Attribute-based Access Control Model Research Articles

Application of Attribute Based Access Control Model for Industrial Control Systems

Application of Attribute Based Access Control Model for Industrial Control Systems

Multi-tenant attribute-based access control for cloud infrastructure services

Cloud Computing is developed as a new wave of ICT technologies, offering a common approach to on-demand provisioning of computation, storage and network resources that are generally referred to as infrastructure services. Most of currently available commercial cloud services are built and organized reflecting simple relations between single provider and customers with the simple security and trust model. New architectural models should deliver multi-provider heterogeneous cloud services environments to organizational customers representing multiple user groups. These models need to be enforced by consistent security services operating in virtualized multi-provider cloud environment. They should incorporate complex access control mechanisms and trust relations among cloud actors. In this paper, we analyze cloud services provisioning use-cases and propose an access control model for multi-tenant cloud services using attribute-based access control model. We also extend the model for Intercloud scenarios with the exchanging tokens approach. To facilitate attribute-based policy evaluation and implementing the proposed model, we apply an efficient mechanism to transform complex logical expressions in policies to compact decision diagrams. Our prototype of the multi-tenant attribute-based access control system for Intercloud is developed, tested and integrated into the GEYSERS project. Evaluations prove that our approach has a good performance in terms of numbers of cloud resources and numbers of clients.

Toward an Access Control Model for IOTCollab

The increase in Internet-connected physical devices offers new possibilities and opportunities. This Internet of Things (IoT) fosters the development of new platforms, services and applications that connect the physical world (represented by physical objects) to the virtual world (represented by the Internet). The work presented here proposes a study of role and attribute-based access control models that tackle the security concerns of our already developed data sharing framework. The framework introduced a formal theoretical model, the IOTCollab domain specific language, and an integrated development environment that implements this model. We have extended this framework by completing the formal theoretical model with access control capabilities.

An extended attribute based access control model with trust and privacy: Application to a collaborative crisis management system

Many efforts in the area of computer security have been drawn to attribute-based access control (ABAC). Compared to other adopted models, ABAC provides more granularity, scalability, and flexibility. This makes it a valuable access control system candidate for securing platforms and environments used for coordination and cooperation among organizations and communities, especially over open networks such as the Internet. On the other hand, the basic ABAC model lacks provisions for context, trust and privacy issues, all of which are becoming increasingly critical, particularly in high performance distributed collaboration environments. This paper presents an extended access control model based on attributes associated with objects and subjects. It incorporates trust and privacy issues in order to make access control decisions sensitive to the cross-organizational collaboration context. Several aspects of the proposed model are implemented and illustrated by a case study that shows realistic ABAC policies in the domain of distributed multiple organizations crisis management systems. Furthermore, the paper shows a collaborative graphical tool that enables the actors in the emergency management system to make better decisions. The prototype shows how it guarantees the privacy of object’s attributes, taking into account the trust of the subjects. This tool incorporates a decision engine that relies on attribute based policies and dynamic trust and privacy evaluation. The resulting platform demonstrates the integration of the ABAC model, the evolving context, and the attributes of actors and resources.

A secure and efficient discovery service system in EPCglobal network

In recent years, the Internet of Things (IOT) has drawn considerable attention from the industrial and research communities. Due to the vast amount of data generated through IOT devices and users, there is an urgent need for an effective search engine to help us make sense of this massive amount of data. With this motivation, we begin our initial works on developing a secure and efficient search engine (SecDS) based on EPC Discovery Services (EPCDS) for EPCglobal network, an integral part of IOT. SecDS is designed to provide a bridge between different partners of supply chains to share information while enabling them to find who is in possession of an item. The most important property of SecDS is: while efficiently processing user's search, it is also secure. In order to prevent unauthorized access to SecDS, an extended attribute-based access control model is proposed and implemented such that information belonging to different companies can be protected using different policies. We design, implement SecDS and conduct extensive experiments on it. The results validate the practicality and cost effectiveness of our design and implementations.

A Multiple-Policy supported Attribute-Based Access Control Architecture within Large-scale Device Collaboration Systems

In order to collaborate large numbers of heterogeneous distributed devices over multiple domains within a modern large-scale device collaboration system, a fine-grained, flexible and secure approach is required for device authentication and authorization. This paper proposed a Multiple-Policy supported Attribute-Based Access Control model and its architecture to address these demands. With eXtensible Access Control Markup Language standard, this model exceeds the traditional Attribute-Based Access Control Model by providing cross-domain authentication and authorization, hierarchical policy combination and enforcement, unified device access control and fine-grained attributes-based privilege description. Experiments show the performance of this architecture is acceptable within production environment.

Attribute-Based Access Control of Collaborative Design Systems

The current research in access control is analyzed, and the features of access control in collaborative design systems are discussed. According to the new requirements of the access control technology in collaborative design systems, the attribute-based access control (ABAC) model is improved to a new one: supporting role and task ABAC model. The concept of role entity and task entity is introduced into the ABAC model. The formal definition and object model of the improved model are given, and the features of the newly-introduced model elements are discussed.

Design of attribute-based access control model in collaborative grid environment

Design of attribute-based access control model in collaborative grid environment

A Time and Mutable Attribute-Based Access Control Model

Access control is one of the most important technologies to guarantee computer security. A new model with support for valid time and usage constraint is described based on full analysis of flaws in existing models. In the new model, authorization rules can express access control policies completely and access constraints are necessary conditions to prevent authorization abuse. To solve the problems in implementation of the model, a sound scheme for administration of authorizations is proposed and some access decision algorithms are developed.

A secure collaborative web-based environment for virtual organisations

The concept of the Virtual Organisation (VO) is a natural outcome of network evolution and the growth of collaborative work tools. In the projects Value Improvement thought a Virtual Aeronautical Collaborative Enterprise (VIVACE) and Transglobal Secure Collaboration Program (TSCP), we studied the different issues when setting VOs up. In this paper, we expose the requirements and characteristics of VOs through a use case where the partners produce a technical aeronautic specification, which was proposed by those consortiums. Then, we present a secured collaborative environment that we have deployed to deal with VO security constraints. It combines attribute-based access control models, privileges management infrastructure and identity federation to make VOs more dynamic.