User Access Rights Research Articles

Efficient key management for cryptographically enforced access control

Cryptographic enforcement of access control mechanisms relies on encrypting protected data with the keys stored by authorized users. This approach poses the problem of the distribution of secret keys. In this paper, a key management scheme is presented where each user stores a single key and is capable of efficiently calculating appropriate keys needed to access requested data. The proposed scheme does not require encryption of the same data (key) multiple times with the keys of different users or groups of users. It is designed especially for the purpose of access control. Thanks to that, the space needed for storing public parameters is significantly reduced. Furthermore, the proposed method supports flexible updates when user's access rights change.

Modular Web-Based Atlas Information Systems

Atlas information systems (AIS) present spatial information on predefined themes and localities in the form of maps and other representations, generally focusing on correct cartographic appearance and offering a certain degree of user interaction. This article introduces the concept of modular AIS, a concept that is essential for the development of an AIS with modern computer technology. The main advantages of a modular architecture are twofold: first, an AIS software framework based on a modular architecture allows for easy and rapid customization to a certain theme and locality; second, functional enhancements and new technologies can be easily integrated into a modular AIS in order to optimally present and analyse the data at hand. Web-based AIS can benefit from the concept of modularity at three different levels: (1) The AIS client can adjust its functionality and adapt to the available technology on the present computer platform. (2) The AIS server can build an AIS client with custom-tailored data and functionality in real time, depending on the user's access rights, needs, or expertise. (3) Distributed, modular data storage greatly simplifies the design, implementation and maintainance of an AIS by using a mediation system. To illustrate the concepts presented, we will discuss selected technical aspects (e.g., Web-based map viewer technology, client–server communication), and describe an exemplary Web-based AIS that extends the modular core architecture through specialized functionalities for the analysis of geophysical data. It is the authors’ hope that the ideas presented will provide an introduction to the technical concepts for designers and developers of similar Web-based atlas information systems.

Compact access control labeling for efficient secure XML query evaluation

Fine-grained access controls for XML define access privileges at the granularity of individual XML nodes. In this paper, we present a fine-grained access control mechanism for XML data. This mechanism exploits the structural locality of access rights as well as correlations among the access rights of different users to produce a compact physical encoding of the access control data. This encoding can be constructed using a single pass over a labeled XML database. It is block-oriented and suitable for use in secondary storage. We show how this access control mechanism can be integrated with a next-of-kin (NoK) XML query processor to provide efficient, secure query evaluation. The key idea is that the structural information of the nodes and their encoded access controls are stored together, allowing the access privileges to be checked efficiently. Our evaluation shows that the access control mechanism introduces little overhead into the query evaluation process.

An Access Control System with Time-constraint Using Support Vector Machines

Access control is an important issue in information security. It is a necessary mechanism for protecting data in a computer system. In this paper, we apply support vector machines to construct an access control system. The security management framework is a pattern classification system using well trained support vector machines. The proposed system can not only be applied to broad access policies, but the access rights of users can also be associated with a time period. The proposed scheme is useful to make predictions on real-time data and it is better adapted to complex computer systems.

Authorization Translation for XML Document Transformation

XML access control models proposed in the literature enforce access restrictions directly on the structure and content of an XML document. Therefore access authorization rules (authorizations, for short), which specify access rights of users on information within an XML document, must be revised if they do not match with changed structure of the XML document. In this paper, we present two authorization translation problems. The first is a problem of translating instance-level authorizations for an XML document. The second is a problem of translating schema-level authorizations for a collection of XML documents conforming to a DTD. For the first problem, we propose an algorithm that translates instance-level authorizations of a source XML document into those for a transformed XML document by using instance-tree mapping from the transformed document instance to the source document instance. For the second problem, we propose an algorithm that translates value-independent schema-level authorizations of non-recursive source DTD into those for a non-recursive target DTD by using schema-tree mapping from the target DTD to the source DTD. The goal of authorization translation is to preserve authorization equivalence at instance node level of the source document. The XML access control models use path expressions of XPath to locate data in XML documents. We define property of the path expressions (called node-reducible path expressions) that we can transform schema-level authorizations of value-independent type by schema-tree mapping. To compute authorizations on instances of schema elements of the target DTD, we need to identify the schema elements whose instances are located by a node-reducible path expression of a value-independent schema-level authorization. We give an algorithm that carries out path fragment containment test to identify the schema elements whose instances are located by a node-reducible path expression.

The myth of technological neutrality in copyright and the rights of institutional users: Recent legal challenges to the information organization as mediator and the impact of the DMCA, WIPO, and TEACH

AbstractThis article discusses the accelerating trend of ownership rights in digital property, copyright, in specific. This trend is in contrast to the stated legislative purpose of copyright law to be neutral as to the technology that either owners employ to embody the copyrighted work or that others employ to facilitate access and use of the work. Recent legislative initiatives as well as interpretive court decisions have undermined this important concept. There is an ascendancy of digital ownership rights that threatens to undermine the concept of technological neutrality, which in essence guarantees that ownership and well as “use” rights apply equally to analog and digital environments. The result of this skewing is twofold: an unstable environment with respect to the access and use rights of individuals, institutions, and other users of copyrighted material, and the incentive of copyright owners to present works to the public in digital formats alone, where ownership rights are strongest. This article attempts to plot that digital ascendancy and demonstrate the undermining of neutrality principles.

The TOLIMAC project: access control, charging and payment of electronic information resources by means of smart cards

TOLIMAC is a research project funded by the Telematics for Libraries Programme of the EU and is developing a system to provide controlled access to, and management of, networked information resources and other services in a library environment. The system is based on smart cards and encryption technology integrating management functionalities ‐such as user identification, remote access control, electronic payment‐, and security requirements ‐such as secure information transfer and financial transactions, document integrity. The system also enables libraries to adjust user access rights, and charges for available electronic resources, whether local or remote, according to user categories. The system is based on standards. It has a Web interface. The pilot system will provide users from three university libraries with access to an electronic document delivery service based at INIST (France), including search, order and delivery of journal articles, as well as payment facilities by means of the electronic purse on the user's smart card.

Efferent connections of the cerebellar fastigial nucleus in the macaque monkey

In long-term and large-scale environmental and forest monitoring schemes, a large amount of data is collected over long periods, which needs to be managed in a cost-efficient, transparent, and sustainable database management system (DBMS). Centralized data collection and validation by a coordination unit responsible for the establishment of rules for data transfer and checking routines is recommended. The ultimate objective being pursued by all partners active in a large monitoring program is to develop a state-of-the-art, Web-based information storage, and delivery system capable of ensuring reliable and user friendly service for data providers and data users as well as for administrative work by the coordination unit. General principles and procedures for data preparation, data quality control, and storage using a DBMS are presented. A comprehensive approach offers tools for dissemination of data, metadata, and results, as well as an automatic reporting application integrated with a WebGIS. Access rights for users are controlled by a rights-and-role management tool. As an example, the ICP Forests database system is described.

In-house access to PACS images and related data through World Wide Web

The development of a hospital wide PACS is in progress at the University Hospital of Geneva and several archive modules are operational since 1992. This PACS is intended for wide distribution of images to clinical wards. As the PACS project and the number of archived images grow rapidly in the hospital, it was necessary to provide an easy, more widely accessible and convenient access to the PACS database for the clinicians in the different wards and clinical units of the hospital. An innovative solution has been developed using tools such as Netscape navigator and NCSA World Wide Web server as an alternative to conventional database query and retrieval software. These tools present the advantages of providing a user interface which is the same, independent of the platform being used (e.g. Mac, Windows, UNIX), and an easy integration of different types of documents (e.g. text, images). A strict access control has been added to this interface. It allows user identification and access rights checking, as defined by the in-house hospital information system, before allowing the navigation through patient data records.

Implementing policy in enterprise networks

There is a need for a general policy management architecture that can guide one in understanding and implementing policy in diverse management applications. The question of policy in network management has evolved since the early '70s concern with monitoring and controlling the access rights of multiple users and resources in large distributed systems. It is now generally acknowledged that policy also plays an important role in other areas of network management, including configuration, accounting, fault, and performance management. Furthermore, it is agreed that a general policy framework is needed for controlling the behavior of the agents the enterprise network comprises, including network users, administrators, troubleshooters, the applications running on the network, and the operational parameters of network hardware. The authors present a framework for understanding and implementing policy in the management of enterprise networks. We describe typical network scenarios in which policy plays a role, a general architecture for policy management and the components and operations of the architecture at a level of abstraction that renders it applicable to specific management tasks which require policy. We also provide an example of the architecture in configuration management. The article draws from work on policy management, including two ESPRIT projects.

Authentication mechanisms in microprocessor-based local area networks

The problem of authenticating the users of a computer network in order to protect the shared resources against unauthorized use is discussed. Since intruders could enter the network and try to use services they have no right to access, the host implementing the service (or server) has to check the user's identity and access rights by searching in the relevant database. The author presents a method of carrying out such checks efficiently. The basic idea is that a suitable interface process is associated with each user-server connection in order to filter out unauthorized requests, thus implementing a sort of cache with parallel search where the working set of the whole database is stored and explored. The use of the interface process enables the system to exploit the hardware support for capability checking provided by new microprocessors. In particular, an implementation using iAPX432-based hosts is illustrated and performance issues are discussed.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

The use of architectural principles in the design of certifiably secure systems

The notion of security, as it applies to information processing, encompasses many approaches and a wide variety of desired ends. A great deal of effort has gone into the problem of certifying the security of a system for use in a ‘multi-level’ environment. Both the data and the population of users are assumed to have different (but discernable) characteristics; policies are established to determine the access rights of users to data based upon these characteristics; and the system is deemed secure if and only if it may be shown never to permit violations of the policy. As the policy typically involves both read and write access, this paradigm has relevance to both national security and the private sector, concerned with disclosure and fraudulent modification of data respectively. It has been customary to model the mechanisms enforcing policies as security kernels. The original notion was of a reference monitor with three notable properties, and the security kernel was one possible embodiment of the monitor. This paper argues that the kernel, seen as being at the heart of the operating system, is in need of rethinking in light of the newer architectures (especially those based upon capabilities) and the proliferation of excellent, readily available, supporting software. What is suggested is that an appropriate use of architectural principles, coupled with vigorously applied administrative procedures and some of the advances in technology, might very well serve to form the basis of the demonstration that a system is secure. It will be argued that only such an amalgam of mechanisms will provide sufficient power both to demonstrate the security of a system and to serve as a criterion of certification for those concerned with this type of security.