Access Control Engine Research Articles

Implementation of a 4-tier cloud-based architecture for collaborative health care delivery

Cloud services permit healthcare providers to ensure information handling and allow different service resources such as Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) on the Internet, given that security and information proprietorship concerns are attended to. Health Care Providers (HCPs) in Nigeria however, have been confronted with various issues because of their method of operations. Amongst the issues are ill-advised methods of data storage and unreliable nature of patient medical records. Apart from these challenges, trouble in accessing quality healthcare services, high cost of medical services, and wrong analysis and treatment methodology are not left out. Cloud Computing has relatively possessed the capacity to give proficient and reliable method for securing medical information and the need for data mining tools in this form of distributed system will go a long way in achieving the objective set out for this project. The aim of this research therefore is to implement a cloud-based architecture that is suitable to integrate Healthcare Delivery into the cloud to provide a productive mode of operation. The proposed architecture consists of four phases (4-Tier); a User Authentication and Access Control Engine (UAACE) which prevents unauthorized access to patient medical records and also utilizes standard encryption/decoding techniques to ensure privacy of such records. The architecture likewise contains a Data Analysis and Pattern Prediction Unit (DAPPU) which gives valuable data that guides decision making through standard Data mining procedures as well as Cloud Service Provider (CSP) and Health Care Providers (HCPs). The architecture which has been implemented on CloudSim has proved to be efficient and reliable base on the results obtained when compared with previous work. Keywords: Architecture, collaborative, cloud computing, cloud service provider (CSP), health care

BTG-AC: Break-the-Glass Access Control Model for Medical Data in Wireless Sensor Networks.

Wireless sensor networks (WSNs) have recently attracted much interest in the research community because of their wide range of applications. An emerging application for WSNs involves their use in healthcare where they are generally termed wireless medical sensor networks. In a hospital, outfitting every patient with tiny, wearable, wireless vital sign sensors would allow doctors, nurses, and other caregivers to continuously monitor the state of their patients. In such a scenario, patients are expected to be treated in reasonable time, so an access control model is needed, which will provide both real-time access to comprehensive medical records and detect unauthorized access to sensitive data. In emergency situations, a doctor or nurse needs to access data immediately. The loss in data availability can result in further decline in the patient's condition or can even lead to death. Therefore, the availability of data is more important than any security concern in emergency situations. To address that research issue for medical data in WSNs, we propose the break-the-glass access control (BTG-AC) model that is a modified and redesigned version of the break-the-glass role-based access control (BTG-RBAC) model to address data availability issue and to detect the security policy violations from both authorized and unauthorized users. Several changes within the access control engine are made in BTG-RBAC in order to make the new BTG-AC to apply and fit in WSNs. This paper presents the detailed design and development of the BTG-AC model based on a healthcare scenario. The evaluation results show that the concepts of BTG, prevention and detection mechanism, and obligation provide more flexible access than other current access control models in WSNs. Additionally, we compare the BTG-AC model with an adaptive access control (A2C) model, which has similar properties, for further evaluation. Alongside with the comparison, the advantages and disadvantages of BTG-AC over current WSN access control models are presented.

A soft computing based location-aware access control for smart buildings

The evolution of wireless communications and pervasive computing is transforming current physical spaces into real smart environments. These emerging scenarios are expected to be composed by a potentially huge amount of heterogeneous smart objects which can be remotely accessed by users via their mobile devices anytime, anywhere. In this paper, we propose a distributed location-aware access control mechanism and its application in the smart building context. Our approach is based on an access control engine embedded into smart objects, which are responsible to make authorization decisions by considering both user location data and access credentials. User location data are estimated using a novel indoor localization system based on magnetic field data sent by user through her personal phone. This localization system implements a combination of soft computing techniques over the data collected by smartphones. Therefore, our location-aware access control mechanism does not require any intermediate entity, providing the benefits of a decentralized approach for smart environments. From the results obtained, we can consider our proposal as a promising approach to tackle the challenging security requirements of typical pervasive environments.

Behavior-based access control for distributed healthcare systems

Sensitivity of clinical data and strict rules regarding data sharing have caused privacy and security to be critical requirements for using patient profiles in distributed healthcare systems. The amalgamation of new information technology with traditional healthcare workflows for sharing patient pr ofiles has made the whole system vulnerable to privacy and security breaches. Standardization organizations are developing specifications to satisfy the required privacy and security requirements. In this paper we present a novel access control model compliant with healthcare standards based on a framework designed for data and service interoperability in the healthcare domain. The proposed model for customizable access control captures the dynamic behavior of the user and determines access rights accordingly. The model is generic and flexible in the sense that an access control engine dynamically receives security effective parameters from the subject user, and identifies the privilege level in accessing data using different specialized components within the engine. Standard data representation formats and ontologies are used to make the model compatible with different healthcare systems. The access control engine employs an approach to follow the user's behavior and navigates among engine components to provide the user's privilege to access a resource. A simulation environment is implemented to evaluate and test the proposed model.

Access Control Engine with Dynamic Priority Resource Allocation for Cognitive Radio Networks

An access control engine with dynamic priority resource allocation (ACE-DPRA) is proposed for unlicensed users to utilize free spectrum of wireless communication systems. A cognitive radio (CR) network with sensing and learning abilities is essential for unlicensed users to achieve ACE-DPRA. Three algorithms are included in ACE-DPRA to improve the spectral efficiency. While requesting to set up connection, unlicensed CR users generate excessive interferences to licensed users. The proposed ACE-DPRA with an admission control scheme allows the connection of unlicensed CR users without degrading the communication quality of licensed users. The priority algorithm for utilizing the unused spectrum is designed according to the location information of unlicensed users. A transmitted power control method is achieved by a fuzzy-learning mechanism. The spectral efficiency of wireless communication systems can be increased after adopting the proposed ACE-DPRA algorithm. Simulation results show that licensed users keep the advantages of high transmission data rate, low interference power, and low average outage probability after the connection of unlicensed CR users.

A Flexible Role Based Access Control Engine Model

The normal role-based access control (RBAC) model decouples users and permissions through roles,and different software systems have different implementation syteles.The paper proposes an engine model which can configure the RBAC management systems flexibly.It is a configuration tool to generate different RBAC management systems which meet different users’ requirements. The practice proves that the engine model can improve the efficiency and quality of software development. The role-based access control model decouples users and permissions through roles in order to simplify authorized operations and safety management[1]. Many literatures[2-6] discuss the RBAC model from different aspects. Some literatures[2-3] add new elements to the normal RBAC model,and these models are unidimensional according to the manipulated resources.For example, the NIST RBAC reference model [2] extends and standardize the RBAC96 [1] model reasonably.Some literatures[4-5] introduce time property to RBAC model and they are two-dimensional models according to the manipulated resources.Literature[6] furtherly add visual data muster to RBAC model and proposes a three-dimensional access control model. All of these models only discuss access control model theoretically,and different role-based access control modules in software systems have different instantiation sytles.For example, a RBAC module in one software system can not meet the access control requirements in another system because different RBAC modules have different table fields in order to realize certain requirements. This paper proposes a flexible role-based access control engine which can configure the RBAC module for different systmes according to each customer’s requirement.The engine is a configuration tool and it can realize various RBAC modules which have different table fields in database.The paper is organized as follows.Section I introduces the basic concepts of the NIST RBAC model;Seciton II details the description of RBAC engine model and gives the configuration steps using this engine to generate RBAC instances,and at last section III gives an example and concludes the paper.

Dynamic access-control policies on XML encrypted data

The erosion of trust put in traditional database servers and in Database Service Providers and the growing interest for different forms of selective data dissemination are different factors that lead to move the access-control from servers to clients. Different data encryption and key dissemination schemes have been proposed to serve this purpose. By compiling the access-control rules into the encryption process, all these methods suffer from a static way of sharing data. With the emergence of hardware security elements on client devices, more dynamic client-based access-control schemes can be devised. This paper proposes a tamper-resistant client-based XML access-right controller supporting flexible and dynamic access-control policies. The access-control engine is embedded in a hardware-secure device and, therefore, must cope with specific hardware resources. This engine benefits from a dedicated index to quickly converge toward the authorized parts of a potentially streaming XML document. Pending situations (i.e., where data delivery is conditioned by predicates, which apply to values encountered afterward in the document stream) are handled gracefully, skipping, whenever possible the pending elements and reassembling relevant parts when the pending situation is solved. Additional security mechanisms guarantee that (1) the input document is protected from any form of tampering and (2) no forbidden information can be gained by replay attacks on different versions of the XML document and of the access-control rules. Performance measurements on synthetic and real datasets demonstrate the effectiveness of the approach. Finally, the paper reports on two experiments conducted with a prototype running on a secured hardware platform.