Access Control System Research Articles

Secured and Privacy-Preserving Multi-Authority Access Control System for Cloud-Based Healthcare Data Sharing

With continuous advancements in Internet technology and the increased use of cryptographic techniques, the cloud has become the obvious choice for data sharing. Generally, the data are outsourced to cloud storage servers in encrypted form. Access control methods can be used on encrypted outsourced data to facilitate and regulate access. Multi-authority attribute-based encryption is a propitious technique to control who can access encrypted data in inter-domain applications such as sharing data between organizations, sharing data in healthcare, etc. The data owner may require the flexibility to share the data with known and unknown users. The known or closed-domain users may be internal employees of the organization, and unknown or open-domain users may be outside agencies, third-party users, etc. In the case of closed-domain users, the data owner becomes the key issuing authority, and in the case of open-domain users, various established attribute authorities perform the task of key issuance. Privacy preservation is also a crucial requirement in cloud-based data-sharing systems. This work proposes the SP-MAACS scheme, a secure and privacy-preserving multi-authority access control system for cloud-based healthcare data sharing. Both open and closed domain users are considered, and policy privacy is ensured by only disclosing the names of policy attributes. The values of the attributes are kept hidden. Characteristic comparison with similar existing schemes shows that our scheme simultaneously provides features such as multi-authority setting, expressive and flexible access policy structure, privacy preservation, and scalability. The performance analysis carried out by us shows that the decryption cost is reasonable enough. Furthermore, the scheme is demonstrated to be adaptively secure under the standard model.

FACE RECOGNITION SYSTEM FOR AUTOMATIC DOOR ACCESS CONTROL

A face recognition system for automatic door access control has been developed in this work with a view to providing a relatively more robust and foolproof access control which can provide better security and reduce human errors inherent in other conventional methods. The system was designed with machine learning and artificial intelligence to capture faces, train faces with machine mode, and run trained faces to grant access to the user. The system uses the RaspberryPi module, camera module, servo motor and the GSM module which were all incorporated into the fabricated building to make up the prototype developed to provide access control by means of facial biometrics. In order to grant access to registered users, various photos of the users were taken in different positions and expressions with proper illumination. The user’s face is been captured by the camera module and saved in the database with the help of Raspberry Pi Module. Good lighting condition and other favorable conditions helps the camera module to recognize faces and sends signal to the Raspberry Pi which processes these images and opens the door with the help of the servo motor. The developed prototype was used to train fifty (50) users. It granted access to all fifty (50) users when there was proper illumination and pose but five (5) and nine (9) users respectively were denied access due to challenges of poor illumination and pose variation.

A technology transfer journey to a model-driven access control system

In the model-driven security domain, access control systems provide an application for handling access of persons through controlled gates. A gate, such as a door, can have a lock mechanism for securing the area from unauthorized access. Most commercial solutions for access control management offer pre-packaged software systems where customization of the authorization logic is either not allowed or subject to payment. Moreover, cross-platform development is a barrier for solution providers due to the high cost of development and maintenance that it implies. To overcome these limitations and further optimize the entire access control systems development process, we propose a model-driven approach that supports automatic code generation to enable communication between an IoT infrastructure and platforms for Facility Access Management. Specifically, the approach combines the benefits of Near-Field Communication (NFC) and Tinkerforge (i.e., an open-source hardware platform) with model-driven techniques. This allows the approach to exploit both behavioral and structural models for the modeling and the consequent code generation of part of the authorization mechanism, thus providing complete coverage of the code generated for the whole system. We implemented and evaluated our approach in a real-world case study within the premises of a fitness center with an IoT infrastructure consisting of several heterogeneous sensors by showing its practical applicability. Experimental results demonstrate the effectiveness of our approach in supporting abstraction and automation concerning traditional code-centric development through code generation features. Consequently, our approach makes the whole development process less time-consuming and error-prone, thus reducing the system’s time to market.

A Framework for Design, Verification, and Management of SoC Access Control Systems

System-on-chip (SoC) architectures are a heterogeneous mix of microprocessors, custom accelerators, memories, interfaces, peripherals, and other resources. These resources communicate using complex on-chip interconnect networks that attempt to quickly and efficiently arbitrate memory transactions whose behaviors can vary drastically depending on the current mode of operation and system operating state. Security- and safety-critical applications require access control policies that define how these resources interact to ensure that malicious and unsafe behaviors do not occur. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Aker</small> is a design and verification framework for on-chip access control. The core of <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Aker</small> is the access control wrapper (ACW)–a high-performance yet efficient hardware module that dynamically arbitrates on-chip communications. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Aker</small> distributes ACWs across the SoC and programs them to perform local access control. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Aker</small> provides a firmware generation tool and a property-driven security verification methodology to ensure that the ACWs are properly integrated and configured. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Aker</small> security verification confirms that the ACW behaves properly at IP level. It verifies the hardware root of trust firmware configures the ACW correctly. And it evaluates system-level security threats due to interactions between shared resources. <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Aker</small> is experimentally validated on a Xilinx UltraScale+ programmable SoC. Additionally, an <sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Aker</small> access control system is integrated into the OpenPULP multicore archtiecture that uses OpenTitan hardware root-of-trust for firmware configuration.

Lightweight certificate revocation for low-power IoT with end-to-end security

Public key infrastructure (PKI) provides the basis of authentication and access control in most networked systems. In the Internet of Things (IoT), however, security has predominantly been based on pre-shared keys (PSK), which cannot be revoked and do not provide strong authentication. The prevalence of PSK in the IoT is due primarily to a lack of lightweight protocols for accessing PKI services. Principal among these services are digital certificate enrollment and revocation, the former of which is addressed in recent research and is being pushed for standardization in IETF. However, no protocol yet exists for retrieving certificate status information on constrained devices, and revocation is not possible unless such a service is available.In this work, we start with implementing the Online Certificate Status Protocol (OCSP), the de facto standard for certificate validation on the Web, on state-of-the-art constrained hardware. In doing so, we demonstrate that the resource overhead of this protocol is unacceptable for highly constrained environments. We design, implement and evaluate a lightweight alternative to OCSP, TinyOCSP, which leverages recently standardized IoT protocols, such as CoAP and CBOR. In our experiments, validating eight certificates with TinyOCSP required 41% less energy than validating just one with OCSP on an ARM Cortex-M3 SoC. Moreover, validation transactions encoded with TinyOCSP are at least 73% smaller than the OCSP equivalent.We design a protocol for compressed certificate revocation lists (CCRL) using Bloom filters which together with TinyOCSP can further reduce validation overhead. We derive a set of equations for computing the optimal filter parameters, and confirm these results through empirical evaluation.

Secured MCDM Model for Crowdsource Business Intelligence

In the current era, there are a plethora of mobile phone companies rendering different features. It is challenging to distinguish the best and create correlations among them. However, this can be accomplished through crowdsourcing. Crowdsourcing is the process of gathering information from multiple sources, and we use the AHP (Analytic Hierarchy Process) process to determine which company’s model is the best among many. The weight value of each model is compared to the assigned values, and if one of the company product weights is greater than the assigned weight, that product is the best. Eventually, we can use this process to select the most preferred and best mobile phone model from among all other models. Gray Relational Analysis (GRA) is one of the most popular models, employing a grey co-efficient that estimates the data items by ranking. This model defines a process’s situation or state as black with no information and white with perfect information. In this work, AHP initially assumes criteria weights and assigns rank with the CR (Consistency Ratio) of 1.5%. The criteria weights are re-assigned based on the outcomes, and the CR remains constant as 1.5%. This work also provides an environmental-based attribute access control system, which adds the strength to the system by providing security and the integrity. So, this proposed work performs as a decision support system combined with the security enhancements, and hence it becomes a complete framework to provide a solution to a target application. The novelty of the proposed work is the combination of the crowdsourcing with the recommender system on a secured framework.

LACE: Low-Cost Access Control Based on Edge Computing for Smart Buildings

With the explosive growth in personal mobile devices, offloading computation through nearby mobile user devices as opportunistic edge servers to support complex applications with limited computation resources is receiving increasing attention. In this paper, we first establish the optimal opportunistic offloading problem using the statistical properties of user movement speed and CPU load of mobile edge servers. We then determine the amount of computation to be offloaded to individual mobile edge servers. Moreover, we design an adaptive mechanism based on PID to realize the function of continuing large data packets from breakpoints, mainly used to adjust the size of data packets automatically. It efficiently avoids data loss and reduces the cost of resources through the latency deviation as the variable of the gain function to estimate the packet size. Finally, an access control system based on edge computing is designed and developed to make full use of the mobile phones of nearby users. It can address the shortcomings of traditional schemes with high latency to some extent, and it makes latency lower and data reliability higher.

Self sovereign and blockchain based access control: Supporting attributes privacy with zero knowledge

Recent years have witnessed, especially in Europe, a shift aimed at bringing users back at the center of digital systems. This has driven innovation towards the affirmation of decentralized systems, in line with the Self Sovereign Identity paradigm. User control over the consumption and disclosure of their data is a key topic of such drive. In this paper we show how it is possible to apply this increasingly popular concept to a traditionally centralized and opaque digital process: Access Control systems. To this aim we expand the XACML standard for Attribute Based Access Control systems with the novel concept of private attributes, i.e. attributes whose values should not be disclosed while still contributing to a policy evaluation result after user consent. Basing our proposal on blockchain systems, we show how to leverage smart contracts and zero knowledge proofs to allow for transparent policies evaluation without disclosing the value of such sensible attributes. Beside formalizing our goals, presenting the system architecture, and discussing its advantages and drawbacks with respect to the traditional model, we provide a reference example to show our proposal innovative capabilities and provide a prototype experimental evaluation to prove its feasibility.

An Empirical Investigation of Human Identity Verification Methods

A recognition technique is essential in practically every industry in the current digital era. It has several advantages and may be used for security, identification, and authentication. The relevance of access control systems based on biometrics has grown in recent years since they have the ability to address the majority of the shortcomings of existing security systems. Automated biometric systems for human identification take a measurement of the body's "signature," compare it to a database, and make an application-specific determination. These biometric methods for personal verification and identification are based on physiological or behavioral traits that are usually recognizable, despite changing over time, such as fingerprints, hand geometry, the face, voice, lip movement, gait, and iris patterns. The purpose of this study is to conduct a thorough literature review in order to pinpoint the most well-known recognition techniques, applications, and obstacles.

УПРАВЛЕНИЕ ДОСТУПОМ К ЭЛЕКТРОННОЙ ИНФОРМАЦИОННО-ОБРАЗОВАТЕЛЬНОЙ СРЕДЕ ВУЗОВ ФЕДЕРАЛЬНЫХ ОРГАНОВ ИСПОЛНИТЕЛЬНОЙ ВЛАСТИ

The purpose of the article: analysis of the problem of ensuring timely authorized access to the resources of the electronic information and educational environment of universities of federal executive authorities and identification of possible directions for its solution. Research methods: system analysis of the problem of ensuring access of officials of universities of federal executive authorities to the resources of the electronic information and educational environment. The result obtained: approaches to improving the existing access control model, optimizing the role-based access scheme and determining unauthorized access attempts based on machine learning methods are proposed. Scope of the proposed approach: access control system of the electronic information and educational environment of universities of federal executive authorities. Scientific novelty: consists in a comprehensive analysis of the problem of creating and functioning of the electronic information and educational environment of universities of federal executive authorities, during which the structure of this environment is determined and its characteristic features are highlighted. Based on the analysis of information security threats in the electronic information and educational environment, the necessity of creating an access control system to its resources, which provides timely authorized access, is substantiated. The proposed approaches to improving the access control system affect not only the improvement of the existing access model by supplementing it with solutions available in the attribute-based access model, but also the optimization of the role- based access scheme using the developed genetic algorithm and the detection of unauthorized access attempts associated with overcoming access rules, based on application of machine learning methods. Experimental results are presented that confirm the effectiveness of the proposed approaches. Contribution: Igor Kotenko – analysis of the state of the art in the creation and application of the electronic information and educational environment of universities of federal executive authorities, setting the task and developing proposals for developing the functionality of the access control system, development of approaches to genetic optimization of the access scheme and detection of unauthorized access attempts using machine learning methods; Igor Saenko – development of approaches to improving the access control system related to the use of an attribute-based access model, genetic optimization of the access scheme and detection of unauthorized access attempts using machine learning methods; Roman Zakharchenko – analysis of technical solutions that ensure the implementation of the access control system to the resources of the electronic information and educational environment of universities of federal executive authorities, Alexander Kapustin – analysis of security threats and access control models to resources of the electronic information and educational environment of universities of federal executive authorities, Mazen Al-Barri – development and experimental study of an approach to detect attempts of unauthorized access to the resources of the electronic information and educational environment of universities of federal executive authorities, based on the use of machine learning methods

Face Identification System and Temperature Detection as A Control to Enter the Building

The purpose of this study was to develop an access control system for the identification of face and body temperature during the pandemic. Access control is granted after system tests and recognizes a person's face according to the information already stored. Facial identification system developed using the CNN method as a facial recognition process. While the Euclidean distance to calculate the pattern of the face extraction point. The sensor (DS18B20) is used for temperature detection and activating the LED if the temperature criteria and face identification are correct. The access control system is written with the Python programming system and uses the OpenCV module. Based on the results of the calculations from 5 datasets, the system has an accuracy of 75.31% with an average detectable temperature of 36.21 Celsius. This access control system can operate for 24 hours so that it is more effective and efficient in controlling entry into the building.

EduASAC: A Blockchain-Based Education Archive Sharing and Access Control System

EduASAC: A Blockchain-Based Education Archive Sharing and Access Control System

Blockchain-based EHR storage and access control system

Blockchain-based EHR storage and access control system

Access Control Systems Based on Blockchain Technology

Now a days the need for decentralized applications is increasing and blockchain provides the foundational technology for creating and developing them. The security and integrity of the blockchain network and its resources are supported by access controls, which is a crucial component of blockchain-based applications. This paper presents a study of various access control mechanisms, including smart contracts, consensus algorithms, and cryptographic protocols, to assess their benefits and limitations in different contexts of applications. The purpose of the paper is to present various access control systems in blockchain-based applications and their applicability and effectiveness in various use case scenarios.

Ether-IoT: A Realtime Lightweight and Scalable Blockchain-Enabled Cache Algorithm for IoT Access Control

Several unique characteristics of Internet of Things (IoT) devices, such as distributed deployment and limited storage, make it challenging for standard centralized access control systems to enable access control in today’s large-scale IoT ecosystem. To solve these challenges, this study presents an IoT access control system called Ether-IoT based on the Ethereum Blockchain (BC) infrastructure with Attribute-Based Access Control (ABAC). Access Contract (AC), Cache Contract (CC), Device Contract (DC), and Policy Contract (PC) are the four central smart contracts (SCs) that are included in the proposed system. CC offers a way to save user characteristics in a local cache system to avoid delays during transactions between BC and IoT devices. AC is the fundamental program users typically need to run to build an access control technique. DC offers a means for storing the resource data created by devices and a method for querying that data. PC offers administrative settings to handle ABAC policies on users’ behalf. Ether-IoT, combined with ABAC and the BC, enables IoT access control management that is decentralized, fine-grained and dynamically scalable. This research gives a real-world case study to illustrate the suggested framework’s implementation. In the end, a simulation experiment is performed to evaluate the system’s performance. To ensure data integrity in dispersed systems, the results show that Ether-IoT can sustain high throughput in contexts with a large number of requests.

MODERN PERSPECTIVES OF APPLYING THE CONCEPT OF ZERO TRUST IN BUILDING A CORPORATE INFORMATION SECURITY POLICY

Modern businesses have undergone significant changes as a result of digital advances and the recent COVID-19 pandemic. In particular, there has been an increase in the number of employees working remotely, using personal digital devices alongside corporate devices, and the enterprise itself moving business processes to the cloud or using hybrid environments that combine both cloud and on-premises services. Taken together, this leads to increased interaction between devices and services over open networks, creating new risks of cyber-attack. It is this situation that has led to the relevance and direction of this research. The paper analyzes the current state of effectiveness of the application of enterprise information security policy, in particular, identifies the main limitations associated with the difficulty, and sometimes impossibility, to control the behavioral aspects of enterprise employees to comply with the basic provisions of security policy and general information security. The basic principles of the Zero Trust conceptual approach are analyzed and the main advantages of its application in the formation of the security policy as a strategic approach to ensuring the information security of the enterprise in the conditions of dynamic growth of new threats and transformation of modern business are determined. At the same time, it is established that one of the key components of the Zero Trust architecture is the access control system. As a result, forming the prospects of applying the concept of Zero Trust in the construction and implementation of the information security policy, the necessity of conducting an accompanying study of the effectiveness of modern mechanisms of identification/authentication of access subjects was determined.

Review of hierarchical database access control for E-medicine systems.

Key management schemes for hierarchical access control enable users who have hierarchical relationships with each other to manage their secret keys efficiently. In these schemes, the users are divided into several groups, and all groups have their own central authorities. Each central authority is responsible for setting parameters and generating user's secret keys in a hierarchical structure such that all users efficiently derive their secret keys and solve dynamic access control problems. Several key management schemes with Health Insurance Portability Accountability Act regulations were recently proposed for hierarchical access control in e-medicine systems. However, these schemes either are insecure or require a large amount of storage and heavy computations. Therefore, this study reviews and discusses hierarchical access control schemes with privacy/security regulations for medical record databases.

AISCM-FH: AI-Enabled Secure Communication Mechanism in Fog Computing-Based Healthcare

Fog computing-based Internet of Things (IoT) architecture is useful for various types of delay efficient network communications and services, like digital healthcare. However, there are privacy and security issues with the fog computing-based healthcare systems, which can further increase the risk of leakage of sensitive healthcare data. Therefore, a security mechanism, such as access control for fog computing-based healthcare systems, is needed to protect its data against various potential attacks. Moreover, the blockchain technology can be used to solve the digital healthcare’s data integrity related problems. The use of Artificial Intelligence (AI) further makes the system more effective in case of prediction of health related diseases. In this paper, an AI-enabled secure communication mechanism in fog computing-based healthcare system (in short, AISCM-FH) has been proposed. The security analysis of the proposed AISCM-FH is provided using the standard random oracle model and also with the heuristic (non-mathematical) security analysis. A pragmatic study determines the impact of the proposed AISCM-FH on key performance indicators. Moreover, we include a detailed performance comparison of AISCM-FH with other relevant existing schemes to show that it has low communication and computation costs, and provides superior security and extra functionality attributes as compared to those for other competing existing approaches.

Security and privacy research of Internet of things systems in mobile networks

The escalating integration of Internet of Things (IoT) devices with mobile networks presents unprecedented opportunities and challenges in the context of security and privacy. This paper offers a comprehensive overview of recent research focusing on the security and privacy concerns associated with IoT systems operating within mobile networks. The fundamental concepts, emerging threats, and potential solutions in this dynamic landscape are examined. The distinctive characteristics of IoT devices and their unique security and privacy requirements are outlined. The paper discusses inherent vulnerabilities, including limited computational resources, device heterogeneity, and the expansive attack surface resulting from interconnected devices. Additionally, the growing risks associated with data collection, transmission, and storage within mobile network environments are explored, emphasizing the importance of protecting user privacy and sensitive information. State-of-the-art security mechanisms and protocols designed to safeguard IoT systems in mobile networks are surveyed. Approaches such as encryption, authentication, access control, and intrusion detection systems are discussed as means to mitigate potential threats. The paper addresses the challenge of secure device onboarding and underscores the importance of ensuring the integrity and authenticity of IoT components within the network. Furthermore, the role of standards and regulatory frameworks in shaping security and privacy requirements for IoT systems is examined. Initiatives by organizations such as the Internet Engineering Task Force (IETF) and the European Union’s General Data Protection Regulation (GDPR) are discussed in relation to their influence on the development and deployment of secure IoT solutions. In conclusion, this review highlights the ongoing need for continuous research and development in the security and privacy domains of IoT systems in mobile networks. As the adoption of IoT devices and mobile network technologies continues to grow, maintaining vigilance in addressing evolving threats and ensuring compliance with emerging regulations is imperative. This paper aims to provide valuable insights into the evolving landscape of IoT security and privacy, catering to researchers, practitioners, and policymakers, and paving the way for a more secure and privacy-preserving future for IoT deployments in mobile networks.

Dynamic Access Control Through Cryptography in Cloud

In recent days, enabling encrypted access control to hosted data is attractive to organizations and many users in untrusted cloud. However, an efficient encrypted progressive access control system designing in the cloud remains a challenge. This paper proposes DAC in cryptographic, for effective access control that provides practical encryption in the system. DAC in cryptography removes permission by designate to update the encrypted data in cloud. DAC in cryptography includes file encryption with a well- formed key list that document a file key and a set of lock keys. A dedicated administrator is required to replace a new revocation key by comparing the previous key. Revocation requires a dedicated administrator to upload a new revocation key to encrypt files with the new encryption level and update the encryption key list accordingly in cloud. DAC in cryptography proposes a three-key technique to limit the key list size and later on encryption. As a result, change in access control is enforced using DAC in cryptography. This improves efficiency by not requiring high decryption or re-encryption and to upload or re-upload of large quantity of data by the administrator and assures security by revoking permissions immediately. It demonstrates the construction safety and efficiency using formalization framework and system implementations.