Attribute Certificates Research Articles

A Research on the Approach of Employment Authorization Licence of the Construction Industry Employees

Occupational accidents ratio of technical staff is quite high in the construction industry in Turkey. This rate is high compared to other countries. The reason for this can be shown as to run without the authorization certificate of technical staff. From the date of 01.01.2012, Craftsmen working in the construction and installation work have the obligation to obtain authorization certificates according to the pursuant article of 28. Of the 3194 number of the zoning law. In this study, it must obtain a certificate of authority pursuant to the law of the employees of the construction industry survey in order to assess their approach to issues was organized. In the survey of the Ministry of National Education (MNE) depends on the efficiency of the education provided by the institution or organization and employee perspectives to assess these issues are considered. The survey data are evaluated, the powers of master document that must be taken to have a positive attitude toward this issue, but they are not very eager to get training if it is determined

Design and Implementation of Mobile System Based Attribute Certificate

Design and Implementation of Mobile System Based Attribute Certificate

Secure Semantic Aware Middleware: a Security Based Semantic Access Control for Web Services

Semantic Access Control model is based on the semantic properties of the resources to be controlled, properties of the clients that request access to them, semantics about the context and lastly, semantics about the attribute certificates trusted by the access control system. Many algorithms and techniques have been developed for the Semantic Access Control. Our previous work introduced a fine grained access control mechanism for accessing semantic web services. However, the policy based semantic access control method does not have any security in the user contribution i.e., the request user may be valid user or invalid user. So, there is more chance for the invalid users to get continuous access to the web services and also they hacks more information from the web services. Thus, such drawbacks in our previous work need to be reduced for attaining a high-quality performance in semantic web services. Hence, a security model is proposed in this paper to include in the security framework to investigate the validity of users. The valid number of users are registered and stored in the registration service. If new user request is obtained, the user’s request query and the registration service are processed to find whether this requested user is a valid or invalid user. The simulation results show that the secure semantic aware fine grained web services accessing framework is robust against the accessing of invalid users without any compromise in the performance of the semantic module.

Decentralized certification scheme for secure admission in on-the-fly peer-to-peer systems

Several alternative schemes have been presented in the literature to try to solve the users’ admission problem in P2P systems when it is not possible to include a logically centralized authority (either online or offline) in the system. However, most of them are not suitable for on-the-fly P2P systems and the most typical ones (IP based, shared secret and threshold cryptography) have several security and performance drawbacks. From the deficiencies of the existing schemes, in this paper we present a new decentralized certification scheme for on-the-fly P2P systems which is based on the recently published Internet Attribute Certificate Profile for Authorization. Our proposal greatly improves the security and flexibility of IP based and shared secret schemes with no infrastructure cost and with a minimal performance charge. Also, it achieves a similar level of security than threshold cryptography while highly reducing its computational and communicational cost. All these facts position our certification proposal as a users’ admission alternative for on-the-fly P2P systems in non very hostile environments where performance and security are key factors.

Enable delegation for RBAC with Secure Authorization Certificate

Our motivation in this paper is to explore a Secure Delegation Scheme that could keep access control information hidden through network transmission. This approach introduces the quasirandom structure, 3-Uniform Hypergraph, as the representation structure for authorization information. It generates a Secure Authorization Certificate (SAC) in place of an Attribute Certificate (AC) to enable both Role-based Access Control (RBAC) and a delegation process for hiding authorization information. We have two contributions in this regard: (1) a value-based delegation scheme and (2) a pattern-based RBAC. A Secure Delegation Scheme is based on the hashing values generated with the quasirandom structure. With this scheme, the delegation process will greatly reduce the risk of sensitive authorization information leakage for applications. In the case of pattern-based access, we introduce a new hash function using quasirandom structure to make a fingerprint 1 1 The term fingerprint is used to refer to a unique pattern. for RBAC. The quasirandom structure derived from k-Uniform Hypergraph has measurable uniformity, which is an advantage over traditional hash functions. Another advantage is that it does not need to access the entire message context to generate the fingerprint which is essential for traditional hash functions such as MD5, SHA-1, etc.

Secure Sensor Sharing Framework for Mobile and Sensor Access Platform Network

We are researching a mobile and sensor access platform network for the future called NerveNet, which accommodates ubiquitous sensors and provides services in local areas. The realization of reliable and accountable information collection, processing and provision over NerveNet poses a challenging and fundamental issue in promotion of the sensor business field. As a first step toward a reliable NerveNet, we investigate privacy preservation and the collection of reliable sensor information for prospective personalized sensor applications. The privacy requirement impels the logic separation between sensor networks and the communication platform in the design of NerveNet architecture. To enable sensor network users (SNUs) to reliably interact with sensors managed by different sensor network owners (SNOs), we designed a secure sensor sharing framework (S3F) based on two business models — the Ad Hoc Sales Model (AHSM) and Shopping Center Sales Model (SCSM). With S3F-AHSM, an SNU acquires permission from an SNO each time she wants to obtain information from a sensor. On the other hand, with S3F-SCSM, an SNU can obtain the access privilege to a flexible set of sensors based on the queried preferences via a third party called a sensor network service provider (SNSP). In S3F-SCSM, SNSPs that share the sensors owned by various SNOs have the ability to search the preferred sensors and provide the authorization certificate to the SNUs.

An improved sanitizable signature scheme

A new sanitizable signature scheme is proposed, in which the security flaw of Miyazaki’s sanitizable signature scheme SUMI-4 is improved. The new scheme overcomes the shortcomings of the original scheme SUMI-4 by using sanitizable authorization certificates. The new scheme enables the primitive signer to limit the sanitizer’s power and still satisfies the security request of sanitizable signature.

Internalizing carbon costs in electricity markets: Using certificates in a load-based emissions trading scheme

Several western states have considered developing a regulatory approach to reduce greenhouse gas (GHG) emissions from the electric power industry, referred to as a load-based (LB) cap-and-trade scheme. A LB approach differs from the traditional source-based (SB) cap-and-trade approach in that the emission reduction obligation is placed upon Load Serving Entities (LSEs), rather than electric generators. The LB approach can potentially reduce the problem of emissions leakage, relative to a SB system. For any of these proposed LB schemes to be effective, they must be compatible with modern, and increasingly competitive, wholesale electricity markets. LSE's are unlikely to know the emissions associated with their power purchases. Therefore, a key challenge for a LB scheme is how to assign emissions to each LSE. This paper discusses the problems with one model for assigning emissions under a LB scheme and proposes an alternative, using unbundled Generation Emission Attribute Certificates. By providing a mechanism to internalize an emissions price signal at the generator dispatch level, the tradable certificate model addresses both these problems and provides incentives identical to a SB scheme.

Framework of biometric authentication applied in open network

A framework of biometric authentication applied in the open network was proposed.In the framework,after identity authentication is carried out with the cooperation of Biometric Process Unit(BPU) distributed at different locations,the instances comprising BPU certificate,BPU function report and result were generated respectively by each BPU and sent to the identity verifier.The verifier retrieved responding authentication policy from Biometric Policy Certificate(BPC) according to the privilege recorded in the user's Attribute Certificate(AC) and checked if these BPUs met the requirements.If so,the verifier accepted this authentication result.

PKI-based secure mobile access to electronic health services and data

Recent research works examine the potential employment of public-key cryptography schemes in e-health environments. In such systems, where a Public Key Infrastructure (PKI) is established beforehand, Attribute Certificates (ACs) and public key enabled protocols like TLS, can provide the appropriate mechanisms to effectively support authentication, authorization and confidentiality services. In other words, mutual trust and secure communications between all the stakeholders, namely physicians, patients and e-health service providers, can be successfully established and maintained. Furthermore, as the recently introduced mobile devices with access to computer-based patient record systems are expanding, the need of physicians and nurses to interact increasingly with such systems arises. Considering public key infrastructure requirements for mobile online health networks, this paper discusses the potential use of Attribute Certificates (ACs) in an anticipated trust model. Typical trust interactions among doctors, patients and e-health providers are presented, indicating that resourceful security mechanisms and trust control can be obtained and implemented. The application of attribute certificates to support medical mobile service provision along with the utilization of the de-facto TLS protocol to offer competent confidentiality and authorization services is also presented and evaluated through experimentation, using both the 802.11 WLAN and General Packet Radio Service (GPRS) networks.

A PKI approach for deploying modern secure distributed e-learning and m-learning environments

While public key cryptography is continuously evolving and its installed base is growing significantly, recent research works examine its potential use in e-learning or m-learning environments. Public key infrastructure (PKI) and attribute certificates (ACs) can provide the appropriate framework to effectively support authentication and authorization services, offering mutual trust to both learners and service providers. Considering PKI requirements for online distance learning networks, this paper discusses the potential application of ACs in a proposed trust model. Typical e-learning trust interactions between e-learners and providers are presented, demonstrating that robust security mechanisms and effective trust control can be obtained and implemented. The application of ACs to support m-learning is also presented and evaluated through an experimental test-bed setup, using the general packet radio service network. The results showed that AC issuing is attainable in service times while simultaneously can deliver flexible and scalable solutions to both learners and e-learning providers.

A role-based PMI security model for e-government

We introduce the general AC (attribute certificate), the role specification AC and the role assignment AC. We discuss the role-based PMI (Privilege Management Infrastructure) architecture. The role-based PMI (Public-Key Infrastructure) secure model for E-government is researched by combining the role-based PMI with PKI architecture (Public Key Infrastructure). The model has advantages of flexibility, convenience, less storage space and less network consumption etc. We are going to use the secure model in the E-government system.

The PERMIS X.509 role based privilege management infrastructure

This paper describes the EC PERMIS project, which has developed a role based access control infrastructure that uses X.509 attribute certificates (ACs) to store the users’ roles. All access control decisions are driven by an authorisation policy, which is itself stored in an X.509 AC, thus guaranteeing its integrity. All the ACs can be stored in one or more LDAP directories, thus making them widely available. Authorisation policies are written in XML according to a DTD that has been published at XML.org. The Access Control Decision Function (ADF) is written in Java and the Java API is simple to use, comprising of just three methods and a constructor. There is also a Privilege Allocator, which is a tool that constructs and signs ACs and stores them in an LDAP directory for subsequent use by the ADF.

Access control based on attribute certificates for medical intranet applications.

BackgroundClinical information systems frequently use intranet and Internet technologies. However these technologies have emphasized sharing and not security, despite the sensitive and private nature of much health information. Digital certificates (electronic documents which recognize an entity or its attributes) can be used to control access in clinical intranet applications.ObjectivesTo outline the need for access control in distributed clinical database systems, to describe the use of digital certificates and security policies, and to propose the architecture for a system using digital certificates, cryptography and security policy to control access to clinical intranet applications.MethodsWe have previously developed a security policy, DIMEDAC (Distributed Medical Database Access Control), which is compatible with emerging public key and privilege management infrastructure. In our implementation approach we propose the use of digital certificates, to be used in conjunction with DIMEDAC.ResultsOur proposed access control system consists of two phases: the ways users gain their security credentials; and how these credentials are used to access medical data. Three types of digital certificates are used: identity certificates for authentication; attribute certificates for authorization; and access-rule certificates for propagation of access control policy. Once a user is identified and authenticated, subsequent access decisions are based on a combination of identity and attribute certificates, with access-rule certificates providing the policy framework.ConclusionsAccess control in clinical intranet applications can be successfully and securely managed through the use of digital certificates and the DIMEDAC security policy.

Access control with role attribute certificates

The goal of access control is to counter the threat of unauthorized operations involving computer or communication systems. Role-based access control (RBAC) is a new paradigm for access control, different from the traditional schemes such as the capability scheme or the access control list scheme. To realize the RBAC scheme, we define role attribute certificates following a generic specification in X.509. Our certificate is a vehicle for carrying role-assignment information about a certificate subject. The certificate is certified, issued, and revoked by a central administrator, called the Role Attribute Certification Authority (RACA); as a result, the access control information conveyed in the certificate is centrally managed. The certificate is sent to application sites where the information is required for access control decisions; consequently, a scheme using this special type of attribute certificate gains the advantage of reducing communication. The drawback with this approach is that role attribute certificates must be accompanied by a public-key certificate, whose functioning depends on the existence of a public-key infrastructure (PKI).

WDAI: a simple World Wide Web distributed authorization infrastructure

The World Wide Web (W3) has the potential to link different kinds of documents into hypertext collections and to distribute such collections among many document servers. Distributed collections can bring forth new W3 applications in extranets and expand the concept of content reuse. However, they also bring new authorization problems, such as the need for coordinated user administration, user authentication, and revocation of rights. This paper proposes WDAI, a simple and general infrastructure for distributed authorization on the World Wide Web. Under WDAI, browsers and servers exchange authorization information using X.509v3-based authorization certificates. WDAI is designed to be open to a wide variety of security policies and, being compatible with existing W3 technology, can be implemented without modifying existing browsers.