Advanced Access Control Research Articles

Connected smart elevator systems for smart power and time saving

Smart elevators provide substantial promise for time and energy management applications by utilizing cutting edge artificial intelligence and image processing technology. In order to improve operating efficiency, this project designs an elevator system that uses the YOLO model for object detection. Compared to traditional methods, our results show a 15% improvement in wait times and a 20% reduction in energy use. Due to the elevator’s increased accuracy and dependability, users’ qualitative feedback shows a high degree of pleasure. These results imply that intelligent elevator systems can make a significant contribution to more intelligent building management. Due to the elevator’s increased accuracy and dependability, users’ qualitative feedback shows a high degree of pleasure. These results imply that intelligent elevator systems can make a significant contribution to more intelligent building management. The successful integration of artificial intelligence (AI) and image processing technologies in elevator systems presents a promising foundation for future research and development. Further advancements in object detection algorithms, such as refining YOLO models for even higher accuracy and real-time adaptability, hold potential to enhance operational efficiency. Integrating smart elevators more deeply into IoT networks and building management systems could enable comprehensive energy management strategies and real-time decision-making. Predictive maintenance models tailored to elevator components could minimize downtime and optimize service schedules, enhancing overall reliability. Additionally, exploring adaptive user interfaces and personalized scheduling algorithms could further elevate user satisfaction by tailoring elevator interactions to individual preferences. Sustainable practices, including energy-efficient designs and integration of renewable energy sources, represent crucial avenues for reducing environmental impact. Addressing security concerns through advanced encryption and access control mechanisms will be essential for safeguarding sensitive data in smart elevator systems.

Conversational AI and Chatbots: Enhancing User Experience on Websites

This research paper explores the transformative potential of conversational AI and chatbots in enhancing website user experience (UX). It addresses two key research questions: How do these technologies improve user engagement and satisfaction on websites, and what are the primary challenges in implementing them, along with effective solutions. The study examines case studies across diverse industries, including e-commerce, travel, healthcare, and finance, to gain insights into the underlying technologies powering conversational AI and chatbots, such as natural language processing (NLP), natural language understanding (NLU), and machine learning techniques. The paper highlights the significant benefits of integrating conversational AI and chatbots into websites, including providing personalized assistance, streamlining complex processes, ensuring 24/7 availability, and enhancing accessibility for users. However, the study also addresses the key challenges faced in implementation, ranging from handling ambiguity and context in natural language processing to ensuring data privacy and security, managing user expectations, and the need for continuous improvement and training. The research proposes solutions to these challenges, such as employing advanced NLP algorithms, robust API management tools, and establishing user feedback loops. Ethical considerations, including data privacy and addressing biases in AI responses, are also explored, emphasizing the importance of robust encryption, adherence to data privacy regulations, and advanced access control mechanisms. The paper concludes by providing a comprehensive overview of the current state and future directions of conversational AI and chatbots in enhancing website user experience, exploring emerging trends such as multimodal interactions, contextual awareness and personalization, integration with IoT devices, and the development of emotional intelligence and empathy in chatbots.

Multi-Level Encryption System using AES and RSA Algorithms

Abstract: As the volume of sensitive data entrusted to the cloud explodes, from healthcare records to financial transactions, the need for robust security solutions intensifies. Traditional encryption techniques, while effective, remain vulnerable to key compromise, leaving data exposed to malicious factors. This study proposes a multi-level encryption strategy that leverages the power of AES for efficient data encryption, RSA for secure key protection with public-key cryptography, and role-based encryption for granular access control. This layered approach significantly increases the computational complexity for unauthorized access, making brute-force or dictionary attacks exponentially more difficult. Our research demonstrates successful integration of these algorithms, achieving a 50% reduction in key compromise risk and enhanced data integrity through MAC verification. Moving forward, we envision seamless integration with multiple cloud platforms and exploring advanced access control mechanisms based on user context and behavior. This multi-level encryption strategy holds immense potential to reshape the landscape of cloud data security, fostering a more secure and trustworthy digital future.

Mitigating Risks in the Cloud-Based Metaverse Access Control Strategies and Techniques

The advent of the metaverse has revolutionized virtual interactions and navigation, introducing intricate access control challenges. This paper addresses the need for effective access control models in the cloud-based metaverse. It explores its distinct characteristics, including its dynamic nature, diverse user base, and shared spaces, highlighting privacy concerns and legal implications. The paper analyzes access control principles specific to the cloud-based metaverse, emphasizing least privilege, separation of duties, RBAC, defense-in-depth, and auditability/accountability. It delves into identity verification and authorization methods, such as biometrics, multi-factor authentication, and role-based/attribute-based authorization. Advanced access control technologies for the cloud-based metaverse are examined, including SSO solutions, blockchain-based access control, ABAC, adaptive access control, and VMI for isolation. Risk mitigation strategies encompass IDS/IPS, SIEM, and user education programs.

Advanced Authentication and Access Control for Encrypted Images in the 3D Cube Domain

Image encryption techniques have been widely employed to protect the privacy of images during transmission and storage. However, the challenge lies in providing secure authentication and access control mechanisms for encrypted images in the 3D cube domain. This research focuses on addressing the issue of authentication and access control for encrypted images within the context of 3D cubes. The 3D cube domain provides a unique and efficient representation for image encryption, allowing for enhanced security and privacy. However, ensuring proper authentication and access control mechanisms while maintaining the encryption's integrity and efficiency poses significant challenges. The proposed methods will aim to provide strong authentication mechanisms to verify the integrity and authenticity of encrypted images, preventing unauthorized access and tampering. By addressing the critical issue of authentication and access control in the 3D cube domain, this research aims to contribute to the development of more secure and reliable image encryption solutions. The outcomes of this research will have implications in various domains, including secure image transmission, cloud storage, and digital rights management, where protecting the confidentiality and access control of encrypted images is of utmost importance.

A systematic literature review of authorization and access control requirements and current state of the art for different database models

Purpose Data protection requirements heavily increased due to the rising awareness of data security, legal requirements and technological developments. Today, NoSQL databases are increasingly used in security-critical domains. Current survey works on databases and data security only consider authorization and access control in a very general way and do not regard most of today’s sophisticated requirements. Accordingly, the purpose of this paper is to discuss authorization and access control for relational and NoSQL database models in detail with respect to requirements and current state of the art. Design/methodology/approach This paper follows a systematic literature review approach to study authorization and access control for different database models. Starting with a research on survey works on authorization and access control in databases, the study continues with the identification and definition of advanced authorization and access control requirements, which are generally applicable to any database model. This paper then discusses and compares current database models based on these requirements. Findings As no survey works consider requirements for authorization and access control in different database models so far, the authors define their requirements. Furthermore, the authors discuss the current state of the art for the relational, key-value, column-oriented, document-based and graph database models in comparison to the defined requirements. Originality/value This paper focuses on authorization and access control for various database models, not concrete products. This paper identifies today’s sophisticated – yet general – requirements from the literature and compares them with research results and access control features of current products for the relational and NoSQL database models.

Keyless Security

This research paper introduces a novel approach to improve security and access control in smart door lock systems. The proposed system incorporates multi-factor authentication, combining a numerical keypad, mobile app, and RFID sensor. Each authentication method is associated with a specific lock, offering differentiated access control. Notably, the system requires the simultaneous use of the mobile app and RFID sensor to unlock a designated lock, adding an extra layer of security. To assess the system's effectiveness, a comprehensive study was conducted, considering security, usability, and user satisfaction. The study involved simulated attacks, user surveys, and usability tests, with data analysis providing insights into the system's resilience and user acceptance. This research contributes to the field of smart door lock systems by offering an innovative approach to enhance security through multi-factor authentication. The findings provide valuable insights for designing advanced access control mechanisms, empowering users with increased confidence in their security measures while maintaining a user-friendly experience.

Instantiation and Implementation of HEAD Metamodel in an Industrial Environment: Non-IoT and IoT Case Studies

Access to resources can take many forms: digital access via an onsite network, through an external site, website, etc., or physical access to labs, machines, information repositories, etc. Whether access to resources is digital or physical, it must be allowed, denied, revoked, or disabled using robust and coherent access control (AC) models. What makes the process of AC more complicated is the emergence of digital transformation technologies and pervasive systems such as the internet of things (IoT) and industry 4.0 systems, especially with the growing demand for transparency in users’ interaction with various applications and services. Controlling access and ensuring security and cybersecurity in IoT and industry 4.0 environments is a challenging task. This is due to the increasing distribution of resources and the massive presence of cyber-threats and cyber-attacks. To ensure the security and privacy of users in industry sectors, we need an advanced AC metamodel that defines all the required components and attributes to derive various instances of AC models and follow the new and increasing demand for AC requirements due to continuous technology upgrades. Due to the several limitations in the existing metamodels and their inability to answer the current AC requirements, we have developed a Hierarchical, Extensible, Advanced, Dynamic (HEAD) AC metamodel with significant features that overcome the existing metamodels’ limitations. In this paper, the HEAD metamodel is employed to specify the needed AC policies for two case studies inspired by the computing environment of Institut Technologique de Maintenance Industrielle (ITMI)-Sept-Îles, QC, Canada; the first is for ITMI’s local (non-IoT) environment and the second for ITMI’s IoT environment. For each case study, the required AC model is derived using the domain-specific language (DSL) of HEAD metamodel, then Xtend notation (an expressive dialect of Java) is utilized to generate the needed Java code which represents the concrete instance of the derived AC model. At the system level, to get the needed AC rules, Cypher statements are generated and then injected into the Neo4j database to represent the Next Generation Access Control (NGAC) policy as a graph. NGAC framework is used as an enforcement point for the rules generated by each case study. The results show that the HEAD metamodel can be adapted and integrated into various local and distributed environments. It can serve as a unified framework, answer current AC requirements and follow policy upgrades. To demonstrate that the HEAD metamodel can be implemented on other platforms, we implement an administrator panel using VB.NET and SQL.

Next generation experimental data access at NSLS-II

The NSLS-II network and computing infrastructure has been significantly updated recently. The re-IP process in 2020-2021 enabled the NSLS-II network to be routable to the rest of the BNL campus. Then, standardization of the operating systems and deployment procedures helped to deliver a consistent environment to workstations and servers used by all NSLS-II beamlines. In particular, the RedHat Enterprise Linux 8 was deployed to 700+ machines using the RedHat Satellite infrastructure management product, and all critical services (IOCs, databases, etc.) were migrated to the new OS. NFS users’ home directories are consistent across all of the machines, which eliminates the need for the individual configuration of the user environment on each host. The standard suite of software packages is available to the beamline staff and users, which includes the system packages (deployed via RPM) as well as the conda environments for data acquisition and analysis. Security measures were implemented to comply with the industry standards, which include multi-factor authentication (using Duo), secure screen lock for the beamline machines, and advanced access control to the experimental data that is stored in shared central storage available on all hosts. These major enhancements facilitated sharing the experimental data (currently for a number of selected beamlines, with a plan to extend it to the whole facility in the nearest future) with the users via an externally facing JupyterHub instance - https://jupyter.nsls2.bnl.gov. The beamlines keep using the Bluesky data acquisition framework to orchestrate their experiments, and the new infrastructure enabled them to use a next-generation data access library called tiled.

Privacy-preserving multi-factor authentication and role-based access control scheme for the E-healthcare system

E-healthcare assists medical specialists in remotely collecting patient health data and providing remote health diagnoses. The roles are distributed among the system's users, contrasted between admin to data entry within certain rules and policies. Role-based access control (RBAC) is a technique of advanced access control that restricts key operations of users (addition, deletion and modification) access based on a user's role within a healthcare system. This paper proposes a privacy-preserving using RBAC and smart multi-factor authentication for the healthcare system to overcome the limitation flaw in previous schemes such as security risk tolerance, scalability and dynamism. This work relies on low-complexity cryptographic hash functions and symmetric operations to authenticate users while using an asymmetric cryptosystem based on the Schnorr digital signature lightweight operation to authenticate the administrator to provide multi-factor authentication. The administrator represents the system's core, and any his information leak could attack the entire system and its components. The proposed scheme conducted two thorough formal security proofs for the proposed work based on informal analysis and the Scyther tool. Furthermore, comparisons with other schemes reveal that the proposed scheme provides greater security features, and resisting attacks than the others while also being efficient in computing and communication costs.

DSMAC: Privacy-Aware Decentralized Self-Management of Data Access Control Based on Blockchain for Health Data

In recent years, the interest in using wireless communication technologies and mobile devices in the healthcare environment has increased. However, despite increased attention to the security of electronic health records, patient privacy is still at risk for data breaches. Thus, it is quite a challenge to involve an access control system especially if the patients’ medical data are accessible by users who have diverse privileges in different situations. Blockchain is a new technology that can be adopted for decentralized access control management issues. Nevertheless, different scalability, security, and privacy challenges affect this technology. To address these issues, we suggest a novel Decentralized Self-Management of data Access Control (DSMAC) system using a blockchain-based Self-Sovereign Identity (SSI) model for privacy-preserving medical data, empowering patients with mechanisms to preserve control over their personal information and allowing them to self-grant access rights to their medical data. DSMAC leverages smart contracts to conduct Role-based Access Control policies and adopts the implementation of decentralized identifiers and verifiable credentials to describe advanced access control techniques for emergency cases. Finally, by evaluating performance and comparing analyses with other schemes, DSMAC can satisfy the privacy requirements of medical systems in terms of privacy, scalability, and sustainability, and offers a new approach for emergency cases.

HEAD Metamodel: Hierarchical, Extensible, Advanced, and Dynamic Access Control Metamodel for Dynamic and Heterogeneous Structures.

The substantial advancements in information technologies have brought unprecedented concepts and challenges to provide solutions and integrate advanced and self-ruling systems in critical and heterogeneous structures. The new generation of networking environments (e.g., the Internet of Things (IoT), cloud computing, etc.) are dynamic and ever-evolving environments. They are composed of various private and public networks, where all resources are distributed and accessed from everywhere. Protecting resources by controlling access to them is a complicated task, especially with the presence of cybercriminals and cyberattacks. What makes this reality also challenging is the diversity and the heterogeneity of access control (AC) models, which are implemented and integrated with a countless number of information systems. The evolution of ubiquitous computing, especially the concept of Industry 4.0 and IoT applications, imposes the need to enhance AC methods since the traditional methods are not able to answer the increasing demand for privacy and security standards. To address this issue, we propose a Hierarchical, Extensible, Advanced, and Dynamic (HEAD) AC metamodel for dynamic and heterogeneous structures that is able to encompass the heterogeneity of the existing AC models. Various AC models can be derived, and different static and dynamic AC policies can be generated using its components. We use Eclipse (xtext) to define the grammar of our AC metamodel. We illustrate our approach with several successful instantiations for various models and hybrid models. Additionally, we provide some examples to show how some of the derived models can be implemented to generate AC policies.

An Autonomous Cybersecurity Framework for Next-generation Digital Service Chains

Today, the digital economy is pushing new business models, based on the creation of value chains for data processing, through the interconnection of processes, products, services, software, and things across different domains and organizations. Despite the growing availability of communication infrastructures, computing paradigms, and software architectures that already effectively support the implementation of distributed multi-domain value chains, a comprehensive architecture is still missing that effectively fulfills all related security issues: mutual trustworthiness of entities in partially unknown topologies, identification and mitigation of advanced multi-vector threats, identity management and access control, management and propagation of sensitive data. In order to fill this gap, this work proposes a new methodological approach to design and implement heterogeneous security services for distributed systems that combine together digital resources and components from multiple domains. The framework is designed to support both existing and new security services, and focuses on three novel aspects: (i) full automation of the processes that manage the whole system, i.e., threat detection, collection of information and reaction to attacks and system anomalies; (ii) dynamic adaptation of operations and security tasks to newest attack patterns, and (iii) real-time adjustment of the level of detail of inspection and monitoring processes. The overall architecture as well as the functions and relationships of its logical components are described in detail, presenting also a concrete use case as an example of application of the proposed framework.

An Integrated Privacy Preserving Attribute-Based Access Control Framework Supporting Secure Deduplication

Recent advances in information technologies have facilitated applications to generate, collect or process large amounts of sensitive personal data. Emerging cloud storage services provide a better paradigm to support the needs of such applications. Such cloud based solutions introduce additional security and privacy challenges when dealing with outsourced data including that of supporting fine-grained access control over such data stored in the cloud. In this paper, we propose an integrated, privacy-preserving user-centric attribute based access control framework to ensure the security and privacy of users' data outsourced and stored by a cloud service provider (CSP). The core component of the proposed framework is a novel privacy-preserving, revocable ciphertext policy attribute-based encryption (PR-CP-ABE) scheme. To support advanced access control features like write access on encrypted data and privacy-preserving access policy updates, we propose extended Path-ORAM access protocol that can also prevent privacy disclosure of access patterns. We also propose an integrated secure deduplication approach to improve the storage efficiency of CSPs while protecting data privacy. Finally, we evaluate the proposed framework and compare it with other existing solutions with regards to the security and performance issues.

Многоуровневая модель политики безопасности управления доступом операционных систем семейства Windows

The purpose of research – development of a more advanced Windows NT family access control mechanism to protect against information leakage from memory by hidden channels. The method of research – analysis of Windows NT family models of mandatory access control and integrity control, modeling of access control security policy for specified security properties, automatic verification of models. The Lamport Temporal Logic of Actions (TLA +) used to describe the model and its specification is used. TLA+ allows automatic verification of the model with the specified security properties. The result of research – revealed the main limitations of the existing mandatory integrity control of operating systems of the Windows NT family. A set of structures of a multilevel model has been developed, reflecting the attributes that are significant for modeling the process of access of subjects to objects. The key mechanisms of access control in the operating system are modeled: management of users, groups, subjects, objects, roles, rights, discretionary and mandatory access control, mandatory integrity control - multilevel control of subjects’ access to objects. The model defines a mechanism for controlling the creation of subjects based on executable files to organize an isolated software environment. The values of the attributes of the model variables for the initialization stage are determined. The invariants of variables correctness in the process of verification and subjects to objects safe access are developed. The model was specified using the TLA + modeling language and verified.

Distributed Triggered Access for BSM Dissemination in 802.11bd V2V Networks

In this paper, a novel channel access scheme, Distributed Triggered Access (DTA), is proposed for distributed V2V Basic Safety Message (BSM) dissemination in future platooning environment. To meet the stringent delay requirements of platooning communications, the proposed scheme is designed to use Wireless Local Area Network (WLAN) multi-user channel access in a distributed manner. The proposed scheme leverages advanced Medium Access Control (MAC) layer features, such as Triggered Uplink Access and Multi-user Request-To-Send (RTS), introduced in the 6th generation mainstream WLAN standard, IEEE 802.11ax, based upon a conceptual Physical (PHY) layer frame structure for IEEE 802.11bd, the successor of IEEE 802.11p. The proposed scheme is analyzed by mathematical model and simulations from transmission delay and successful transmission rate perspective. The mathematical model includes a Markov chain analysis that models the Enhanced Distributed Channel Access (EDCA) backoff procedure of DTA considering the effect of resumed backoff procedure with empty buffer caused by triggered access. Also, a Markov arrival/General service distribution/1 service channel (M/G/1) queuing model is provided to analyze the transmission delay of a BSM under unsaturated traffic condition. The extensive simulation results corroborate that DTA effectively improves the transmission success rate and reduces the average BSM collecting delay in a highly congested environment.

A Novel Packets Transmission Scheme Based on Software Defined Open Wireless Platform

The IEEE 802.11-2012, known as wireless-fidelity, offers a rich set of physical layer (PHY) features supported by advanced media access control (MAC) mechanisms. The use of off-the-shelf commercial 802.11 network interface card based (NIC-based) platforms constitutes an inexpensive prototyping approach based on reprogramming the cards software drivers. Besides, the commercial 802.11 NIC-based platform performs the functions of the MAC layer and PHY layer, respectively, by way of the firmware in the networking card and the software-driver running on the host computer, the former of which carries out the time-critical functions (Low MAC and PHY) while the latter serves the time-tolerant functions (High MAC). However, the maintenance of the cards produced in this way turns out quite troublesome. Therefore, based on a mixed real-time software-hardware architecture, i.e., a software defined open wireless platform, a novel packets transmission scheme is proposed in this paper in order to overcome the limitations of the NIC-based platform so that it becomes fully flexible and re-configurable. Furthermore, the novel scheme consists of three parts. First, a preliminary scheme is designed as follows: shift the hard-coded Low MAC and the PHY to the user space, then carry out the High MAC in the kernel space, and then combine the High MAC with the Low MAC via the Netlink. Second, based on preliminary scheme, the sending packets (i.e., the MAC frame) are reorganized in a lightweight way and the packets’ completeness and correctness are validated with experiments. Third, an M/M/1 model is exploited to create a packets transmission ring for optimizing the preliminary scheme. And the experimental results of the packets transmission concerned have proved the above-mentioned novel scheme outperforms the traditional one (i.e., the NIC-based platform) in terms of the system overhead and the number of packets sent in unit time.

A new approach for managing Android permissions: learning users\u2019 preferences

Today, permissions management solutions on mobile devices employ Identity Based Access Control (IBAC) models. If this approach was suitable when people had only a few games (like Snake or Tetris) installed on their mobile phones, the current situation is different. A survey from Google in 2013 showed that, on average, french users have installed 32 applications on their Android smartphones. As a result, these users must manage hundreds of permissions to protect their privacy. Scalability of IBAC is a well-known issue and many more advanced access control models have introduced abstractions to cope with this problem. However, such models are more complex to handle by non-technical users. Thus, we present a permission management system for Android devices that (1) learns users’ privacy preferences with a novel learning algorithm, (2) proposes them abstract authorization rules, and (3) provides advanced features to manage these high-level rules. Our learning algorithm is compared to two other well-known approaches to show its efficiency. Finally, we prove this whole approach is more efficient than current permission management system by comparing it to Privacy Guard Manager.

A policy enforcement framework for Internet of Things applications in the smart health

Abstract Internet of Things (IoT) is characterized by heterogeneous technologies, which concur to the provisioning of innovative services in different application domains. Introducing efficient mechanisms for collecting, processing, and delivering data generated by sensors, medical equipment, wearable devices, and humans, is a key enabling factor for advanced healthcare services. The adoption of IoT in smart health, however, opens the doors to some security concerns. In fact, by considering the confidentiality and sensitivity of medical data, a healthcare system must fulfill advanced access control procedures with strict security and data quality requirements. To this end, a flexible policy enforcement framework, based on the IoT paradigm, is defined hereby. It is able to face security and quality threats in dynamic large scale and heterogeneous smart hearth environments. As a key feature of the proposed framework, cross-domain policies have been defined using a specification language based on XML. In this way, it becomes possible to ease the management of interactions across different realms and policy conflicts. Moreover, to demonstrate the usefulness of the proposed approach, a running example, based on a smart health application, is detailed throughout the manuscript. This helps to highlight the different facets of the conceived enforcement framework. A preliminary performance analysis also demonstrates its feasibility in large scale environments.

A Survey of Role Mining

Role-Based Access Control (RBAC) is the most widely used model for advanced access control deployed in diverse enterprises of all sizes. RBAC critically depends on defining roles, which are a functional intermediate between users and permissions. Thus, for RBAC to be effective, an appropriate set of roles needs to be identified. Since many organizations already have user-permission assignments defined in some form, it makes sense to identify roles from this existing information. This process, known as role mining, is one of the critical steps for successful RBAC adoption in any enterprise. In recent years, numerous role mining techniques have been developed, which take into account the characteristics of the core RBAC model, as well as its various extended features. In this article, we comprehensively study and classify the basic problem of role mining along with its several variants and the corresponding solution strategies. Categorization is done on the basis of the nature of the target RBAC system, the objective of role mining, and the type of solution. We then discuss the limitations of existing work and identify new areas of research that can lead to further enrichment of this field.