Access Permissions Research Articles

Self-Sovereign Identity-Based E-Portfolio Ecosystem

In Taiwan, traditional student assessments, covering academic and extracurricular achievements, have shifted from paper to electronic portfolios (e-portfolios). However, limited trust among institutions restricts students from freely sharing and using their educational data. This paper introduces a self-sovereign identity-based infrastructure aimed at enhancing personal data security within the e-portfolio ecosystem. The proposed system includes two core components: (1) a decentralized identity chain, aligning user identities across platforms and granting users full self-sovereign control; and (2) an e-portfolio application chain to manage user interactions and access permissions within the ecosystem. A trusted educational authority also audits data sources, ensuring data integrity and reliability. This infrastructure empowers users to control who can access their data, safeguarding their security, with the identity chain preventing unauthorized access and the application chain recording authorization statuses to restrict data visibility to approved parties only.

Development of a Smart Lock System using QR Code Technology

A smart lock system refers to a modern security solution that enables users to remotely control access to their homes or businesses using a smart device such as smartphone, tablet, or computer. This paper presents the development of a smart lock system using Quick Response (QR) code technology to address the problem of insecurity, inconvenience, and inflexibility in access control. The proposed system eliminates the need for physical keys or complex authentication and verification methods. The system integrates an ESP8266 microcontroller, barcode scanner, 16x2 liquid-crystal display (LCD), solenoid lock, relay, and a 12V power supply. The system allows authorised users to generate unique QR codes representing their access credentials through a user-friendly interface. These QR codes are scanned by the system, which processes the codes, verifies access permissions via a central server and provides real-time feedback through the LCD. Upon successful verification, the system triggers a relay to control the solenoid lock, to grant or deny access. The implementation and testing of the smart lock system demonstrated successful operation. The performance indices include authentication speed, system reliability, accuracy and response time, which were evaluated and found to be satisfactory. The obtained results showed that the proposed system outperformed traditional methods such as keys, and fingerprint authentication, with an access speed of 2.00 seconds, which is significantly faster than the alternatives. Comparative analysis with existing access control techniques demonstrated the developed system's enhanced security features and user-friendly operation, making it applicable for residential, commercial, and industrial use. Additionally, the system's scalability and adaptability allow it to be customised for various environments, offering a versatile solution to diverse security challenges. This work contributes to the field of security technology by providing an efficient and scalable smart lock system with novel algorithms, which enhances the convenience, robustness of access control and seamless user experience.

Light sensor based covert channels on mobile devices

The widespread adoption of light sensors in mobile devices has enabled functionalities that range from automatic brightness control to environmental monitoring. However, these sensors also present significant security and privacy risks within the Android ecosystem due to unrestricted access permissions. This paper explores how light sensor data can be used for covert communication through a novel, light-based out-of-band channel. We develop two approaches–Baseline and ResetBased–that use luminance values to encode and decode data. These methods tackle challenges that arise from data variability and the unpredictability of sensor event timings. To enhance data transmission accuracy, our methods employ a novel strategy for selecting luminance reference sequences and leverage mean-squared-error-based distance for decoding. Experimental results validate the effectiveness of our approaches and their potential for real-world applications.

Design and implementation of a decentralized document management system

Digital document management systems (DMSs) can enhance organizational efficiency, security, and compliance, fostering collaboration and reducing operational costs, and are widely used for convenience and productivity. However, DMSs are vulnerable to security issues, such as unauthorized access, document forgery, and malicious insider activities. Traditional DMSs grant access permissions to individual users, which increases the risk of document leakage or manipulation when these permissions are misused. This article aims to design and implement a decentralized document management system (DDMS) that enhances the security and integrity of digital documents by decentralizing access permissions and using blockchain technology. The proposed DDMS encrypts digital documents using a symmetric key and then the key is divided and distributed among multiple users through Shamir’s secret sharing scheme. The encrypted documents are stored using the InterPlanetary file system (IPFS), ensuring integrity through content-based addressing. And blockchain-based smart contracts manage access permissions and document retrieval, ensuring access is only granted when a predefined number of participants agree. We implement our system using the Ethereum blockchain and IPFS and evaluated its performance against other types of DMSs. The experimental results demonstrate that the proposed DDMS significantly enhances security and integrity compared to three types of DMSs. While the system introduces a reasonable performance overhead, particularly with larger documents, it effectively prevents unauthorized access and tampering. For instance, the proposed system incurs approximately 12 s (1.2%) overhead when handling an 8GB document compared to the P2 system, but ensures tamper-proof access control and document integrity. As a result, the proposed DDMS addresses the critical security vulnerabilities found in conventional DMSs by decentralizing document access and leveraging blockchain and decentralized storage. This approach offers a robust solution for secure, tamper-resistant document management, making it suitable for organizations requiring high levels of confidentiality and document integrity.

Home-Field Advantage in Soccer: UEFA Champions League and Europa League Evaluation on the 2021-2022 Season

Competition analysis in football is an important method to evaluate the success and failure of teams. Home advantage is considered as an important factor in achieving success in competitions. The aim of this study is to examine the effect of home advantage on technical criteria in the UEFA Champions League and UEFA Europa League, which are organised at club level, played in the 2021-2022 season. In the data collection phase, descriptive survey method was used. Within the scope of the research, a total of 262 football matches, excluding the final matches played at neutral grounds and total of 744 goals scored in these matches were analysed in terms of home and away teams in the UEFA Champions League and Europa League. The goals scored were categorised as the goal minutes intervals, the goal scoring areas (Inside the Penalty Area: IPA; Outside the Penalty Area: OPA), the ways goals were scored (Head Kick; Foot Kick), the number of touches on the ball before the goal (1 Touch: 1T; 2 Touches: 2T; 3 Touches: 3T; 4 Touches + >4T), the direction of attack before the goal and the goals scored from set-pieces (Corner Kick; Penalty Kick and Free Kick) for the home and away teams. The images of the analysed goals were accessed on the UEFA official website with open access permission. Frequency (f) and percentage (%) were calculated for the evaluation of the data obtained, and since the data did not show normal distribution according to the Shapiro-Wilk test results, Kruskal-Wallis test was applied to look at the difference between the groups and the significance level was accepted as p

Exploring user privacy awareness on GitHub: an empirical study

GitHub provides developers with a practical way to distribute source code and collaboratively work on common projects. To enhance account security and privacy, GitHub allows its users to manage access permissions, review audit logs, and enable two-factor authentication. However, despite the endless effort, the platform still faces various issues related to the privacy of its users. This paper presents an empirical study delving into the GitHub ecosystem. Our focus is on investigating the utilization of privacy settings on the platform and identifying various types of sensitive information disclosed by users. Leveraging a dataset comprising 6,132 developers, we report and analyze their activities by means of comments on pull requests. Our findings indicate an active engagement by users with the available privacy settings on GitHub. Notably, we observe the disclosure of different forms of private information within pull request comments. This observation has prompted our exploration into sensitivity detection using a large language model and BERT, to pave the way for a personalized privacy assistant. Our work provides insights into the utilization of existing privacy protection tools, such as privacy settings, along with their inherent limitations. Essentially, we aim to advance research in this field by providing both the motivation for creating such privacy protection tools and a proposed methodology for personalizing them.

Efficient provable dual receiver hybrid and light weight public key schemes based on the discrete logarithm problem without pairings

AbstractDual‐receiver proxy re‐encryption is a cryptographic technique that enables secure data sharing among multiple authorized users or entities. It has gained significant attention for its ability to manage access permissions, data confidentiality, and streamline communication channels. These schemes have been widely used in various applications, including healthcare systems, cloud computing, Internet of Things (IoT) systems, collaborative environments, and secure communication channels. This paper aims to propose two proxy re‐encryption schemes for dual receivers without pairings. The first is dual receiver lightweight proxy re‐encryption without pairings (DR‐LWPRE‐WP), which uses a public key scheme to reduce computational complexity. The second is dual receiver hybrid proxy re‐encryption without pairings (DR‐HPRE‐WP), which incorporates public key and symmetric key schemes. Both schemes offer protection against selected plaintext attacks based on the decisional Diffie‐Hellman principle. The DR‐LWPRE‐WP scheme reduces computation by approximately 53% compared to pairing‐based schemes, making it suitable for lightweight applications like the Internet of Things. The computational efficacy of these schemes offers significant benefits for resource‐constrained environments and practical implementations.

A cross domain access control model for medical consortium based on DBSCAN and penalty function

BackgroundGraded diagnosis and treatment, referral, and expert consultations between medical institutions all require cross domain access to patient medical information to support doctors’ treatment decisions, leading to an increase in cross domain access among various medical institutions within the medical consortium. However, patient medical information is sensitive and private, and it is essential to control doctors’ cross domain access to reduce the risk of leakage. Access control is a continuous and long-term process, and it first requires verification of the legitimacy of user identities, while utilizing control policies for selection and management. After verifying user identity and access permissions, it is also necessary to monitor unauthorized operations. Therefore, the content of access control includes authentication, implementation of control policies, and security auditing. Unlike the existing focus on authentication and control strategy implementation in access control, this article focuses on the control based on access log security auditing for doctors who have obtained authorization to access medical resources. This paper designs a blockchain based doctor intelligent cross domain access log recording system, which is used to record, query and analyze the cross domain access behavior of doctors after authorization. Through DBSCAN clustering analysis of doctors’ cross domain access logs, we find the abnormal phenomenon of cross domain access, and build a penalty function to dynamically control doctors’ cross domain access process, so as to reduce the risk of Data breach. Finally, through comparative analysis and experiments, it is shown that the proposed cross domain access control model for medical consortia based on DBSCAN and penalty function has good control effect on the cross domain access behavior of doctors in various medical institutions of the medical consortia, and has certain feasibility for the cross domain access control of doctors.

A New Approach to Chinese Delivery Software under the New Situation: A Business Report on Campus Pickup ServicesCan-grab

This paper introduces the design of Can-grab, a campus service app for college students. Providing two sections of servicesdelivery and housekeeping, Can-grab aims to bring the last miles convenience to customers. Stanley Milgrams concept of the six-degree network and distribution of coupons are used for promotion. This essay examines the key benefits of Can-grab, including the marketing strategy and market size. According to the joint analysis, the lowest estimates of Total Addressable Market Size, Serviceable Available Market Size, and Serviceable Obtainable Market Size are estimated at 42 million, 26 million, and 8.32 million. By comparing the revenue, the best price is concluded as 7.8 yuan when time=30 and function=3. The Acquisition cost and LTV are 8 yuan and 34,897.4 yuan, respectively. This paper makes a three-stage plan for the future development of can-grab, introduces the start-up members and department structure, and points out the potential problems for development, including personal privacy and security, campus access permission, and intense market competitiveness.

The Effect of Student-Centered Teaching Methods and Techniques on Academic Achievement in Life Sciences Teaching: A Meta-Analysis Study

In this study, it was aimed to determine the general effect of student-centered teaching on students' academic achievement in life science teaching. For this purpose, 25 theses scanned in YÖK Thesis Center, having open access permission and methodologically meeting the criteria for inclusion in meta-analysis constituted the data of this study. From 25 thesis studies, 26 effect values were calculated by meta-analysis method. Cohen's g value was used to determine the effect values. The studies included in the meta-analysis were first tested for publication bias using the Rosenthal method and funnel plot. In addition, Z value, significance of Z value, Q value and chi-square distribution values at 25 degrees of freedom were used to decide the meta-analysis model. It was found that the studies included in the meta-analysis did not show publication bias and were heterogeneously distributed. Accordingly, meta-analysis was conducted according to the random effects model. According to the findings obtained in the study, it was seen that each study included in the analysis independently positively affected students' academic achievement. It was determined that the overall effect size of the studies integrated according to the random effects model was 1.028. From this point of view, it was concluded that student-centered teaching methods and techniques in life science teaching have a large positive effect on students' academic achievement.

An Architecture of Enhanced Profiling Assurance for IoT Networks

Attacks launched from IoT networks can cause significant damage to critical network systems and services. IoT networks may contain a large volume of devices. Protecting these devices from being abused to launch traffic amplification attacks is critical. The manufacturer usage description (MUD) architecture uses pre-defined stateless access control rules to allow or block specific network traffic without stateful communication inspection. This can lead to false negative filtering of malicious traffic, as the MUD architecture does not include the monitoring of communication states to determine which connections to allow through. This study presents a novel solution, the enhanced profiling assurance (EPA) architecture. It incorporates both stateless and stateful communication inspection, a unique approach that enhances the detection effectiveness of the MUD architecture. EPA contains layered intrusion detection and prevention systems to monitor stateful and stateless communication. It adopts three-way decision theory with three outcomes: allow, deny, and uncertain. Packets that are marked as uncertain must be continuously monitored to determine access permission. Our analysis, conducted with two network scenarios, demonstrates the superiority of the EPA over the MUD architecture in detecting malicious activities.

Auditable and dynamic access control scheme with behavior and identity tracing

Ciphertext policy attribute-based encryption (CP-ABE) is a potential solution to security sharing issues since it offers one-to-many encryption and fine-grained access control. To prevent users from disclosing their access permissions, traceable CP-ABE schemes are emerging. However, the current traceable CP-ABE schemes still have some security problems, such as impromptu attribute retracting, unreliable tracking, and easy disclosure of access policy privacy, making it essential to implement dynamic data security sharing and malicious user auditing. To address these issues, we propose an auditable and dynamic access control scheme with behavior and identity tracing. The scheme first uses an access tree with hidden leaf nodes to express the access policy, improving the flexibility and security of access control. Secondly, the Blockchain and InterPlanetary File System (IPFS) frameworks perform the audit authentication and store the ciphertext, policy, and public keys to avoid tampering with shared data. Furthermore, to prevent users from leaking their decryption keys, a tracing algorithm based on white-box traceability is developed. On this basis, an authority update algorithm is proposed to revoke the malicious user’s permission immediately and update the decrypted key for unrevoked users. An auditable smart contract based on blockchain is proposed to prevent user denial. Finally, theoretical analyses prove that the proposed scheme not only achieves traceability, revocation, authority updating, policy hiding, and audit, but also guarantees security under a chosen plaintext attack model. Experiments demonstrate that our proposal reduces the key generation time by 22.6%, the encryption and decryption time by 39.2% and 59.8%, and the storage costs of ciphertext and private key are reduced by 12.1% and 5.6% over existing schemes.

Self-Provisioning Infrastructures for the Next Generation Serverless Computing

Serverless computing has ushered in a transformative paradigm, with a promise to alleviate developers from the intricacies of infrastructure management. However, current serverless platforms predominantly offer only serverless compute capabilities. As a consequence, the application developers are once again tasked to explicitly provision and manage the backend services (BaaS), such as object stores or API gateways, the infrastructure, and the configuration models. This violates the main promise of serverless computing and erases much of the practical benefits of the serverless paradigm. It also introduces the challenges of managing the application execution environment, which includes maintaining provisioning and deployment scripts, configuring and managing access permissions, and scaling the services during runtime. To address these challenges, in this paper we introduce a novel paradigm for the next generation of serverless computing, called self-provisioning infrastructure. The self-provisioning infrastructure is an infrastructure that is capable to automatically and autonomously (with zero-configuration and zero-touch) provision serverless functions, their infrastructure, and their supporting BaaS services. To achieve this vision, we introduce novel design principles, models, and mechanisms that are formalized via novel programming, function, and system models. With this novel paradigm, we intend to fortify the core design principles of serverless computing but also extend them to the entire application execution environment. By doing so, we aim to enable the next-generation serverless computing in the Edge-Cloud continuum.

SMART LOCK SYSTEM USING IOT AND SOLANA BLOCKCHAIN

This project explores the integration of Solana blockchain technology with smart locking systems to revolutionize access control and security. Leveraging the decentralized and immutable nature of the Solana blockchain, the intelligent system provides a powerful platform to manage access permissions and monitor lock transactions in real-time. With integrated management and remote control, users can grant or revoke access from any mobile or web application. The scalability and efficiency of the Solana blockchain enable the system to process large volumes of transactions without sacrificing performance, making it suitable for widespread use in the field, workplace, and office. Overall, the integration of the Solana blockchain into smart registration systems represents a significant advance in access control, providing a secure, transparent and user-friendly solution to the problems of the digital age. This project presents the design and implementation of a smart lock system empowered by Solana blockchain technology, aimed at enhancing security, transparency, and efficiency in access control. Leveraging a distributed ledger framework, the system facilitates decentralized access management, allowing users to remotely authorize and monitor door access through a user-friendly mobile/web interface. The integration of Solana blockchain ensures immutability and transparency in access permissions, while also offering scalability and low-latency transaction processing capabilities. Hardware components, including smart lock mechanisms and gateway devices, are seamlessly integrated with software modules such as firmware, gateway software, and blockchain integration layers to enable secure communication and interoperability. Robust security measures, including encryption protocols and cryptographic algorithms, safeguard data integrity and privacy. Through meticulous testing, deployment, and documentation processes, this project delivers a reliable and future-ready smart lock solution poised to redefine access management paradigms in various settings, from residential homes to commercial establishments. Key Words: Solana, Smart locking systems, Security, Blockchain, Immutability

Hierarchical Identity-Based Authenticated Encryption with Keyword Search over encrypted cloud data

With the rapid development of cloud computing technology, cloud storage services are becoming more and more mature. However, the storage of sensitive data on remote servers poses privacy risks and is presently a source of concern. Searchable Encryption (SE) is an effective method for protecting sensitive data while preserving server-side searchability. Hierarchical Public key Encryption with Keyword Search (HPEKS), a new variant of SE, allows users with higher access permission to search over encrypted data sent to lower-level users. To the best of our knowledge, there exist only four HPEKS schemes in the literature. Two of them are in traditional public-key setting, and the remaining ones are identity-based public key cryptosystems. Unfortunately, all of the four existing HPEKS schemes are vulnerable against inside Keyword Guessing Attacks (KGAs). Moreover, all of the existing HPEKS schemes are based on the computationally expensive bilinear pairing operation which dramatically increases the computational costs. To overcome these issues, in this paper, we introduce the notion of Hierarchical Identity-Based Authenticated Encryption with Keyword Search (HIBAEKS). We formulate a security model for HIBAEKS and propose an efficient pairing-free HIBAEKS scheme. We then prove that the proposed HIBAEKS scheme is secure under the defined security model and is resistant against KGAs. Finally, we compare our proposed scheme with related constructions regarding security requirements, computational and communication costs to indicate the overall superiority of our proposed scheme.

A fine-grained reversible data hiding in encrypted domain based on the cipher-text redundancy of encryption process

Considering the granularity of embedded data in the design of reversible data hiding scheme has important research significance for the permission control and management of multi-granularity information. To broaden the application possibilities of encrypted data in cloud environments, the researchers propose a fine-grained reversible data hiding method leveraging the cipher-text redundancy of ElGamal encryption. Initially, prior to the encryption process, pixels are organized into a full binary tree based on fine-grained access permissions. Subsequently, a chaotic sequence generator is employed to assign distinct embedding keys to each layer of the full binary tree according to the access permissions. Following this, an XOR operation is conducted between the embedding key and the corresponding secret information in each layer to derive the target features of the cipher-text, facilitating subsequent fine-grained data hiding. Throughout the ElGamal encryption process, iterative manipulation of the random variable ensures alignment between the cipher-text output and the target feature, enabling the embedding of secret information across different layers. This approach facilitates the fine-grained blind extraction of secret information from an encrypted state, thereby expanding the potential applications of cipher-text by extracting information without revealing the original data. Furthermore, the scheme enhances information security through distributed storage and conceals the presence of information hiding by leveraging the separability of lossless decryption and information extraction. Simulation results demonstrate that secret information of three granularities can be embedded and extracted without interference within a three-layer full binary structure, with a maximum embedding capacity of up to 1.75 bpp.

Time-Controllable Keyword Search Scheme With Efficient Revocation in Mobile E-Health Cloud

Electronic health (e-health) systems may outsource data such as patient e-health records to mobile cloud servers for efficiency gains (e.g., minimizing local storage and computation costs). However, such a move may result in privacy implications in the presence of semi-honest cloud servers. Searchable Encryption (SE) can potentially facilitate privacy-preserving searches based on keywords for encrypted data stored in the mobile cloud, but most existing SE solutions do not support temporal access control (i.e., a mechanism that grants access permissions to users for specified time ranges). Hence, in this paper we design a time-controllable keyword search scheme by using an attribute-based comparable access control. This allows users to match indexes encrypted at specified time intervals. Then, we improve the basic framework to support efficient user revocation using secret sharing. We then formally prove the security of our proposed frameworks against chosen-keyword attack and key collusion attack, as well as achieving keyword secrecy. We also evaluate the performance of our proposed approach using a real-world dataset to demonstrate their practical utility.

Android Apps Vulnerability Detection with Static and Dynamic Analysis Approach using MOBSF

Ensuring the security of Android applications is paramount, especially for apps like Mobile JKN, launched by the Social Security Agency on Health “BPJS Kesehatan” under the Ministry of Health Republic Indonesia, which contain sensitive participant data. Such information is often targeted by cybercriminals seeking personal gain through data theft by exploiting security vulnerabilities within the application. To address these risks, a thorough analysis was conducted to detect security loopholes in the Mobile JKN application. The study used the Mobile Security Framework (MOBSF) tools and involved static and dynamic analyses. Despite the application’s implementation of secure SSL Pinning and detection of rooted devices, the static analysis revealed potential security loopholes, including dangerous permission access, weak cryptographic methods, and vulnerable hardcoded secrets. Moreover, the application was found vulnerable to Janus, SQL Injection, and padding oracle attacks. While the dynamic analysis showed satisfactory implementation of SSL Pinning and no performance degradation, it also revealed that root detection was lacking, and debugger connections were not detected while the application was running. These findings emphasize the critical need for immediate security enhancements in the Mobile JKN application.

A Block Chain-Based Access Control Framework with Privacy Protection in Cloud

Access control is a pivotal aspect of modern computing systems, ensuring that only authorized entities can interact with sensitive data and resources. Traditional access control methods, while effective, face challenges in terms of security, transparency, and scalability. Blockchain technology has emerged as a promising solution to enhance access control in cloud computing environments. Blockchain's inherent features, such as decentralization, immutability, and cryptographic security, offer a unique framework for addressing the limitations of traditional access control systems. In this paper, we explore the integration of blockchain technology with cloud computing to establish a more secure and transparent access control mechanism. By utilizing blockchain, access control policies and permissions can be stored in a tamper-proof and transparent ledger. Scalability is an issue since processing many access control transactions on the blockchain might cause network congestion and sluggish processing. Transactions take time to upload to the blockchain, which can delay real-time access choices. It takes skill to integrate and manage blockchain and cloud technologies together. Choosing the correct consensus mechanism affects system efficiency and security. Consider the costs of establishing and maintaining such a system and the difficulty of fixing faults owing to blockchain immutability. In conclusion, this paper underscores the significance of access control in cloud computing and the limitations of traditional approaches. By harnessing the power of blockchain technology, a more secure, transparent, and scalable access control framework can be established, revolutionizing the way we manage access to sensitive data and resources in complex digital ecosystems.

Academic Credentials Issuance and Validation System Using Blockchain

Certificate generation and validation have long been essential processes in various domains, from education and professional certifications to document authentication. However, traditional methods of issuing and verifying certificates often suffer from issues like fraud, tampering, and inefficient record-keeping. Digital certificates with distinctive cryptographic hashes are produced using blockchain technology and safely stored there. This increases trust and lowers the danger of certificate counterfeiting by making certificates easily available and tamper-proof. Blockchain facilitates seamless validation. By instantaneously verifying certificates against the blockchain, anyone with access permissions can streamline the verification process by doing away with middlemen. It could make certificates easily available across institutions and borders, offering to revolutionize the way we validate credentials in the sectors of education, healthcare, and other professions. It provides a clear and effective method of managing and validating certificates, ushering in a time of efficiency and confidence in the digital era. With the help of blockchain technology, certificates are now not only safe but also simple to access from different institutions and geographical locations. It offers a clear and effective method for managing and validating certificates, and it is expected to transform the way we check credentials and identities across a range of sectors, including supply chain management, healthcare, and education. Blockchain-powered certificate production and validation provide a bright future of trust and efficiency in a society that is becoming more and more dependent on digital records.