Access Control Framework Research Articles

BorderChain: Blockchain-Based Access Control Framework for the Internet of Things Endpoint

The Internet of Things (IoT) providers serve better IoT services each year while producing more IoT gateways and devices to expand their services. However, the security of the IoT ecosystem remains an afterthought for most IoT providers. This action results in many cybersecurity breaches in the field, most likely due to the lack of access control mechanisms. In this paper, we propose BorderChain, an access control framework based on blockchain for IoT endpoints. The security protocol guarantees two properties. First, our proposal assures IoT users and services that they communicate with approved IoT gateways as endpoints, holding verified IoT devices that they need. Second, BorderChain also generates access tokens that the IoT service and users can use to query IoT resources legitimately inside the IoT domains. As a result, the protocol can convince IoT domain owners that the system will only authorize IoT requests that they approve. We realize our protocol in the form of a smart contract to allow many IoT entities such as IoT domain owners, IoT devices, IoT gateways, IoT vendors, IoT services, IoT users, and Internet Service Provider (ISP) to collaborate in a unified environment. We then implement entities in BorderChain as Node JS applications connecting to the Ethereum blockchain as our peer-to-peer platform. Based on our performance evaluation using several Raspberry Pi hardware and our private server, we show that BorderChain can process entities’ authentication and authorization requests efficiently using all hardware resources. Finally, we release BorderChain for public use.

An efficient policy evaluation engine with locomotive algorithm

The evaluation performance of PDP (policy decision point), especially in large-scale policy sets, is one of the most significant challenges in XACML (eXtensible Access Control Markup Language). With high time-consuming and extensive storage policies, large-scale policy sets are becoming more complicated when their evaluation performance need to be improved. Based on numericalization and batch processing, a new locomotive algorithm is proposed to design and implement a novel policy evaluation engine called XDPNBE that can efficiently deal with large-scale policy sets and make authorization decisions in multiple circumstances. XDPNBE enables efficient decisions within an attributed-based access control framework that has a strong promotion of evaluation performance. By simulating requests, XDPNBE is compared with the Sun PDP, XEngine, HPEngine and SBA-XACML. Experimental results show that if the number of requests reaches 10,000, the evaluation time of XDPNBE on the large-scale policy set with 120,000 rules is approximately 0.21%, 4.69%, 5.67% and 9.66% of that of the Sun PDP, XEngine, HPEngine and SBA-XACML, respectively.

AI-Enabled Blockchain-Based Access Control for Malicious Attacks Detection and Mitigation in IoE

In Internet of Everything (IoE), malicious attacks detection and mitigation are important issues. These issues can be resolved through an access control framework where two entities first authenticate each other prior to establishing any secret key for their secure communication. The sensing data of various smart devices in an IoE environment are processed securely at the nearby fog servers and at the same time legitimate users can also access the real-time data directly from designated smart devices through access control mechanism. We first discuss various attack trends in an IoE environment. After that, we discuss evolution of the blockchain technology in the IoE. An artificial intelligence based blockchain-envisioned access control framework for malicious attacks detection and mitigation has been suggested to secure the IoE environment. Finally, a blockchain-based implementation has been conducted on the proposed blockchain-envisioned access control framework for measuring the computational time needed for varying number of blocks mined in the blockchain and also for varying number of transactions per block.

Regulating data sharing across MQTT environments

Nowadays, due to the personal nature of the managed data, numerous Internet of Things (IoT) applications represent a potential threat to user privacy. In order to address this issue, several access control models have been specifically designed for IoT. The great majority of these proposals adopt centralized enforcement mechanisms designed to control the communication of IoT devices operating in the same environment. However, these approaches cannot regulate data exchange operated by devices connected to different environments. To the best of our knowledge, effective approaches capable of controlling these forms of communications are still missing. Therefore, in this paper, we do a step to fill this void, by focusing on applications built on top of MQTT, a widely used protocol for IoT. We propose an access control framework to regulate data sharing across bridged MQTT environments, on the basis of both access control policies and user preferences. The proposed approach regulates data exchange among IoT devices belonging to interconnected environments by means of a decentralized enforcement mechanism. Experimental analyses show the efficiency of the proposed approach.

LoRadar

IoT deployments targeting different application domains are being unfolded at various administrative levels such as countries, states, corporations, or even individual households. Facilitating data transfers between deployed sensors and back-end cloud services is an important aspect of IoT deployments. These data transfers are usually done using Low Power WAN technologies (LPWANs) that have low power consumption and support longer transmission ranges. LoRa (Long Range) is one such technology that has recently gained significant popularity due to its ease of deployment. In this paper, we present LoRadar , a passive packet sniffing framework for LoRa's Medium Access Control (MAC) protocol, LoRaWAN. LoRadar is built using commodity hardware. By carrying out passive measurements at a given location, LoRadar provides key insights of LoRa deployments such as available LoRa networks, deployed sensors, their make, and transmission patterns. Since LoRa deployments are becoming more pervasive, these information are pivotal in characterizing network performance, comparing different LoRa operators, and in emergencies or tactical operations to quickly assess available sensing infrastructure at a given geographical location. We validate the performance of LoRadar in both laboratory and real network settings and conduct a measurement study at eight key locations distributed over a large city-wide geographical area to provide an in-depth analysis of the landscape of commercial IoT deployments. Furthermore, we show the usage of LoRadar in improving the network such as potential collision and jamming detection, device localization, as well as spectrum policing to identify devices that violate the daily duty-cycle quota. Our results show that most of the devices transmitting over the SF12 data rate at one of the survey location were violating the network provider's quota.

Integrated Security, Authentication and Decentralized Access Control (ISADA) Framework Based on Novel Key Exchange Mechanism for a Public Cloud Environment

Integrated Security, Authentication and Decentralized Access Control (ISADA) Framework Based on Novel Key Exchange Mechanism for a Public Cloud Environment

Enforcing situation-aware access control to build malware-resilient file systems

Traditional non-semantic file systems are not sufficient in protecting file systems against attacks, either caused by ransomware attacks or software-related defects. Furthermore, outbreaks of new malware often cannot provide a large quantity of training samples for machine-learning-based approaches to counter malware campaigns. The malware defense system should aim to achieve the best balance between early detection and detection accuracy. In this paper, we present a situation-aware access control framework to work with existing file systems as a stackable add-on. Our framework enables the access control decision making to be deferred when required, to observe the consequence of such an access request to the file system and to roll back changes if required. As an application against ransomware attacks, it can be applied to preserve file content integrity, by enforcing that all binary files written to the file system have consistent internal file structures with the declared file types, and rolling back changes that violate such constraints. We envision our access control framework to complement existing operating system access control frameworks, to significantly reduce the dimension of data required for machine learning, and to build extra resilience into the operating systems against damages caused by either malware or software defects. We demonstrate the practicality of our framework through a prototype testing, capturing relevant ransomware situations. The experimental results along with a large ransomware dataset show that our framework can be effectively applied in practice.

Attribute-Based Access Control for Smart Cities: A Smart-Contract-Driven Framework

Efficient and reliable access control in smart cities is critical for the protection of various resources for decision making and task execution. Existing centralized access control schemes suffer from the limitations of single point of failure, low reliability, and poor scalability. This article, therefore, proposes a distributed and reliable access control framework for smart cities by combining the blockchain smart contract technology and the attribute-based access control (ABAC) model. The framework consists of one policy management contract (PMC) for managing the ABAC policies, one subject attribute management contract (SAMC) for managing the attributes of subjects (i.e., entities accessing resources), one object attribute management contract (OAMC) for managing the attributes of objects (i.e., resources being accessed), and one access control contract (ACC) for performing the access control. To show the feasibility of the proposed framework, we construct a local private Ethereum blockchain system to implement the four smart contracts and also conduct experiments to evaluate the monetary cost as well as to compare the proposed framework with an existing access control list (ACL)-based scheme. The experimental results show that although the proposed scheme consumes more money than the ACL-based scheme at the deployment stage, it introduces less monetary cost during the system running especially for large-scale smart cities.

Blockchain Driven Access Control Mechanisms, Models and Frameworks: A State of the Art Review

Access Control or authorization is referred to as the confinement of specific actions of an entity to perform an action. Blockchain driven access control mechanisms have gained considerable attention since applications for blockchain were found beyond the premises of cryptocurrencies. However, there are no systematic efforts to analyze existing empirical evidence. To this end, we aim to synthesize literature to understand the state-of-the-art in blockchain driven access control mechanisms with respect to underlying platforms, utilized blockchain properties, nature of the models and associated test-beds & tools. We conducted the review in a systematic way. Meta Analysis and thematic synthesis was performed on the findings and results from the relevant primary studies in order to answer the research questions in perspective. We identified 76 relevant primary studies passing the quality assessment. A number of problems like single point of failure, security, privacy etc were targeted by the relevant primary studies. The meta analysis suggests the use of different blockchain platforms, several application domains and different utilized blockchain properties. In this paper, we present a state of the art review of blockchain driven access control systems. In hindsight, we present a taxonomy of blockchain driven access control systems to better under the immense implications this field has over various application domains.

AC4AV: A Flexible and Dynamic Access Control Framework for Connected and Autonomous Vehicles

Sensing data plays a pivotal role in connected and autonomous vehicles (CAVs), enabling CAV to perceive surroundings. For example, malicious applications might tamper this life-critical data, resulting in erroneous driving decisions and threatening the safety of passengers. Access control, one of the promising solutions to protect data from unauthorized access, is urgently needed for vehicle sensing data. However, due to the intrinsic complexity of vehicle sensing data, including historical and real time, and access patterns of different data sources, there is currently no suitable access control framework that can systematically solve this problem; current frameworks only focus on one aspect. In this article, we propose a novel and flexible access control framework, <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">AC4AV</monospace> , which aims to support various access control models, and provide APIs for dynamically adjusting access control models and developing customized access control models, thus supporting access control research on CAV for the community. In addition, we propose a data abstraction method to clearly identify data, applications, and access operations in CAV, and therefore is easily able to configure the permits of each data and application in access control policies. We have implemented a prototype to demonstrate our architecture on NATS for real-time data and NGINX for historical data, and three access control models as built-in models. We measured the performance of our <monospace xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">AC4AV</monospace> while applying these access control models to real-time and historical data. The experimental results show that the framework has little impact on real-time data access within a tolerable range.

AppMonitor: restricting information leakage to third-party applications

Nowadays, the popularity of online social networks (OSNs) has been increased tremendously. Meanwhile, a wide range of third-party applications (TPAs) facilitated by OSNs has made a significant contribution to their popularity. TPAs offer many attractive functionalities and services to the OSN users but pose serious privacy threats to the users. Therefore, it is essential to strictly regulate the divulgence of user data to TPAs. In this paper, we propose an access control framework called AppMonitor to monitor and curb the user data to TPA. Further, we also introduce a relation-based access control policy model that uses predicate calculus to express data access policies. Analysis of the usability and correctness of the introduced policy model has been made, based on a logical model using answer set programming. A simplified prototype has been developed to show the feasibility of AppMonitor, and its effectiveness is shown through a user study.

Towards Secure, Flexible and Efficient Role Based Hospital’s Cloud Management System: Case Study

INTRODUCTION: Many organizations of health care have recognized that quality of service can be improved by maintaining e-records of patient’s reports, medical histories, surgeries recordings, etc. over the multimedia cloud servers. But, the data breach is always a matter of stake for an organization as well as for the patients.OBJECTIVES: This work has considered a qualitative scenario related to multimedia e-content management for a multiforte hospital’s cloud server.METHODS: An End-to-End Encryption with the cryptographic algorithm is applied along with an access control framework for secure transmission and storage of e-records.RESULTS: The results are presented in the form of bar graphs for the time taken to perform encryption/decryption of various media files and combo graphs for different scenarios of access control.CONCLUSION: This can provide prevention from many attacks/threats, ensures authentication and privacy along with limiting the server usage and cost.

DACIoT: Dynamic Access Control Framework for IoT Deployments

This article presents a dynamic access control framework for the Internet of Things (DACIoT). The main objective of DACIoT is to prevent unauthorized access to IoT devices and tightens the authorized access while an IoT device is in use. The rigidness of existing access control (AC) techniques in terms of manual policy specification, discontinuity of access decision making, and immutability to changing access behaviors makes these solutions fall short in highly dynamic IoT environments. DACIoT supports three functionalities that are lacking in existing AC solutions: 1) automatic policy generation; 2) continuous policy enforcement; and 3) adaptive policy adjustment. The DACIoT extends the standard reference model of the extensible AC markup language (XACML) with the added three functionalities to improve the adaptability of attribute-based AC policies to highly dynamic IoT environments. Results show that DACIoT provides improved security, dynamic adaptability, and can scale efficiently to IoT environments.

Blockchain-based access control management for Decentralized Online Social Networks

Online Social Networks (OSNs) represent today a big communication channel where users spend a lot of time to share personal data. Unfortunately, the big popularity of OSNs can be compared with their big privacy issues. Indeed, several recent scandals have demonstrated their vulnerability. Decentralized Online Social Networks (DOSNs) have been proposed as an alternative solution to the current centralized OSNs. DOSNs do not have a service provider that acts as central authority and users have more control over their information. Several DOSNs have been proposed during the last years. However, the decentralization of the social services requires efficient distributed solutions for protecting the privacy of users. During the last years the blockchain technology has been applied to Social Networks in order to overcome the privacy issues and to offer a real solution to the privacy issues in a decentralized system. However, in these platforms the blockchain is usually used as a storage, and content is public. In this paper, we propose a manageable and auditable access control framework for DOSNs using blockchain technology for the definition of privacy policies. The resource owner uses the public key of the subject to define auditable access control policies using Access Control List (ACL), while the private key associated with the subject’s Ethereum account is used to decrypt the private data once access permission is validated on the blockchain. We provide an evaluation of our approach by exploiting the Rinkeby Ethereum testnet to deploy the smart contracts. Experimental results clearly show that our proposed ACL-based access control outperforms the Attribute-based access control (ABAC) in terms of gas cost. Indeed, a simple ABAC evaluation function requires 280,000 gas, instead our scheme requires 61,648 gas to evaluate ACL rules.

A novel multi-objective optimizer framework for TDMA-based medium access control in IoT

Recently, cross-layer optimization has been emphasized by researchers for Internet of Things (IoT) where billions of devices communicate intelligently making every day communication highly informative. Medium Access Control (MAC) sub-layer is part of data link layer in IoT protocol stack. The energy consumption of things is greatly affected by MAC protocol which controls the node radio functionalities. In this article, we propose the design of an efficient MAC for IoT by minimizing its energy consumption at various levels. The minimization model is subject to reduction in distortion levels while simultaneously extending network lifetime. This article synthesizes and optimizes MAC layer of IoT based protocols using a novel delta diagram synthesizer and accurately captures both the high heterogeneity of the IoT and the impact of the Internet as part of the MAC layer architecture. Furthermore a novel hybrid Whale-Artificial Bee Colony optimizer framework is proposed to obtain optimal nodes based on energy consumption and the communication parameters among things, by exploiting the interrelations among different layer functionalities in the IoT. This novel system saves considerable computation resources of the resource constrained IoT devices and adapts to various data sources with different distortion levels rapidly.

A collaborative access control framework for online social networks

Most Online Social Networks allow users to set their privacy settings concerning posting information, but current implementations do not allow a fine grained enforcement in case the posted item concerns other users. In this paper we propose a new collaborative access control framework that takes into account the relation of multiple users for viewing as well as for sharing items, eventually solving conflicts in the privacy settings of the users involved. Our solution relies on two algorithms, one for viewing and another one for sharing items. We provide an evaluation of these algorithms where we demonstrate how varying some of the parameters directly influences the decision of viewing or sharing an item. Last but not least, we present a proof-of-concept implementation of our approach in an open source social network called Diaspora.

A constraint and risk-aware approach to attribute-based access control for cyber-physical systems

Cyber-physical systems (CPSs) integrate cyber components and physical processes. This integration enhances the capabilities of physical systems by incorporating intelligence into objects and services. On the other hand, the integration of cyber and physical components and the interaction between them introduce new security threats. Since CPSs are mostly safety-critical systems, data stored and communicated in them are highly critical. Hence, there is a crucial need for protecting the data and resources in CPSs against unauthorized accesses. In this paper, we propose an access control (AC) framework to address CPS related security issues. The proposed framework consists of two parts: a Cyber-Physical Access Control model (CPAC) and a Generalized Action Generation Model (GAGM). CPAC utilizes an attribute-based approach and extends it with cyber-physical components and cyber-physical interactions. In addition, we incorporate Separation of Duty (SoD) constraints into the CPAC model. GAGM is used to augment the enforcement of access policies. We present formal representations of CPAC and GAGM and demonstrate their use in a sample scenario for a medical CPS. We propose an algorithm for enforcing authorization policies. We implement the CPAC model and compare its performance against the core attribute-based access control model. We present an authorization enforcement approach and show through our experimental results its feasibility.

A Survey of Context-Aware Access Control Mechanisms for Cloud and Fog Networks: Taxonomy and Open Research Issues

Over the last few decades, the proliferation of the Internet of Things (IoT) has produced an overwhelming flow of data and services, which has shifted the access control paradigm from a fixed desktop environment to dynamic cloud environments. Fog computing is associated with a new access control paradigm to reduce the overhead costs by moving the execution of application logic from the centre of the cloud data sources to the periphery of the IoT-oriented sensor networks. Indeed, accessing information and data resources from a variety of IoT sources has been plagued with inherent problems such as data heterogeneity, privacy, security and computational overheads. This paper presents an extensive survey of security, privacy and access control research, while highlighting several specific concerns in a wide range of contextual conditions (e.g., spatial, temporal and environmental contexts) which are gaining a lot of momentum in the area of industrial sensor and cloud networks. We present different taxonomies, such as contextual conditions and authorization models, based on the key issues in this area and discuss the existing context-sensitive access control approaches to tackle the aforementioned issues. With the aim of reducing administrative and computational overheads in the IoT sensor networks, we propose a new generation of Fog-Based Context-Aware Access Control (FB-CAAC) framework, combining the benefits of the cloud, IoT and context-aware computing; and ensuring proper access control and security at the edge of the end-devices. Our goal is not only to control context-sensitive access to data resources in the cloud, but also to move the execution of an application logic from the cloud-level to an intermediary-level where necessary, through adding computational nodes at the edge of the IoT sensor network. A discussion of some open research issues pertaining to context-sensitive access control to data resources is provided, including several real-world case studies. We conclude the paper with an in-depth analysis of the research challenges that have not been adequately addressed in the literature and highlight directions for future work that has not been well aligned with currently available research.

Crowd review and attribute-based credit computation for an access control mechanism in cloud data centers

ABSTRACT The cloud services are very useful and demanded in an information technology industry these days. Cloud services are universally delivered with the help of the internet. Cloud services provide more flexibility than conventional service methods. It is the responsibility of cloud service providers to ensure the provisioning and scaling of resources, reliability, and security of cloud resources. The cloud services witnessed exponential growth in recent years, which created many opportunities for developers but also created many security concerns. To overcome these security and legal issues, there exist various access control mechanisms. In this paper, we review the existing access control mechanism and proposed an access control framework for a cloud computing environment. The conventional access control mechanism does not fulfill the requirement of the cloud environment. The cloud environment has the diverse set of users with different sets of security requirement. It has different security concerns, namely multi-tenant hosting, heterogeneity of users, trust among the cloud components, etc. This paper proposes the innovative approach of crowd review and attribute-based credit computation for the access control mechanism in cloud data centers. In this paper, the concept of attribute-based access control is integrated with a credit component module. The concept of crowdreviewing and reputation is used to compute the credit value of users. The simulation experiment has been shown to protect the consistent users and to restrict the access of inconsistent users in the cloud environment. It is an access control approach to mitigate the challenges in security concerns.

Enhanced Medium Access for Traffic Management in Smart-Cities’ Vehicular-Cloud

We propose an enhanced vehicular-cloud medium access control framework. The framework is utilizing the Long Term Evolution-Advanced (LTE-A) for better QoS and more reliable transportation telecommunication applications. It decreases the communication delay in real-time traffic applications while maintaining the highest network resource utilization. The objective of the proposed approach is to improve the connection quality between the vehicle and the base station (BS). The proposed approach integrates a Voice-Batch Markovian Arrival Process (V-BMAP) with IEEE 802.16 to analyze various reliability metrics, such as energy consumption, delay, throughput and the average packet loss. The archived results show that the proposed approach is superior in comparison to other potential alternatives in the literature.