Network Access Control Research Articles

Toward an SDN-enabled NFV architecture

This article presents the progressive evolution of NFV from the initial SDN-agnostic initiative to a fully SDN-enabled NFV solution, where SDN is not only used as infrastructure support but also influences how virtual network functions (VNFs) are designed. In the latest approach, when possible, stateless processing in the VNF shifts from the computing element to the networking element. To support these claims, the article presents the implementation of a flowbased network access control solution, with an SDN-enabled VNF built on IEEE 802.1x, which establishes services as sets of flow definitions that are authorized as the result of an end user authentication process. Enforcing the access to the network is done at the network element, while the authentication and authorization state is maintained at the compute element. The application of this proposal allows the performance to be enhanced, while traffic in the control channel is reduced to a minimum. The SDN-enabled NFV approach sets the foundation to increase the areas of application of NFV, in particular in those areas where massive stateless processing of packets is expected.

Fuzzy-controller for WiMAX networks

WiMAX is a broadband wireless last mile technology providing high speeds for long distances and offering great flexibility. Scheduling in WiMAX became one of the most important tasks, because it is responsible for distributing available resources among users. A high level of quality of service and scheduling support is one of the most interesting features of the WiMAX standard. In modern telecommunication networks the access control techniques are widely used. That is because using such devices instead of traditional ones permits to increase accuracy and reliability of control. Fuzzy systems have replaced conventional techniques in many engineering applications, especially in control systems. In the article it is suggested to use a fuzzy controller for access control in WiMAX networks that allows avoiding congestion in networks. The main objective of this work is providing an implementation of the WiMAX standard using the dynamic fuzzy logic based priority scheduler. We propose to use a fuzzy controller having three input and one output linguistic variables. Input linguistic variables of the controller are waiting time, queue length and packet size, its output variable is user’s priority. A block diagram of the fuzzy controller was developed. Linguistic variables, terms and membership functions for input and output values have been defined. The Waiting time linguistic variable has three terms: low, medium, high. The Queue length linguistic variable has three terms: short, medium, long. The Packet size linguistic variable has three terms: small, medium, large. The rules base consisting oftwenty-seven rules has been developed. The fuzzy controller has been simulated using Matlab 6.5. Results of the simulation prove the accuracy and reliability of the fuzzy-controller’s model.

Toward a flexible and fine‐grained access control framework for infrastructure as a service clouds

AbstractCloud computing, as an emerging computing paradigm, greatly facilitates resource sharing and enables providing computing power as services over the Internet. However, it also brings new challenges for security and access control, especially in infrastructure as a service clouds. The introduction of virtualization layer increases new security risks, which should be restricted and confined by more stringent access control techniques. In this paper, we propose a flexible and fine‐grained access control framework, named IaaS‐oriented Hybrid Access Control (iHAC), which combines the advantages of both the role‐based access control and type enforcement model. We consider access control issues from the perspective of virtual machines. A permission transition model is designed to dynamically assign permissions to virtual machines. A Virtual Machine Monitor (VMM)‐based access control mechanism is presented to confine the virtual machine's behaviors in a fine‐grained manner. A VMM‐enabled network access control approach is proposed to regulate the communication among virtual machines. iHAC is successfully implemented in the Internet based Virtual Computing Infrastructure (iVIC) platform, and several experiments are conducted to evaluate its effectiveness and efficiency. The results show that iHAC can make correct access control decisions with low performance overhead. Copyright © 2015 John Wiley & Sons, Ltd.

Frame-Based Medium Access Control for 5G Wireless Networks

Millimeter wave (mmWave) communications is one of the key technologies for future 5th generation (5G) wireless networks. In this paper, we investigate the problem of medium access control (MAC) in mmWave networks. We develop a frame-based scheduling directional MAC protocol, termed FDMAC, to achieve the goal of leveraging collision-free concurrent transmissions to fully exploit spatial reuse in mmWave networks. The high efficiency of FDMAC is achieved by amortizing the scheduling overhead over multiple concurrent, back-to-back transmissions in a row. The core of FDMAC is a graph coloring-based scheduling algorithm, termed greedy coloring (GC) algorithm, that can compute near-optimal schedules with respect to the total transmission time with low complexity. FDMAC is analyzed and evaluated with simulations.

Personalized keystroke dynamics for self-powered human--machine interfacing.

The computer keyboard is one of the most common, reliable, accessible, and effective tools used for human--machine interfacing and information exchange. Although keyboards have been used for hundreds of years for advancing human civilization, studying human behavior by keystroke dynamics using smart keyboards remains a great challenge. Here we report a self-powered, non-mechanical-punching keyboard enabled by contact electrification between human fingers and keys, which converts mechanical stimuli applied to the keyboard into local electronic signals without applying an external power. The intelligent keyboard (IKB) can not only sensitively trigger a wireless alarm system once gentle finger tapping occurs but also trace and record typed content by detecting both the dynamic time intervals between and during the inputting of letters and the force used for each typing action. Such features hold promise for its use as a smart security system that can realize detection, alert, recording, and identification. Moreover, the IKB is able to identify personal characteristics from different individuals, assisted by the behavioral biometric of keystroke dynamics. Furthermore, the IKB can effectively harness typing motions for electricity to charge commercial electronics at arbitrary typing speeds greater than 100 characters per min. Given the above features, the IKB can be potentially applied not only to self-powered electronics but also to artificial intelligence, cyber security, and computer or network access control.

Exploring a Context-based Network Access Control for Mobile Devices

Abstract Significant advancement in mobile devices coupled with high speed networks have shifted personal computing towards pervasive environments. Mobile devices currently offer many value-added applications and services such as emailing, messaging, navigation, social networking, finance, and entertainment. Typically, such value-added applications have access to users’ personal information and are capable of gathering and transmitting trust sensitive information, hence posing security risks and/or privacy concerns. In this paper, we propose a context-based analytic hierarchy process (AHP) framework for eliciting context information and adapting this information with network access control measures for mobile devices. The framework enforces the execution of mobile applications inside security incubators to control the communication between mobile applications and mobile device resources. Mobile applications’ access requests are analyzed based on user's context information collected from the mobile device sensors and the application network access control configuration. We use the Facebook mobile application, as a test case, to evaluate our proposed framework. Evaluation results have demonstrated the efficacy of the framework in providing network access control measures based on real-time assessment of user's context.

New Security Architecture for IoT Network

We explain the notion of security architecture for Internet of Things (IoT) based on software-defined networking (SDN). In this context, the SDN-based architecture works with or without infrastructure, that we call SDN-Domain. This work describes the operation of the proposed architecture and summarizes the opportunity to achieve network security in a more efficient and flexible with SDN. An overview of existing SDN security applications were discussed and tackles its issues, presenting a new IoT system's architecture. In this paper we considered the network access control and global traffic monitoring for ad-hoc networks. Finally, we point out architectural design choices for SDN using OpenFlow and discuss their performance implications.

TIE-MAC: tolerable interference estimation-based concurrent medium access control for WLAN mesh networks

This paper proposes TIE-MAC, tolerable interference estimation-based concurrent medium access control protocol for wireless local area network (WLAN) mesh networks. The goal is to increase spatial reuse, achieve high throughput and reduce average energy consumption through exploiting concurrent transmissions among neighbouring nodes. TIE-MAC confirms that the tolerable interference of the receiver plays a key role in determining the efficiency of concurrent transmission scheduling, and puts forward a novel tolerable interference estimation mechanism, enabling the receivers to precisely estimate their tolerable interference. Meanwhile, a concurrent transmission gap (CTG) is inserted between the transmission of the RTS/CTS and data packets to offer the nodes in the vicinity of the receiver the chance to schedule possible overlapping transmissions. The size of the CTG is optimised using an exponential smoothing model-based adjustment algorithm. Moreover, sequenced acknowledgements (ACKs) are introduced in TIE-MAC and used in combination with the tolerable interference estimation mechanism to avoid possible collisions among different concurrent transmissions. Simulation results show that TIE-MAC gains better throughput and energy consumption performance in comparison with existing concurrent transmission protocols as well as the active WLAN mesh standard.

Cognitive Self-Scheduled Mechanism for Access Control in Noisy Vehicular Ad Hoc Networks

Within the challenging environment of intelligent transportation systems (ITS), networked control systems such as platooning guidance of autonomous vehicles require innovative mechanisms to provide real-time communications. Although several proposals are currently under discussion, the design of a rapid, efficient, flexible, and reliable medium access control mechanism which meets the specific constraints of such real-time communications applications remains unsolved in this highly dynamic environment. However, cognitive radio (CR) combines the capacity to sense the radio spectrum with the flexibility to adapt to transmission parameters in order to maximize system performance and has thus become an effective approach for the design of dynamic spectrum access (DSA) mechanisms. This paper presents the enhanced noncooperative cognitive division multiple access (ENCCMA) proposal combining time division multiple access (TDMA) and frequency division multiple access (FDMA) schemes with CR techniques to obtain a mechanism fulfilling the requirements of real-time communications. The analysis presented here considers the IEEE WAVE and 802.11p as reference standards; however, the proposed medium access control (MAC) mechanism can be adapted to operate on the physical layer of different standards. The mechanism also offers the advantage of avoiding signaling, thus enhancing system autonomy as well as behavior in adverse scenarios.

Cooperation between Channel Access Control and TCP Rate Adaptation in Multi-Hop Ad Hoc Networks

Cooperation between Channel Access Control and TCP Rate Adaptation in Multi-Hop Ad Hoc Networks

Towards more pro-active access control in computer systems and networks

Access control is a core security technology which has been widely used in computer systems and networks to protect sensitive information and critical resources and to counter malicious attacks. Although many access control models have been developed in the past, such as discretionary access control (DAC), mandatory access control (MAC) and role-based access control (RBAC), these models are designed primarily as a defensive measure in that they are used for examining access requests and making authorization decisions based on established access control policies. As the result, even after a malicious access is identified, the requester can still keep issuing more malicious access requests without much fear of punitive consequences from the access control system in subsequent accesses. Such access control may be acceptable in closed systems and networks but is not adequate in open systems and networks where the real identities and other critical information about requesters may not be known to the systems and networks. In this paper, we propose to design pro-active access control so that access control systems can respond to malicious access pro-actively to suit the needs of open systems and networks. We will first apply some established principles in the Game Theory to analyze current access control models to identify the limitations that make them inadequate in open systems and networks. To design pro-active access control (PAC), we incorporate a constraint mechanism that includes feedback and evaluation components and show based on the Game Theory how to make such access control respond to malicious access in a pro-active manner. We also present a framework design of PAC and demonstrate through the implementation of trust-based access control the feasibility of design, implementation and application of pro-active access control. Such kind of models and mechanisms can serve as the foundation for the design of access control systems that will be made more effective in deterring malicious attacks in open systems and networks.

Mining a high level access control policy in a network with multiple firewalls

A policy mining approach that aims to automatically extract a high level of abstraction policy from the rules configured on a firewall has been recently proposed (Hachana et al., 2013). This technique is likely to considerably facilitate firewall management. However, protecting the information system of a business organization usually requires the enforcement of more than one firewall. In this paper, we augment the policy mining approach by an additional processing for a network access control policy mining. We develop the problem of integration of Net-RBAC (Hachana, 2014) policies resulting from policy mining over several firewalls in order to mine a high level network policy. Moreover, we show how to verify security properties related to the deployment consistency over the firewalls. We illustrate the network policy mining approach by a realistic example, and we experimentally evaluate the performance of our merger algorithms.

PBS: A Portable Billing Scheme with Fine-Grained Access Control for Service-Oriented Vehicular Networks

Vehicular ad hoc networks (VANETs) are an emerging wireless network technology used to improve road safety. Commercial services will play an important role in drawing customers to VANETs. Therefore, service-oriented vehicular networks offer an effective and promising approach. To meet the diverse requirements of different users, fine-grained access control is essential. This paper aims to address security, privacy and billing issues in service-oriented vehicular networks. Taking advantage of a portable electronic currency, the proposed scheme mitigates the long authentication delay of the centralized AAA architecture. Variant attribute-based encryption ensures fine-grained access control and secure billing. Only vehicles possessing the proper service attributes and valid electronic currency are authorized to access the requested service file. The security properties of entity authentication, session key agreement, privacy, fraud electronic currency prevention, double-spending prevention, and nonrepudiated billing are achieved. Extensive analysis and simulations demonstrate that our scheme is a viable candidate to replace a centralized AAA architecture with a decentralized method for better scalability in service-oriented vehicular networks.

An Attribute-Based Encryption Scheme with Revocation for Fine-Grained Access Control in Wireless Body Area Networks

The wireless body area networks (WBANs) have emerged as a new method for e-healthcare. Without being measured face-to-face, the medical workers can give guidance to patients in a real-time way. WBANs can greatly improve the healthcare quality. The personal information and medical data are stored and processed in sensors. The security and privacy are two vital issues. In this paper, we design an attribute-based encryption scheme for fine-grained access control in WBANs. In our scheme, a user can decrypt a ciphertext if the attributes related with a ciphertext satisfy the user's access structure. The users can be revoked if necessary. Therefore, the security and privacy of patients can be protected. Our scheme provides confidentiality, security, and resistance to collusion attack. We analyze the correctness, security, and energy consumption of the scheme.

IPv6 기반의 네트워크 접근제어 시스템 설계 및 구현

인터넷 사용자 및 스마트 디바이스의 증가로 네트워크 보안의 중요성이 점차적으로 커지고 있다. 네트워크 보안의 세부기술들은 방화벽, IPS, DDoS차단시스템, UTM, VPN, 네트워크 접근제어시스템, 무선네트워크보안, 모바일보안, 망분리 등으로 구성된다. 현재 하드웨어 인프라는 이미 IPv6를 위한 기능을 지원하고 있지만 IPv6 기반 서비스의 제공은 미진하여 대부분의 보안제품들은 IPv4에서 동작하고 있다. 그러므로 본 논문에서는 IPv6를 지원하는 보안 기술인 네트워크 접근제어기능을 설계하고 이를 위해 필수적으로 요구되는 IPv6 단말의 탐색, 차단/격리 그리고 128bit IPv6 주소의 효율적인 관리를 위한 도메인자동 할당 기능을 설계 및 구현하였다. 이를 위해 KISA에서 실제 구축한 IPv6 환경에서 보편적 단말들에 적용이 가능하도록 구현하였다. 결과적으로 보편적으로 사용하고 있는 IPv6 장비들에 대해서 유 무선 호스트 검출, 차단, 격리 및 도메인 할당이 정상적으로 동작하는 것을 확인할 수 있었다. The increase in the Internet and smart device users requires high-level network security. Network security consists of Web Firewall, Network Firewall, IPS, DDoS system, UTM (Unified Treat Management), VPN, NAC (Network Access Control), Wireless security, Mobile security, and Virtualization. Most network security solutions running on IPv4, and IPv6 network services are not sufficiently ready. Therefore, in this paper, this study designed and implemented important functions of Network Access Control (NAC), which include IPv6 host detection, isolation, blocking and domain assignment for the IPv6 network. In particular, domain assignment function makes 128 bits IPv6 address management easy. This system was implemented on a KISA IPv6 test-bed using well known devices. Finally, the test result showed that all IPv6 based wired and wireless devices were well-controlled (detection, blocking, isolation and domain assignment).

An improved password‐based authentication scheme for session initiation protocol using smart cards without verification table

SummaryAuthentication schemes have been widely deployed access control and mobility management in various communication networks. Especially, the schemes that are based on multifactor authentication such as on password and smart card come to be more practical. One of the standard authentication schemes that have been widely used for secure communication over the Internet is session initiation protocol (SIP). The original authentication scheme proposed for SIP was vulnerable to some crucial security weaknesses. To overcome the security problems, various improved authentication schemes have been developed, especially based on elliptic curve cryptography (ECC). Very recently, Zhang et al. proposed an improved authentication scheme for SIP based on ECC using smart cards to overcome the security flaws of the related protocols. Zhang et al. claimed that their protocol is secure against all known security attacks. However, this paper indicates that Zhang et al. protocol is still insecure against impersonation attack. We show that an active attacker can easily masquerade as a legal server to fool users. As a remedy, we also improve Zhang et al. protocol by imposing a little extra computation cost. Copyright © 2014 John Wiley & Sons, Ltd.

NAC 시스템의 시험방법과 평가사례에 관한 연구

Abstract With the advancement of internet and mobile communication devices, mobile banking such as internet banking, internet loan and smart phones related to the people's economic activities using mobile communication devices is becoming increasingly more popular. Various security systems to prevent such new crimes are being introduced and the security system market is anticipated to continuously increase substantially in the future. Accordingly, qualitative advancement of the security systems are also in continuous demand. Therefore, this thesis proposes the method and system for quality evaluation of the network access control system by proposing testing and evaluating method for the relevant system through surveying and analyzing the tend in the foundation technologies and standards in the area of network access control system, which is one of the security systems, in order to cope with the demands for the evaluation of the quality of the security system as the security system product market is anticipated to grow continuously.

Software-defined access networks

Control-plane functions are migrating from dedicated network equipment into software running on commodity hardware. The Software- Defined Access Network (SDAN) concept introduced here extends the benefits of Software- Defined Networking and Network Function Virtualization (NFV) into broadband access. In a SDAN, access-network control and management functions for broadband access are virtualized, to streamline operations, speed services creation, and enhance broadband customer satisfaction, particularly in multi-operator environments. This article examines industry drivers, identifies software- definable control and management functions for broadband access, and presents some specific usage scenarios for the SDAN.

Prioritized Medium Access Control in Cognitive Radio Ad Hoc Networks: Protocol and Analysis

Cognitive radio (CR) technology enables opportunistic exploration of unused licensed channels. By giving secondary users (SUs) the capability to utilize the licensed channels (LCs) when there are no primary users (PUs) present, the CR increases spectrum utilization and ameliorates the problem of spectrum shortage. However, the absence of a central controller in CR ad hoc network (CRAHN) introduces many challenges in the efficient selection of appropriate data and backup channels. Maintenance of the backup channels as well as managing the sudden appearance of PUs are critical issues for effective operation of CR. In this paper, a prioritized medium access control protocol for CRAHN, PCR-MAC, is developed which opportunistically selects the optimal data and backup channels from a list of available channels. We also design a scheme for reliable switching of a SU from the data channel to the backup channel and vice-versa. Thus, PCR-MAC increases network throughput and decreases SUs' blocking rate. We also develop a Markov chain-based performance analysis model for the proposed PCR-MAC protocol. Our simulations, carried out in $$NS-3$$NS-3, show that the proposed PCR-MAC outperforms other state-of-the-art opportunistic medium access control protocols for CRAHNs.

Interference management via access control and mobility prediction in two-tier heterogeneous networks

Two-tier heterogeneous networks (HetNets), where the current cellular networks, i.e., macrocells, are overlapped with a large number of randomly distributed femtocells, can potentially bring significant benefits to spectral utilization and system capacity. The interference management and access control for open and closed femtocells in two-tier HetNets were focused. The contributions consist of two parts. Firstly, in order to reduce the uplink interference caused by MUEs (macrocell user equipments) at closed femtocells, an incentive mechanism to implement interference mitigation was proposed. It encourages femtocells that work with closed-subscriber-group (CSG) to allow the interfering MUEs access in but only via uplink, which can reduce the interference significantly and also benefit the marco-tier. The interference issue was then studied in open-subscriber-group (OSG) femtocells from the perspective of handover and mobility prediction. Inbound handover provides an alternative solution for open femtocells when interference turns up, while this accompanies with PCI (physical cell identity) confusion during inbound handover. To reduce the PCI confusion, a dynamic PCI allocation scheme was proposed, by which the high handin femtocells have the dedicated PCI while the others share the reuse PCIs. A Markov chain based mobility prediction algorithm was designed to decide whether the femtocell status is with high handover requests. Numerical analysis reveals that the UL interference is managed well for the CSG femtocell and the PCI confusion issue is mitigated greatly in OSG femtocell compared to the conventional approaches.