Access Control Model Research Articles

Identity and Access Control Techniques for Enhanced Data Communication in Cloud

The preservation of sensitive data and prevention of unauthorized access are critical objectives in cloud computing environments, necessitating the implementation of robust security measures. The present study delves into the amalgamation of the Hierarchical Role Based Access Control Model (HR-ACM), Composikey, a composite key encryption algorithm, and Interactive Tree Based zero knowledge protocol (ITZKP) to construct a robust security framework for cloud security. This study presents an investigation into the viability and efficacy of integrating HRACM, Composikey, and ITZKP as a means of augmenting security measures and reducing potential hazards in cloudbased systems. The execution times comparison of the Composikey, IBPRE, and KPRE models were compared for different filesizes (1 KB to 2 GB) to evaluate the performance of the HRACM method. As roles increase, RBAC a execution time increases significantly. The HRACM Method takes 0.001 to 0.002 seconds to implement across all role counts. The results show that the HRACM Method is more efficient and time-effective than the RBAC Method. The response time measured in microseconds for the existing ZKP and Libra systems for different file sizes, ranging from 1KB to 1 GB. The results reveal that the verifier time for the ITZKP system aligns closely with the existing systems, demonstrating its ability to perform efficient verification processes. These findings collectively demonstrate the potential of the integrated security framework in enhancing cloud security.

An Access Control Framework for Multilayer Rail Transit Systems Based on Trust and Sensitivity Attributes

The construction of multilayer rail transit systems is a necessary way to realize “modern metropolitan areas on rail”, improve resource sharing, and increase travel services, where data integration is of utmost importance. To break data silos and realize data flow between different rail systems, a fine-grained access control framework is proposed in this paper. Through categorical and hierarchical schemes, a universal security scale is established for cross-domain data resources. Based on this, a trust and sensitivity attribute-based access control (TSABAC) model is put forward to describe the characteristics of the access control process. Furthermore, the method of policy integration is discussed, as well as the solution to the policy incompatibility problem, due to cross-domain interaction. As shown in practical application and simulation analysis, this framework can meet the requirements of security and granularity. This research is of great significance for promoting the high-quality development of urban agglomerations and metropolitan areas, and improving the quality and efficiency of rail transit.

Mitigating Risks in the Cloud-Based Metaverse Access Control Strategies and Techniques

The advent of the metaverse has revolutionized virtual interactions and navigation, introducing intricate access control challenges. This paper addresses the need for effective access control models in the cloud-based metaverse. It explores its distinct characteristics, including its dynamic nature, diverse user base, and shared spaces, highlighting privacy concerns and legal implications. The paper analyzes access control principles specific to the cloud-based metaverse, emphasizing least privilege, separation of duties, RBAC, defense-in-depth, and auditability/accountability. It delves into identity verification and authorization methods, such as biometrics, multi-factor authentication, and role-based/attribute-based authorization. Advanced access control technologies for the cloud-based metaverse are examined, including SSO solutions, blockchain-based access control, ABAC, adaptive access control, and VMI for isolation. Risk mitigation strategies encompass IDS/IPS, SIEM, and user education programs.

МЕТОДЫ ОБЕСПЕЧЕНИЯ БЕЗОПАСНОСТИ БАЗ ДАННЫХ

The article introduces the main trends in the development of databases that generate new threats regarding their availability, integrity and confidentiality. It provides an overview of literature sources. The article describes modern approaches to the tasks of ensuring the security of database operation. It also determines suitability database protection methods to the potential threats characteristic of them, shows the sources of these threats. Article containes example of corporate information and educational system of the East Kazakhstan University named after S. Amanzholov, where has been implemented such elements of the information security policy as basic security mechanisms (network filtering of information flows, installation of anti-virus software), role-based access control model, mandatory management of granting powers to authorized users, logging of user actions for ensuring the procedure of non-repudiation. At the end, has been formulated recommendations for the expanded use of the metadata mechanism and the improvement of authentication procedures.

Attribute and User Trust Score-Based Zero Trust Access Control Model in IoV

The Internet of Vehicles (IoV) is an innovative area of interest in modern mobility that is rapidly evolving while facing complex challenges. Traditional IoV networks are susceptible to intrusion threats, which can lead to data leakage and seizure of vehicle control by attackers, thereby endangering vehicle users’ privacy and personal safety. An Attribute and User Trust Score-based Zero Trust Access Control Model (AU-ZTAC) is proposed, combining the zero-trust and attribute-based access control models to meet network protection requirements while achieving fine-grained dynamic access control and incorporating trust evaluation in the access control process to better reflect users’ intent. Experimental results demonstrate the effectiveness and feasibility of trust assessment through the proposed model. A comparison with the classical schemes illustrates that AU-ZTAC allows for more flexible and fine-grained access control in complex access control environments while improving IoV security.

Assessment of energy consumption for information flow control protocols in IoT devices

In the IoT (Internet of Things), millions of devices are interconnected and devices support too poor computation resources to install enough security functions to protect from malicious accesses. Hence, devices have to be supported with access control mechanisms. The CBAC (Capability-Based Access Control) model is most useful to be as access control model for IoT devices because it is sufficient for each device to just check the capability of each access request. However, illegal and late information flows among devices and subjects occur. Types of IFC (Information Flow Control) protocols like the OI and TBOI protocols to prevent illegal and late types of information flows are proposed in our previous studies. A secure device supports the CBAC model and the IFC protocols. First, an EC (Energy Consumption) model is proposed to show how a secure device consumes the electric energy in this paper. By using the EC model, the IFC protocols are evaluated in terms of the energy consumed by secure devices. A secure device mostly consumes energy to check capability tokens of each access request. In the simulation, the energy consumed by secure devices to process access requests can be reduced by selecting only tokens required. About 69% and 73% of energy in the OI and TBOI protocols can be reduced by adopting the CTS (Capability Token Selection) algorithms, respectively.

Capability and Blockchain-Based Fine-Grained and Flexible Access Control Model

Currently, integrating blockchain into access control systems has become a new research trend. However, existing access control systems still have problems such as easy confusion of capability authorisation subjects, inflexible capability granting and revocation, insufficient granularity of capability, insecure capability transfer and lack of capability verification. To solve these problems, this work proposes Capability- & Blockchainbased Fine-grained and Flexible Access Control (CB2FAC), defines new capability authorisation rules, and designs an authorisation tree with capability revocation list to meet the needs of flexibility and timeliness of capability revocation. Finally, simulation experiments show that CB2FAC is flexible and secure in granting, revoking, granularity control and verification of capability, and significantly outperforms the existing schemes in terms of performance.

Securing Cloud Data: An Enhanced Approach through Attribute-Based Access Control Mechanism

Cloud computing is considered one of the most dominant paradigms in the Information Technology (IT) industry these days. It offers new cost-effective services on-demand such as Software as a Service (SaaS), Infrastructure as a Service (IaaS) and Platform as a Service (PaaS). However, with all of these services promising facilities and benefits, there are still a number of challenges associated with utilizing cloud computing such as data security, abuse of cloud services, malicious insider and cyber-attacks. Among all security requirements of cloud computing, access control is one of the fundamental requirements in order to avoid unauthorized access to systems and protect organizations assets. Although, various access control models and policies have been developed such as Attribute based Access Control (ABAC) and Role Based Access Control (RBAC) for different environments, these models may not fulfil cloud’s access control requirements. In this paper, an enhanced attribute-based access control based on strategy mechanism is proposed by introducing a strategy for providing access control to the users in the cloud environment.

Leaving the Business Security Burden to LiSEA: A Low-Intervention Security Embedding Architecture for Business APIs

In the evolving landscape of complex business ecosystems and their digital platforms, an increasing number of business Application Programming Interfaces (APIs) are encountering challenges in ensuring optimal authorization control. This challenge arises due to factors such as programming errors, improper configurations, and sub-optimal business processes. While security departments have exhibited proficiency in identifying vulnerabilities and mitigating certain viral or adversarial incursions, the safeguarding of comprehensive business processes remains an intricate task. This paper introduces a novel paradigm, denoted as the Low-Intervention Security Embedding Architecture (LiSEA), which empowers business applications to enhance the security of their processes through judicious intervention within business APIs. By strategically incorporating pre- and post-intervention checkpoints, we devise a finely grained access control model that meticulously assesses both the intent of incoming business requests and the outcomes of corresponding responses. Importantly, these advancements are seamlessly integrated into the existing business codebase. Our implementation demonstrates the effectiveness of LiSEA, as it adeptly addresses eight out of the ten critical vulnerabilities enumerated in the OWASP API Security Top 10. Notably, when the number of threads is less than 200, LiSEA brings less than 20 msec of latency to the business process, which is significantly less than the microservice security agent based on the API gateway.

DACP: Enforcing a dynamic access control policy in cross-domain environments

Enabling hybrid authorisations to enforce dynamic access control policy from single-domain to cross-domain environments (CDEs) is important for distributed services. However, traditional Attribute-Based Access Control (ABAC) models are incompatible with CDEs. To fill this gap, approaches that apply cryptographic primitives, e.g., attribute-based encryption (ABE), have been proposed. The computation and storage overhead in most ABE constructions is non-negligible and increases with the complexity of the associated policies. In addition, most access control policy systems enforce authorisation policies in a centralised way, raising serious security and privacy issues. In this paper, we introduce DACP – a practical Dynamic Access Control Policy system supporting dynamic cross-domain authorisation. DACP combines traditional ABAC approach and a novel cryptographic primitive Attribute-based group signature (ABGS). ABAC is used for the access control decision and policy enforcement according to the user’s attributes whereas ABGS is used for managing the user’s attributes between users and authorities. Thus, the user’s attributes are securely distributed along with the access structure in CDEs while preserving the user’s privacy. We present the concrete design and implementation of DACP, and evaluate it in real-world settings. The evaluation shows that DACP is practical and efficient in CDEs.

Computable Access Control: Embedding Access Control Rules Into Euclidean Space

Access control is one of the most basic techniques to ensure the security of the information system. The traditional access controls of information systems are usually performed based on the traversals or queries of rules. However, with the increasing complexity of information systems, massive data, and open environments bring great workload and risk for the traditional methods. This study proposes a model of embedding-based computable access control (ECAC), by employing the idea of representation learning in artificial intelligence. According to ECAC, access control rules can be embedded into a Euclidean vector space, and the security of arbitrary behavior can be computed by numerical vector operations, without any traditional querying or traversing of rules, and thus the workload of access control is reduced. Furthermore, by the embedding-based computation, the security of unknown behaviors can be predicted. Potentially, due to the use of numerical vectors instead of traditional semantic symbols, the risk of privacy leakage via semantics can be reduced. Finally, as the first embedding-based access control model, the effectiveness of ECAC is evaluated and concluded by the experiment-based analyses and discussions.

Temporal Role Access Control Model for New Power Systems Based on Trust Degree

With the continuous development of information construction in the new power system and the power information network system, users have their own role identities in the corresponding business systems, and access permissions change over time. Traditional access control permanently assigns user roles, which has made the issue of power information security increasingly prominent. This article introduces time constraints in the role-based access control of the new power system. Building on the research of GTRBAC, a trust-based time-constrained role-based access control model for the new power system is proposed. The model’s semantics, execution model, and formal verification are defined.

CRABAC: Combined Role-Attribute Based Access Control Model

Access control is one of the techniques to provide accessibility, flexibility and control over the cloud resources. The traditional access control model is no longer sufficient to provide protection of data. Due to the rising data breaches, it is important to evolve our data security mechanisms. Therefore, it is better to combine several techniques to bring out the most efficient technique. Thus, this paper introduces custom access control model where Role- Based Access Control (RBAC) model and Attribute-Based Access Control (ABAC) model is combined to give a single hybrid model. This technique brings out the best qualities of both models. It provides both flexibility and dynamicity. The assignment of attributes provides better security. Key Words: Access Control, Role-Based Access Control, Attribute-Based Access Control, Cloud Computing

Hybrid Approaches (ABAC and RBAC) Toward Secure Access Control in Smart Home IoT

Smart homes are interconnected homes in which a wide variety of digital devices with limited resources communicate with multiple users and among themselves using multiple protocols. The deployment of resource-limited devices and the use of a wide range of technologies expand the attack surface and position the smart home as a target for many potential security threats. Access control is among the top security challenges in smart home IoT. Several access control models have been developed or adapted for IoT in general, with a few specifically designed for the smart home IoT domain. Most of these models are built on the role-based access control (RBAC) model or the attribute-based access control (ABAC) model. However, recently some researchers demonstrated that the need arises for a hybrid model combining ABAC and RBAC, thereby incorporating the benefits of both models to better meet IoT access control challenges in general and smart homes requirements in particular. In this paper, we used two approaches to develop two different hybrid models for smart home IoT. We followed a role-centric approach and an attribute-centric approach to develop HyBAC <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$_{RC}$</tex-math></inline-formula> and HyBAC <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$_{AC}$</tex-math></inline-formula> , respectively. We formally define these models and illustrate their features through a use case scenario demonstration. We further provide a proof-of-concept implementation for each model in Amazon Web Services (AWS) IoT platform. Finally, we conduct a theoretical comparison between the two models proposed in this paper in addition to the EGRBAC model (RBAC model for smart home IoT) and HABAC model (ABAC model for smart home IoT), which were previously developed to meet smart homes' challenges.

Blockchain-Based Secure Smart Health IoT solution Using RBAC Architecture

The revolution of Internet technology, which led to connecting everything through the World Wide Web, the Internet of Things (IoT) emerged to serve this need. IoT technology connects different devices, hardware, and software together, which are created to provide services and facilitate human life. The most critical application is in the health sector, where data privacy, security, and accessibility are demanding and agonizing challenges. In this paper, we use a block chain (BC) model that enforces the Role-Based Access Control (RBAC) model to address privacy and security concerns as well as the limited nature of IoT devices. The paper's concept is to divide the network according to the assigned role, and authentication and data transfer are thoroughly discussed. The Architecture of the proposed system is shown and displayed in flowcharts, where each node has different permissions and privileges. In the experimental part, two scenarios are applied; one where the network (IoT devices) is connected through an MQTT broker as an intermediary, and the second with BC that controls the IoT, which uses proof of assignment as a consensus model. The data flow shows that with BC, the network is much more secure and holds the privacy and integrity of the data.

An Improved Integrity-Based Hybrid Multi-User Data Access Control for Cloud Heterogeneous Supply Chain Databases

Cloud-based supply chain applications play a vital role in the multi-user data security framework for heterogeneous data types. The majority of the existing security models work effectively on small to medium-sized datasets with a homogenous data structure. In contrast, Supply Chain Management (SCM) systems in the real world utilize heterogeneous databases. The heterogeneous databases include a massive quantity of raw SCM data and a scanned image of a purchase quotation. In addition, as the size of the database grows, it becomes more challenging to provide data security on multi-user SCM databases. Multi-user datatypes are heterogeneous in structure, and it is complex to apply integrity and confidentiality models due to high computational time and resources. Traditional multi-user integrity algorithms are difficult to process heterogeneous datatypes due to computational time and variation in hash bit size. Conventional attribute-based encryption models such as "Key-policy attribute-based encryption" (KP-ABE), "Ciphertext-Policy Attribute-Based Encryption" (CP-ABE) etc., are used to provide strong data confidentiality on large textual data. Providing security for heterogeneous databases in a multi-user SCM system requires a significant computational runtime for these conventional models. An enhanced integrity-based multi-user access control security model is created for heterogeneous databases in the cloud infrastructure to address the problems with heterogeneous SCM databases. A non-linear integrity model is developed to provide strong integrity verification in the multi-user communication process. A multi-user based access control model is implemented by integrating the multi-user hash values in the encoding and decoding process. Practical results proved that the multi-user non-linear integrity-based multi-access control framework has better runtime and hash bit variation compared to the conventional models on large cloud-based SCM databases.

Improved Private Data Protection Scheme for Blockchain Smart Contracts

Data security and privacy protection are critical challenges that constrain the advancement of edge computing. Similarly, blockchain technology faces constraints in addressing security issues linked with edge computing due to its scalability limitations. To tackle these challenges and promote the development of blockchain technology, this paper presents a scheme that enhances privacy data protection in blockchain smart contracts using edge computing and a master-slave multichain architecture. Firstly, we propose a master-slave multichain architecture based on the traditional single chain and integrate it with a three-layer edge computing structure to address security issues on the edge side. We also design a signature authentication scheme utilizing ECC integrated with blockchain encryption technology. Secondly, we incorporate the role-based access control (RBAC) model with smart contracts to finely divide user privileges, construct an interdomain role-based access control (ID-RBAC) model, and provide detailed access authentication process designs for both within and between domains. Finally, experimental results demonstrate that our proposed scheme can effectively resist various attacks, significantly improve algorithm efficiency, and maintain a system overhead of less than 160 p, with a maximum transaction throughput of nearly 310 tx/s.

A Blockchain-Based Access Control Scheme for Zero Trust Cross-Organizational Data Sharing

Multi-organization data sharing is becoming increasingly prevalent due to the interconnectivity of systems and the need for collaboration across organizations (e.g., exchange of data in a supply chain involving multiple upstream and downstream vendors). There are, however, data security concerns due to lack of trust between organizations that may be located in jurisdictions with varying security and privacy legislation and culture (also referred to as a zero trust environment). Hence, in such a zero trust setting, one should introduce strengthened, yet efficient, access control mechanisms to facilitate cross-organizational data access and exchange requests. Contemporary access control schemes generally focus on protecting a single objective rather than multiple parties, due to higher security costs. In this article, we propose a blockchain-based access control scheme, designed to facilitate lightweight data sharing among different organizations. Specifically, our approach utilizes the consortium blockchain to establish a trustworthy environment, in which a Role-Based Access Control (RBAC) model is then deployed using our proposed multi-signature protocol and smart contract methods. Evaluation of our proposed approach is performed on the HyperLedger Fabric consortium blockchain platform using both Caliper and BFT-SMaRT benchmarks, and the findings demonstrate the utility of our approach.

NDN-RBE: An Accountable Privacy Aware Access Control Framework For NDN

Abstract Named Data Networking (NDN) is an emerging network architecture. An important characteristic of NDN is its in-network cache, which enables Data packets to be available from multiple locations on the Internet. Hence the enforcement of access control mechanisms becomes even more critical in the NDN. This paper proposes a novel access control scheme referred to as Role-Based Encryption for NDN (NDN-RBE), which uses a broadcast encryption mechanism to achieve secure data access control. Our scheme uses the role inheritance property of the traditional Role-Based Access Control (RBAC) model to achieve efficient data access control over hierarchical content. This makes our scheme particularly suitable for large-scale real-world content-centric services like Netflix. Our scheme also supports additional design features such as anonymous signature-based authentication, batch signature verification and two types of privilege revocations. In addition, our formal security analysis demonstrates that our scheme is provably secure against Chosen Plaintext Attacks. Our performance and functionality comparison show that our scheme outperforms other notable existing works in terms of security, functionality, computation, communication and storage overhead. Furthermore, our experimental results show an improvement in content delivery time of the order of 15 percent compared with the other closely related works.

Blockchain-Based Secure Storage and Access Control Scheme for Supply Chain Ecological Business Data: A Case Study of the Automotive Industry.

The reliable circulation of automotive supply chain data is crucial for automotive manufacturers and related enterprises as it promotes efficient supply chain operations and enhances their competitiveness and sustainability. However, with the increasing prominence of privacy protection and information security issues, traditional data sharing solutions are no longer able to meet the requirements for highly reliable secure storage and flexible access control. In response to this demand, we propose a secure data storage and access control scheme for the supply chain ecosystem based on the enterprise-level blockchain platform Hyperledger Fabric. The design incorporates a dual-layer attribute-based auditable access control model for access control, with four smart contracts aimed at coordinating and implementing access policies. The experimental results demonstrate that the proposed approach exhibits significant advantages under large-scale data and multi-attribute conditions. It enables fine-grained, dynamic access control under ciphertext and maintains high throughput and security in simulated real-world operational scenarios.