Access Control Configuration Research Articles

SAFEGUARDING FORENSIC EVIDENCE USING BLOCKCHAIN TECHNOLOGY

Digital evidence is important when investigating cybercrime because it can be used to link criminal s to victims. As digital evidence passes through various stages of the chain of custody during a criminal investigation, ensuring its integrity, authenticity and investigation is crucial. A security certificate is required to ensure that the data containing the evidence remains secure during and after processing. The system called Digital Threat Investigator developed in this project is built on Hyperledger Fabric, a permissioned network that requires the permission of all users. Access control, channel authorization and participant configuration are very important in order to effectively solve the privacy and confidentiality problem. Blockchain can also be used to store and distribute valuable information. The raw forensic data is fragmented, stored in the cloud and linked to the blockchain in Digit al Threat Investigator, and the usage history of the raw data is also stored in the blockchain. These t wo processes are integrated to ensure scalability and traceability of data entry. Programming is done using WordPress, HTML, CSS and PHP. The results of the experiment show that latency continously decreases as the number of nodes in the blockchain decreases. The results show that the time increases from 150ms to 353ms as the number of nodes increases from 1 to 8. The system has proven to be a useful tool to assist digital forensics and ensure the security of forensic evidence. Key Words: Blockchain, Cyber Crime, Information Security, proof of concept, blockchain technology; Ethereum.

Traffic Prediction and Random Access Control Optimization: Learning and Non-Learning-Based Approaches

Random access channel (RACH) procedures in modern wireless communications are generally based on multi-channel slotted-ALOHA, which can be optimized by flexibly organizing devices' transmission and retransmission. However, due to the lack of information about the traffic generation statistics and the occurrence of random collision, optimizing RACH in an exact manner is generally challenging. In this article, we first summarize the general structure of optimization for different RACH schemes, and then review existing RACH optimization methods based on machine learning (ML) and non-ML techniques. We demonstrate that the ML-based methods can better optimize RACH schemes compared to non-ML-based methods due to their capability in solving high-complexity long-term optimization problems. To further improve the RACH performance, we introduce a decoupled learning strategy (DLS) for access control optimization, which individually executes two sub-tasks: traffic prediction and access control configuration. In detail, the traffic prediction relies on an online supervised learning method adopting recurrent neural networks that can accurately capture traffic statistics over consecutive frames, while the access control configuration uses either a non-ML-based controller or a cooperatively trained deep reinforcement learning (DRL)-based controller selected depending on the complexity of different random access schemes. Numerical results show that the DLS optimizer considerably outperforms conventional DRL optimizers in terms of higher training efficiency and better access performance.

An integrated access control and lighting configuration system for smart buildings

This article presents an integrated access control and lighting configuration system for smart buildings. The system uses two-factor authentication, one based on face recognition and other on RFID TAG, and identifies the user inside a room and performs an automatic lighting configuration based on user’s behavior. The communication among the devices is performed by Radio Frequency using the low to medium frequency spectrum (LMRF), without providing direct Internet access, and, hence, avoiding known Internet security issues. This system can be easily deployed on meeting rooms or offices in business or government buildings. Through the evaluations we observe an acceptable processing execution time, an acceptable communication time and the robustness of the system.

A security evolution driven by the Internet of Intelligent Things

The technological evolution characterised by Social, Mobile, Analytics and Cloud (SMAC) brings transformational benefits for consumers at the expense of increased risk. The risk is not limited to data breach, initiated by cybercriminals. The Internet of Things (IoT) refers to devices with processing capability and internet connectivity. These things have a broad range of uses and may control hardware, such as industrial machinery, vehicles and medical devices. Malfunctions caused by software defects, malware attacks or misuse are potential causes of catastrophic events. This paper argues that information security controls, processes and capabilities need to evolve in order to address the risks that arise in this distributed digital landscape. Commonly accepted best practices, such as secure software development, privileged access control and security configurations are still critical mitigations. They are difficult to implement in the Internet of Things marketplace, however, which is characterised by rapid product development, limited regulation and uninformed consumers. In security terms, we need to defend a rapidly expanding attack surface against an increased range of threats. Loss of system availability or compromised data integrity could have catastrophic consequences for self-driving cars or in the dispensing of medication. When assessing risk, security systems provide necessary but insufficient mitigation. This paper will argue for a multidisciplined approach to risk management, requiring a greater convergence between the disciplines of both software quality and information security. This is especially necessary within the software development life cycle.

Dominant Channel Occupancy for Wi-Fi Backscatter Uplink in Industrial Internet of Things

This paper presents a dominant channel occupancy (DCO) mechanism for the Wi-Fi backscatter uplink in the industrial Internet of things (IIoT). The DCO provides high-priority channel access and reliable burst transmission to the Wi-Fi backscatter devices, thereby enabling the Wi-Fi backscatter tag to deliver its tag information to the Wi-Fi reader without interference from neighboring legacy Wi-Fi devices to guarantee the timeliness and reliability of the IIoT system. For the former, we consider three types of medium access control (MAC) configurations: “carrier sense multiple access with collision avoidance (CSMA/CA) starting with short inter-frame space (SIFS)”, “freezing of the backoff period”, and “reduced CWmin.” In addition, the DCO uses the SIFS between burst packets to guarantee reliable burst transmission. To verify the effectiveness of DCO and determine a proper value for MAC parameters, we conduct experimental simulations under IEEE 802.11n PHY/MAC environments. The simulation results show that the reduced CWmin has the most significant effect on the channel occupancy. The Wi-Fi backscatter devices achieve much higher throughput than the separate cases when two or more configurations are used simultaneously. Moreover, the results exhibit that the use of SIFS between consecutive packets supports reliable burst transmission regardless of the transmission of the legacy Wi-Fi devices in the vicinity.

Exploring a Context-based Network Access Control for Mobile Devices

Abstract Significant advancement in mobile devices coupled with high speed networks have shifted personal computing towards pervasive environments. Mobile devices currently offer many value-added applications and services such as emailing, messaging, navigation, social networking, finance, and entertainment. Typically, such value-added applications have access to users’ personal information and are capable of gathering and transmitting trust sensitive information, hence posing security risks and/or privacy concerns. In this paper, we propose a context-based analytic hierarchy process (AHP) framework for eliciting context information and adapting this information with network access control measures for mobile devices. The framework enforces the execution of mobile applications inside security incubators to control the communication between mobile applications and mobile device resources. Mobile applications’ access requests are analyzed based on user's context information collected from the mobile device sensors and the application network access control configuration. We use the Facebook mobile application, as a test case, to evaluate our proposed framework. Evaluation results have demonstrated the efficacy of the framework in providing network access control measures based on real-time assessment of user's context.

Information flow control for workflow management systems

Abstract Workflow management plays an important role in analyzing and automating business processes. Security requirements in workflow management systems are typically mapped to (role-based) access control configurations. This paper focuses on information flow control, taking into account implicit information leaks. The presented approach operates on a specification level in which no executable program is available yet. We illustrate the modeling of a workflow management system as a composition of state-event systems, each representing one of the activities of the workflow. This facilitates distributed deployment and eases verification by splitting up the verification of the overall system into verification of the individual components. Confidentiality requirements are modeled in terms of information flow predicates using the MAKS framework and verified following existing decomposition methodologies, which are adapted for open systems with ongoing user interaction. We discuss the interaction with other security requirements, notably separation of duty.

Development of community health service-oriented computer-assisted information system for diagnosis and treatment of respiratory diseases

<h3>Objective</h3> Community health services are an emerging trend. We have found in practice that diagnosis and treatment of respiratory diseases in the community are distinct. The respiratory department’s daily work involves a number of outpatient registration items and a vast workload. The routine manual operation is inefficient and it is not convenient to make effective statistical analysis of the outpatient data to identify the risk factors closely related to diseases. Therefore, it is imperative to process the outpatient information of patients with respiratory diseases effectively and efficiently in a unified manner by means of computer technology. <h3>Methods</h3> The design and realization of the <b><i>C</i></b>ommunity <b><i>H</i></b>ealth <b><i>S</i></b>ervice-oriented computer-assisted Information System for <b><i>D</i></b>iagnosis and <b><i>T</i></b>reatment of <b><i>R</i></b>espiratory <b><i>D</i></b>iseases (CHS-DTRD) was completed as part of the community intervention study on bronchial asthma that was carried out jointly by the Nanjing First Hospital Affiliated to Nanjing Medical University and the Hospital of Nanjing University of Science &amp; Technology, and based on 2 years of experience and the needs of an overall analysis. <h3>Results</h3> The computer-assisted information system for diagnosis and treatment was developed using Java Server Page (JSP) technology and introducing the advanced Asynchronous JavaScript XML (AJAX) technique and MS-SQL Server was used in the background database. CHS-DTRD was composed of eight functional modules (outpatient data maintenance, outpatient appointment, intelligent analysis for disease risk factors, query and statistics, data dictionary maintenance, database manipulation, access control, and system configuration). CHS-DTRD featured a friendly interface, convenient operation, and stability and reliability. <h3>Conclusion</h3> Community health-oriented diagnosis and treatment of respiratory diseases is simple, programmable, and intuitive, thus the workload of physicians is significantly reduced and the work efficiency is improved. This system facilitates an intelligent analysis of disease risk factors using data mining technology, and provides physicians with suggestions on intelligent analysis for diagnosis of disease and conclusion of disease causes.

Handling least privilege problem and role mining in RBAC

For a given role-based access control (RBAC) configuration, user-role assignment satisfying least privilege principle (specified as LPUAP) is one of the most important problems to be solved in information security. LPUAP has been proved to be NP-hard. This paper gives several efficient greedy algorithms for handling this problem. Experiment results show that the output of our algorithms is almost optimal while the running time is greatly reduced. In another case where a RBAC configuration is to be set up, minimizing the descriptive set of roles (specified as Basic-RMP) and minimizing the administrative assignments for roles (specified as Edge-RMP) can greatly decrease the management costs. Both role mining problems (i.e., Basic-RMP and Edge-RMP) have also been proved to be NP-hard. This paper converts Basic-RMP to set cover problem and Edge-RMP to weighted set cover problem, and two algorithms respectively named $$GA_{Basic}$$GABasic algorithm for Basic-RMP and $$GA_{Edge}$$GAEdge algorithm for Edge-RMP, are designed. Experiment results show that the average similarity rate between role sets produced by $$GA_{Basic}$$GABasic algorithm and the original ones used in generating the dataset is above 90 %. However, in the process of converting role mining into Set Cover Problem, the number of candidate role set is very large. In order to reduce the complexity of the $$GA_{Basic}$$GABasic algorithm, this paper presents a new polynomial-time algorithm with a performance nearly the same as that of $$GA_{Basic}$$GABasic algorithm.

Role Mining with Probabilistic Models

Role mining tackles the problem of finding a role-based access control (RBAC) configuration, given an access-control matrix assigning users to access permissions as input. Most role-mining approaches work by constructing a large set of candidate roles and use a greedy selection strategy to iteratively pick a small subset such that the differences between the resulting RBAC configuration and the access control matrix are minimized. In this article, we advocate an alternative approach that recasts role mining as an inference problem rather than a lossy compression problem. Instead of using combinatorial algorithms to minimize the number of roles needed to represent the access-control matrix, we derive probabilistic models to learn the RBAC configuration that most likely underlies the given matrix. Our models are generative in that they reflect the way that permissions are assigned to users in a given RBAC configuration. We additionally model how user-permission assignments that conflict with an RBAC configuration emerge and we investigate the influence of constraints on role hierarchies and on the number of assignments. In experiments with access-control matrices from real-world enterprises, we compare our proposed models with other role-mining methods. Our results show that our probabilistic models infer roles that generalize well to new system users for a wide variety of data, while other models’ generalization abilities depend on the dataset given.

Performance analysis of IEEE 802.11 WLANs with rate adaptation in time-varying fading channels

The IEEE 802.11 supports multiple transmission bit rates by using different modulation and coding schemes. Due to different bit error characteristics and transmission efficiencies of the rates, stations may benefit from an adaptive use of them for a varying channel condition, called rate adaptation. The accuracy of rate adaptation is expected to be highly affected by a time varying nature of typical radio channels due to multipath fading. This paper presents an analytic model of the IEEE distributed coordination function (DCF) with the automatic rate fallback (ARF) rate adaptation algorithm, which is the most widely used one in the 802.11 market, under time-correlated Rayleigh fading. The key idea behind the approach is to exploit the first-order Markovian approximation of Rayleigh fading channels, based on which transmission failure probabilities are obtained depending on the current and previous transmission status. By using those probabilities, the ARF process of a station is modeled as a Markov chain, then, the rate distribution obtained by solving the Markov chain is fed to a DCF model. The proposed DCF model is described in a per-station manner, thus enables the analysis of heterogeneous channel conditions and medium access control (MAC) configurations among stations.

An Authorization Framework using Building Information Models

A building information model (BIM) is an electronic repository of structured, three-dimensional data that captures both the physical and dynamic functional characteristics of a facility. In addition to its more traditional function as a tool to aid design and construction, a BIM can be used throughout the life cycle of a facility, functioning as a living database that places resources contained within the building in their spatial and temporal context. Through its comprehension of spatial relationships, a BIM can meaningfully represent and integrate previously isolated control and management systems and processes, and thereby provide a more intuitive interface to users. By placing processes in a spatial context, decision-making can be improved, with positive flow-on effects for security and efficiency. In this article, we systematically analyse the authorization requirements involved in the use of BIMs. We introduce the concept of using a BIM as a graphical tool to support spatial access control configuration and management (including physical access control). We also consider authorization requirements for regulating access to the structured data that exists within a BIM as well as to external systems and data repositories that can be accessed via the BIM interface. With a view to addressing these requirements we present a survey of relevant spatiotemporal access control models, focusing on features applicable to BIMs and highlighting capability gaps. Finally, we present a conceptual authorization framework that utilizes BIMs.

Providing throughput guarantees in heterogeneous wireless mesh networks

In this paper, we propose to provide throughput guarantees in heterogeneous wireless mesh networks by jointly optimizing routing and Medium Access Control configuration. Our solution is based on the notion of linearized capacity region, which provides a technology-independent way of representing the capacity of a wireless link thereby hiding the technology specifics to the upper layers. From the available capacity of the underlying links as given by the linearized capacity region, we propose two routing algorithms based on multipath and single path that find optimal paths for all the flows in the network given their throughput requirements. The throughput allocation resulting from routing is then provided to each link, which uses this information to optimize its technology-specific Medium Access Control parameters. The proposed approach is evaluated in a heterogeneous scenario comprising Wireless Local Area Networks WLAN and Worldwide Interoperability for Microwave Access WiMAX technologies and is shown to outperform previous solutions by at least a factor of 2.Copyright © 2012 John Wiley & Sons, Ltd.

Repairing Access Control Configurations via Answer Set Programming

Abstract Although various access control models have been proposed, access control configurations are error prone. There is no assurance of the correctness of access control configurations. When we find errors in an access control configuration, we take immediate actions to repair the configuration. The repairing is difficult, largely because arbitrary changes to the configuration may result in no less threat than errors do. In other words, constraints are placed on the repaired configuration. The presence of constraints makes a manual error-and-trial approach less attractive. There are two main shortcomings with the manual approach. Firstly, it is not clear whether the objectives are reachable at all; if not, we waste time trying to repair an error prone configuration. Secondly, we have no knowledge of the quality of the solution such as correctness of the repair. In order to address these shortcomings, we aim to develop an automated approach to the repairing task of access control configurations. We have utilized answer set programming (ASP), a declarative knowledge representation paradigm, to support such an automated approach. The rich modeling language of ASP enables us to capture and express the repairing objectives and the constraints. In our approach, the repairing instance is translated into an ASP, and the ASP solvers are invoked to evaluate it. Although the applications of ASP follow the general “encode-compute-extract” approach, they differ in the representations of the problems in ASP. In our case, there are two principal factors which render the proposed problem and approach non-trivial. Firstly, we need to identify constraints which are not only amendable to ASP interpretation, but also expressive enough to capture common idioms of security and business requirements; there is a trade-off to make. Secondly, our ASP programs should model the quality measure of repairs—when more than one repair is possible, the reported one is optimized in terms of the quality measure. We have also undertaken extensive experiments on both real-world and synthetic data-sets. The experiment results validate the effectiveness and efficiency of the automated approach.

Towards accuracy of role-based access control configurations in component-based systems

Access control is a common concern in most software applications. In component-based systems, although developers can implement access control requirements (ACRs) by simply declaring role-based access control configurations (ACCs) of components, it is still difficult for them to define and evolve ACCs accurately implementing ACRs due to the gap between the complex high-level ACRs and the voluminous ACCs enforced by underlying middleware platforms, and the ad hoc mistakes of human. This paper introduces and clarifies the concept of accuracy of ACCs relative to ACRs, and presents a set of metrics and algorithms which can be used to automatically evaluate and improve accuracy of ACCs by evaluating and reconfiguring the software architecture with ACCs. We apply our achievements in a composed e-shop application.

Practical safety in flexible access control models

Assurance that an access control configuration will not result in the leakage of a right to an unauthorized principal, called safety , is fundamental to ensuring that the most basic of access control policies can be enforced. It has been proven that the safety of an access control configuration cannot be decided for a general access control model, such as Lampson's access matrix, so safety is achieved either through the use of limited access control models or the verification of safety via constraints. Currently, almost all safety critical systems use limited access control models, such as Bell--LaPadula or Domain and Type Enforcement, because constraint expression languages are far too complex for typical administrators to use properly. However, researchers have identified that most constraints belong to one of a few basic types, so our goal is to develop a constraint expression model in which these constraints can be expressed in a straightforward way and extensions can be made to add other constraints, if desired. Our approach to expressing constraints has the following properties: (1) an access control policy is expressed using a graphical model in which the nodes represent sets (e.g., of subjects, objects, etc.) and the edges represent binary relationships on those sets and (2) constraints are expressed using a few, simple set operators on graph nodes. The basic graphical model is very simple, and we extend this model only as necessary to satisfy the identified constraint types. Since the basic graphical model is also general, further extension to support other constraints is possible, but such extensions should be made with caution as each increases the complexity of the model. Our hope is that by keeping the complexity of constraint expression in check, flexible access control models, such as role-based access control, may also be used for expressing access control policy for safety-critical systems.