Access Permissions Research Articles

Secure Authenticated Communication Via Digital Signature and Clear List in VANETs

Vehicular ad hoc network (VANET) plays a vital role in the intelligent transportation system (ITS). When a vehicle receives a message through network, the CRL (certificate revocation list) checking process will operate before certificate and signature verification. After successful authentication, a CRL list is created based on authentication. This CRL is used to verify whether a vehicle node can be permitted for communication in the VANET network. But when using CRL, a huge amount of storage space and checking time is needed. So we proposed a method without the CRL list. It mentions a key management list to overcome large storage space and checking time. Even it reduced the access delay. For access permission we can do an authentication system based digital novel signature authentication (DNSA) for each vehicle in the VANET with the RSU unit or with other participant node vehicles in the communication as per the topology. We can perform an efficient and secured communication in VANET.

Proxy Re-Encryption Scheme for Decentralized Storage Networks

Storage is a promising application for permission-less blockchains. Before blockchain, cloud storage was hosted by a trusted service provider. The centralized system controls the permission of the data access. In web3, users own their data. Data must be encrypted in a permission-less decentralized storage network, and the permission control should be pure cryptographic. Proxy re-encryption (PRE) is ideal for cryptographic access control, which allows a proxy to transfer Alice’s ciphertext to Bob with Alice’s authorization. The encrypted data are stored in several copies for redundancy in a permission-less decentralized storage network. The redundancy suffers from the outsourcing attack. The malicious resource provider may fetch the content from others and respond to the verifiers. This harms data integrity security. Thus, proof-of-replication (PoRep) must be applied to convince the user that the storage provider is using dedicated storage. PoRep is an expensive operation that encodes the original content into a replication. Existing PRE schemes cannot satisfy PoRep, as the cryptographic permission granting generates an extra ciphertext. A new ciphertext would result in several expensive replication operations. We searched most of the PRE schemes for the combination of the cryptographic methods to avoid transforming the ciphertext. Therefore, we propose a new PRE scheme. The proposed scheme does not require the proxy to transfer the ciphertext into a new one. It reduces the computation and operation time when allowing a new user to access a file. Furthermore, the PRE scheme is CCA (chosen-ciphertext attack) security and only needs one key pair.

An interest‐based access control scheme via edge verification in Named Data Networking

SummaryNamed Data Networking (NDN) is a disruptive future architecture, in which content delivery can be significantly improved through named routing and distributed caching. However, distributed caching also leads to serious access control problems. Once a content is disseminated to the network, any entity can fetch it regardless of owning the access permission or not. To protect the authorized content, current solutions are mainly designed based on data packet encryption, but redundant in‐network traffic is still a challenge due to illegal interest‐data exchange. Focus on this problem, an Interest‐Based Access Control scheme via Edge Verification (IBAC‐EV) is proposed in this paper. In IBAC‐EV, the producer authorizes the user to sign interest packet. By checking the signature, the edge router can forbid unsubscribed users to enter network through discarding interest packets. Simulation results show that IBAC‐EV can effectively reduce the in‐network traffic. Moreover, by using proxy signature algorithm, it simplifies the complexity of key management and alleviates the storage overhead on the edge router.

Evaluation Of Network Access Restrictions Using Mac Address Filtering On Microtik To Improve Network Security

Freedom in the use of the internet network needs to be implemented in a security system in order to keep the hotspot / wifi facilities used by responsible users. Ibnu khaldun Vocational School 1 is a state school that has many study programs, one of which is Computer and Network Engineering. The problem that occurs in the Vocational High School Ibnu Khaldun is the absence of restrictions on internet network access in the use of internet networks at schools so that students, teachers, and school staff are free to use hotspot / wifi facilities, in terms of WLAN (Wireless Local Area Network) network security. The purpose of this study is to evaluate internet network security using Mac Address Filtering which is implemented at SMK Ibnu Khaldun by registering Mac Address clients on the Access List menu to obtain access permissions in an effort to improve network security. The research approach used in this research is the quantitative approach. The result of this research is that after the Wilcoxcon test, the value of Asymp.Sig is obtained. (2-tailed) of 0.000 which indicates that the value of Asymp.Sig. (2-tailed) < 0.05 then Ha is accepted and Ho is rejected. So the results of the evaluation of internet network access restrictions using MAC Address Filtering to improve network security are accepted

Evaluation Of Network Access Restrictions Using Mac Address Filtering On Microtik To Improve Network Security

Freedom in the use of the internet network needs to be implemented in a security system in order to keep the hotspot / wifi facilities used by responsible users. Ibnu khaldun Vocational School 1 is a state school that has many study programs, one of which is Computer and Network Engineering. The problem that occurs in the Vocational High School Ibnu Khaldun is the absence of restrictions on internet network access in the use of internet networks at schools so that students, teachers, and school staff are free to use hotspot / wifi facilities, in terms of WLAN (Wireless Local Area Network) network security. The purpose of this study is to evaluate internet network security using Mac Address Filtering which is implemented at SMK Ibnu Khaldun by registering Mac Address clients on the Access List menu to obtain access permissions in an effort to improve network security. The research approach used in this research is the quantitative approach. The result of this research is that after the Wilcoxcon test, the value of Asymp.Sig is obtained. (2-tailed) of 0.000 which indicates that the value of Asymp.Sig. (2-tailed) < 0.05 then Ha is accepted and Ho is rejected. So the results of the evaluation of internet network access restrictions using MAC Address Filtering to improve network security are accepted

Privacy Preservation and Access Control for Sharing Electronic Health Records Using Blockchain Technology

Sharing of Electronic Health Records (EHRs) is of significant importance in health care. Lately, a cloud-based electronic health record sharing scheme has been used extensively to share patient records among various healthcare organizations. However, cloud centralization may compromise patients’ privacy and security. Due to the special features of blockchain, it is important to see this technology as a promising solution to resolve these issues. This article proposes a privacy-preserving, secure EHR sharing and access control framework based on blockchain technology. The proposal aims to implement EHR blockchain technology and ensure that electronic records are stored safely by specifying user access permissions. We emulate the cryptographic primitives and use smart contracts to describe the relationships between the EHR owner and EHR user through the proposed system on the Ethereum blockchain. We assess the proposal results based on encryption and decryption time and the costs of the smart contract. The encryption and decryption times are proportional to the size of the EHR, which varies from 128 KB to 128 MB. When it comes to encryption, the smallest EHR takes 0.0012 s to encrypt, while the largest EHR, which is 128 MB, takes 1.4149 s. On the other hand, a 128 KB EHR takes 0.0013 s to decrypt, whereas a 128 MB EHR requires 1.6284 s. As a result, performance evaluation and security analysis confirm that the proposal is secure for practical application.

Securing the access control policies to the Internet of Things resources through permissioned blockchain

AbstractSecurity and privacy of information transmitted among the devices involved in an Internet of Things (IoT) network represent relevant issues in IoT contexts. Guaranteeing effective control and supervising access permissions to IoT applications is a complex task, mainly due to resources' heterogeneity and scalability requirements. The design and development of highly customizable access control policies, along with an efficient mechanism for ensuring that the rules applied by the IoT platform are not tampered with or violated, will undoubtedly have a significant impact on the diffusion of IoT‐based solutions. In such a direction, the article proposes the integration of a permissioned blockchain within an honest‐but‐curious (i.e., not trusted) IoT distributed middleware layer, which aims to guarantee the correct management of access to resources by the interested parties. The result is a robust and lightweight system, able to manage the data produced by IoT devices, support relevant security features, such as integrity and confidentiality, and resist different kinds of attacks. The use of blockchain will ensure the tamper‐resistance and synchronization of the distributed system, where various stakeholders own applications and IoT platforms. The methodology and the proposed architecture are validated employing a test‐bed.

Content Analysis of Theory-Based Graduate Theses Published in the Field of Distance Education in Turkey between 2008-2020

Purpose: To examine the trends in theory-based graduate theses published between 2008-2020 in the field of distanceeducation in Turkey.Methodology: In this study, which aims to examine theory-based graduate theses published in the field of distance educationin Turkey between 2008-2020, systematic literature review was adopted and content analysis technique was used in theanalysis of data. 483 theses with access permission in the Council of Higher Education (YOK) national database were examinedand 150 theses that were suitable for the research criteria were included in the study. Theses were categorized using the"Thesis Review Form", which has different fields such as thesis type, thesis title, the year the thesis was published, the universitywhere the thesis was published, the variables used in the theses, the science fields of the theses, the theory / model used inthe theses, the sample level of the theses and the sample sizes. The data of 150 theses, which are theory-based, were analyzedwith the descriptive content analysis technique.Findings: When the theses included in the study are examined, it has been determined that one of every three theses publishedin the field of distance education are based on theory. Considering the theoretical basis of the theses, it has been seen that thetheories of Social Presence, ARCS Motivation and Interactional Distance were given the most place. While Anadolu Universityand Gazi University were the universities where the most theses were published, Computer Sciences emerged as the fieldwhere the most theses were published. It was seen that academic success and attitude were the most studied variables in thetheses. It was concluded that the sample group studied in the theses mostly consisted of students studying at undergraduateand primary education level, and 31-100 participants were preferred more as the sample size.Highlights: In the study, 150 graduate theses published between 2008-2020 in the field of distance education in Turkey andmeeting the research criteria were examined and it was determined that one of these three theses was theory-based. Sincethis number has been determined to be quite small, it is thought that the findings obtained from this study will be useful for adeeper understanding of the theses that have a theoretical basis in distance education, by providing suggestions for futureresearch, and to contribute to the thesis work or research planned to be done in the future on this subject.

Blockchain based hierarchical semi-decentralized approach using IPFS for secure and efficient data sharing

Nowadays, cloud servers are gathering an increasing amount of data. Data is commonly stored on cloud servers in the form of ciphertext to protect security and concealment of data. When a consumer requests to access of encrypted data, a third party must provide an access key. The system's security, however, will be compromised if the third party or internal personnel are dishonest. To address this issue, a novel blockchain-based secure decentralized system using IPFS is proposed in this research for secure data transfer. Because all participant of system model are recorded the every action on the chain, and the continuously extending chain makes it conditionally difficult to modify any block without being detected, a blockchain based system is often regarded as a safe platform. In the proposed approach, the data owner uploads an encrypted file to IPFS, which is subsequently separated into n secret sections called hash codes for data security. The data owner must additionally write the access permissions in order to achieve access to this secure data. For security, the system uses two-level key management: first, the data owner encrypts the file, and then the IPFS server makes a hash code of that encrypted file. The proposed solution, which employs blockchain technology, enables consumers to be handled across several domains, erase the single-point failure in traditional centralized systems, and overhead related to communication and computation are decreased at the consumer level. According to the security analysis, the proposed system might effectively resist single and collaboratively malicious persons, as well as untrustworthy cloud servers.

Understanding Users’ Behavior towards Applications Privacy Policies

Recently, smartphone usage has increased tremendously, and smartphones are being used as a requirement of daily life, equally by all age groups. Smartphone operating systems such as Android and iOS have made it possible for anyone with development skills to create apps for smartphones. This has enabled smartphone users to download and install applications from stores such as Google Play, App Store, and several other third-party sites. During installation, these applications request resource access permissions from users. The resources include hardware and software like contact, memory, location, managing phone calls, device state, messages, camera, etc. As per Google’s permission policy, it is the responsibility of the user to allow or deny any permissions requested by an app. This leads to serious privacy violation issues when an app gets illegal permission granted by a user (e.g., an app might request for granted map permission and there is no need for map permission in the app, and someone can thereby access your location by this app). This study investigates the behavior of the user when it comes to safeguarding their privacy while installing apps from Google Play. In this research, first, seven different applications with irrelevant permission requests were developed and uploaded to two different Play Store accounts. The apps were live for more than 12 months and data were collected through Play Store analytics as well as the apps’ policy page. The preliminary data analysis shows that only 20% of users showed concern regarding their privacy and security either through interaction with the development team through email exchange or through commenting on the platform and other means accordingly.

Authorized Update in Multi-user Homomorphic Encrypted Cloud Database

Cloud Computing is a promising solution in distributed internet computing for IT and scientific research. However, data storage and computing in the cloud domain raise added questions in terms of security. Data encrypted with traditional encryption schemes may confirm confidentiality, but computation in cloud domain becomes infeasible. This paper focuses on designing an encrypted database considering homomorphic encryption (HE) as an underlying scheme so that query execution is carried out on encrypted version of the database without any need of intermediate decryption. Existing encrypted databases are either based on partial HE or deterministic HE to achieve practical performance; hence, they are either limited in terms of types of query execution or prone to known attacks. To mitigate these issues, we explore the practical challenges of a fully homomorphic encryption (FHE)-based database design. FHE theoretically promises to perform arbitrary operations on encrypted data. However, realizing any algorithm in homomorphic domain requires a circuit-based representation of that specific algorithm, which is a non-trivial task. In this work, we explore the practical challenges of FHE database design, mostly in the case of multi-user organizational scenarios, and propose a scheme for secure modification or conditional update of the encrypted database. Moreover, when an organization outsources a database to the cloud, a single FHE key is used to encrypt all columns of the database. However, all users(or employees) of the same organization should not have equal read and write access permission to the whole database. In this work, we propose an architecture to apply Attribute-Based Access Control (ABAC) on FHE databases with minimum overhead in terms of performance and storage. We propose required changes in registration, login, and user revocation phases for our scheme to perform conditional SQL query processing on FHE encrypted database (EDB). Our proposed framework is capable of performing end-to-end encrypted conditional UPDATE with suitable access control within 17 minutes on a multi-core processor platform for 769 rows and 9 columns of database size with 16-bit size of data. To the best of our knowledge, our proposed technique is the first one in literature to support arbitrary secure encrypted SQL query execution with suitable access control.

FileWallet: A File Management System Based on IPFS and Hyperledger Fabric

Online file management systems enable cooperatively editing and sharing. However, due to the cost of communication and storage infrastructures, traditional online file management services, e.g., Google Drive and OneDrive, usually provide limited storage space and relatively low download speed for free users. To achieve better performance, ordinary users have to purchase their expensive services. Moreover, these file management systems are based on centralized architecture and bear the privacy leakage risk, because users’ personal files are stored and controlled by their servers. To address the above problems, we propose a peer-to-peer (P2P) file management system based on IPFS and Hyperledger Fabric, named as FileWallet, which can serve as a personal wallet for individual users or organizations to store and share their files in a secure manner. In FileWallet, the users form a P2P network and a Fabric network, where P2P network builds the connections and distributed storage network and the Fabric network sustains consistent blockchain ledgers to record file operation related transactions. In our FileWallet, the storage and communication costs are mitigated in the decentralized design, and the file owner can fully control the access permission of the file to preserve the file privacy. The design of the system architecture, main functionalities, and system implementations are presented in this paper. The performance of the system is evaluated through experiments, and the experimental results show its wide applicability and scalability.

Permissioned Blockchain Approach using Open Data in Healthcare

Digital health records play a key role in the area. However, it is difficult to obtain a unified view of your data, as it is distributed among different providers, spread over several places, and is not integrated. To address these problems, blockchain technology and the openEHR interoperability standard have emerged. Blockchain is a new wave of disruption that has come to redesign interactions that involve any form of exchange of values, with the potential to improve healthcare, bringing a new perspective on security, resilience, and effectiveness of systems. In turn, with the use of openEHR, the standardization of electronic records is guaranteed, offering fine-grained access permissions for stakeholders. In addition to the use of archetypes as a reference to make the templates, where they are integrated to build a module with compatible standards.Based on an open data framework, OpenEHR, and blockchain technology, this paper has conceptualised a proposed two architectures that will be implemented within a Portuguese hospital, at the ICU, to increase and provide support for clinical decision-making, ensuring interoperability between systems, as well as the veracity, privacy and security of the data being used.

Relevance and prospects of the development of Privileged Access Management solutions

The subject matter of the article is cyber security incidents related to the violation of the rights of privileged users and the development of the market of PAM solutions over the past five years — 2017–2022. And there is also a process of safe and secure granting of access permissions to the organization's information systems with the provision and tracking of secure user activity in the company's business network and cloud environment. The goal and tasks are: determining the relevance and need for management and administrator access control tools, as well as studying the growth trends of the PAM service market. Determination of prospects for the development of a strategy for the implementation of PAM solutions for or in cloud environments. The methods used are: forecasting methods based on market analysis and conclusions from the presented reports of international companies regarding the development of PAM solutions and increasing demand for system data in the future, as well as observing trends in the transition of organizations' activities to the cloud environment with the development of cloud services: IaaS, PaaS, SaaS. The following results were obtained: the reports of CIS Controls, OWASP, Balabit, Gartner, Allied Marked Research and studies of global vendors: Heimdal security, Microsoft, IBM were considered, which made it possible to draw the necessary conclusions and prove the feasibility of using and increasing demand for PAM systems in the next ten years and prove the prospects and the need to implement a new PAM development strategy in the cloud through integration and blurring the boundaries with IAM. Conclusions. The scientific novelty of the obtained market research results indicates that the interest of PAM solutions on the part of customers, who will be aware of the need for access control tools for administrators, determines the further development and competitiveness of these systems. Increasing attack surfaces, increased security risks, the need to keep up with modern business processes — all this requires the implementation of new PAM solutions with an increased level of security, automation, as well as integration to ensure comprehensive information protection, which will become an integral part of the overall strategy information and cyber security of both enterprises and state institutions.

User Centric Android Application Permission Manager

Mobile malware has become a very hot research topic in the last few years, and this was due to the widespread usage of mobile devices all over the world. Like other systems, mobile devices are prune to different attacks that might invade user’s privacy and lead to private data leakage. Millions of Mobile application have been developed and used Worldwide, most of them are requiring permissions to work properly. The permission management problem is more apparent on Android systems rather than other mobile systems such as iOS. Some of these permissions might lead to successful security attacks on Android systems and hence lead to privacy leakage. To reduce the possibility of such attacks, many researchers have proposed mobile applications that help users to manage access permissions for their mobile applications. Most of the proposed systems lack the ability to profile users according to their preferences and do not provide automatic follow up with temporary granted permissions. In this research, we propose a User Centric Android Application Permission Manager tool called (UCAAPM), that provides an efficient and flexible way for managing permissions and profiling these permissions for each user, these profiles can be used on any Android device. UCAAPM will automatically follow up users permissions and grant/deny the permission on a scheduling basis defined by the user’s profile and according to his preferences. Experimental results showed that the tool works efficiently in terms of CPU, RAM, and power consumption, furthermore users are highly satisfied with using it.

CoMeT: Configurable Tagged Memory Extension.

Commodity processor architectures are releasing various instruction set extensions to support security solutions for the efficient mitigation of memory vulnerabilities. Among them, tagged memory extension (TME), such as ARM MTE and SPARC ADI, can prevent unauthorized memory access by utilizing tagged memory. However, our analysis found that TME has performance and security issues in practical use. To alleviate these, in this paper, we propose CoMeT, a new instruction set extension for tagged memory. The key idea behind CoMeT is not only to check whether the tag values in the address tag and memory tag are matched, but also to check the access permissions for each tag value. We implemented the prototype of CoMeT on the RISC-V platform. Our evaluation results confirm that CoMeT can be utilized to efficiently implement well-known security solutions, i.e., shadow stack and in-process isolation, without compromising security.

GA4GH Passport standard for digital identity and access permissions

SummaryThe Global Alliance for Genomics and Health (GA4GH) supports international standards that enable a federated data sharing model for the research community while respecting data security, ethical and regulatory frameworks, and data authorization and access processes for sensitive data. The GA4GH Passport standard (Passport) defines a machine-readable digital identity that conveys roles and data access permissions (called “visas”) for individual users. Visas are issued by data stewards, including data access committees (DACs) working with public databases, the entities responsible for the quality, integrity, and access arrangements for the datasets in the management of human biomedical data. Passports streamline management of data access rights across data systems by using visas that present a data user’s digital identity and permissions across organizations, tools, environments, and services. We describe real-world implementations of the GA4GH Passport standard in use cases from ELIXIR Europe, National Institutes of Health, and the Autism Sharing Initiative. These implementations demonstrate that the Passport standard has provided transparent mechanisms for establishing permissions and authorizing data access across platforms.

Examination of postgraduate thesis studies on teachers working in the field of special education in Turkey (2000-2020)

The aim of this research was to examine graduate thesis studies conducted in the field of special education in Turkey about special education teachers in terms of various variables. In the thesis scanning center of the Council of Higher Education Center (YOK), it was determined that 89 graduate thesis studies in the special education field were conducted. Yet, due to the reason that six of them did not have access permissions, 83 graduate thesis studies were examined. Of the postgraduate thesis examined, 79 of them are master's and four are doctoral dissertations. As a result of the research, it was determined that most of the graduate thesis studies were conducted in 2019. Moreover, when the distribution of universities is examined it has been observed that most of the graduate thesis were studied at Necmettin Erbakan University and Marmara University, and most of the thesis advisor titles are Assist. Prof. Dr. It was concluded that most of the postgraduate thesis were carried out in the Special Education Department and when the methods used in the studies were examined, it was noted that the quantitative method was preferred the most. Considering the research models used in the studies, it was concluded that the correlational survey model was used the most and the sources used in the graduate thesis were mainly domestic sources.

ACCESS - IoT enabled smart lock

<div class="abstract">ACCESS is a centrally controlled extensible security system - a system for enhancing accessibility and security methods. Security is an important matter of concern and everyone wants things easy and fast with the advancement of technology. Many IoT engineers are inclined towards home automation today. An area of recent interest is the automation of lock and key systems of homes and workplaces. This paper comprises mechanisms to view visitors of households, machinery, or any appliance that may be remotely controlled through a mobile application. Owners or supervisors can keep a watch on the guests and choose whom they want to grant entry to. This is conducted by providing the guests with temporary access permission for a validity period of the owner’s choice. They can also simultaneously monitor the activities of the guests.</div>

Multi-tenant data isolation techniques in public clouds assessing the effectiveness of isolation mechanisms

Cloud computing is characterized by its capacity for multiple tenants to share a single cloud infrastructure, which is known as multi-tenancy. Even while it offers cost-efficiency and resource optimization, implementing multi-tenancy raises a number of distinct security challenges. With an emphasis on isolation and access control methods, this paper aims to offer a thorough investigation into the security of multi-tenancy in cloud computing. In this study, the potential dangers that are linked with co-located tenants are investigated, and a variety of measures that can be used to guarantee strong isolation between renters are discussed. Furthermore, the research examines access control methods including Attribute-Based Access Control (ABAC) and Role-Based Access Control (RBAC) to enforce finer-grained access permissions. Both cloud service providers and tenants can enhance cloud security by learning and using effective isolation and access control mechanisms. This will help with multi-tenant setups and overall cloud security.