Access Control Level Research Articles

Modified EDCF to improve the performance of IEEE 802.11e WLAN

In this paper, we propose a modified EDCF scheme, M-EDCF, to improve the Quality of Service (QoS) of the IEEE 802.11e wireless network. The IEEE 802.11e standard is presented to support QoS at medium access control level using a priority scheme by differentiating the inter-frame space and the initial window size. In addition to providing relative priorities by adjusting the size of the Contention Window (CW) of each traffic class, our proposed scheme, M-EDCF, also consider the effect of a back_off_timer to avoid unnecessary collisions. Our study shows that in either in heavy or light traffic load our proposed scheme can provide better quality for both high priority and low priority packets than either the AEDCF [L. Romdhani, Ni. Qiang, T. Turletti, Adaptive EDCF: enhanced service differentiation for IEEE 802.11 wireless ad-hoc networks, IEEE Wireless Communications and Networking, Conference. vol. 2, March (2003) pp. 16–20] or the original EDCF.

Application of the API/NPRA SVA methodology to transportation security issues

Security vulnerability analysis (SVA) is becoming more prevalent as the issue of chemical process security is of greater concern. The American Petroleum Institute (API) and the National Petrochemical and Refiner's Association (NPRA) have developed a guideline for conducting SVAs of petroleum and petrochemical facilities in May 2003. In 2004, the same organizations enhanced the guidelines by adding the ability to evaluate transportation security risks (pipeline, truck, and rail). The importance of including transportation and value chain security in addition to fixed facility security in a SVA is that these issues may be critically important to understanding the total risk of the operation. Most of the SVAs done using the API/NPRA SVA and other SVA methods were centered on the fixed facility and the operations within the plant fence. Transportation interfaces alone are normally studied as a part of the facility SVA, and the entire transportation route impacts and value chain disruption are not commonly considered. Particularly from a national, regional, or local infrastructure analysis standpoint, understanding the interdependencies is critical to the risk assessment. Transportation risks may include weaponization of the asset by direct attack en route, sabotage, or a Trojan Horse style attack into a facility. The risks differ in the level of access control and the degree of public exposures, as well as the dynamic nature of the assets. The public exposures along the transportation route need to be carefully considered. Risks may be mitigated by one of many strategies including internment, staging, prioritization, conscription, or prohibition, as well as by administrative security measures and technology for monitoring and isolating the assets. This paper illustrates how these risks can be analyzed by the API/NPRA SVA methodology. Examples are given of a pipeline operation, and other examples are found in the guidelines.

X-GTRBAC: an XML-based policy specification framework and architecture for enterprise-wide access control

Modern day enterprises exhibit a growing trend toward adoption of enterprise computing services for efficient resource utilization, scalability, and flexibility. These environments are characterized by heterogeneous, distributed computing systems exchanging enormous volumes of time-critical data with varying levels of access control in a dynamic business environment. The enterprises are thus faced with significant challenges as they endeavor to achieve their primary goals, and simultaneously ensure enterprise-wide secure interoperation among the various collaborating entities. Key among these challenges are providing effective mechanism for enforcement of enterprise policy across distributed domains, ensuring secure content-based access to enterprise resources at all user levels, and allowing the specification of temporal and nontemporal context conditions to support fine-grained dynamic access control. In this paper, we investigate these challenges, and present X-GTRBAC, an XML-based GTRBAC policy specification language and its implementation for enforcing enterprise-wide access control. Our specification language is based on the GTRBAC model that incorporates the content- and context-aware dynamic access control requirements of an enterprise. An X-GTRBAC system has been implemented as a Java application. We discuss the salient features of the specification language, and present the software architecture of our system. A comprehensive example is included to discuss and motivate the applicability of the X-GTRBAC framework to a generic enterprise environment. An application level interface for implementing the policy in the X-GTRBAC system is also provided to consolidate the ideas presented in the paper.

Stack-based access control and secure information flow

Access control mechanisms are often used with the intent of enforcing confidentiality and integrity policies, but few rigorous connections have been made between information flow and runtime access control. The Java virtual machine and the .NET runtime system provide a dynamic access control mechanism in which permissions are granted to program units and a runtime mechanism checks permissions of code in the calling chain. We investigate a design pattern by which this mechanism can be used to achieve confidentiality and integrity goals: a single interface serves callers of more than one security level and dynamic access control prevents release of high information to low callers. Programs fitting this pattern would be rejected by previous flow analyses. We give a static analysis that admits them, using permission-dependent security types. The analysis is given for a class-based object-oriented language with features including inheritance, dynamic binding, dynamically allocated mutable objects, type casts and recursive types. The analysis is shown to ensure a noninterference property formalizing confidentiality and integrity.

Integrated access control and intrusion detection for web servers

Current intrusion detection systems work in isolation from access control for the application the systems aim to protect. The lack of coordination and interoperation between these components prevents detecting and responding to ongoing attacks in real-time before they cause damage. To address this, we apply dynamic authorization techniques to support fine-grained access control and application level intrusion detection and response capabilities. This paper describes our experience with integration of the Generic Authorization and Access Control API (GAA-API) to provide dynamic intrusion detection and response for the Apache Web server. The GAA-API is a generic interface which may be used to enable such dynamic authorization and intrusion response capabilities for many applications.

Task–role-based access control model

There are many information objects and users in a large company. It is an important issue how to control user's access in order that only authorized user can access information objects. Traditional access control models—discretionary access control, mandatory access control, and role-based access control—do not properly reflect the characteristics of enterprise environment. This paper proposes an improved access control model for enterprise environment. The characteristics of access control in an enterprise environment are examined and a task–role-based access control (T–RBAC) model founded on concept of classification of tasks is introduced. Task is a fundamental unit of business work or business activity. T–RBAC deals with each task differently according to its class, and supports task level access control and supervision role hierarchy. T–RBAC is a suitable access control model for industrial companies.

Intelligent Meeting Management Applications

ABSTRACT Smart card based meeting management applications have the potential to increase attendee satisfaction, increase communications, and strengthen coordination with improved operational efficiency. The value of embedded chip card technology lies in its ability to store data locally with a high degree of security and portability. Recent developments that incorporate biometric extensions to smart card configurations support higher levels of security and access control. This article describes the potential for applying smart card and related technology to the meeting planning industry. It also identifies challenges that need to be addressed prior to the proliferation of smart card and/or biometric implementation within the meeting planning industry.

A programmable 800 Mbit/s CRC check/generator unit for LANs and MANs

Abstract To preserve the integrity of data in high-speed LAN's and MANs, error-detecting Cyclic Redundancy Codes, or CRCs, are often employed at the Medium Access Control (MAC) level. Thus, a high-speed LAN like FDDI uses a single CRC code, while high-speed networks like the DQDB MAN and the Orwell ring employ up to three different CRC codes at the MAC level. In the light of this, the design and application of a programmable high-speed parallel CRC implementation are described in this paper. The implementation is based on a VLSI architecture with 8 kbits of embedded RAM. This architecture can be programmed to generate or verify CRC checksums corresponding to any generator polynomial of any degree between 1 and 32. Generation or verification of two different CRC checksums with the same VLSI architecture is also possible for any pair of generator polynomials of degrees up to 16. As representative implementation examples, an 800 Mbit/s ECL and a 160 Mbit/s CMOS semi-custom VLSI realization of the architecture are presented.

Packet level access control scheme for internetwork security

Increasing user demands to access resources, such as databases and application programmes, beyond those available in a single network has resulted in the introduction of teleprocessing systems and communication services between networks supported by different organisations. Consequently, the sharing of network resources introduces security threats such as unauthorised reading, modifying, adding or deleting of the contents of resources. It is therefore necessary to implement certain access control mechanisms to protect these resources from unauthorised access. In the paper, an internet access control scheme which operates at the network level (or the packet level) is presented. This scheme allows controlled access to the internal resources of a network, and only trusted systems can gain access to external networks. In this scheme, a secure communication link is established between a requesting machine and the requested remote resource at the initiation of an external session. All the entities, the network gateways and the machines at the end points, along this communication path are authenticated during the initiation process. Any subsequent packets transmitted along this path are also authenticated throughout the session to ensure that they originated from the machine initiating the session. The scheme uses the RSA and the DES security algorithms to implement session initiation and packet origin authentication, respectively. A major issue in internet access control is the distribution of packet keys (which are used for packet authentication purposes) to network entities for each communication session. This problem has been overcome in the scheme by deriving the packet authentication key from the RSA private key of each network entity, using a reference key number concept, and allowing a different packet authentication key for each external session between communicating entities. This eliminates the need to distribute the packet authentication keys, which otherwise could be a major threat to the integrity of an access control scheme. The overheads incurred due to the extra access control procedures have been quantified and are presented in the paper. It was found that the overheads of this scheme are smaller in comparison with the visa scheme [1].

LANSF: A protocol modelling environment and its implementation

AbstractLANSF is a software package that was originally designed as a tool to investigate the behaviour of medium access control (MAC) level protocols. These protocols form an interesting class of distributed computations: timing of events is the key factor in them. The protocol definition language of LANSF is based on C, and protocols are specified (programmed) as collections of communicating, interrupt‐driven processes. These specifications are executable: an event‐driven emulator of MAC‐level communication phenomena forms the foundation of the implementation. Some tools for debugging, testing, and validation of protocol specifications are provided. We present key features of LANSF at the syntactic level, comment informally on the semantics of these features, and highlight some implementation issues. A complete example of a LANSF application is discussed in the Appendix.

Method to implement packet level access control in multinetworks

The letter describes a method to implement an access control policy for multinetwork environments. The access control method is based on the public-key cryptosystem proposed by Rivest, Shamir and Adleman (RSA) and on the message authentication algorithm based on Data Encryption Standard (DES)

The access control mechanism of a database computer (DBC)

The database computer (DBC) is a specialized back-end computer which is capable of managing data 10 10 bytes in size and supporting known data models such as relational, network, hierarchical and attribute-based models. It is also perhaps the first database machine to have a built-in security mechanism for access control. At the outset, the security mechanism was made an integral part of the DBC design. This design philosophy not only allowed us to construct a system that has no “backdoors”, but also ensured that all access requests are, in fact, controlled by DBC's security mechanism. The DBC security mechanism is based on the concept of security atoms, aggregates of data units being definable by the user in terms of conjunctions of query predicates. The fundamental gain in utilizing query conjunctions for the purpose of access control is that any data that is accessible or updateable is also protectable. It is believed that the DBC security mechanism is less cumbersome than the view mechanism of some database systems and more efficient than the query modification mechanism used by some other systems. This is demonstrated at three levels of access control, namely the subfile, record and field (attribute) levels.