Access Token Research Articles

Gentrification gone too far? affordable 2nd-class values for fun and (co-)effect

First-class functions dramatically increase expressiveness, at the expense of static guarantees. In ALGOL or PASCAL, functions could be passed as arguments but never escape their defining scope. Therefore, function arguments could serve as temporary access tokens or capabilities, enabling callees to perform some action, but only for the duration of the call. In modern languages, such programming patterns are no longer available. The central thrust of this paper is to re-introduce second-class functions and other values alongside first-class entities in modern languages. We formalize second-class values with stack-bounded lifetimes as an extension to simply-typed λ calculus, and for richer type systems such as F <: and systems with path-dependent types. We generalize the binary first- vs second-class distinction to arbitrary privilege lattices, with the underlying type lattice as a special case. In this setting, abstract types naturally enable privilege parametricity. We prove type soundness and lifetime properties in Coq. We implement our system as an extension of Scala, and present several case studies. First, we modify the Scala Collections library and add privilege annotations to all higher-order functions. Privilege parametricity is key to retain the high degree of code-reuse between sequential and parallel as well as lazy and eager collections. Second, we use scoped capabilities to introduce a model of checked exceptions in the Scala library, with only few changes to the code. Third, we employ second-class capabilities for memory safety in a region-based off-heap memory library.

CERTIFICATELESS ENCRYPTION FOR SECURE DATA SHARING IN PUBLIC CLOUD

Cloud computing is more popular in organizations and institutions because it provides storage and computing services at low cost. Cloud computing provide users and enterprises with various capabilities to store and process their data in third-party data centers that may be located far from the user ranging in distance from across a city to across the world. However, it also introduces new challenges for ensuring the confidentiality, integrity and access control of the data. Some approaches are given to ensure these security requirements but they are lacked in some ways such as violation of data confidentiality due to collusion attack and heavy computation (due to large no keys).To address these issues we propose a scheme that uses efficient certificate less in which data owner divides users in groups and gives single key to each user group for decryption of data and, each user in the group shares parts of the key. Certificateless cryptography is a Capricious of ID-based cryptography intended to prevent the key escrow problem. Ordinarily, keys are generated by a certificate authority or a key generation center (KGC) who is given complete power and is implicitly trusted. For prevention of a complete breakdown of the system in the case of a compromised KGC, the key generation process (KGP) is split between the KGC and the user. In this paper, we use capability list and access list to control the access. Authentication and access control are often merged into a single operation, so that access is approved based on successful authentication or based on an anonymous access token. This scheme not only provides the strong data confidentiality but also reduces the number of keys. Key words- capability list, authentication, certificateless cryptography, confidentiality, access control, malicious outsiders

MOONACS: a mobile on-/offline NFC-based physical access control system

Purpose The purpose of this paper is to present a smartphone-based physical access control system in which the access points are not directly connected to a central authorization server, but rather use the connectivity of the mobile phone to authorize a user access request online by a central access server. The access points ask the mobile phone whether a particular user has access or not. The mobile phone then relays such a request to the access server or presents an offline ticket. One of the basic requirements of our solution is the independence from third parties like mobile network operators, trusted service managers and handset manufacturers. Design/methodology/approach The authentication of the smartphone is based on public key cryptography. This requires that the private key is stored in a secure element or in a trusted execution environment to prevent identity theft. However, due to the intended independence from third parties, subscriber identity module (SIM)-based secure elements and embedded secure elements (i.e. separate hardware chips on the handset) were not an option and only one of the remaining secure element architectures could be used: host card emulation (HCE) or a microSD-based secure element. Findings This paper describes the implementation of such a physical access control system and discusses its security properties. In particular, it is shown that the HCE approach cannot solve the relay attack under conservative security assumptions and an implementation based on a microSD secure element is presented and discussed. Moreover, the paper also describes an offline solution which can be used if the smartphone is not connected to the access server. In this case, an access token is sent to the access point in response to an access request. These tokens are renewed regularly and automatically whenever the smartphone is connected. Originality/value In this paper, a physical access control system is presented which operates as fast as existing card-based solutions. By using a microSD-based secure element (SE), the authors were able to prevent the software relay attack. This solution is not restricted to microSD-based SEs, it could also be implemented with SIM-based or embedded secure elements (with the consequence that the solution depends on third parties).

퍼스널 클라우드 환경에서 사용자 관리를 위한 보안 프레임워크의 설계 및 평가

Cloud computing technologies are utilized and merged in various domains. Cloud computing technology-based personal cloud service technologies provide mobility and free access by using user centered storages and smart devices such like smart phones and table PCs. Therefore, we should overcome limits on the storage by solving the capacity problems of devices to provide security services in the personal cloud environments It can be addressable to provide the convenience of various security technologies. However, there are some security threats inherited from existing cloud environments and the possibilities of information leakage when devices are lost or stolen. Therefore, we designed a framework for providing secure cloud services by adding objects, such as user authorization, access tokens, set permissions by key generation, and key management assignments, for user management in personal cloud environments. We analyzed the stability of the proposed framework in terms of irreverent use and abuse, access to insiders, and data loss or leakage. And we evaluated the proposed framework in terms of the security with access control requirements in personal cloud environments.

High-dimentional data authentication protocol based on hash chain for Hadoop systems

Social media networks along with mobile devices are major sources of big data. A recent trend involves using Hadoop for big data to extract unique trends, insights, and patterns. However, Hadoop lacks secure authentication mechanisms that prevent unauthorized access to data. The current authentication token system that is used for user authentication in the Hadoop distributed file system (HDFS) is vulnerable to replay and datanode hacking attacks. This paper proposes a data authentication protocol that protects sensitive data in HDFS against malicious attacks. The proposed protocol uses the hash chain method instead of the key exchange method based on public-key encryption. An HDFS blocks in datanodes of the proposed protocol are accessed by a client with a valid block access token from a namenode. In addition, clients' anonymity is guaranteed because an HDFS adopting the proposed protocol passes hash-chained block values so the HDFS blocks that generates security awareness information is not exposed unnecessarily to a third party. An HDFS adopting the proposed protocol has the performance (e.g., communication power, computational power, and area efficiency) as good as that of conventional HDFS systems.

Pseudonymous authentication for secure V2I services in cloud-based vehicular networks

Vehicular cloud computing is a technological paradigm shifting which takes advantage of cloud computing to provide vehicles with useful computing resources and services on the roads. The advancement in smart vehicles and information technologies motivate researchers and industries to pay attention to the combination of vehicular network with cloud computing in recent. In order to make the emerging vehicular cloud computing viable, security issues must be considered. Especially, privacy is one of the critical security issues in vehicular cloud services as well as vehicular communications since a third-party entity may be involved in cloud management and operations. In this paper, we propose an anonymous vehicle-to-infrastructure cloud access management system in which identity and location privacy of service requesting vehicles are prevented from not only a global eavesdropper but also any single system management entity. We devise pseudonymous service access tokens for vehicles and RSU-local revocation mechanism to reduce the size of revocation list containing revoked pseudonyms in the proposed system.

Security evaluation of the OAuth 2.0 framework

Purpose – The interoperability of cloud data between web applications and mobile devices has vastly improved over recent years. The popularity of social media, smartphones and cloud-based web services have contributed to the level of integration that can be achieved between applications. This paper investigates the potential security issues of OAuth, an authorisation framework for granting third-party applications revocable access to user data. OAuth has rapidly become an interim de facto standard for protecting access to web API data. Vendors have implemented OAuth before the open standard was officially published. To evaluate whether the OAuth 2.0 specification is truly ready for industry application, an entire OAuth client server environment was developed and validated against the speciation threat model. The research also included the analysis of the security features of several popular OAuth integrated websites and comparing those to the threat model. High-impacting exploits leading to account hijacking were identified with a number of major online publications. It is hypothesised that the OAuth 2.0 specification can be a secure authorisation mechanism when implemented correctly. Design/methodology/approach – To analyse the security of OAuth implementations in industry a list of the 50 most popular websites in Ireland was retrieved from the statistical website Alexa (Noureddine and Bashroush, 2011). Each site was analysed to identify if it utilised OAuth. Out of the 50 sites, 21 were identified with OAuth support. Each vulnerability in the threat model was then tested against each OAuth-enabled site. To test the robustness of the OAuth framework, an entire OAuth environment was required. The proposed solution would compose of three parts: a client application, an authorisation server and a resource server. The client application needed to consume OAuth-enabled services. The authorisation server had to manage access to the resource server. The resource server had to expose data from the database based on the authorisation the user would be given from the authorisation server. It was decided that the client application would consume emails from Google’s Gmail API. The authorisation and resource server were modelled around a basic task-tracking web application. The client application would also consume task data from the developed resource server. The client application would also support Single Sign On for Google and Facebook, as well as a developed identity provider “MyTasks”. The authorisation server delegated authorisation to the client application and stored cryptography information for each access grant. The resource server validated the supplied access token via public cryptography and returned the requested data. Findings – Two sites out of the 21 were found to be susceptible to some form of attack, meaning that 10.5 per cent were vulnerable. In total, 18 per cent of the world’s 50 most popular sites were in the list of 21 OAuth-enabled sites. The OAuth 2.0 specification is still very much in its infancy, but when implemented correctly, it can provide a relatively secure and interoperable authentication delegation mechanism. The IETF are currently addressing issues and expansions in their working drafts. Once a strict level of conformity is achieved between vendors and vulnerabilities are mitigated, it is likely that the framework will change the way we access data on the web and other devices. Originality/value – OAuth is flexible, in that it offers extensions to support varying situations and existing technologies. A disadvantage of this flexibility is that new extensions typically bring new security exploits. Members of the IETF OAuth Working Group are constantly refining the draft specifications and are identifying new threats to the expanding functionality. OAuth provides a flexible authentication mechanism to protect and delegate access to APIs. It solves the password re-use across multiple accounts problem and stops the user from having to disclose their credentials to third parties. Filtering access to information by scope and giving the user the option to revoke access at any point gives the user control of their data. OAuth does raise security concerns, such as defying phishing education, but there are always going to be security issues with any authentication technology. Although several high impacting vulnerabilities were identified in industry, the developed solution proves the predicted hypothesis that a secure OAuth environment can be built when implemented correctly. Developers must conform to the defined specification and are responsible for validating their implementation against the given threat model. OAuth is an evolving authorisation framework. It is still in its infancy, and much work needs to be done in the specification to achieve stricter validation and vendor conformity. Vendor implementations need to become better aligned in order to provider a rich and truly interoperable authorisation mechanism. Once these issues are resolved, OAuth will be on track for becoming the definitive authentication standard on the web.

A token-based authentication security scheme for Hadoop distributed file system using elliptic curve cryptography

In recent years, a number of platforms for building Big Data applications, both open-source and proprietary, have been proposed. One of the most popular platforms is Apache Hadoop, an open-source software framework for Big Data processing used by leading companies like Yahoo and Facebook. Historically, earlier versions of Hadoop did not prioritize security, so Hadoop has continued to make security modifications. In particular, the Hadoop Distributed File System (HDFS) upon which Hadoop modules are built did not provide robust security for user authentication. This paper proposes a token-based authentication scheme that protects sensitive data stored in HDFS against replay and impersonation attacks. The proposed scheme allows HDFS clients to be authenticated by the datanode via the block access token. Unlike most HDFS authentication protocols adopting public key exchange approaches, the proposed scheme uses the hash chain of keys. The proposed scheme has the performance (communication power, computing power and area efficiency) as good as that of existing HDFS systems.

Block Access Token Renewal Scheme Based on Secret Sharing in Apache Hadoop

In a cloud computing environment, user data is encrypted and stored using a large number of distributed servers. Global Internet service companies such as Google and Yahoo have recognized the importance of Internet service platforms and conducted their own research and development to utilize large cluster-based cloud computing platform technologies based on low-cost commercial off-the-shelf nodes. Accordingly, as various data services are now allowed over a distributed computing environment, distributed management of big data has become a major issue. On the other hand, security vulnerability and privacy infringement due to malicious attackers or internal users can occur by means of various usage types of big data. In particular, various security vulnerabilities can occur in the block access token, which is used for the permission control of data blocks in Hadoop. To solve this problem, we have proposed a weight-applied XOR-based efficient distribution storage and recovery scheme in this paper. In particular, various security vulnerabilities can occur in the block access token, which is used for the permission control of data blocks in Hadoop. In this paper, a secret sharing-based block access token management scheme is proposed to overcome such security vulnerabilities.

Integration of the OAuth and Web Service family security standards

There are more and more scenarios requiring the transparent integration of heterogeneous security services in order to facilitate application development, simplify deployment and provide a seamless user experience. One of the most common use cases occurs when resources make use of OAuth to provide a simple and flexible way to authorize clients in order to access protected resources. But different OAuth implementations normally use distinct types of authorization grant and access tokens. This heterogeneity can be tackled by leveraging on WS-Trust, which is especially intended to offer integration mechanisms among services that implement WS-∗ specifications. By integrating these mechanisms it is possible to reduce the complexity supported by the OAuth Authorization Server (AS), so easing the interoperability through the delegation of the issuance and validation processes. This work also proposes a solution to cover the needs of WS-Trust clients which intend to use OAuth resources.

Survey on Restful Web Services Using Open Authorization (Oauth)

Web services are application based programming interfaces (API) or web APIs that are accessed through Hypertext Transfer Protocol (HTTP) to execute on a remote system hosting the requested services. A RESTFUL web service is a budding technology, and a light weight approach that do not restrict the client- server communication. The open authorization (OAuth) 2.0 protocol enables the users to grant third-party application access to their web resources without sharing their login credential data. The Authorization Server includes authorization information with the Access Token and signs the Access Token. An access token can be reused until it expires. An authentication filter is used for business services. This paper presents a secure communication at the message level with minimum overhead and provides a fine grained authenticity using the Jersey framework. Keywords: Open authorization (oauth), Restful web services, HTTP protocols and uniform resource identifier(URI).

A Security Scheme for Dependable Key Insertion in Mobile Embedded Devices

Public Key Cryptography enables entity authentication protocols based on a platform's knowledge of other platforms' public key. This is particularly advantageous for embedded systems, such as FPGA platforms, with limited or none read-protected memory resources. For access control systems, an access token is authenticated by the mobile system. Only the public key of authorized tokens needs to be stored inside the mobile platform. At some point during the platform's lifetime, these might need to be updated in the field due to loss or damage of tokens. This paper proposes a holistic approach for an automotive access control system based on Public Key Cryptography. Next to a FPGA-based hardware architecture, we focus on a secure scheme for key flashing of public keys to highly mobile systems. The main goal of the proposed scheme is the minimization of online dependencies to Trusted Third Parties, Certification Authorities, or the like, to enable key flashing in remote locations with only minor technical infrastructure. Introducing trusted mediator devices, new tokens can be authorized and later their public key can be flashed into a mobile system on demand.

Spectrum Auctions: Yesterday's Heresy, Today's Orthodoxy, Tomorrow's Anachronism. Taking the Next Step to Open Spectrum Access

Abstract The auction paradigm for spectrum allocation has moved from heresy to orthodoxy, but like its predecessors it will not be the end of history. A better alternative, not driven by the revenue needs of government, is license‐free spectrum. Users would gain entry to frequency bands on a pay‐as‐you‐go basis, instead of controlling a slice of the spectrum. They would transmit their content together with access tokens. These tokens are electronic money. Access prices would vary with congestion, set by automatic clearinghouses of spectrum users. Spot and futures markets for spectrum access would emerge. Once technology and economics can solve the interference problem in ways other than exclusivity, the question arises whether the right to use the spectrum for electronic speech is the government's to sell in the first place.

Buzz-Net: A Hybrid Token/Random Access LAN

Buzz-net is a local network supported by a pair of unidirectional buses to which stations are connected via passive interfaces. The access protocol is a hybrid which combines random access and virtual token features. More precisely, the network operates in random access mode at light load and virtual token mode at heavy load. Because of the virtual token implementation, Buzz-net retains high efficiency even at very high bus speeds. Efficiency at high speeds and bus unidirectionality make Buzz-net particularly suitable for fiber optics media. This paper describes the protocol, develops approximate analytic models for performance evaluation, and compares Buzz-net performance results to those of other unidirectional bus schemes.