Authorization Policies Research Articles

Bi-objective Optimization in Role Mining

Role mining is a technique that is used to derive a role-based authorization policy from an existing policy. Given a set of users U , a set of permissions P and a user-permission authorization relation UPA ⊆ U × P , a role mining algorithm seeks to compute a set of roles R , a user-role authorization relation UA ⊆ U × R and a permission-role authorization relation PA ⊆ R × P , such that the composition of UA and PA is close (in some appropriate sense) to UPA . Role mining is therefore a core problem in the specification of role-based authorization policies. Role mining is known to be hard in general and exact solutions are often impossible to obtain, so there exists an extensive literature on variants of the role mining problem that seek to find approximate solutions and algorithms that use heuristics to find reasonable solutions efficiently. In this paper, we first introduce the Generalized Noise Role Mining problem (GNRM) – a generalization of the MinNoise Role Mining problem – which we believe has considerable practical relevance. In particular, GNRM can produce “security-aware” or “availability-aware” solutions. Extending work of Fomin et al., we show that GNRM is fixed parameter tractable, with parameter r + k , where r is the number of roles in the solution and k is the number of discrepancies between UPA and the relation defined by the composition of UA and PA . We further introduce a bi-objective optimization variant of GNRM, where we wish to minimize both r and k subject to upper bounds \(r \le \bar{r} \) and \(k\le \bar{k} \) , where \(\bar{r} \) and \(\bar{k} \) are constants. We show that the Pareto front of this bi-objective optimization problem (BO-GNRM) can be computed in fixed-parameter tractable time with parameter \(\bar{r} +\bar{k} \) . From a practical perspective, a solution to BO-GNRM gives security managers the opportunity to identify a mined policy offering the best trade-off between the number of policy discrepancies and the number of roles. We then report the results of our experimental work using the integer programming solver Gurobi to solve instances of BO-GNRM. Our key findings are that (a) we obtained strong support that Gurobi’s performance is fixed-parameter tractable, (b) our results suggest that our techniques may be useful for role mining in practice, based on our experiments in the context of three well-known real-world authorization policies. We observed that, in many cases, our solver is capable of obtaining optimal solutions when the values of either k or r are small.

IEEE Transactions on Energy Markets, Policy, and Regulation Information for Authors

IEEE Transactions on Energy Markets, Policy, and Regulation Information for Authors

Medicare Advantage Prior Authorization Requirements for Otolaryngologic Procedures in 2021.

Little is known about the extent of prior authorization requirements in otolaryngology. We performed a secondary analysis of data comparing prior authorization (PA) policies across 5 major Medicare Advantage insurers to estimate the counterfactual proportion of 2021 Medicare Part B fee-for-service spending and utilization for commonly performed otolaryngologic procedures that would have required PA. The counterfactual proportion of spending (range: 20.4%-27.6%) and utilization (range: 1.8%-4.5%) requiring PA was relatively consistent across insurers and largely attributable to rhinologic procedures. However, PA requirements for specific services varied widely among insurers. Among the 70 (of 196; 35.7%) services subject to PA by any insurer, nearly half were subject to PA by a single insurer (n = 34; 48.6%). Only 10 (14.3%) services were subject to PA by 4 (n = 6; 8.6%) or 5 (n = 4; 5.7%) insurers. These discrepancies illustrate the challenges of navigating discordant insurer policies for otolaryngologists and raise concerns about the validity of certain PA requirements.

IEEE Transactions on Energy Markets, Policy, and Regulation Information for Authors

IEEE Transactions on Energy Markets, Policy, and Regulation Information for Authors

A Blockchain-Based Electronic Health Record (EHR) System for Edge Computing Enhancing Security and Cost Efficiency

Blockchain technology offers unique features, such as transparency, the immutability of data, and the capacity to establish trust without a central authority. Such characteristics can be leveraged to support the collaboration among several different software systems operating within the healthcare ecosystem, while ensuring data integrity and make electronic health records (EHRs) more easily accessible. To provide a solution based on blockchain technology, this paper has evaluated the main issues that arise when large amounts of data are expected, i.e., mainly cost and performance. A balanced approach that maximizes the benefits and mitigates the constraints of the blockchain has been designed. The proposed decentralized application (dApp) architecture employs a hybrid storage strategy that involves storing medical records locally, on users’ devices, while utilizing blockchain to manage an index of these data. The dApp clients facilitate interactions among participants, leveraging a smart contract to enable patients to set authorization policies, thereby ensuring that only designated healthcare providers and authorized entities have access to specific medical records. The blockchain data-immutability property is used to validate data stored externally. This solution significantly reduces the costs related to the utilization of the blockchain, while retaining its advantages, and improves performance, since the majority of data are available off-chain.

Cedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization

Cedar is a new authorization policy language designed to be ergonomic, fast, safe, and analyzable. Rather than embed authorization logic in an application’s code, developers can write that logic as Cedar policies and delegate access decisions to Cedar’s evaluation engine. Cedar’s simple and intuitive syntax supports common authorization use-cases with readable policies, naturally leveraging concepts from role-based, attribute-based, and relation-based access control models. Cedar’s policy structure enables access requests to be decided quickly. Cedar’s policy validator leverages optional typing to help policy writers avoid mistakes, but not get in their way. Cedar’s design has been finely balanced to allow for a sound and complete logical encoding, which enables precise policy analysis, e.g., to ensure that when refactoring a set of policies, the authorized permissions do not change. We have modeled Cedar in the Lean programming language, and used Lean’s proof assistant to prove important properties of Cedar’s design. We have implemented Cedar in Rust, and released it open-source. Comparing Cedar to two open-source languages, OpenFGA and Rego, we find (subjectively) that Cedar has equally or more readable policies, but (objectively) performs far better.

Prior Authorization and Association With Delayed or Discontinued Prescription Fills.

Prior authorization requirements are increasing but little is known about their effects on access to care. We examined the association of a new prior authorization policy with delayed or discontinued prescription fills for oral anticancer drugs among Medicare Part D beneficiaries. Using Medicare part D claims data from 2010 to 2020, we studied beneficiaries regularly filling one of 11 oral anticancer drugs, defined as three 30-day fills in 120 days preceding the plan's prior authorization policy change on that drug and continuously enrolled in the same plan for 120 days before and after the policy change at the start of a new year. The control group consisted of beneficiaries meeting the same utilization criteria, but who were enrolled in plans at the same time that did not implement a prior authorization policy change. The outcomes of interest were discontinuation of the drug within 120 days (analyzed with regression analyses) and time (in days) to next fill after a prior authorization policy change (analyzed using a quasi-experimental difference-in-differences event study). The introduction of a new prior authorization on an established drug increased the odds of discontinuation within 120 days (adjusted odds ratio, 7.1 [95% CI, 6.0 to 8.5]; P < .001) and increased time to next fill by 9.7 days (95% CI, 8.2 to 11.2; P < .001), relative to patients whose plans did not have a prior authorization policy change. Introduction of a new prior authorization policy on an established drug regimen is associated with increased probability of discontinued and delayed care. For some conditions, this may represent a clinically consequential barrier to access. Waiving prior authorization for patients already established on a drug may improve adherence.

IEEE Transactions on Energy Markets, Policy, and Regulation Information for Authors

IEEE Transactions on Energy Markets, Policy, and Regulation Information for Authors

Enforcing security policies on interacting authentication systems

Security policies of authentication systems are a crucial factor in mitigating the risk of impersonation, which is often the first stage of advanced persistent threats. Online authentication systems may often interact with each other, due to various mechanisms, such as account recovery or federated authentication. This leads to an implicit extension of the security policies of an authentication system with policies over which the system has no control. As a result, an authentication system that adopts very strong security policies can be unexpectedly weak. This paper deals with the above problem, which affects most real-world online authentication systems. The paper proposes a theoretical framework that formalizes authentication policies and interactions among authentication systems, together with a protocol that prevents, whenever an interaction is established or updated, the security issues described above. An SSI-based implementation of the proposed protocol is presented as well.

Medicaid Managed Care Prior Authorization For Buprenorphine Tied To State Partisanship And Health Plan Profit Status, 2018.

Buprenorphine is among the most effective drugs for treating opioid use disorder, yet only a quarter of Americans who need it receive it. Requiring prior authorization has been identified as an important barrier to buprenorphine access. However, the practice remains widespread in Medicaid-the largest insurer of Americans with opioid use disorder. In this study, we examined how prior authorization for buprenorphine is related to plan structure and state political environment, using data on all 266 comprehensive Medicaid managed care plans active in 2018. We found substantial variation in prior authorization use across states, with all plans requiring prior authorization in eleven states and no plans requiring it in thirteen other states. We found that for-profit plans and those located in Republican states were more likely to impose prior authorization policies. Our findings suggest that managed care plans' decisions regarding use of prior authorization may be shaped by internal pressures to control costs, as well as by differing partisan stances regarding the need to prevent criminal diversion of buprenorphine.

Banks and Inequality: Evidence from a Nationwide Branch Authorization Policy

Banks and Inequality: Evidence from a Nationwide Branch Authorization Policy

Journal of Library Outreach and Engagement - Review

The Journal of Library Outreach and Engagement offers a venue for public, school and academic librarians to share peer-reviewed original research, features and content of note for those tasked with attracting and retaining patrons at libraries and other cultural heritage institutions. Although it is relatively new and has a somewhat irregular issue count, the journal features indications of commitment to diversity, equity and inclusion and follows best practices for scholarly journal publication, including open access licensing and transparent policies for potential authors.

FedAAA-SDN: Federated Authentication, Authorization and Accounting in SDN controllers

Modern technology advancements such as Software Defined Networking (SDN) have been employed in distinct scenarios such as cloud computing and wireless networks, and have made network administration simpler since it gives greater flexibility in centralizing the configurations of a network and its data. Several SDN controllers have started to offer Authorization, Authentication, and Accounting (AAA) services to improve user management and security, including support for OAuth2.0. However, basic authentication schemes using the tuple username and password are not considered secure nowadays (prone to brute force attacks), or the use of basic tokens in OAuth 2.0 is propitious to security vulnerabilities not meeting the security requirements in current and future use cases dealing with authentication. Therefore, the main objective of this work is the design and evaluation of the FedAAA-SDN framework enabling authentication, authorization, and accounting mechanisms in SDN controllers controlling different types of networks. In particular, the FedAAA-SDN framework enables federated authentication and authorization processes for network functions by enabling the conveyance of identity and authentication information across heterogeneous domains/networks, allowing also network operators to enforce authorization policies for network functions in wired and wireless networks. A FedAAA-SDN proof of concept is implemented with OpenDaylight as the SDN controller, OpenID Connect as the authentication and authorization mechanism, and Keycloak as the OpenID Provider. FedAAA-SDN also includes the concept of trust levels and trust policies that rely on the context information of a user’s device and associated connected access networks. The implementation of the FedAAA-SDN framework proof of concept involves modifications in the OpenDaylight AAA filter component to secure all the interactions with the several network applications/subcomponents of the OpenDaylight SDN controller. STRIDE security analysis demonstrates that the FedAAA-SDN framework is able to reduce the number of threats.

Removal of Medicaid Prior Authorization Requirements and Buprenorphine Treatment for Opioid Use Disorder

Buprenorphine treatment for opioid use disorder (OUD) is associated with decreased morbidity and mortality. Despite its effectiveness, buprenorphine uptake has been limited relative to the burden of OUD. Prior authorization (PA) policies may present a barrier to treatment, though research is limited, particularly in Medicaid populations. To assess whether removal of Medicaid PAs for buprenorphine to treat OUD is associated with changes in buprenorphine prescriptions for Medicaid enrollees. This state-level, serial cross-sectional study used quarterly data from 2015 through the first quarter (January-March) of 2019 to compare buprenorphine prescriptions in states that did and did not remove Medicaid PAs. Analyses were conducted between June 10, 2021, and August 15, 2023. The study included 23 states with active Medicaid PAs for buprenorphine in 2015 that required similar PA policies in fee-for-service and managed care plans and had at least 2 quarters of pre- and postperiod buprenorphine prescribing data. Removal of Medicaid PA for at least 1 formulation of buprenorphine for OUD. The main outcome was number of quarterly buprenorphine prescriptions per 1000 Medicaid enrollees. Between 2015 and the first quarter of 2019, 6 states in the sample removed Medicaid PAs for at least 1 formulation of buprenorphine and had at least 2 quarters of pre- and postpolicy change data. Seventeen states maintained buprenorphine PAs throughout the study period. At baseline, relative to states that repealed PAs, states that maintained PAs had lower buprenorphine prescribing per 1000 Medicaid enrollees (median, 6.6 [IQR, 2.6-13.9] vs 24.1 [IQR, 8.7-27.5] prescriptions) and lower Medicaid managed care penetration (median, 38.5% [IQR, 0.0%-74.1%] vs 79.5% [IQR, 78.1%-83.5%] of enrollees) but similar opioid overdose rates and X-waivered buprenorphine clinicians per 100 000 population. In fully adjusted difference-in-differences models, removal of Medicaid PAs for buprenorphine was not associated with buprenorphine prescribing (1.4% decrease; 95% CI, -31.2% to 41.4%). For states with below-median baseline buprenorphine prescribing, PA removal was associated with increased buprenorphine prescriptions per 1000 Medicaid enrollees (40.1%; 95% CI, 0.6% to 95.1%), while states with above-median prescribing showed no change (-20.7%; 95% CI, -41.0% to 6.6%). In this serial cross-sectional study of Medicaid PA policies for buprenorphine for OUD, removal of PAs was not associated with overall changes in buprenorphine prescribing among Medicaid enrollees. Given the ongoing burden of opioid overdoses, continued multipronged efforts are needed to remove barriers to buprenorphine care and increase availability of this lifesaving treatment.

Policy-Based Remote User Authentication From Multi-Biometrics

Abstract In this paper, we introduce the first generic framework of policy-based remote user authentication from multiple biometrics. The proposed framework allows an authorized user to remotely authenticate herself to an authentication server using her multiple biometrics, which enhances both the security and usability of user authentications. The authentication server approves a user’s authentication request if and only if the user’s multiple biometrics satisfies an authentication policy. In particular, the authentication policy can be dynamically updated to satisfy different security and usability requirements in practice. We implement an instantiation of the proposed framework and report its performance under various authentication policies.

DACP: Enforcing a dynamic access control policy in cross-domain environments

Enabling hybrid authorisations to enforce dynamic access control policy from single-domain to cross-domain environments (CDEs) is important for distributed services. However, traditional Attribute-Based Access Control (ABAC) models are incompatible with CDEs. To fill this gap, approaches that apply cryptographic primitives, e.g., attribute-based encryption (ABE), have been proposed. The computation and storage overhead in most ABE constructions is non-negligible and increases with the complexity of the associated policies. In addition, most access control policy systems enforce authorisation policies in a centralised way, raising serious security and privacy issues. In this paper, we introduce DACP – a practical Dynamic Access Control Policy system supporting dynamic cross-domain authorisation. DACP combines traditional ABAC approach and a novel cryptographic primitive Attribute-based group signature (ABGS). ABAC is used for the access control decision and policy enforcement according to the user’s attributes whereas ABGS is used for managing the user’s attributes between users and authorities. Thus, the user’s attributes are securely distributed along with the access structure in CDEs while preserving the user’s privacy. We present the concrete design and implementation of DACP, and evaluate it in real-world settings. The evaluation shows that DACP is practical and efficient in CDEs.

User Authorization in Microservice-Based Applications

Microservices have emerged as a prevalent architectural style in modern software development, replacing traditional monolithic architectures. The decomposition of business functionality into distributed microservices offers numerous benefits, but introduces increased complexity to the overall application. Consequently, the complexity of authorization in microservice-based applications necessitates a comprehensive approach that integrates authorization as an inherent component from the beginning. This paper presents a systematic approach for achieving fine-grained user authorization using Attribute-Based Access Control (ABAC). The proposed approach emphasizes structure preservation, facilitating traceability throughout the various phases of application development. As a result, authorization artifacts can be traced seamlessly from the initial analysis phase to the subsequent implementation phase. One significant contribution is the development of a language to formulate natural language authorization requirements and policies. These natural language authorization policies can subsequently be implemented using the policy language Rego. By leveraging the analysis of software artifacts, the proposed approach enables the creation of comprehensive and tailored authorization policies.

A formal approach for the identification of redundant authorization policies in Kubernetes

Application containerization allows for efficient resource utilization and improved performance when compared to traditional virtualization techniques. However, managing multiple containers and providing services such as load balancing and fault tolerance is a challenging aspect. This led to the inception of Kubernetes, which allows for building resilient containerized distributed systems. The authorization process provided by Kubernetes is well-defined and thorough; however, the policies are prone to redundancy conflict. The size of an authorization policy has a direct impact on its manageability and performance of the evaluation process. Redundant rules in an access control policy increase the size of the policy and may induce unexpected side effects. In this paper, we have proposed an approach for the identification of redundancy conflicts in the authorization policies supported by Kubernetes. The proposed approach is formal and based on Event-Calculus, a logic programming formalism. The proposed approach can model different authorization modes (such as ABAC and RBAC) as supported by Kubernetes and allows for the identification of redundant policies amongst attributes, roles, and their combinations. We have provided tool support to convert the Kubernetes policyobjects to Event-Calculus models and then to automatically invoke the reasoner on the converted models and display any identified conflicts. We have also detailed the performance evaluation results to justify the practicality of the proposed approach.

IEEE Transactions on Energy Markets, Policy, and Regulation Information for Authors

IEEE Transactions on Energy Markets, Policy, and Regulation Information for Authors

Energy Efficient Trust Based Data Communication using AODV Protocol in MANET

MANET is a collection of mobile devices and small-scale infrastructure networks built without centralized control. Each node in these networks collaborates with the other nodes to serve as a host or router. Because the detection medium contains information about distributed communication transmitted through Internet resources, security is an essential aspect of the wireless sensor network. Due to security flaws in network routing attacks, most existing principles control power resources and topology structure responsibility in fewer security dependencies, resulting in various intrusion factors due to data breaches. This paper presents a secure routing mechanism for wireless sensor networks based on trust aware routing protocol. Most constraints the routing protocol is resilient in the presence of malicious nodes activities monitoring on the routing levels based on response portability and energy constraints. By concerning energy level-based security, we propose a Trust Aware Energy Efficient Routing Protocol (TAE2RP) using secure routing data transmission for improving lifetime maximization in WSN. Initially the Resistance Support Factor (RSF) was estimated based on the packet drop ratio by handling the data resemblance of route containing information. Then the routing levels behaviors are analyzed through Secure Surf-Channel Multicast Routing Protocol (SSCMRP). To evaluate the trust factor on packet transmission rate using TAE2RP. In addition, Redundant Array Shifting Encryption (RASE) was applied to secure the data packets. The authentication policy was enhanced through Master Node Digital signing authentication. This optimized the cost of security routing by handling energy balancing mechanisms to improve the higher security by concerning authentication to attain higher security.