Access Control Model Research Articles

Real geo‐time‐based secured access computation model for e‐Health systems

AbstractRole Back Access Control model (RBAC) allows devices to access cloud services after authentication of requests. However, it does not give priority in Big Data to devices located in certain geolocations. Regarding the crisis in a specific region, RBAC did not provide a facility to give priority access to such geolocations. In this paper, we planned to incorporate Location Time‐ (GEOTime) based condition alongside Priority Attribute role‐based access control model (PARBAC), so requesters can be allowed/prevented from access based on their location and time. The priority concept helped to improve the performance of the existing access model. TIME‐PARBAC also ensures service priorities based on geographical condition. For this purpose, the session is encrypted using a secret key. The secret key is created by mapping location, time, speed, acceleration and other information into a unique number, that is, K(Unique_Value) = location, time, speed, accelerator, other information. Spatial entities are used to model objects, user position, and geographically bounded roles. The role is activated based on the position and attributes of the user. To enhance usability and flexibility, we designed a role schema to include the name of the role and the type of role associated with the logical position and the rest of the PARBAC model proposed using official documentation available on the website for Azure internet of things (IoT) Cloud. The implementation results utilizing a health use case signified the importance of geology, time, priority and attribute parameters with supporting features to improve the flexibility of the existing access control model in the IoT Cloud.

Blockchain-Based Internet of Things Access Control Technology in Intelligent Manufacturing

The integration of information systems and physical systems is the development trend of today’s manufacturing industry. Intelligent manufacturing is a new model of manufacturing, based on advanced manufacturing technology with human–machine–material collaboration. Internet of Things technology is the core technology of intelligent manufacturing, and access control technology is one of the main measures to ensure the security of the IoT. In view of the problem that the existing IoT access control model does not support distributed and fine-grained dynamic access control, this paper uses the characteristics of blockchain, such as decentralization and non-tampering, combined with the attribute-based access control (ABAC) method, to propose a distributed access control method, applicable to the IoT environment in the process of intelligent manufacturing. This paper describes a fine-grained access control policy by defining the access control attribute values in a formal language, which supports complex logic operations in the policy and enhances the expressiveness of the model. Distributed access control decision making, using smart contracts for blockchain, improves the decision-making efficiency of the access control model, increases the post-facto audit of the access control behavior, and improves the overall security of IoT data protection. The paper concludes with proof of security and a performance analysis, and the experimental results, such as storage and computing overheads, show that this method can provide fine-grained, dynamic, and distributed access control for devices in intelligent manufacturing, ensuring the security and reliability of access control for IoT devices.

Smart Contract-Based Access Control Through Off-Chain Signature and On-Chain Evaluation

Access control is essential in computer security systems to regulate the access to critical or valuable resources. Conventional access control models mainly rely on a centralized and trusted server to mediate each attempted access from client to resources, which face serious challenges of single point of failure and lack of transparency. In this brief, we propose a smart contract-based access control framework, which enables the owner to achieve resource access control in a reliable, auditable and scalable way. An access control contract is deployed on blockchain to manage attribute-based access policies of resources flexibly and make access decisions for clients credibly. A set of attributes is distributed to the clients through off-chain signatures signed by the owner to determine their privileges, without consuming the expensive on-chain storage space. Finally, we implement an experimental prototype on Ethereum test network and perform extensive experimental and theoretical analysis to evaluate its scalability and efficiency.

Access Control Metamodels: Review, Critical Analysis, and Research Issues

The new generation of networking environments such as the internet of things (IoT), cloud computing, etc. is emerging and releases new prospects to traditional information systems by merging new technologies and services for seamless access to information sources at anytime and anywhere. Concurrently, this emergence opens new threats to information security and new challenges to controlling access to resources. To ensure security, several techniques have been employed, and access control (AC) is one of the essential security requirements especially for recent networking environments. Various authentication and AC methods are proposed to enforce AC policy and to prevent any unauthorized access to logical/physical assets. The continuous technology upgrades and the diversity of AC models force the need to find AC metamodels with a higher level of abstraction that serves as a unifying framework for specifying any AC policy. AC metamodels are proposed to encompass AC features and are used to derive various instances of AC models and methods. In this paper we review the proposed AC metamodels and their implementation scenarios, we analyze them, their objectives, their limitations, and present current research issues and open questions that still need to be addressed.

A novel role-mapping algorithm for enhancing highly collaborative access control system

The collaboration among different organizations is considered one of the main benefits of moving applications and services to a cloud computing environment. Unfortunately, this collaboration raises many challenges such as the access of sensitive resources by unauthorized people. Usually, Role-Based Access-Control (RBAC) model is deployed in large organizations. This paper addresses the scalability problem of the online stored rules. This problem affects the performance of the access control system due to increasing number of shared resources and/or number of collaborating organizations in the same cloud environment. Therefore, this paper proposes replacing the cross-domain RBAC rules with Role-To-Role (RTR) mapping rules among all organizations. The RTR mapping rules are generated using a newly proposed Role-Mapping algorithm. A comparative study is performed to evaluate the proposed algorithm’s performance with concerning the Rule-Store size and the authorization response time. According to the results, it is found that the proposed algorithm reduces the number of stored rules which minimizes the Rule-Store size and reduces the authorization response time. Additionally, this paper proposes applying a concurrent approach on the RTR mapping model using the proposed Role-Mapping algorithm to achieve more savings in the authorization response time. Therefore, it will be suitable in highly-collaborative cloud environments.

Automatic Control Model of Power Information System Access Based on Artificial Intelligence Technology

Looking at the issues of low efficiency, poor control performance, and difficult access control of the traditional role-based access control model, an artificial intelligence technique-based power information system access control model has been designed. The detector is designed by artificial intelligence technology, combining artificial neural network, and artificial immune algorithm, which provide the basis for checking the access request module. It has been proved that the design model can effectively support the access and modification of legitimate users and prevent illegal users from accessing, and the control accuracy is high. The use of artificial intelligence (AI) in the power sector is now reaching emerging markets, where it may have a critical impact, as clean, cheap, and reliable energy is essential to development. Artificial intelligence can be proven very efficient for resolving the control and decision-making issues in high complex systems.

Healthcare Big Data Privacy Protection Model Based on Risk-Adaptive Access Control

Edge computing is playing an increasingly important role in the field of health care. Edge computing provides high-quality personalized services to patients based on user and device data information. However, edge nodes will collect a large amount of sensitive patient information, and patients will also bear the risk of privacy disclosure while enjoying personalized services. How to reduce the risk of privacy disclosure while ensuring that patients enjoy personalized services brought by edge computing is the research content of this paper. In this paper, the work flow and management mode of Hospital Information System (HIS) are investigated on the spot, and the risk-adaptive access control model based on entropy is established. First, we use International Classification of Diseases, Tenth Revision (ICD-10) to mark the information resources accessed by users and use information entropy to measure the correlation “α” between medical information accessed by users and work tasks. Finally, we analyze the relationship between correlation “α” and risk through an example. The results show that users with high correlation α have low risk of access behavior, and users with low risk have high correlation α of access information resources and work goals. This discovery can help managers predict users’ access behavior in the Big Data environment, so as to dynamically formulate access control policies according to the actual access situation of users and then realize the privacy protection of medical big health data.

Efficient NFS Model for Risk Estimation in a Risk-Based Access Control Model.

Providing a dynamic access control model that uses real-time features to make access decisions for IoT applications is one of the research gaps that many researchers are trying to tackle. This is because existing access control models are built using static and predefined policies that always give the same result in different situations and cannot adapt to changing and unpredicted situations. One of the dynamic models that utilize real-time and contextual features to make access decisions is the risk-based access control model. This model performs a risk analysis on each access request to permit or deny access dynamically based on the estimated risk value. However, the major issue associated with building this model is providing a dynamic, reliable, and accurate risk estimation technique, especially when there is no available dataset to describe risk likelihood and impact. Therefore, this paper proposes a Neuro-Fuzzy System (NFS) model to estimate the security risk value associated with each access request. The proposed NFS model was trained using three learning algorithms: Levenberg–Marquardt (LM), Conjugate Gradient with Fletcher–Reeves (CGF), and Scaled Conjugate Gradient (SCG). The results demonstrated that the LM algorithm is the optimal learning algorithm to implement the NFS model for risk estimation. The results also demonstrated that the proposed NFS model provides a short and efficient processing time, which can provide timeliness risk estimation technique for various IoT applications. The proposed NFS model was evaluated against access control scenarios of a children’s hospital, and the results demonstrated that the proposed model can be applied to provide dynamic and contextual-aware access decisions based on real-time features.

Distributed Authentication and Authorization Models in Cloud Computing Systems: A Literature Review

As the functionality and services provided by cloud computing increase, control access to these services becomes more complex, and more security breaches are generated. This is mainly based on the emergence of new requirements and constraints in the open, dynamic, heterogeneous, and distributed cloud environment. Despite the importance of identifying these requirements for designing and evaluating access control models, the available studies do not provide a rigorous review of these requirements and the mechanisms that fulfill them. The purpose of this study was to conduct a literature review of the published articles that have dealt with cloud access control requirements and techniques. This paper allowed us to answer the following two research questions: What cloud access control security requirements have been presented in the published literature? What access control mechanisms are proposed to fulfill them? This review yielded 21 requirements and nine mechanisms, reported by 20 manuscripts. The identified requirements in this review will help researchers, academics and practitioners assess the effectiveness of cloud access control models and identify gaps that are not addressed in the proposed solutions. In addition, this review showed the current cloud access control mechanisms used to meet these requirements such as access control based on trust, risk, multi-tenant, and attribute encryption.

An investigation study for risk calculation of security vulnerabilities on android applications

Applications within mobile devices, although useful and entertaining, come with security risks to private information stored within the device such as name, address, and date of birth. Standards, frameworks, models, and metrics have been proposed and implemented to combat these security vulnerabilities, but they remain to persist today. In this review, we discuss the risk calculation of android applications which is used to determine the overall security of an application. Besides, we also present and discuss the permission-based access control models that can be used to evaluate application access to user data. The study also focuses on examining the predictive analysis of security risks using machine learning. We conduct a comprehensive review of the leading studies accomplished on investigating the vulnerabilities of the applications for the Android mobile platform. The review examines various well-known vulnerabilities prediction models and highlights the sources of the vulnerabilities, prediction technique, applications and the performance of these models. Some models and frameworks prove to be promising but there is still much more research needed to be done regarding security for Android applications.

Confidentiality-minded framework for blockchain-based BIM design collaboration

Building Information Modeling (BIM) is widely adopted for design collaboration in the architecture, engineering, and construction (AEC) industry, while its centralized paradigm suffers the risk of data manipulation. To this end, blockchain is an emerging distributive technology that guarantees data authenticity and integrity by providing decentralized, immutable, and traceable data storage. However, directly integrating BIM with blockchain risks leaking sensitive data, since a blockchain is a transparent network insofar as shared information (including sensitive data) can be disclosed to all members without access control. Therefore, this paper proposes a confidentiality-minded framework (CMF) for blockchain-based design collaboration. The major innovations are twofold. First, an access control model is developed in the CMF to prevent unauthorized access to sensitive BIM data in a blockchain ledger. Second, new design strategies are developed in CMF to facilitate design coordination within the access-controlled blockchain network. An illustrative design example validates the feasibility and performance of the proposed CMF, which has acceptable latency and storage cost. The results also show that the sensitive BIM data are effectively kept confidential when project members collaborate within the CMF.

ORGANIZATION OF USER ACCESS DIFFERENTIATION TO INFORMATION SYSTEM FUNCTIONALITY

This article offers practical guide on how to organize user access differentiation to information system functionality on the basis of the author's improvement of the classical scheme of the Role Model of user access control. Recommendations on the implementation of the proposed system of access differentiation in the information system are given. The peculiarities of the construction of the mechanism of user authentication using web-tokens in the context of the proposed system are briefly touched upon.

Traditional and Hybrid Access Control Models: A Detailed Survey

Access control mechanisms define the level of access to the resources among specified users. It distinguishes the users as authorized or unauthorized based on appropriate policies. Several traditional and hybrid access control models have been proposed in previous researches over the last few decades. In this study, we provide a detailed survey of access control models and compare the traditional and hybrid access control models based on their access control criteria. This survey focuses on the growing literature of access control models and summarizes it through comparative analysis, identifying limitations and illustrating the advantages of both traditional and hybrid models. This study will help the researchers to get a deep understanding of the traditional and hybrid access control models.

A smart access control mechanism based on user preference in online social networks

SummaryAccess control can effectively protect users' data and privacy in social networks. Different access control models address different data privacy requirements, and the corresponding implementation technologies and performance are also quite different. The existing access control mechanisms of social networks rarely take into account the individual preferences of users, and cannot provide personalized services for users. Therefore, we have studied an analysis mechanism of user preference to quantify user preferences, and then use user preference values and some key information of users' social resources as decision vectors, and proposed an access control mechanism based on user preference (ACMBUP). ACMBUP turns the problem of access decision‐making into a problem of classification, that is, whether to allow access or not to allow access. At the same time, we add an encryption and decryption mechanism in ACMBUP to prevent data leakage and protect data when users interact with access mechanisms. Experiments show that this mechanism can automatically generate appropriate access control policies to meet the potential privacy needs of different users, so as to better protect the privacy of social networks data.

MLS-ABAC: Efficient Multi-Level Security Attribute-Based Access Control scheme

Realizing access control to sensitive data offloaded to a Cloud is challenging in the Internet of Things, where various devices with low computational power and different security levels are interconnected. Despite various solutions, the National Institute of Standards and Technology (NIST)’s Attribute-Based Access Control (ABAC) model is one of the preferred techniques in the literature. In this model, users who satisfy access policies using both static and dynamic attributes are allowed to access the data. However, NIST’s ABAC model does not support encryption and therefore does not satisfy data confidentiality. Attribute-Based Encryption (ABE) is a known cryptographic primitive that enables fine-grained access control over encrypted data. However, currently the existing ABE schemes do not meet NIST’s ABAC requirements or are not computationally efficient enough for IoT applications. In this paper, we propose a Multi-Level Security ABAC (MLS-ABAC) scheme that satisfies the requirements of NIST’s ABAC model. Our construction is efficient and relies on a decryption outsourceable Ciphertext-Policy ABE scheme. Additionally, based on realistic application scenarios, only the authorized data users can decrypt the ciphertext, and check the integrity of the retrieved message. Furthermore, we present both conceptual and formal models for our proposed MLS-ABAC architecture along with performance metrics. The experimental results show that the proposed MLS-ABAC achieves a constant ciphertext size of ∼230 bytes and with encryption and decryption running times of ∼18 and ∼10 ms, respectively, independent of the number of attributes.

An Attribute-Based Approach toward a Secured Smart-Home IoT Access Control and a Comparison with a Role-Based Approach

The area of smart homes is one of the most popular for deploying smart connected devices. One of the most vulnerable aspects of smart homes is access control. Recent advances in IoT have led to several access control models being developed or adapted to IoT from other domains, with few specifically designed to meet the challenges of smart homes. Most of these models use role-based access control (RBAC) or attribute-based access control (ABAC) models. As of now, it is not clear what the advantages and disadvantages of ABAC over RBAC are in general, and in the context of smart-home IoT in particular. In this paper, we introduce HABACα, an attribute-based access control model for smart-home IoT. We formally define HABACα and demonstrate its features through two use-case scenarios and a proof-of-concept implementation. Furthermore, we present an analysis of HABACα as compared to the previously published EGRBAC (extended generalized role-based access control) model for smart-home IoT by first describing approaches for constructing HABACα specification from EGRBAC and vice versa in order to compare the theoretical expressiveness power of these models, and second, analyzing HABACα and EGRBAC models against standard criteria for access control models. Our findings suggest that a hybrid model that combines both HABACα and EGRBAC capabilities may be the most suitable for smart-home IoT, and probably more generally.

Adaptive Contextual Risk-Based Model to Tackle Confidentiality-Based Attacks in Fog-IoT Paradigm

The Internet of Things (IoT) allows billions of physical objects to be connected to gather and exchange information to offer numerous applications. It has unsupported features such as low latency, location awareness, and geographic distribution that are important for a few IoT applications. Fog computing is integrated into IoT to aid these features to increase computing, storage, and networking resources to the network edge. Unfortunately, it is faced with numerous security and privacy risks, raising severe concerns among users. Therefore, this research proposes a contextual risk-based access control model for Fog-IoT technology that considers real-time data information requests for IoT devices and gives dynamic feedback. The proposed model uses Fog-IoT environment features to estimate the security risk associated with each access request using device context, resource sensitivity, action severity, and risk history as inputs for the fuzzy risk model to compute the risk factor. Then, the proposed model uses a security agent in a fog node to provide adaptive features in which the device’s behaviour is monitored to detect any abnormal actions from authorised devices. The proposed model is then evaluated against the existing model to benchmark the results. The fuzzy-based risk assessment model with enhanced MQTT authentication protocol and adaptive security agent showed an accurate risk score for seven random scenarios tested compared to the simple risk score calculations.

Industry 4.0 Engineering Product Life Cycle Management Based on Multigranularity Access Control Model.

In order to improve the management efficiency of the safety status of Industry 4.0 engineering products, the multigranularity access control model (MGACM) Industry 4.0 engineering product life cycle management (PLM) is adopted to optimize the safety management mode of Industry 4.0 engineering products in this paper. The multigranularity access control model is constructed in this paper, which has strong nonlinearity and better fault tolerance. In addition, the parameters of PLM are optimized through the multiparticle access control model, and PLM search is enabled. Taking into account the slow and easy convergence of the multigranular access control model, a niche technology with full life cycle heterogeneity and elimination mechanism is proposed to solve the premature convergence problem of the multigranular access control model. The final simulation results of this paper show that, compared with traditional algorithms, the proposed multigranularity access control model is more reliable and effective and has faster convergence speed and higher management efficiency.

Design of the Secure Smart Home System Based on the Blockchain and Cloud Service

In this paper, a variety of cloud service combinations is used to form the control core of a smart home, realize data forwarding, storage, and analysis in the cloud, and complete the remote management of smart home devices. This paper studies the secure access control of smart home data combined with the blockchain technology and password technology to realize the secure and efficient access control of smart home data. The system can achieve the goal of independent research and development. Aiming at the problem that the access control of a smart home is generally managed by third-party authorized institutions and there is an unauthorized access, a blockchain-based smart home (BSH) access control scheme is proposed. The scheme extends the attribute-based access control model (ABAC) and applies the blockchain technology to the smart home ABAC model to realize fine-grained access control. In the scheme, the resource provider first publishes the access control policy of the resource to the blockchain. If the resource visitor wants to access the resource, he needs to submit an access request to the blockchain and use an SM2 threshold signature to process the transaction proposal. The endorsement peer node in the blockchain runs the access control policy smart contract to decide whether to grant access rights. This scheme can ensure that resource providers can participate in all the processes of access control and avoid the risk of unauthorized access caused by the centralized management of the third party. Finally, the simulation experiment is carried out on the Hyperledger Fabric alliance chain development platform. The results show that the BSH access control scheme has good applicability in the smart home scenario.

Embedding Risk-Based Anonymization into Data Access Control for Providing Individual-Level Health Data in a Secure Way.

Especially in biomedical research, individual-level data must be protected due to the sensitivity of the data that is associated with patients. The broad goal of scientific data re-use is to allow many researchers to derive new hypotheses and insights from the data while preserving privacy. Data usage control (DUC) as an attribute-based access mechanism promises to overcome the limitations of traditional access control models achieving that goal. Park and Sandhu provided the usage control (UCON) model as an instance of DUC, which defines policies that evaluate certain attributes. Here, we present an UCON-based architecture, which is augmented with risk-based anonymization as provided by the R package sdcMicro and an extensible Access Control Markup Language (XACML) environment with a core policy decision point as implemented by authzforce.