Authentication Access Control Research Articles

Three-phase coded triboelectric nanogenerator disk: A novel approach for generating diverse control instructions in human–machine interactions

Triboelectric nanogenerator (TENG) has been widely utilized in a variety of real-world applications such as the Internet of Things (IoT) and human–machine interactions (HMIs). However, current technologies are difficult to be implemented in the situations that require a large amount of control instructions, due to the limitation on the size and the cost of the TENG-based interface. In this paper, a sliding operation three-phase coded TENG based control disk HMI interface is developed by integrating three coded copper electrodes, polytetrafluoroethylene (PTFE) film, and electronic signal processing circuits. The three-phase coded TENG electrodes enable the ability to overcome the challenge of increasing the number of generatable control instructions. The proposed system successfully achieves thirty sensing transitions through the utilization of the three-phase patterned electrodes. To evaluate the performance of this system, four applications, including English letters typing, game control, smart home control, and authentication access control, are implemented in real-time. An embedded microcontroller with a Bluetooth interface is employed to process and transmit the triboelectric control signal. The proposed TENG control disk effectively supports all functionalities required for these applications. Overall, the successful implementation and support of these applications demonstrate the effectiveness and versatility of the proposed TENG control disk in real-world scenarios and potential environments.

IHIBE: A Hierarchical and Delegated Access Control Mechanism for IoT Environments

Ensuring authorized access control in the IoT is vital for privacy and safety protection. Our study presents the novel IHIBE framework, which combines IOTA (a distributed ledger technology) with hierarchical identity-based encryption (HIBE), thereby enhancing both IoT security and scalability. This approach secures access tokens and policies while reducing the computational demand on data owners. Our empirical findings reveal a significant performance gap, with access rights delegation on the Raspberry Pi 4 exceeding those on AWS by over 250%. Moreover, our analysis uncovers optimal identity policy depths: up to 640 identities on AWS and 640 on the Raspberry Pi 4 for systems with higher tolerable delays, and 320 identities on AWS versus 160 on the Raspberry Pi 4 for systems with lower tolerable delays. The system shows practical viability, exhibiting insignificant operational time differences compared to Zhang et al.’s schemes, particularly in access rights verification processes, with a minimal difference of 33.35%. Our extensive security assessment, encompassing scenarios like encrypted token theft and compromise of authority, affirms the efficacy of our challenge-response and last-word challenge (LWC) mechanisms. This study underscores the importance of platform choice in IoT system architectures and provides insights for deploying efficient, secure, and scalable IoT environments.

A Blockchain-Based Trustworthy Access Control Scheme for Medical Data Sharing

Blockchain is commonly employed in access control to provide safe medical data exchange because of the characteristics of decentralization, nontamperability, and traceability. Patients share personal health data by granting access rights to users or medical institutions. The major purpose of the existing access control techniques is to identify users who are permitted to access medical data. They hardly ever recognize internal assailants from legitimate entities. Medical data will involve multilayer access within the authorized organizations. Considering the cost of permissions management and the problem of insider malicious node attacks, users hope to implement authorization constraints within the authorized institutions. It can prevent their data from being maliciously disclosed by end-users from different authorized healthcare domains. For the purpose to achieve the fine-grained permissions propagation control of medical data in sharing institutions, a trust-based authorization access control mechanism is suggested in this study. Trust thresholds are assigned to different privileges based on their sensitivity and used to generate zero-knowledge proof to be broadcasted among blockchain nodes. This method evaluates the trust of each user through the dynamic trust calculation model. And meanwhile, smart contract is employed to verify whether the user’s trust can activate some permissions and ensure the privacy of the user’s trust in the process of authorization verification. In addition, the authorization transaction between users and institutions is recorded on the blockchain for patient traceability and accountability. The feasibility and effectiveness of the scheme are demonstrated through comprehensive comparisons and extensive experiments.

An efficient multi-data owner cooperative resource sharing scheme against key regeneration in edge computing

In cloud storage, attribute-based keyword searchable encryption realizes multi-user fine-grained authorization access control and outsourcing data sharing. However, (1) resisting key regeneration is an urgent problem to be solved in practical applications of attribute-based keyword search; (2) the general attribute-based keyword search scheme ignores the application scenario where multiple data owners jointly manage files. In addition, the interaction of data between intelligent terminals and cloud servers has become more frequent, leading to issues such as central load, transmission efficiency, and data privacy protection in cloud computing. To address the above issues, we propose an attribute-based searchable encryption scheme with the multi-data owner based on edge computing. In this scheme, the Pedersen (k,n) secret sharing protocol and the Reciprocal protocol are used to realize the common management and sharing of data by the multi-data owner to enhance data security. Secondly, the attribute set and identity information of each user are embedded into the private key to prevent key regeneration and resist user collusion attacks. Thirdly, edge computing is introduced, and part of the storage and decryption work is outsourced to edge nodes to reduce the computing load of users and data transmission bandwidth. Security proof and performance analysis show that the proposed scheme has strong security and practicability in multi-user sharing scenarios such as Online Education with multi-data owners.

Role-based Access Control (RBAC) Authorization in Kubernetes

In computer systems security, role-based access control (RBAC) or role-based security is an approach to restricting system access to authorized users [1]. This paper will describe how the Kubernetes RBAC authorization sub-system works, how to leverage it to secure access to resources in the cluster, and how to validate the set policies through impersonation to ensure users and service accounts are granted the intended rights.

BSKM-FC: Blockchain-based secured key management in a fog computing environment

With an increase in the number of devices in the edge layer connected to the fog server of the fog computing environment, it is found that vulnerable and unauthorized activities are also increasing relatively. Thus, there is a requirement for authorized access control in such an environment that is governed by secured and efficient key management between the communicating devices. Many researchers have presented conventional solutions for key management depending on a third party. The third party operated for a key generation or key distribution in a fog computing environment based on a centralized architecture which leads to the drawbacks like a single-point failure and inconsistency of key management. So, effective and secured key management between the edge devices which are willing to communicate is the major concern to be addressed in the current digital world to achieve access control. This paper proposes a BSKM-FC (Blockchain-based Secured Key Management in a Fog Computing Environment) which is a decentralized system in a fog computing environment without using a third party. The BSKM-FC makes use of a one-way hash chain for the generation of private and public key pairs and ECC (Elliptic Curve Cryptography) for secured sharing. Upon successful authentication, the session key generation at both edge devices is based on the key pair provided by the fog server and stored securely in the blockchain. The BSKM-FC system uses private blockchain technology in the fog layer to provide secured storage and management. The work is implemented in the Truffle Blockchain and found that BSKM-FC performs better in terms of overall block preparation time. The security analysis of the proposed scheme is carried out based on the ROR model and also verified using AVISPA for some known attacks. Informal security analysis of the proposed work is performed by considering some of the known attacks where we observe that the proposed scheme overcomes such attacks. Performance overhead analysis is demonstrated using MIRACL considering computation cost, communication cost, and storage cost. The results show that the proposed scheme meets security requirements and performs effectively. The computation overhead, communication overhead, storage overhead, and block preparation time of the proposed scheme were improved by 7% to 14%, 9% to 18%, 7% to 17%, and 14% to 28%, respectively, as compared to existing schemes.

NikshayChain: A Blockchain-Based Proposal for Tuberculosis Data Management in India

A recent development in the Internet of Things (IoT) has accelerated the application of IoT-based solutions in healthcare. Next-Gen networks and IoT, supported by the development of technologies such as Artificial Intelligence (AI) and blockchain, have propelled the growth of e-health applications. However, there are some unique challenges in the widespread acceptance of IoT in healthcare. Safe storage, transfer, authorized access control, and the privacy and security aspects of patient data management are crucial barriers to the widespread adoption of IoT in healthcare. This makes it necessary to identify current issues in the various health data management systems to develop novel healthcare solutions. As a case study, this work considers a scheme launched by the Government of India for tuberculosis care called Nikshay Poshan Yojana (NPY). It is a web-based Direct Benefit Transfer scheme to provide a nutritional incentive of INR 500/- per month to all tuberculosis patients. The main objective of this work is to identify the current implementation challenges of the NPY scheme from patient and healthcare stakeholder perspectives and proposes a blockchain-based architecture called NikshayChain for sharing patient medical reports and bank details among several healthcare stakeholders within or across Indian cities. The proposed architecture accelerates healthcare stakeholder productivity by reducing workload and overall costs while ensuring effective data management. This architecture can significantly improve medical care, incentive transfer, and data verification, propelling the use of e-health applications.

Blockchain-driven authorized data access mechanism for digital healthcare

The existing traditional medical database system is a centralized system in which data manipulation is easy, privacy is critical, and there is a lack of easy information exchange and adequate data management. Although blockchain mechanisms have the potential to use and easily maintained on the distributed medical architecture around the globe to address the bottleneck situation. In this paper, we propose a blockchain-based authenticated access control framework. We use blockchain technology to defend patients’ rights to licensed medical material distribution systems. The proposed mechanism’s security has been demonstrated against adversary. The analysis of performance and comparative study is also performed, which shows that it is a reliable authenticated access control architecture for e-healthcare in terms of efficiency and security.

Access Control Based on Log File for Internet of Things Devices

The use of Internet of Things devices has lately increased significantly, leading to the management of a diverse set of nodes and a vast number of data. Most Internet of Things nodes have limited resources and are vulnerable to a variety of threats and failures. Therefore, numerous novel techniques have been conducted to secure resource-constrained devices such as access control. In this work, we proposed an access control mechanism by using the user log files when they interact with their Internet of Things devices. Where it is possible to define and enforce access control restrictions and follow logs through log files to monitor the user accessing behaviors. This mechanism can be applied as an extra security layer along with any traditional user authentication access control to have the effective and accurate access control to prevent intrusion reveal information in the Internet of Things devices. To do this, we developed three Internet of Things applications on mobile, table, and website pages with different functionalities and goals to store the user log file features. We collected a large-scale date-set from over a thousand participants. Three machine learning algorithms: J48, Part, and Naive Bayes are applied and compared to predict the legitimate users. Several experiments were performed with significant results.

High-Secured Data Communication for Cloud Enabled Secure Docker Image Sharing Technique Using Blockchain-Based Homomorphic Encryption

In recent years, container-based virtualization technology for edge and cloud computing has advanced dramatically. Virtualization solutions based on Docker Containers provide a more lightweight and efficient virtual environment for Edge and cloud-based applications. Because their use is growing on its own and is still in its early phases, these technologies will face a slew of security issues. Vulnerabilities and malware in Docker container images are two serious security concerns. The risk of privilege escalation is increased because Docker containers share the Linux kernel. This study presents a distributed system framework called Safe Docker Image Sharing with Homomorphic Encryption and Blockchain (SeDIS-HEB). Through homomorphic encryption, authentication, and access management, SeDIS-HEB provides secure docker image sharing. The SeDIS-HEB framework prioritizes the following three major functions: (1) secure docker image upload, (2) secure docker image sharing, and (3) secure docker image download. The proposed framework was evaluated using the InterPlanetary File System (IPFS). Secure Docker images were uploaded using IPFS, preventing unauthorized users from accessing the data contained within the secure Docker images. The SeDIS-HEB results were transparent and ensured the quality of blockchain data access control authentication, docker image metadata denial-of-service protection, and docker image availability.

Identification of Key Nodes in Distributed Access Control Model

Background: With the complexity of the network structure and the diversity of access, the access control model of distributed permissions management came into being. Aims: The central idea of the model is to store the access permissions of all nodes in the model to the network nodes covered by the access control model, and let the neighboring nodes act as access control agents. That is, each node in the model is a routing node in the execution of a certain access control. Methods: Considering the execution parameters of distributed access control model, the evaluation index of key node identification technology in distributed authorized access control model is established. Access control to achieve the management of distributed permissions. It is necessary to protect the key nodes in the model, increase the robustness of the access control model and support the smooth implementation of distributed access. Results: This paper presents a key node recognition algorithm based on distributed access control magic. The application of key node recognition algorithm in distributed access control model in traditional network is compared. Conclusion: Compared with the traditional key node recognition algorithm in the distributed access control model, the algorithm proposed in this paper is more accurate.

A cross-domain authorization access control model based on security label attribute

This paper proposes a minimum diffusion and cross-domain security authorization strategy based on security label, which solves the security problems of minimum visible range and cross-domain authorization in access control mechanism. The strategy makes full use of security label attributes, introduces multi-level constraint mechanism in access control, and makes the scope of knowledge controllable in cross-domain authorization. Through the experimental validation of different security domain scenarios, compared with the traditional access control mechanism, the diffusion speed of sensitive files in the access control based on security label attributes is significantly reduced. If the number of security labels is set as Nlabel , and each label has Nscale values, the file diffusion speed of the network is only times that of the linear diffusion speed.

An authenticated access control framework for digital right management system

With the growing development in digital content distribution, researchers focus on the construction of an access right enabled digital content distribution framework for the legal user. Digital rights management (DRM) is the system which tries to ensure authorized content distribution. Current, DRM systems either provide authentication or constrain access right, but access control with legal authentication in the digital content distribution has remained a challenging issue for public-key cryptography (PKC) or identity-based public-key cryptography (ID-PKC). PKC associates certificate management, which includes revocation, storage, distribution and verification of certificates. As a result, certificate authority becomes the bottleneck in a large network. On the other hand, ID-PKC has the drawback of key escrow. For secure and authorized content distribution, evacuation from these problems is needed. In this paper, we present an authenticated access control protocol, which maintains user’s right with authorized content distribution for the digital right management system. Its security has been proved in the random oracle model. An analysis of performance shows enhancement in efficiency, which indicates that the proposed scheme presents a secure and authorized access control mechanisms for resource-constrained devices.

An Improved Genetic Algorithm for Safety and Availability Checking in Cyber-Physical Systems

Cross-IoT infrastructure access frequently occurs when performing tasks in a distributed computing infrastructure of a cyber-physical system (CPS). The access control technology that ensure secure access cross-IoT infrastructure usually automatically establish relationships between user-attribute/role-permission. How to efficiently determine whether an automatic authorization access control state satisfies the safety and availability requirements of a system is a huge challenge. Existing work often focuses on a single aspect of safety or availability, while ignoring the differences between permissions and the differences between users. In this paper, we first propose a fine-grained personalization policy that takes into account the specificity of permissions/users and describes the safety, availability and efficiency requirements of an access control system in CPS. Second, we define a Personalization Policy Checking (PPC) Problem to determine whether a given personalization policy is satisfied in an access control state. We give the computational complexity of the PPC problem in different subcases, and show that it is NP-complete in general. Third, we design a binary genetic search algorithm, whose improvements mainly include continuous update and selection of the best chromosomes in the population for iteration, and exploring and determining the optimal crossover and mutation probabilities, thereby improving the convergence efficiency of the algorithm. Finally, simulation results show the effectiveness of our proposed algorithm, which is especially fit for the case that the computational overhead is even more important than the accuracy in a large-scale CPS system.

Investment Priority Analysis of ICS Information Security Resources in Smart Mobile IoT Network Environment Using the Analytic Hierarchy Process

The industrial control system (ICS) inherits the attributes of the traditional information system, but because it has its own characteristics that availability of triad (CIA) of information security should be a top priority, it needs to be set differently from the traditional information security requirements. In response to the issue, TTAK.KO-12.0307 (Standard for Industrial Control System Information Security Requirements) proposed by the National Security Research Institute (NSRI) and established by the Telecommunications Technology Association (TTA) is being used. However, it is difficult to apply security requirements of TTAK.KO-12.0307 uniformly because of the reason that the characteristics of the ICS in each layer are different. There is also a limit to invest the security resources with equivalent priority for all requirements and ICS layers. It is still unresolved in the previous research studies which are related to information security resources, for example, Choi (2013), Ko et al. (2013), and Nah et al.’s (2016) studies. Therefore, this study tried to focus on what a top priority of information security requirements by the ICS in each layer is, using the analytic hierarchy process. As a result, we derived that the top priority requirement in the operation layer is “Identification Authentication Access Control,” in the control layer is “Event Response,” and in the field device layer is “Physical Interface Protection” with the highest importance. The results of this study can be utilized as a guideline for the security strategy and policy design by determining security requirements that should be prioritized in each layer of the ICS.

Intelligent RFID biometric enabled dual security lock in the banking environment

This paper describes an expert RFID biometric enabled dual system architecture which acts as a smart and digitized banking vault door locking system. The proposed system is novel, multipurpose and provides three levels of security. It is based on locker automation using RFID technology and software Android App technology that allows access only to the authorized owner of the bank vault to open it. Despite the legacy key system, the overall control of electronic smart door lock system utilizes the RFID tags via NFC, biometric traits via web portal and mobiles via Bluetooth as the procedure for authentication. Our proposed RFID technology-based access control authentication mechanism utilizes low cost irrevertible functions to control the vulnerable security attacks. Furthermore, the proposed lock system has a tag’s identification search complexity of only $${\mathcal {O}}(1)$$ .

Design of electroencephalogram authentication access control to smart car.

In recent years, with the development of intelligent vehicles, the demand for security will be bigger and bigger. One of the most important solutions is the use of new biometric technology. At present, there are still some areas to be improved on biometric technology. For example, diseases will destroy some biological characteristics, some detection methods are too slow, many detection methods do not need living detection, and so on. Electroencephalogram (EEG) is a new biometric tool for living identification. In this Letter, a kind of identity authentication system based on the EEG signal is presented. The overall goal of this research is to design a new authentication method and develop the corresponding application. Therefore, the authors carried out a series of EEG experiments, and analysed and discussed the experimental results. Based on these results, they build and present an access control system based on the uniqueness of their EEG signals to be capable of authenticating access control to the car. The accuracy of the authentication system is >87.3%.

Multi authority access control mechanism for secure cloud storage

Cloud stockpiling encourages the two people and ventures to cost adequately share their information over the Internet. In any case, this furthermore carries irksome challenges to the passageway control of shared data since relatively few cloud servers can be totally trusted. Right now, present check and monetarily wise property-based data find a good pace conveyed capacity structures. Specifically, we manufacture a multiauthority CP-ABE plot that features: 1) the system needn't waste time with a totally trusted in central force, and all property pros self-ruling issue puzzle keys for customers; 2) every trademark authority can continuously oust any customer from its space with the ultimate objective that those revoked customers can't find a good pace way redistributed data; 3) cloud servers can invigorate the mixed data from the present timespan to the accompanying one to such a degree, that the denied customers can't find a good pace available data; and 4) the update of secret keys and ciphertext is acted in an open manner.

A Graph and Clustering-Based Framework for Efficient XACML Policy Evaluation

EXtensible Access Control Markup Language (XACML) is one of the standardized languages for specifying access control policies. Policies described by the XACML are used to express the security requirement in the network and information system when we study authorization access control. With the aim to improve the Policy Decision Point (PDP) evaluation performance, we put forward a Graph and Clustering-Based Framework, employing the aggregate function. First, we partition the rule set into subsets. For the single value, we select the best partition quantity based on the aggregate function. As for the interval value, we handle with the start point and the finish point, respectively, in the same way as single value. Second, the policy set is split according to the partition of rule set. In this way, not only single values, but also interval values are taken into consideration. After that, we explore the searching tree to obtain the possibly matched rules. Finally, we construct the combining tree and output the policy decision on the basis of it. The experimental results show that our approach is orders of magnitude better than the Sun PDP. A comparison in evaluation performance between the redundancy detecting and eliminating engine and the Sun PDP, as well as XEngine and SBA-XACML, is made. Experimental results show that the evaluation performance of the PDP can be prominently improved by eliminating redundancies.

Self-powered control interface based on Gray code with hybrid triboelectric and photovoltaics energy harvesting for IoT smart home and access control applications

The rapid expansion of Internet of Things (IoT) in many living environments, such as smart home, has motivated the development of human-machine interfaces (HMIs) for the interactions between human and machine. In this paper, a sliding operation triboelectric nanogenerator (TENG) based control disk interface, generating 3-bit binary-reflected Gray-code (BRGC), is developed by integrating copper electrodes, polytetrafluoroethylene (PTFE) film, photovoltaic cell, and electronic signal processing circuits. Eight sensing transitions are successfully achieved by the 3-bit BRGC encoding patterns with two electrodes. One electrode represents the binary bit “0”; another electrode represents the binary bit “1”. A third electrode located in the middle of the disk is utilized to indicate the sliding directions (inward or outward). The output signal detection mechanism and signal processing circuit have been developed, and a Bluetooth transmitter is employed for enabling controlling applications wirelessly. Besides the self-powered sensing characteristic of the triboelectric control disk, a hybrid energy harvester that can harvest triboelectric and photovoltaics energy is proposed to power the entire electronic control circuit. Finally, this triboelectric control disk is employed as a self-powered interface for smart home control and password authentication access control system, which exhibits promising reliability, practicality, and flexibility.