Access Control Components Research Articles

Federated learning implementation based on DDS data distribution service

Federated learning allows multiple local private clients to collaborate on training the same model without sharing each client's private data. It can achieve collaborative training between users while protecting data privacy and security. Therefore, it is advocated for use in the fields of Internet of Things, Internet of Vehicles, etc. There are security issues in the transmission process of federated learning models. How to ensure data privacy during local data collection, local model parameter transmission, model aggregation and performance testing while maximizing the use of private data is a question that people have been exploring. This paper proposes a DDS-based FL framework (FL-DDS) to achieve secure transmission of model parameters. The client and server are used as nodes in the DDS security domain, and the DDS data distribution mechanism is used to transmit model parameters. Through the DDS topic-based publish-subscribe mechanism, the global model and local model are transmitted through the DDS topic. At the same time, the DDS authentication component, access control component and encryption component are used to achieve domain-level security and intra-domain security of model transmission. Experiments show that (FL-DDS) can protect the privacy of model parameters without affecting communication performance.

A virtual network model for gateway media access control virtualisation in Large Scale Internet of Things

Recent approaches, technologies and standards have been developed to address scalability in very large IoT networks with an emphasis on the Media Access Control (MAC) component. One of the best strategies to manage media access for a large number of devices is to provide concurrent media access. This can be achieved through the concept of Radio Frequency (RF) virtualisation. However, to support such strategies in a Large Scale Internet of Things (LS-IoT) network, the Gateway’s (GW) MAC functions need to equally manage transmissions concurrently otherwise congestion is imminent due to the resource constraints of the GW node. In this work, a virtual media access approach using virtual Access Groups (vAG) for supporting the scalability of Large-Scale IoT (LS-IoT) networks over a virtual network framework is proposed. The virtual network and the impact on the MAC throughput are modelled analytically using the Queuing Network Analyser (QNA) method and the unsaturated throughput model for the IEEE 802.11ah standard. The impact of managing large devices using vAGs for a resource-constrained Gateway MAC is also modelled and the results are compared and analysed. The results obtained suggest that the throughput can be improved for a large number of devices based on vAGs when the GW MAC is virtualised using the proposed framework as opposed to using a dedicated localised GW MAC component.

A virtual gateway media access placement approach for large-scale Internet of Things

The virtualisation of the Internet of Things (IoT) Gateway (GW) Media Access Control (MAC) component separates the GW MAC functions from the GW device by deploying the GW MAC functions in a selected remote edge Data Centre (eDC). This concept can help support media access for a large number of devices based on concurrent transmissions over Radio Frequency (RF) virtualisation. However, the requests for virtual GW MAC instances are dynamic and the virtual network is characterised by varying resource levels and response times. This can affect the throughput performance of the MAC protocol since the timing deadlines of the MAC functions or frame transmissions may not be met. In this work, the GW MAC functions of the IEEE 802.11ah standard for Large Scale IoT (LS-IoT) networks are virtualised as concurrent virtual Access Groups (vAGs) over a proposed Software Defined Network (SDN) virtual network. A virtual GW MAC placement strategy is proposed to optimally select the host for running the virtual GW MAC instances to minimise the virtualisation delay, improve the robustness of the deployment process and maintain a good MAC throughput performance. The results obtained in this work show that the virtualisation delay is minimised and the MAC throughput versus the number of devices is improved especially for high IoT traffic rates when compared to suboptimal approaches and the dedicated localised GW MAC approach.

An Introduction to Semantic Threat Analysis for Systems Security Engineering

AbstractThe objectives of this paper are (a) to motivate the adoption of semantic graphical models of threat relations and countermeasures in the design and operation of cyber‐physical systems (CPS), and (b) to raise awareness of the various benefits which systems security engineers (SSEs) stand to gain by adopting such practices. Specifically, we propose that a Semantic Threat Analysis (STA) can endow SSEs with a comprehensive, extensible, machine‐readable, and logically inferable model of system features. An STA shaped to the specific architecture and security requirements of a CPS environment can support the identification and visualization of system interdependencies and process flows among network, computing, mechanical, security, and access control components. The proposed STA process presupposes a team‐oriented systems engineering approach employing a combination of subject matter experts (SMEs) and ontologists who can bring their respective expertise together to bear on the task.

Leveraging Blockchain Technology Centric Tools in Enhancing the Security Safeguards of Documents Storage

The most widely used method for exchanging data worldwide is the Internet. Numerous cloud service providers support this sharing by letting customers store and share data over the Internet. However, cloud service providers have consistently failed to guarantee data's 100% security regarding privacy. Data breaches, piracy, and hacking attacks have threatened cloud providers' security mechanisms. However, customer data should be 100% secure because it may contain private information that should only be accessible to the owner and an intended audience. As a result, making this system more secure is critical to maintaining data privacy and cloud provider trust. We present a system that incorporates cloud-based data security into the Blockchain. It permits clients to store information in the cloud and gives a specific access control component that guarantees information security. Users can share data with others with permission by sharing the document's link with the intended user. The owner will have access to logs of all operations performed with the document at any time. This will guarantee the data's true ownership and privacy. A third party or individual will be permitted to access the document with prior authorization. This will increase cloud storage's security and reduce data breaches and attacks.

CRIC: a unified information system for WLCG and beyond

The Worldwide LHC Computing Grid (WLCG) is an innovative distributed environment which is deployed through the use of grid computing technologiesin order to provide computing and storage resources to the LHC experimentsfor data processing and physics analysis. Following increasing demands of LHC computing needs toward high luminosity era, the experiments are engagdin an ambitious program to extend the capability of WLCG distributed environment, for instance including opportunistically used resources such as High-Performance Computers (HPCs), cloud platforms and volunteer computer. norder to be effectively used by the LHC experiments, all these diverse distributed resources should be described in detail. This implies easy service discovery of shared physical resources, detailed description of service configurations and experiment-specific data structures is needed. In this contribution, we present a high-level information component of a distributed computing environment, the Computing Resource Information Catalogue (CRIC) which aims to facilitate distributed computing operations for the LHC experiments and consolidate WLCG topology information. In addition, CRIC performs data validation and provides coherent view and topology descriptinto the LHC VOs for service discovery and configuration. CRIC represents teevolution of ATLAS Grid Information System (AGIS) into the common experiment independent high-level information framework. CRIC’s mission is to serve not just ATLAS Collaboration needs for the description of the distributed environment but any other virtual organization relying on large scale distributed infrastructure as well as the WLCG on the global scope. The contribution describes CRIC architecture, implementation of data model,collectors, user interfaces, advanced authentication and access control components of the system.

Analysis of ANSI RBAC Support in EJB

This paper analyzes access control mechanisms of the Enterprise Java Beans (EJB) architecture and defines a configuration of the EJB protection system in a more precise and less ambiguous language than the EJB 3.0 standard. Using this configuration, the authors suggest an algorithm that formally specifies the semantics of authorization decisions in EJB. The level of support is analyzed for the American National Standard Institute’s (ANSI) specification of Role-Based Access Control (RBAC) components and functional specification in EJB. The results indicate that the EJB specification falls short of supporting even Core ANSI RBAC. EJB extensions dependent on the operational environment are required in order to support ANSI RBAC required components. Other vendor-specific extensions are necessary to support ANSI RBAC optional components. Fundamental limitations exist, however, due to the impracticality of some aspects of the ANSI RBAC standard itself. This paper sets up a framework for assessing implementations of ANSI RBAC for EJB systems.

Analysis of ANSI RBAC Support in COM+

We analyze access control mechanisms of the COM+ architecture and define a configuration of the COM+ protection system in more precise and less ambiguous language than the COM+ documentation. Using this configuration, we suggest an algorithm that formally specifies the semantics of authorization decisions in COM+. We analyze the level of support for the American National Standard Institute's (ANSI) specification of role-based access control (RBAC) components and functional specification in COM+. Our results indicate that COM+ falls short of supporting even Core RBAC. The main limitations exist due to the tight integration of the COM+ architecture with the underlying operating system, which prevents support for session management and role activation, as specified in ANSI RBAC.

Eine modulare gesundheitsakte als antwort auf kommunikationsprobleme im gesundheitswesen

Since 2000 the University of Muenster has developed an electronic health record (EHR) called „akteonline.de“. Several clinics and departments use the EHR in routine. „akteonline.de“ in its current structure supports patients as well as health care professionals and aims at providing a collaborative health information system which perfectly supports the clinical workflow even across institutional boundaries. In order to fulfill high data security and data protection requirements strictly, complex encryption, authorization and access control components have been developed.