing system to prevent the service-oriented hosts form external fraud, intrusion, or malicious attacks. As a result of the experiments the number of accessing in-cloud ERP is 5.2 times as many as in-house ERP. The total expenditure of in-cloud ERP has decreased significantly to 48.4 % the cost of in-house ERP. In terms of operational speed, the approach proposed in this paper outperforms two well-known benchmark ERP systems, in-house ECC 6.0 and in-cloud ByDesign.

Self-adaptive federated authorization infrastructures

Authorization infrastructures are an integral part of any network where resources need to be protected. As networks expand and organizations start to federate access to their resources, authorization infrastructures become increasingly difficult to manage. In this paper, we explore the automatic adaptation of authorization assets (policies and subject access rights) in order to manage federated authorization infrastructures. We demonstrate adaptation through a Self-Adaptive Authorization Framework (SAAF) controller that is capable of managing policy based federated role/attribute access control authorization infrastructures. The SAAF controller implements a feedback loop to monitor the authorization infrastructure in terms of authorization assets and subject behavior, analyze potential adaptations for handling malicious behavior, and act upon authorization assets to control future authorization decisions. We evaluate a prototype of the SAAF controller by simulating malicious behavior within a deployed federated authorization infrastructure (federation), demonstrating the escalation of adaptation, along with a comparison of SAAF to current technology.

A Patient Privacy Protection Scheme for Medical Information System

In medical information systems, there are a lot of confidential information about patient privacy. It is therefore an important problem how to prevent patient's personal privacy information from being disclosed. Although traditional security protection strategies (such as identity authentication and authorization access control) can well ensure data integrity, they cannot prevent system's internal staff (such as administrators) from accessing and disclosing patient privacy information. In this paper, we present an effective scheme to protect patients' personal privacy for a medical information system. In the scheme, privacy data before being stored in the database of the server of a medical information system would be encrypted using traditional encryption algorithms, so that the data even if being disclosed are also difficult to be decrypted and understood. However, to execute various kinds of query operations over the encrypted data efficiently, we would also augment the encrypted data with additional index, so as to process as much of the query as possible at the server side, without the need to decrypt the data. Thus, in this paper, we mainly explore how the index of privacy data is constructed, and how a query operation over privacy data is translated into a new query over the corresponding index so that it can be executed at the server side immediately. Finally, both theoretical analysis and experimental evaluation validate the practicality and effectiveness of our proposed scheme.

Proof of the Authentication Property of Secure WLAN Authentication Scheme (SWAS) using Protocol Composition Logic (PCL)

Authentication is one of the essential tools available for security in WLANs. Access control authentication mechanisms provides entity authentication, access into the network and key evolving for data frames protection. Secure WLAN Authentication Scheme (SWAS) is one such access control authentication mechanism. It provides entity authentication along with per frame authentication. All the participating entities in the scheme i.e. STA, AP and AS authenticate each other. The scheme makes use of cryptographic measure like delegation, key management, encryption and MIC for securing the scheme. The security properties of the scheme need to be validated for effectiveness. In this paper, a formal tool i.e. Protocol Composition Logic (PCL) is used for proving the authentication property of the scheme. General Terms Networks, Security, WLAN

Multilevel security in UPnP networks for pervasive environments

Security has become a critical concern in pervasive environments, since personal information can be available to malicious users. In this context, some of the major drawbacks in UPnP architecture are the user authentication and service access control, which are not suitable for pervasive environments. Moreover, the inherited heterogeneity of pervasive environments brings different security and privacy requirement concerns depending on the environment and the services provided. This paper introduces a UPnP extension that not only allows multilevel user authentication for pervasive UPnP services, but also provides a flexible security approach that adapts to the network. What is more, it offers a seamless security level negotiation protocol1.

Ntrusion Detection of Masquerading Attacks & Secure Authentication in Cloud

This paper proposed for a new authenticated access control scheme for securing data in cloud system. In this scheme cloud system verifies the authenticity of user and provides access control only to applicable user to decrypt the stored data. The scheme prevents replay attacks and supports creation, modification, and reading data stored in the cloud. By impersonating legal users, intruders can use the copious resources of cloud computing environments. CIDS also provides a component to summarize the alerts and inform the cloud administrator. CIDS architecture is scalable and elastic with no central coordinator. This paper also describes the components, architecture, detection models, and advantages of CIDS. Keywords - Authentication, Attribute-based signatures, Attribute-based encryption, intrusion detection, and masquerade attacks

Research on Dynamic Authorization Access Control Strategy Model of Distributed Multi-Organization MIS

Focus on the problem of dynamic authorization access control of Distributed Multi-Organization Management Information System (DMOMIS), the system resources are divided into two kinds: relatively independent resources and shared resources. These two kinds of resources were used different authorization system to authorize. The relatively independent resources were authorized by using distributed authorization system (DA), and the similar and shared resources were authorized by using authorized system (A). According to the key terms definition, the system hypothesis and the idea of dynamic programming, then the dynamic authorization access control process of DMOMIS was abstracted as a multi stage users authorization process based on resources, and put out the dynamic authorization access control strategy model of DMOMIS, at last, depicted its execution process.

Evaluation of Unified Security, Trust and Privacy Framework (UnifiedSTPF) for Federated Identity and Access Management (FIAM) Mode

identity and access management systems such as Shibboleth may symbolize a boost: (i) to bring the efficiency and effectiveness in collaboration for governments, enterprises and academia, and (iii) conserve the home domain user's identity privacy in a privacy-enhanced fashion. However, the consternation is about the absence of a trusted computing based mutual trust and security establishment in the Shibboleth infrastructure. The Trusted Computing based mutual attestation notion may assist to add-on the mutual trust and security but raises bidirectional platform privacy concerns. Therefore, to enjoy effectively the federated identity and resource (service) access by the home and foreign domain organizations it is necessary to provide an access control that may coalesced at least some security, trust and privacy aspects in a cohesive fashion. The objective of the work appearing in this paper is to provide a viable and feasible unified security, trust and privacy framework access control solution for federated identity and access management systems by fusing the Shibboleth authentication and authorization access control with the trusted computing based trustworthy mutual attestation.

Electronic Document Safe Exchange Technology Based on Identity Cryptography

In this paper, in accordance with the current difficulties in the document and data exchange between different departments of an enterprise, the authors carry on analysis on the identity authentication and authorization problems in the document transmission system at the present time, and design a scheme for the electronic document exchange platform which is based on the cryptography algorithm of identity, and finally put forward an electronic document safe exchange platform based on the identity, which provides a security guarantee for the implementation of the free flow and conversion of the electronic documents among different intranets. In addition, the identity authentication and authorization access control with safety and higher reliability can be realized for the electronic documents transmission system in the applications of network as well.

Face Authentication for Access Control based on SVM using Class Characteristics

Face Authentication for Access Control based on SVM using Class Characteristics

Shibboleth as a Tool for Authorized Access Control to the Subversion Repository System

Shibboleth is an architecture and protocol for allowing users to authenticate and be authorized to use a remote resource by logging into the identity management system that is maintained at their home institution. With Shibboleth, a federation of institutions can share resources among users and yet allow the administration of both the user access control to resources and the user identity and attribute information to be performed at the hosting or home institution. Subversion is a version control repository system that allows the creation of fine-grained permissions to files and directories. In this project an infrastructure, Shibbolized Subversion, has been created that consists of a Subversion repository with an Apache web interface that is protected by a Shibboleth authentication system. The infrastructure can allow authorized and authenticated data sharing between institutions yet retains simplicity and protects privacy for users. In addition, it also relieves local administrators from the task of having to perform extra account management for users from other institutions. This paper describes the Shibboleth and Subversion systems, the implementation of the file sharing infrastructure, and issues of attribute maintenance, privacy and security.

A contextual role-based access control authorization model for electronic patient record.

The design of proper models for authorization and access control for electronic patient record (EPR) is essential to a wide scale use of EPR in large health organizations. In this paper, we propose a contextual role-based access control authorization model aiming to increase the patient privacy and the confidentiality of patient data, whereas being flexible enough to consider specific cases. This model regulates user's access to EPR based on organizational roles. It supports a role-tree hierarchy with authorization inheritance; positive and negative authorizations; static and dynamic separation of duties based on weak and strong role conflicts. Contextual authorizations use environmental information available at access time, like user/patient relationship, in order to decide whether a user is allowed to access an EPR resource. This enables the specification of a more flexible and precise authorization policy, where permission is granted or denied according to the right and the need of the user to carry out a particular job function.

ADEPT-The Advanced Database Environment for Planning and Tracking

The Advanced Database Environment for Planning and Tracking (ADEPT) is a system that provides the ability to define and manage process definitions. These predefined definitions can be instantiated to create project plans. In managing such plans, ADEPT ensures adherence to predefined process definitions. Unlike most commercial project planning systems, project plans in ADEPT can include information that is tracked across multiple projects. In addition, ADEPT provides the ability to track other kinds of project details besides simple task information and milestone dates. It supports both operational (that is, day-to-day) management of single projects and strategic management of information that crosses project boundaries. It was built on top of a commercial client-server relational database system and uses the standard Structured Query Language (SQL) to model process definitions as object-oriented semantic networks. ADEPT features include real-time reporting, generation of HyperText Markup Language (HTML) reports, report subscription, tracking of quality records, e-mail notification of database transactions, and authorization access control.

Providing secure remote access to legacy healthcare applications

While the widespread adoption of Internet and intranet technology has been one of the most exciting developments of recent years, many hospitals are finding that their data and legacy applications do not naturally fit into the new methods of dissemination. Existing applications often rely on isolation or trusted networks for their access control or security, whereas untrusted wide area networks pay little attention to the authenticity, integrity or confidentiality of the data they transport. Many hospitals do not have the resources to develop new `network-ready' versions of existing centralised applications. The article examines the issues that must be considered when providing network access to an existing healthcare application, and describes how we have implemented the proposed solution in one healthcare application, namely the diabetic register at Hope Hospital. The architecture is described which allows remote access to the legacy application, providing it with encrypted communications and strongly authenticated access control, but without requiring any modifications to the underlying application. As well as comparing alternative ways of implementing such a system, the article also considers issues relating to usability and manageability, such as password management.

Authentication and discretionary access control in computer networks

This paper proposes a new mechanism for authentication and discretionary access control in networks with decentralized control. Girling's strategy for one-time keywords for authentication forwarding is combined with a proxy login mechanism to obtain a reliable method for network authentication that does not depend on the transmission of passwords. The authentication mechanism is used as the basis for a scheme for network-wide access control lists allowing a user to grant access rights to any other user in a network. These proposals are described in the context of the Digital Network Architecture (DNA), but are in fact applicable to any packet switched network.