Access Control Method Research Articles

A Priority Control Method for Media Access Control Method SP-MAC to Improve Throughput of Bidirectional Flows

A Priority Control Method for Media Access Control Method SP-MAC to Improve Throughput of Bidirectional Flows

Effects of LTE Random Access Methods on Healthcare M2M Applications

In recent years, the communication between machines, known as Machine-to-Machine (M2M) communication, has become a dynamic research area. M2M refers to networks, which connect devices together and enable them to make a smart decision. The most viable option of implementing M2M communication is over the Long Term Evolution (LTE) network. A key challenge for M2M communication over the Long Term Evolution (LTE) is the performance of Random Access Channel (RACH) because its operation was not designed with the enormous number of M2M devices in mind. To deal with the situation reduces network access success rate, several major access control methods were adopted. However, the suggested methods generally increase the access success rate regardless of delay requirements. On the other hand, access delay is crucial for many M2M applications such as healthcare. This paper investigates the effects of LTE Random Access Methods on healthcare M2M applications when enormous number of devices are introduced. The study clearly shows that to meet the requirements for delay sensitive M2M applications, the random access (RA) resources should be very strictly and carefully allocated.

A Proposal for Standardized Data Attribution and Ownership in the Cloud Environment

Since the earliest days of cloud computing there has been a steady migration of data from local data stores to the cloud. As more and more cloud platforms become available, this inflow of data has only increased dramatically. By some estimates, "the cloud" will hold 50% of all data by 2020. Localized management of data is typically handled using tools, policies and access control methods that are appropriate to the local environment in question. Once data has been migrated to the cloud, these local tools and policies are rarely applicable and a new approach must be taken. Other works have focused on the problems associated with cloud security. This paper try to determine attribution and ownership for data in the cloud. Just because data is stored in account X that does not necessarily mean that X owns all the data in that account. An approach based on the use of a Public Key Infrastructure (PKI) is addressed to provide cryptographically strong data attribution and attestation for data in the cloud.

Data access control method for multimedia content data sharing and security based on XMDR-DAI in mobile cloud storage

Mobile cloud storage service is used for users’ multimedia content data sharing or synchronization in effective way with several mobile devices. To save various content data in the mobile cloud storage, the matters of security should be treated in the process of data sharing to provide flexibility and expandability for solving its heterogeneousness. Currently, the cloud storage service generally encrypts the content data for the security. However, this method is not perfectly safe for it manages ID, password, and encryption key simply with software; thus it may accept unauthorized users. This research suggests the data access control model and the method for multimedia content sharing and security based on XMDR-DAI in the mobile cloud storage. It supports key management based on hardware, identification for the integrity of client software, and security key sharing. Also, the suggested model saves/manages different types of multimedia content, thus it establishes XMDR-DAI-based metadata relationship for the problems that occurred in searching to increase the reliability. And this research suggests the prototype using TPM emulator that is operated in secure world of ARM TrustZone and TrustZone environment.

Creating Time-Limited Attributes for Time-Limited Services in Cloud Computing

Nowadays, Cloud Computing is considered one of the important fields in both research and industry. Users enjoy membership of cloud providing effective services called time-limited services. This paper addresses time-limited services offering an attribute-based access control method and time-limited attributes providing users' time-limited membership in cloud service. The proposed method authenticates users for specific time limit after which they are considered invalid. This method is decentralized resistible against backward and forward attacks. Moreover, this approach compared to other approaches reduces calculation and communication overhead.

Research issues for privacy and security of electronic health services

With the prevalence of information and communication technologies, Electronic Health Services (EHS) are commonly used by patients, doctors, and other healthcare professionals to decrease healthcare costs and provide efficient healthcare processes. However, using EHS increases the concerns regarding security, privacy, and integrity of healthcare data. Several solutions have been proposed to address these issues in EHS. In this survey, we categorize and evaluate state-of-the-art electronic health system research based on their architecture, as well as services including access control, emergency access, sharing, searching, and anonymity methods by considering their cryptographic approaches. Our survey differs from previous EHS related surveys in being method-based such that the proposed services are classified based on their methods and compared with other solutions. We provide performance comparisons and state commonly used methods for each category. We also identify relevant open problems and provide future research directions.

An energy efficient privacy-preserving content sharing scheme in mobile social networks

The rising popularity of mobile social media enables personalization of various content sharing and subscribing services. These two types of services entail serious privacy concerns not only to the confidentiality of shared content, but also to the privacy of end users such as their identities, interests and social relationships. Previous works established on the attribute-based encryption (ABE) can provide fine-grained access control of content. However, practical privacy-preserving content sharing in mobile social networks either incurs great risk of information leaking to unauthorized third parties or suffers from high energy consumption for decrypting privacy-preserving content. Motivated by these issues, this paper proposes a publish---subscribe system with secure proxy decryption (PSSPD) in mobile social networks. First, an effective self-contained privacy-preserving access control method is introduced to protect the confidentiality of the content and the credentials of users. This method is based on ciphertext-policy ABE and public-key encryption with keyword search. After that, a secure proxy decryption mechanism is proposed to reduce the heavy burdens of energy consumption on performing ciphertext decryption at end users. The experimental results demonstrate the efficiency and privacy preservation effectiveness of PSSPD.

Multi User Profile Orient Access Control based Integrity Management for Security Management in Data Warehouse

Background/Objectives: The Aim of this research work to demonstrate that the security enhancement of data warehousing, the methods face major challenges in integrity management and have the responsibility to restrict the unauthorized user. Methods/Statistical Analysis: There are many access control methods discussed earlier for the problem of integrity management, and some of them have been discussed using the user profiles. Still they suffer from the problem of efficiency in integrity management. Findings: To overcome such issues, in this paper a multi-user profile orient access depths measure based integrity management is proposed. The method maintains a set of Meta data which keep track of data objects in a hierarchical manner according to their importance and sensitivity of the data. The method first identifies a set of objects being specified from the input query and the sensitive tree; the method computes the access depthness measure. The access depthness is computed based on the level of objects being called and the access level the user has been given and the number of objects the user has access. Application/Improvement: Based on computed access depths measure user query is being processed, and the method improves the performance of integrity management.

Face recognition for authentication on mobile devices

Accessing information from mobile devices has become mainstream nowadays; besides the clear benefits that mobility provides as a means to improve efficiency, productivity and user convenience, it in turn does require proper methods for secure access control. In this paper, we discuss the use of face biometric technology and share our thoughts on key related issues and concerns: usability, security, robustness against spoofing attacks, and user privacy among others.

Distributed clinical data sharing via dynamic access-control policy transformation

BackgroundData sharing in electronic health record (EHR) systems is important for improving the quality of healthcare delivery. Data sharing, however, has raised some security and privacy concerns because healthcare data could be potentially accessible by a variety of users, which could lead to privacy exposure of patients. Without addressing this issue, large-scale adoption and sharing of EHR data are impractical. The traditional solution to the problem is via encryption. Although encryption can be applied to access control, it is not applicable for complex EHR systems that require multiple domains (e.g. public and private clouds) with various access requirements. ObjectivesThis study was carried out to address the security and privacy issues of EHR data sharing with our novel access-control mechanism, which captures the scenario of the hybrid clouds and need of access-control policy transformation, to provide secure and privacy-preserving data sharing among different healthcare enterprises. MethodsWe introduce an access-control mechanism with some cryptographic building blocks and present a novel approach for secure EHR data sharing and access-control policy transformation in EHR systems for hybrid clouds. ResultsWe propose a useful data sharing system for healthcare providers to handle various EHR users who have various access privileges in different cloud environments. A systematic study has been conducted on data sharing in EHR systems to provide a solution to the security and privacy issues. ConclusionsIn conclusion, we introduce an access-control method for privacy protection of EHRs and EHR policy transformation that allows an EHR access-control policy to be transformed from a private cloud to a public cloud. This method has never been studied previously in the literature. Furthermore, we provide a protocol to demonstrate policy transformation as an application scenario.

Evaluation of the Effects of Hidden Node Problems in IEEE 802.15.7 Uplink Performance.

In the last few years, the increasing use of LEDs in illumination systems has been conducted due to the emergence of Visible Light Communication (VLC) technologies, in which data communication is performed by transmitting through the visible band of the electromagnetic spectrum. In 2011, the Institute of Electrical and Electronics Engineers (IEEE) published the IEEE 802.15.7 standard for Wireless Personal Area Networks based on VLC. Due to limitations in the coverage of the transmitted signal, wireless networks can suffer from the hidden node problems, when there are nodes in the network whose transmissions are not detected by other nodes. This problem can cause an important degradation in communications when they are made by means of the Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) access control method, which is used in IEEE 802.15.7 This research work evaluates the effects of the hidden node problem in the performance of the IEEE 802.15.7 standard We implement a simulator and analyze VLC performance in terms of parameters like end-to-end goodput and message loss rate. As part of this research work, a solution to the hidden node problem is proposed, based on the use of idle patterns defined in the standard. Idle patterns are sent by the network coordinator node to communicate to the other nodes that there is an ongoing transmission. The validity of the proposed solution is demonstrated with simulation results.

A SECURE SYSTEM IN DISTRIBUTED COMPUTER NETWORKS USING SINGLE SIGN-ON MECHANISM

nIn the distributed computer network environment, it is easy for user terminals to share information and computing power with hosts. Accessing of resources becomes efficient and convenient because of the distributed locations of service providers. A Single Sign-On is a method of access control that enables a user to log in once and gain access to the resources of multiple software systems without being prompted to log in again. This scheme is based on one-way hash functions and randomly used to decrease the overhead of the system. In this Paper a secure system with single sign-on mechanism is proposed which allow mobile users to use the unitary token to access service providers.

F2AC: A Lightweight, Fine-Grained, and Flexible Access Control Scheme for File Storage in Mobile Cloud Computing

Current file storage service models for cloud servers assume that users either belong to single layer with different privileges or cannot authorize privileges iteratively. Thus, the access control is not fine-grained and flexible. Besides, most access control methods at cloud servers mainly rely on computationally intensive cryptographic algorithms and, especially, may not be able to support highly dynamic ad hoc groups with addition and removal of group members. In this paper, we propose a scheme called F2AC, which is a lightweight, fine-grained, and flexible access control scheme for file storage in mobile cloud computing. F2AC can not only achieve iterative authorization, authentication with tailored policies, and access control for dynamically changing accessing groups, but also provide access privilege transition and revocation. A new access control model called directed tree with linked leaf model is proposed for further implementations in data structures and algorithms. The extensive analysis is given for justifying the soundness and completeness of F2AC.

The integration of access control levels based on SDN

Systems and networks include several inputs and outputs from which they are accessed. Access controls exist to manage authentication and access controls through those inputs and outputs. One of the significant problems in this scope is the difficulty to have a global consistent system or network level access control. Such global centralised access control is needed to make sure that access control decisions taken by different applications at different levels are consistent. In this paper, we propose an SDN-based access control to approach this problem. Different access control methods are proposed to handle user and flow level access information. Access tables in those methods are initiated by network administrators. Concrete rules in those access tables can change dynamically based on network activities. We believe that ultimately all access control systems are going to converge in this direction.

Access control method in distributed grid computing networks

The problem of data unauthorized access in distributed computing networks is considered. Existing implementations of access control mechanisms used in grid systems are analyzed and their disadvantages are listed. The access control method that makes it possible to verify the status of distributed computing networks is proposed. Security parameters that form the initial state of the system are determined.

Detecting Incorrect Uses of Combining Algorithms in XACML 3.0 Policies

With the increasing complexity of software, new access control methods have emerged to deal with attribute-based authorization. As a standard language for specifying attribute-based access control policies, XACML offers a number of rule and policy combining algorithms to meet different needs of policy composition. Due to their variety and complexity, however, it is not uncommon to apply combining algorithms incorrectly, which can lead to unauthorized access or denial of service. To solve this problem, this paper presents a fault-based testing approach for revealing incorrect combining algorithms in XACML 3.0 policies. The theoretical foundation of this approach relies on the formalization of semantic differences between rule combining algorithms and between policy combining algorithms. It allows the use of a constraint solver for generating queries to which a given policy produces different responses than its combining algorithm-based mutants. Such queries can determine whether or not the given combining algorithm is used correctly. Our empirical studies using various XACML policies have demonstrated that our approach is effective.

Fine-Grained Access Control via XACML Policy Optimization in Cloud Computing

One primary challenge of enforcing access control in cloud computing is how to ensure access with high efficiency while preserving data security. This paper proposes a fine-grained access control method for cloud resources. The basic idea is to use XACML as access control language and to optimize policies by data fragmentation and policy refinement algorithms. Through data fragmentation, the accessible resources are divided into disjoint data blocks, and each of them will be combined with a set of policy rules. This helps to refine the policy and to avoid data leakage caused by rule conflicting on the resource intersections. Finally, the disjoint data blocks and the optimized policy are distributed in the three-layered cloud, and the decision to a request is made by rule matching on a specific resource rather than traversing the whole policy rules. Experiments show that our proposal enjoys higher efficiency in cloud-based access control.

Integrated Identity and Access Management System for Tertiary Institutions in Developing Countries

Issuance of disparate identifiers to students, manual method of student identity management and access control and the unavailability of actionable information on pattern of students’ use of schools’ services describe identity and access management in tertiary institutions in developing countries. An Integrated Identity and Access Management System for tertiary institutions is developed in this work. This Tertiary Identity and Access Management System (T-IAMS) is a fingerprint biometric database that centrally manages students’ identity, course registration, library and medical services information. It shortens student provisioning and de-provisioning processes, provides medical service data mining functionality and offers examination screening module which checks students into examination centres by cross-referencing database enrolment with course registration status. The system was developed following exploratory type of evolutionary software development model. MySql was used in building the database and Visual Basic for developing the graphic user interface of the student record module. The work also reports the results of testing done by 20 testers, on a 5-point scale. Analysis of the test results shows the system’s average acceptability percentage of 100 in ability to prevent duplicate enrolments, 79.165 in effectiveness in student clearance while the format and usefulness of reports generated on the medical service module recorded 73.125 as average acceptability percentage. Also, effectiveness in examination screening averaged 66.785 in performance acceptability. It has been shown that managing student identity centrally eases student provisioning and de-provisioning processes, and tightens access control to school facilities and programmes. http://dx.doi.org/10.4314/njt.v34i4.23

Automated Model-Based Testing of Role-Based Access Control Using Predicate/Transition Nets

Role-based access control is an important access control method for securing computer systems. A role-based access control policy can be implemented incorrectly due to various reasons, such as programming errors. Defects in the implementation may lead to unauthorized access and security breaches. To reveal access control defects, this paper presents a model-based approach to automated generation of executable access control tests using predicate/transition nets. Role-permission test models are built by integrating declarative access control rules with functional test models or contracts (preconditions and postconditions) of the associated activities (the system functions). The access control tests are generated automatically from the test models to exercise the interactions of access control activities. They are transformed into executable code through a model-implementation mapping that maps the modeling elements to implementation constructs. The approach has been implemented in an industry-adopted test automation framework that supports the generation of test code in a variety of languages. The full model-based testing process has been applied to three systems implemented in Java. The effectiveness is evaluated through mutation analysis of role-based access control rules. The experiments show that the model-based approach is highly effective in detecting the seeded access control defects.

A New Type of WEB-based Access Control Method

A New Type of WEB-based Access Control Method