Access Control Requests Research Articles

Authorization Recycling in Attribute-Based Access Control

In most access control scenarios, the communication between the PDP (policy decision point) and the PEP (policy enforcement point) can cause high authorization overhead. Authorization recycling enables PEP to use the previous access control decisions fetched from the PDP to handle some upcoming access control requests, reduce authorization costs, and increase the efficiency of access control decision-making. Inspired by the RBAC (role-based access control) authorization recycling mechanism, this article first presents an ABAC (attribute-based access control) model based on Boolean expressions of subject and object attributes. It then proposes an authorization recycling approach for this model. In this approach, we provide construction and update methods for authorization data caches and access control decision-making rules for SDP (secondary decision point) by using the caches. The proposed approach can deduce precise and approximate access control decisions from the cache of authorization data, reducing communication between the PEP and the PDP. Finally, the feasibility of the proposed method is verified by conducting a small-scale test. ABAC, SDP, authorization recycling, and authorization caching.

Blockchain-Based Access Control Techniques for IoT Applications

The Internet of Things is gaining more importance in the present era of Internet technology. It is considered as one of the most important technologies of everyday life. Moreover, IoT systems are ceaselessly growing with more and more devices. They are scalable, dynamic, and distributed, hence the origin of the crucial security requirements in IoT. One of the most challenging issues that the IoT community must handle recently is how to ensure an access control approach that manages the security requirements of such a system. Traditional access control technologies are not suitable for a large-scale and distributed network structure. Most of them are based on a centralized approach, where the use of a trusted third party (TTP) is obligatory. Furthermore, the emergence of blockchain technology has allowed researchers to come up with a solution for these security issues. This technology is highly used to record access control data. Additionally, it has great potential for managing access control requests. This paper proposed a blockchain-based access control taxonomy according to the access control nature: partially decentralized and fully decentralized. Furthermore, it presents an overview of blockchain-based access control solutions proposed in different IoT applications. Finally, the article analyzes the proposed works according to certain criteria that the authors deem important.

An Attribute-Based Access Control Policy Retrieval Method Based on Binary Sequence

With the widespread application of new technologies, fine-grained authorization requires a large number of access control policies. However, the existing policy retrieval method applied to a large-scale policy environment has the problem of low retrieval efficiency. Therefore, this paper proposes an attribute access control policy retrieval method based on the binary sequence. This method uses binary identification and binary code to express access control requests and policies. When the policy is retrieved, the appropriate group is selected through the logical operation of the access control request and the policy binary identification. Within the group, the binary code of the access control request is matched with the binary code of all rules to find suitable rules, thereby reducing the number of matching attribute-value pairs in the rule and improving the efficiency of policy retrieval. Experimental results show that the policy retrieval method proposed in this paper has higher retrieval efficiency.

Efficient Access Control Permission Decision Engine Based on Machine Learning

Access control technology is critical to the safe and reliable operation of information systems. However, owing to the massive policy scale and number of access control entities in open distributed information systems, such as big data, the Internet of Things, and cloud computing, existing access control permission decision methods suffer from a performance bottleneck. Consequently, the large access control time overhead affects the normal operation of business services. To overcome the above-mentioned problem, this paper proposes an efficient permission decision engine scheme based on machine learning (EPDE-ML). The proposed scheme converts the attribute-based access control request into a permission decision vector, and the access control permission decision problem is transformed into a binary classification problem that allows or denies access. The random forest algorithm is used to construct a vector decision classifier in order to establish an efficient permission decision engine. Experimental results show that the proposed method can achieve a permission decision accuracy of around 92.6% on a test dataset, and its permission decision efficiency is significantly higher than that of the benchmark method. In addition, its performance improvement becomes more obvious as the scale of policy increases.

Improved Access Control Mechanisms Using Action Weighted Grid Authorization Graph for Faster Decision Making

Access control mechanisms are the way to guarantee secure access to grid resources. Recent research works were focused on how to improve the representation of the resources' security policies for faster decisions making. PCM, HCM, GAG, and WGAG are all different ways to represent these security policies. This paper presents an enhancement to WGAG, the action-weighted grid authorization graph (Action-WGAG). A security policy-parser (SP-Parser) has been developed to implement the Action-WGAG. The evaluation results of the proposed model showed that it assures a smaller number of security rule checking in some cases and a reduction of the answer time to an access control request.

Decentralized Context Aware Access Control Model for Internet of Things

Access control mechanisms are a primary security requirement in Internet of Things applications. Traditional access control mechanisms are inefficient while applying directly to IoT applications. Various proposals have been made to adapt traditional access control models for IoT applications. These proposals are either centralized or distributed approaches. In centralized approach, for each access request, it is required that device access central control server to verify access rights via multiple message exchanges. This results in communication overhead at a device side. A single point of failure is also possible if the central server fails. In distributed approach, for each access control request, reliance is still there on a central unit, which again results into communication overhead and possibility of a single point of failure. In IoT applications, access rights are also dependent on various characteristics of the entities involved at the specific instance of access request. These characteristics are interpreted by providing context awareness to the access control models. Context aware access control models are used to provide fine-grained access rights in IoT applications. We propose a decentralized context aware access control model in this paper. Our design results in lesser communication overhead with the central unit and removes single point of failure. Our model uses contextual information to provide fine-grained access control mechanism. Our model provides greater flexibility to users to easily add/modify access control policies for different entities.

Provisional Access Control Model for Mobile Ad-Hoc Environments: Application to Mobile Electronic Commerce

INTRODUCTION Mobile devices with wireless communication capabilities have become part of our lives. In a mobile environment, compared to the static desktop environment, network resources are constantly accessed through these devices while users are still moving. In this new mobile environment, it is easy to form a mobile ad-hoc network where neighboring mobile devices are forming a self-configuring network connected by wireless links. Examples include vehicular ad-hoc networks (VANETs) where neighboring vehicles communicate important information on road conditions or ride-share, social networks for finding friends, navigation advice in transportation, asset tracking, and mobile collaborative work. Especially, application to mobile electronic commerce is in our particular interests such as online ad-hoc auction market environment where auctioneers allow bidding from neighboring potential buyers. In this environment, each mobile user is treated as a peer because one can retrieve data from one's neighboring mobile devices, and at the same time, one can provide the information as the other people request the information that she brings. This local search-and-discover action is performed by each peer without connecting to the centralized server. In order to protect one's own resources, each peer specifies its own security/privacy policies. In a mobile peer-to-peer environment, access control decision depends on (i) specific actions performed before the decision is taken and (ii) also spatio-temporal attributes. First, connection between peers is arbitrary; and thus, it would be more appropriate if the access control decision is based on the conditions that the resource-holding peer has. For example, in online ad-hoc auction market, an auctioneer allows bidding of only serious users who meet the criteria such as reading and signing the contract beforehand. Second, access control decisions are also based on current locations (i.e., spatial attribute) of neighboring peers within the specific time durations (temporal attribute). For example, in location-based services (LBS) applications, a mobile user wants to receive promotion deals only if the current location of the user is within a certain distance from the merchant during the evening hours in order not to be overwhelmed by spam mails from merchants. The Role-based access control (RBAC) model is popular because it can handle complicated enterprise-wide access requests where the traditional access control models such as Mandatory Access Control (MAC) and Discretionary Access Control (DAC) cannot handle. In RBAC, a role denotes a job function, and permissions to perform certain operations are assigned to specific roles instead of users. Then, each user is assigned to particular roles. Although facilitating resource sharing with enforcing security/privacy policies in a static environment has been discussed (Maruoka, Memati, Barolli, Enokido & Takizawa, 2008; Park, An, & Chandra, 2007; Park & Hwang, 2003; Ravichandran & Yoon, 2006; Silva et al. 2005), it is not applicable to a mobile ad-hoc environment due to the following reasons. First of all, existing RBAC cannot be directly applicable to a mobile ad-hoc environment since peers are constantly moving over time and the policies are updated based on time and space. A naive solution would use a trusted party which authenticates each user and makes an access control decision. However, this is not practical especially for mobile a-hoc environment where participating peers are not predetermined and do not have the capability to connect to the central server. Also, it creates an issue with scalability of the system because the trusted server must be able to deal with all the access control requests and evaluates each peer's security policies. Considering the fact that these policies are based on space and time as well as specific actions that each peer has performed, overheads to the system to enforce these policies would not be scalable. …

Using the Pairing Function for Distributed Access Control in Cloud Computing

Access control has vital significance in cloud computing, where data files are stored in the cloud server. In current schemes, the cloud server typically needs to consult the backend authorization server, when processing access control request from data users. This will put a heavy burden on the authorization server, and therefore introduce Denial-of-Service attack on it. To address this issue, this paper models the access control requirement in cloud computing, and designs a distributed access control scheme. Its security features and efficiency are analyzed. The results show that our scheme is quite improved, because it separates the authorization process from the access control process, and releases the authorization server from the access control process. By doing so, the burden on the authorization server is reduced, and the Denial-of-Service attacks on it during access control process are avoided.

The Study of Access Control for Service-Oriented Computing in Internet of Things

In Internet of Things, computing and processing of information is the core supporting. In this paper, we introduce “Service-Oriented Co mputing” to solve the computing and processing of information in IoT. However, a key challenge in service-o riented environ ment is the design of effect ive access control schemas.We put forward a model of Workflow -oriented Attributed Based Access Control (WABA C), and an access control framework based on WABAC model. WABA C model grants and adapts permissions to subjects according to subject atttribute, resource attribute, environment attribute and current task, meeting access control request of SOC. Using the approach presented can effectively enhance the access control security for SOC applicat ions, and prevent the abuse of subject permissions.

A Model of Workflow-oriented Attributed Based Access Control

Abstract —the emergence of “Internet of Things” breaks previous traditional thinking, which integrates physical infrastructure and network infrastructure into unified infrastructure. There will be a lot of resources or information in IoT, so computing and processing of information is the core supporting of IoT. In this paper, we introduce “Service-Oriented Computing” to solve the problem where each device can offer its functionality as standard services. Here we mainly discuss the access control issue of service-oriented computing in Internet of Things. This paper puts forward a model of Workflow-oriented Attributed Based Access Control (WABAC), and design an access control framework based on WABAC model. The model grants permissions to subjects according to subject atttribute, resource attribute, environment attribute and current task, meeting access control request of SOC. Using the approach presented can effectively enhance the access control security for SOC applications, and prevent the abuse of subject permissions.

A trusted decentralized access control framework for the client/server architecture

This paper proposes a trusted decentralized access control (TDAC) framework for the client/server architecture. As the fundamental principle, TDAC enforces access control policies at the client side and protects sensitive objects at the server side by leveraging trusted computing technologies. Compared with the previous work of Sandhu and Zhang (2005), TDAC uses fewer requirements for trusted components. To implement TDAC, we design a private trusted reference monitor that runs at the client side, evaluates an access control request, and signs a temporary access control credential for a client application trustworthily; we also design a master reference monitor that runs at the server side, evaluates the request from the client application only according to the temporary access control credential. As a typical application, TDAC can protect client's private context data in subject-context aware access control.

Efficient and flexible access control via Jones-optimal logic program specialisation

We describe the use of a flexible meta-interpreter for performing access control checks on deductive databases. The meta-program is implemented in Prolog and takes as input a database and an access policy specification. For processing access control requests we specialise the meta-program for a given access policy and database by using the logen partial evaluation system. The resulting specialised control checking program is dependent solely upon dynamic information that can only be known at the time of actual access request evaluation. In addition to describing our approach, we give a number of performance measures for our implementation of an access control checker. In particular, we show that by using our approach we get flexible access control with virtually no overhead, satisfying the Jones optimality criterion. The paper also shows how to satisfy the Jones optimality criterion more generally for interpreters written in the non-ground representation.