Access Control Management Research Articles

[formula omitted]: A blockchain-based secure access control management for the Internet of Things

The Internet of Things (IoT) paradigm has widespread applications across many fields in which private and sensitive user or environmental data are sensed and shared. Most present-day IoT applications depend on centralized cloud servers for authentication and access control. Validating the identity of a user and determining the legitimacy of his/her access requests require multiple rounds of data communications over the untrusted Internet, exposing sensitive data to potential attacks. Thus, protecting these data from security and privacy attacks and ensuring legitimate access is imperative. To address this challenge, we adopt an emerging technology called blockchain to propose a decentralized security framework called BloAC. It ensures secure access control in IoT networks without the intervention of the back-end cloud. We have used the Hyperledger Fabric, an open-source, permissioned blockchain platform, for implementing a prototype system using customized attribute-based access control (ABAC) policies. We have performed simulated and real test bed-based experiments to illustrate that BloAC outperforms the cloud–server-based access control in latency and scalability, significantly reducing latency by up to 42.45% compared to cloud-based solutions. Finally, we conduct a security analysis to formally verify the ABAC policies used in BloAC and establish its robustness against attacks theoretically and using the AVISPA tool.

Adaptive MAC Scheme for Interference Management in Ad Hoc IoT Networks

The field of wireless communication has undergone revolutionary changes driven by technological advancements in recent years. Central to this evolution is wireless ad hoc networks, which are characterized by their decentralized nature and have introduced numerous possibilities and challenges for researchers. Moreover, most of the existing Internet of Things (IoT) networks are based on ad hoc networks. This study focuses on the exploration of interference management and Medium Access Control (MAC) schemes. Through statistical derivations and systematic simulations, we evaluate the efficacy of guard zone-based MAC protocols under Rayleigh fading channel conditions. By establishing a link between network parameters, interference patterns, and MAC effectiveness, this work contributes to optimizing network performance. A key aspect of this study is the investigation of optimal guard zone parameters, which are crucial for interference mitigation. The adaptive guard zone scheme demonstrates superior performance compared to the widely recognized Carrier Sense Multiple Access (CSMA) and the system-wide fixed guard zone protocol under fading channel conditions that mimic real-world scenarios. Additionally, simulations reveal the interactions between network variables such as node density, path loss exponent, outage probability, and spreading gain, providing insights into their impact on aggregated interference and guard zone effectiveness.

Self-sovereign identity management in ciphertext policy attribute based encryption for IoT protocols

In the Internet of Things, access control and identity management rely on centralized platforms. However, centralized platforms will compromise user privacy with identity leakage. Self-sovereign identity (SSI) is a novel model for identity management that does not require third-party centralized authority. Thus, SSI is a potential solution to the identity management problem in IoT access control. This paper’s motivation is to address the problems of lack of identity sovereignty, centralized authorization, and high computational overhead for IoT access control. We propose a novel access control scheme for IoT that decentralizes identity management and tackles single-point-of-failure issues. This scheme leverages ciphertext policy attribute-based encryption (CP-ABE) and SSI to achieve the overall goal. Specifically, Our scheme eliminates the central authority and empowers users to manage their identity, allowing users to decide what attributes they disclose. Regarding the distribution of roles in the architecture, this paper follows the generic SSI model (ISSUER–HOLDER—VERIFIER) that allows a user to access a service from a service provider. To enable real-world deployment of our scheme, we establish an attribute authorization authority(such as the government) as a trusted identity point of entry. Users generate decentralized identifiers to enjoy services of interest in a privacy-preserving manner. The analysis demonstrates the practicality and superiority of our scheme. Our scheme requires less computation and is suitable for resource-constrained IoT scenarios.

JCDC: A blockchain-based framework for secure data storage and circulation in JointCloud

JointCloud computing represents a new generation cloud computing paradigm, which deeply integrates the cloud resources of multiple Cloud Service Providers (CSPs) to offer tailored cloud services to users. In contrast to traditional multi-cloud environment, JointCloud environment involve data circulation among multiple CSPs. However, in JointCloud environment, CSPs are not always fully trustworthy and they may illegally infringe upon users’ data privacy and security for their own benefit. Additionally, the heterogeneity arising from different data storage formats, structures, access control, and permission management mechanisms adopted by various CSPs makes achieving unified data management in JointCloud challenging. Therefore, to ensure secure storage and efficient circulation of data within JointCloud, it is essential to prevent violations for user privacy and data ownership, shield the heterogeneity of underlying data management mechanisms across different CSPs, and establish trusted transactions between CSPs. In this paper, we propose a framework called JointCloud Data Chain (JCDC) based on JointCloud computing and blockchain for data storage and circulation, aiming to ensure secure data storage and trustworthy transactions. JCDC utilizes blockchain to record data ownership and control data circulation, while integrating storage resources from various CSPs to construct a distributed off-chain Personal Data Storage (PDS) for expanding system storage capacity. Additionally, JCDC employs Certificateless Public Key Cryptography (CL-PKC) and Proxy Re-encryption technologies for user identity management and secure data transactions. Furthermore, smart contracts are designed to enable automated data storage and sharing. We conduct a security analysis of JCDC and develop a prototype system to validate its performance and practicality. Finally, extensive experimentation and analysis demonstrate that JCDC exhibits low time latency and cost, which makes it practical.

Adaptive context-aware access control for IoT environments leveraging fog computing

The increasing use of the Internet of Things (IoT) has driven the demand for enhanced and robust access control methods to protect resources from unauthorized access. A cloud-based access control approach brings significant challenges in terms of communication overhead, high latency, and complete reliance. In this paper, we propose a Fog-Based Adaptive Context-Aware Access Control (FB-ACAAC) framework for IoT devices, dynamically adjusting access policies based on contextual information to prevent unauthorised resource access. The main purpose of FB-ACAAC is to provide adaptability to changing access behaviors and context by bringing decision-making and information about policies closer to the end nodes of the network. FB-ACAAC improves the availability of resources and reduces the amount of time for information to be processed. FB-ACAAC extends the widely used eXtensible Access Control Markup Language (XACML) to manage access control decisions. Traditional XACML-based methods do not take into account changing environments, different contexts, and changing access behaviors and are vulnerable to certain types of attacks. To address these issues, FB-ACAAC proposes an adaptive context-aware XACML scheme for heterogeneous distributed IoT environments using fog computing and is designed to be context-aware, adaptable, and secure in the face of unauthorised access. The effectiveness of this new scheme is verified through experiments, and it has a low processing time overhead while providing extra features and improved security.

Face Recognition Attendance System

Abstract— Face recognition is a biometric technique which involves determining if the image of the face of any given person matches with any of the face images stored in the database. This problem is very difficult to solve automatically due to the changes that various factors, such as facial expression, ageing and even lighting. It is widely used in areas such as security and access control, forensic medicine, police controls and attendance management system. Our Face Recognition Attendance System can utterly eliminate the manual work wherever the attending can now not involve any paperwork. This system will scale back the whole time required for attending marking. The system can acquire individual attending with the assistance of facial recognition to secure information accuracy of the attending. The primary goal of this project is to build a face recognition-based attendance monitoring system for employees working in an organization in order to improve and upgrade the current attendance system to make it more efficient and effective than before. The employee should be in an area containing light so that the detection can be clearly made. Keywords: Face recognition, biometric technique, image matching, database, facial expression, ageing lighting, security, access control, forensic medicine, police controls, attendance management, manual work, paperwork, time reduction, facial recognition, data accuracy.

The Need for Adaptive Access Control System at the Network Edge

The emergence of edge computing, characterized by its distributed nature and real-time processing, necessitates a paradigm shift in access control mechanisms. Traditional, static methods struggle to adapt to the dynamic and heterogeneous environment of edge computing. This research addresses this gap by proposing an Adaptive Risk-Based Access Control (ARBAC) model specifically designed for edge environments. The objective of this research is to develop a robust access control system that dynamically responds to the changing security landscape of edge computing. The proposed ARBAC model integrates real-time data on user context, resource sensitivity, action severity, and risk history to dynamically assess the security risk associated with each access request. This approach ensures a balance between robust security and user experience by tailoring access controls based on the specific context. The research builds upon the growing recognition of the limitations of traditional access control methods in edge environments. Existing literature highlights the need for adaptive and risk-based access control models to address the dynamic nature of edge computing. This research contributes to this evolving field by proposing an ARBAC model that leverages real-time information for contextually relevant access decisions. The proposed ARBAC model offers several advantages. By dynamically adjusting access controls based on risk levels, the model enhances security and ensures compliance with regulatory requirements. Additionally, it improves network performance by reducing load and facilitating faster access to resources. Furthermore, the model's scalability makes it suitable for managing access in large-scale edge deployments. In conclusion, this research proposes an ARBAC model that aligns with the dynamic nature of edge computing environments. By leveraging real-time data and contextual information, the model offers a robust and adaptable approach to access control, promoting security, compliance, performance, and scalability in edge computing. This research paves the way for further exploration and implementation of ARBAC systems, empowering organizations to effectively manage access control in the evolving landscape of edge computing and IoT.

Implementation of Attribute-Base Control in Personal Data Protection

This research addresses the growing concern of cybersecurity and access control in Python applications, providing actionable recommendations for improving Attribute-Based Access Control (ABAC) systems to better protect personal data. The study aims to evaluate ABAC's efficacy in managing access control within Python applications, particularly focusing on its ability to provide precise and fine-grained control over personal data access. By analyzing three key attributes—user roles, data classification, and access times—within Python applications, the research methodically assesses ABAC's performance and challenges in implementation. The findings, with a significant proportion of 70%, underscore ABAC's advantages over traditional models like Discretionary Access Control (DAC) and Role-Based Access Control (RBAC), emphasizing its capability to provide precise and fine-grained control over personal data access. Additionally, the research identifies and addresses three main challenges in ABAC implementation: attribute management complexity 15%, the necessity for standardization 10%, and interoperability issues 5%. This research has far-reaching implications, highlighting the importance of meticulous planning and modeling for successful ABAC deployment. By enriching our understanding of ABAC in Python-based environments, the study offers insights for enhancing cybersecurity measures and access control strategies in personal data protection.

Reliablity and Security for Fog Computing Systems

Fog computing (FC) is a distributed architecture in which computing resources and services are placed on edge devices closer to data sources. This enables more efficient data processing, shorter latency times, and better performance. Fog computing was shown to be a promising solution for addressing the new computing requirements. However, there are still many challenges to overcome to utilize this new computing paradigm, in particular, reliability and security. Following this need, a systematic literature review was conducted to create a list of requirements. As a result, the following four key requirements were formulated: (1) low latency and response times; (2) scalability and resource management; (3) fault tolerance and redundancy; and (4) privacy and security. Low delay and response can be achieved through edge caching, edge real-time analyses and decision making, and mobile edge computing. Scalability and resource management can be enabled by edge federation, virtualization and containerization, and edge resource discovery and orchestration. Fault tolerance and redundancy can be enabled by backup and recovery mechanisms, data replication strategies, and disaster recovery plans, with a residual number system (RNS) being a promising solution. Data security and data privacy are manifested in strong authentication and authorization mechanisms, access control and authorization management, with fully homomorphic encryption (FHE) and the secret sharing system (SSS) being of particular interest.

A blockchain‐based secure framework for data management

AbstractData management is a crucial requirement due to the autonomous and constrained nature of Unmanned Aerial Vehicles (UAVs), Internet of Things (IoTs), and the aviation domain. The autonomous and restricted nature of these sectors increases the need for a shared, distributed database, strong access control management, consensus in autonomous decision‐making, and effective communication across diverse protocols and devices. This research presents a comprehensive approach and offers a new viewpoint to the field of blockchain while establishing a fundamental baseline for future improvements in data management systems and addressing the shortcomings of previously proposed existing frameworks in order to fulfill the complex needs of secure data management. This study contributes to the advancement of secure and efficient data management systems by implementing robust data monitoring for error detection, ensuring data integrity, and enabling encrypted or anonymous data sharing based on sensitivity levels. Additionally, the integration of diverse devices, enforcement of immutable regulations compliance, and development of permissioned blockchain systems for identity management further enhance the system's capabilities, offering comprehensive solutions for modern data management challenges. In the tests, the proposed framework showed increased successful transactions in all rate controllers. Besides, effect of the validator number on throughput and latency is tested and analyzed thoroughly.

DS-PACK: Tool assembly for the end-to-end support of controlled access human data sharing

The EU General Data Protection Regulation (GDPR) requirements have prompted a shift from centralised controlled access genome-phenome archives to federated models for sharing sensitive human data. In a data-sharing federation, a central node facilitates data discovery; meanwhile, distributed nodes are responsible for handling data access requests, concluding agreements with data users and providing secure access to the data. Research institutions that want to become part of such federations often lack the resources to set up the required controlled access processes. The DS-PACK tool assembly is a reusable, open-source middleware solution that semi-automates controlled access processes end-to-end, from data submission to access. Data protection principles are engraved into all components of the DS-PACK assembly. DS-PACK centralises access control management and distributes access control enforcement with support for data access via cloud-based applications. DS-PACK is in production use at the ELIXIR Luxembourg data hosting platform, combined with an operational model including legal facilitation and data stewardship.

A secure and lightweight cloud data deduplication scheme with efficient access control and key management

Data deduplication technology is extensively employed to enhance the storage efficiency of cloud servers by eliminating redundant files. Cloud users commonly encrypt their data prior to uploading it to the server. Conventional encryption algorithms, however, lead to the encryption of duplicated data from different users into distinct ciphertexts. Consequently, these ciphertexts must be stored in the cloud since the cloud server cannot identify such duplicated data. In this paper, we introduce a hybrid cloud-based secure deduplication scheme tailored for implementation on large-scale data systems. Specifically, our approach leverages ciphertext-policy attribute-based encryption (CP-ABE), which enables us to establish access control and key management via a private cloud server. Simultaneously, we leverage a public cloud server to cater to enterprises and groups seeking secure data storage. Notably, our approach ensures mutual zero-interaction verification between both public and private cloud servers through ElGamal encryption, thereby guaranteeing data unforgeability. The security assessment illustrates that our proposed approach ensures both data privacy and integrity. We also show that the approach resists brute-force attacks on the dictionary, prevents malicious users from deceiving cloud servers to return incorrect ciphertext, and achieves secure and efficient access control and key management. Furthermore, functional and performance evaluation underscores the superiority of our method over five other classical data deduplication schemes. Under the premise of having more comprehensive security settings, the performance of the scheme still maintains a good level at every stage.

IoT based Biometric Student Access Control and Attendance Management

Abstract: The Fingerprint-Based Attendance Management System offers an innovative solution for automating attendance tracking in educational institutions. Utilizing an ATmega328 microcontroller and fingerprint sensor, the system enables efficient capture of student attendance data. Real-time feedback is provided through an LCD display, ensuring users are promptly informed of authentication status. Captured fingerprint IDs are transmitted to a cloud-based server for comparison with stored student records. Upon successful matching, attendance is marked, and SMS notifications are sent to parents, enhancing communication and transparency. Additionally, a teacher management interface within the cloud system allows for recording student internal marks and managing attendance records. The system prioritizes security, reliability, and accuracy to maintain the integrity of attendance data. By streamlining attendance tracking processes and improving communication between schools and parents, the system contributes to enhanced efficiency and accountability in educational institutions.

Efficient and Secure Blockchain-Based Access Control for Fog-Assisted IoT Cloud in Electronic Medical Records Sharing

Fog-assisted IoT Cloud environments have emerged as a result of the rapid spread of Internet of Things (IoT) devices and the requirement for seamless data sharing in the healthcare industry. The effective and safe management of access control to sensitive data, such as Electronic Medical Records (EMRs), becomes crucial in such configurations. The Efficient and Secure Blockchain-Based Access Control (ESBAC) framework, designed specifically for Fog-assisted IoT Cloud scenarios in EMR sharing, is our creative approach to this problem. The ESBAC architecture makes use of the blockchain's openness and immutability to provide reliable access control and auditability. The implementation of a consortium blockchain includes participants including healthcare providers, patients, and authorised entities. Each EMR has a smart contract attached to it that specifies access restrictions and permissions to make sure that only authorised parties are able to access and edit the data. Because of the decentralisation provided by the blockchain, security and privacy are improved because no single party has overwhelming control. Proposed framework uses attribute-based access control and lightweight encryption methods to provide a fair trade-off between security and efficiency. As a result, there can be fine-grained access control policies with the least amount of computing overhead. Comprehensive simulations are used to evaluate the suggested solution and compare it to current methods. The outcomes show that ESBAC improves security in EMR sharing and greatly lowers access latency.

State-of-the-Art and New Challenges in 5G Networks with Blockchain Technology

As mobile communications transform, 5G technology can potentially change many industries and businesses. The change will have a great influence across many fields, such as the automotive, healthcare, and manufacturing sectors. This paper aims to review the existing applications of blockchain technology in providing 5G network security and identify new possibilities for such security solutions. We consider different aspects of blockchain in 5G, particularly data transmission, access control, and applications including vertical industry-oriented applications and specific solutions supporting such sectors of economic activity. The paper briefly describes modern technologies in 5G networks and introduces blockchain’s properties and different aspects of using such technology in practical applications. It also presents access control management with blockchain applied in 5G and related problems, reviews other blockchain-enforced network technologies, and shows how blockchain can help in services dedicated to vertical industries. Finally, it presents our vision of new blockchain applications in modern 5G networks and beyond. The new-generation networks use two fundamental technologies, slicing and virtualization, and attackers attempt to execute new types of attacks on them. In the paper, we discuss one of the possible scenarios exhibiting the shortcomings of the slicing technology architecture. We propose using blockchain technology to create new slices and to connect new or existing subscribers to slices in the 5G core network. Blockchain technology should solve these architectural shortcomings.

Hyperphagia and impulsivity: use of self-administered Dykens’ and in-house impulsivity questionnaires to characterize eating behaviors in children with severe and early-onset obesity

BackgroundThe determinants of early-onset obesity (< 6 years) are not completely elucidated, however eating behavior has a central role. To date no study has explored eating behavior in children with severe, early-onset obesity. Self-administered questionnaire data from these children were examined to evaluate eating behavior and the etiology of early-onset obesity.MethodsChildren with severe, early-onset obesity (body mass index [BMI] > International Obesity Task Force [IOTF] 30) of different etiologies (hypothalamic obesity [HO], intellectual disability with obesity [IDO], common polygenic obesity [CO]) were prospectively included. BMI history and responses from the Dykens’ Hyperphagia Questionnaire and an in-house Impulsivity Questionnaire at first visit were compared between groups.ResultsThis cohort of 75 children (39 girls; mean age ± standard deviation [SD] 10.8 ± 4.4 years) had severe, early-onset obesity at an age of 3.8 ± 2.7 years, with a BMI Z-score of 4.9 ± 1.5. BMI history varied between the 3 groups, with earlier severe obesity in the HO group versus 2 other groups (BMI > IOTF40 at 3.4 ± 1.6 vs. 4.6 ± 1.6 and 8.4 ± 4.1 years for the IDO and CO groups, respectively [P < 0.01]). Absence of adiposity rebound was more prevalent in the HO group (87% vs. 63% and 33% for the IDO and CO groups, respectively [P < 0.01]). The Dykens’ mean total score for the cohort was 22.1 ± 7.2 with no significant between-group differences. Hyperphagia (Dykens’ score > 19) and impulsivity (score > 7) were found in 50 (67%) and 11 children (15%), respectively, with no difference between the HO, IDO and CO groups regarding the number of patients with hyperphagia (10 [67%], 14 [74%], and 26 [63%] children, respectively) or impulsivity (2 [13%], 1 [7%], and 8 [19%] children, respectively). Children with food impulsivity had significantly higher total and severity scores on the Dykens’ Questionnaire versus those without impulsivity.ConclusionThe Dykens’ and Impulsivity questionnaires can help diagnose severe hyperphagia with/without food impulsivity in children with early-onset obesity, regardless of disease origin. Their systematic use can allow more targeted management of food access control in clinical practice and monitor the evolution of eating behavior in the case of innovative therapeutic targeting hyperphagia.

Information Technology Security Audit at the YDSF National Zakat Institution Using the ISO 27001 Framework

In this era of cyber crimes, data security is an important aspect that needs special attention from an organization. This is reinforced by the ratification of Law Number 27 of 2022 on personal data security. The National Zakat Amil Institute (LAZNAS) Yayasan Dana Sosial al Falah (YDSF) as an institution with a legal entity and having data on more than 100,000 donors and partners, it also has an obligation to protect the personal data of donors and partners. The focus of this research is to evaluate and audit information technology at the LAZNAS YDSF, especially regarding the security aspect of information technology. Evaluations and audits were carried out using the ISO 27001 framework as a standardization of information technology security at the international level. In this study, information technology audits were conducted using quantitative methods. The assessment was carried out on seven main clauses that are priorities for the LAZNAS YDSF based on management priorities: compliance clauses, risk management, policies, assets, physical and environmental management, access control, and incident management. Data were collected using a questionnaire distributed to all the LAZNAS YDSF managers and employees. Fifty-five respondents, ranging from management to staff, were involved in filling out the questionnaire, ranging from management to staff. Based on the recapitulation of answers from respondents, it was found that the risk management and access control clauses had good results, with scores of 2,727 and 2,796. The compliance and incident management clauses have scores of 2.381 and 2.53, respectively; therefore, improvement efforts need to be made. By evaluating and auditing information technology that refers to the ISO 27001 standard, it is hoped that LAZNAS YDSF can protect and maintain the confidentiality, integrity, and availability of information, and manage and control information security risks.

Lightweight data bridge for connecting self-service end-user analytic tools to NGSI-based IoT systems

The FIWARE and related projects aim to provide an open, sustainable ecosystem based on public standards and royalty-free that accelerates the development of Smart Solutions. The broker (Orion, Scorpio and Stellio) and additional components, named Generic Enablers (GE), provide means for collecting IoT data and feeding a data layer. The NGSI standard has a structural role in terms of interoperability, thus promoting the development of new GEs. However, this standard is not being adopted in analytic tools. In general, these tools connect to the IoT backend databases, which poses problems regarding data access control management and requires specialised IT support. Thus, it is not well suited for enterprise scenarios like, for instance, smart agriculture or smart industry, in which self-service tools, such as Power BI, Tableau and Qlik, are frequently used.We propose a lightweight connector for data analytic tools and IoT ecosystems based on NGSI-v2/NGSI-LD/NGSI-TSDB. The proposed system provides web services based on JSON and CSV formats that those tools use without applying complex transformations in the data. Thus, non-technical business users can consume IoT data on demand and use all the analytical capabilities of these tools. We tested the system in an educational scenario where dashboards and analytics processes were developed with minimal effort. The system has implemented a mechanism for access control management at the service/tenant level and several querying features. The system is now being implemented in a real public service scenario. In future versions, we intend to improve the system in terms of performance, security and add more query features.

Potential use of semantic blockchain technology in smart construction

In recent years, the increased attention in distributed ledger technologies (DLTs) has sparked interest in their potential applications across various industries. This paper delves into the realm of the construction industry and explores the advancements made in semantic blockchain technology and its potential implications for smart construction practices. The primary research objective is to review the suitability of semantic blockchain approaches in specific usage domains within the construction sector. These domains include contracting with stakeholders, financial contracting, design and monitoring. To achieve this objective, the study investigates the integration of digital identity, access-control management, reputation management, trust computing and semantic blockchain approaches into construction processes. Through this analysis, the paper identifies the potential benefits in terms of enhanced efficiency, improved collaboration, heightened security and more informed decision making. Ultimately, these advancements are poised to create positive outcomes for all stakeholders involved in the construction process.

SPEC 2.0 Smart Pill Expert System

The article throws light on the implementation of an enhanced idea of the smart pill expert system. The proposed system is used to automate the capability of dispensing the right dosage of medicines at a given day-time interval. The spec 2.0 can be used at one's home, workplace, at hospitals by a user of any age group, and then possibly expanding the functionalities to a wider audience. It mainly focuses on providing access control and monitoring management functionality through a mobile app on a daily basis with no monthly subscriptions required. There will be alerts and SMSs sent across to the user based on the pill dispensing event's result. The spec 2.0 mainly focuses on providing an “over-dosage” functionality so that the user won't have to consume the medication if he hasn't taken them at the allocated time interval, to prevent over consumption. The system has been tested and the results have been formulated on a daily basis.