Capability-based Access Control Research Articles

EDAAAS: Efficient distributed anonymous authentication and access in smart homes

The smart home field has witnessed rapid developments in recent years. Internet of Things applications for the smart home are very heterogeneous and continuously increasing in number, making user management from a security perspective very challenging. Moreover, the resource-constrained nature of most of the devices implies that any security mechanisms deployed should be lightweight and highly efficient. In this article, we propose an authentication scheme based on symmetric key cryptography, combined with a capability-based access control system, to provide the different stakeholders (residents, recurring guests, or temporary guests) end-to-end secure access to the Internet of Things devices in a smart home, managed by the home owner in an anonymous way. The operations in our scheme only include a small number of communication phases and protect the identities of the entities involved (i.e. stakeholders and end-nodes) from any outside entity. The proposed scheme ensures that even if the stakeholder’s device or the Internet of Things device is attacked, the system remains secure.

Editorial for Special Issue on “Challenges Pervasive Network and Applications for Internet of Things”

Editorial: This special issue features seven selected papers with high quality. The first article, “Mobile target positioning using refining distance measurements with inaccurate anchor nodes in chaintype wireless sensor networks” by Chengming Luo, Wei Li, Hai Yang, Mengbao Fan and Xuefeng Yang, As a class of long and narrow structures widely exist such as the river, road, mine tunnel, pipe, chain-type wireless sensor networks (CWSN) can be applied to monitor these environments. The accurate position estimation is a key technology for the mobile target in CWSN. This paper proposes an innovative positioning method to estimate the position of mobile target. Firstly, wireless signals can be affected by measurement noises, coordinate errors of anchor nodes, and chain scene structure. Kernel canonical correlation analysis is applied to analyze the correlation coefficients of these nonlinear wireless signal sets. Secondly, we search out two maximum correlative sets of wireless signals and integrate them into a set of optimal wireless signals. Thirdly, the uncertainty coordinate of anchor node is modeled and the position of mobile target is estimated under measurement and geometry constraints. Furthermore, we simulate the proposed method for mobile target, in comparison with the weighted least squares (WLS) and CHAN methods. Estimation results indicate that the proposed method can refine distance measurement accuracy and perform better positioning performance than WLS and CHAN methods, when we vary the conditions of TDOA/AOAmeasurement errors, anchor nodes coordinate errors, and anchor nodes spacing distance. Finally, the actual positioning experiments are implemented in a corridor, which show that the practical estimation results are similar to the simulation results. The second article, “Physical Memory Collection and Analysis in Smart Grid Embedded System” from Seokjun Lee and Taeshik Shon, Unlike the existing electric grid, the smart grid has a variety of functions that enable electric utility suppliers and consumers to perform dual exchanges of real-time information by adding IT technology. Therefore, the systems of smart grid suppliers and those of users are always connected through a network, which means that the systems related to the smart grid could become targets of malicious attackers. The various smart grid systems could have different hardware configuration from those of general systems, but their fundamental operating mechanism is the same as that of the general computer system. When a system is operating, its information and the data used by a program are loaded into the system’s memory. In this paper, we studied the method of physical memory collection and analysis in smart grid embedded systems in order to help investigate crimes related to smart grid s. In addition, we verify the method studied in this paper through the collection and analysis of physical memory in the virtual Linux environment using a virtual machine. The third, “Behavior and Capability based Access Control Model for Personalized TeleHealthCare Assistance” by Meriem Zerkouk, Paulo Cavalcante, Abdallah Mhamed, Jerome Boudy, Belhadri Messabih, With the growing proportion of dependant people (ageing, disabled users), Tele-assistance and Tele-monitoring platforms will play a significant role to deliver an efficient and less-costly remote care in their assistive living environments. Sensor based technology would greatly contribute to get valuable information which should help to provide personalized access to the services available within their living spaces. However, current access control models remain unsuitable due to the lack of completeness, flexibility and adaptability to the user profile. In this paper, we propose a new access control model based on K. W. Choi (*) Georgia Institute of Technology, Atlanta, GA, USA e-mail: kchoi.jopt@gmail.com

Behavior and Capability Based Access Control Model for Personalized TeleHealthCare Assistance

With the growing proportion of dependant people (ageing, disabled users), Tele-assistance and Tele-monitoring platforms will play a significant role to deliver an efficient and less-costly remote care in their assistive living environments. Sensor based technology would greatly contribute to get valuable information which should help to provide personalized access to the services available within their living spaces. However, current access control models remain unsuitable due to the lack of completeness, flexibility and adaptability to the user profile. In this paper, we propose a new access control model based on the user capabilities and behavior. This model is evaluated using the data sensed from our tele-monitoring platform in order to assist automatically the dependent people according to the occurred situation. The design of our model is a dynamic ontology and evolving security policy according to the access rules that are used in the inference engine to provide the right service according to the user's needs. Our security policy reacts according to the detected distress situation derived from the data combination of both the wearable devices and the pervasive sensors. The security policy is managed through the classification and reasoning process. Our classification process aims to extract the behavior patterns which are obtained by mining the data set issued from our Tele-monitoring platform according to the discriminating attributes: fall, posture, movement, time, user presence, pulse and emergency call. Our reasoning process aims to explore the recognized context and the extracted behavior patterns which set up the rule engine to infer the right decision security policy.

DCapBAC: embedding authorization logic into smart things through ECC optimizations

In recent years, the increasing development of wireless communication technologies and IPv6 is enabling a seamless integration of smart objects into the Internet infrastructure. This extension of technology to common environments demands greater security restrictions, since any unexpected information leakage or illegitimate access to data could present a high impact in our lives. Additionally, the application of standard security and access control mechanisms to these emerging ecosystems has to face new challenges due to the inherent nature and constraints of devices and networks which make up this novel landscape. While these challenges have been usually addressed by centralized approaches, in this work we present a set of Elliptic Curve Cryptography optimizations for point and field arithmetic which are used in the design and implementation of a security and capability-based access control mechanism (DCapBAC) on smart objects. Our integral solution is based on a lightweight and flexible design that allows this functionality is embedded on resource-constrained devices, providing the advantages of a distributed security approach for Internet of Things (IoT) in terms of scalability, interoperability and end-to-end security. Additionally, our scheme has been successfully validated by using AVISPA tool and implemented on a real scenario over the Jennic/NXP JN5148 chipset based on a 32-bit RISC CPU. The results demonstrate the feasibility of our work and show DCapBAC as a promising approach to be considered as security solution for IoT scenarios.

On optimal cryptographic key derivation

Any secured system (such as secure group communication) can be modeled as a capability-based access control system in which each user is given a set of secret keys of the resources he is granted access to. In some large systems with resource-constrained devices, such as sensor networks and RFID systems, the design is sensitive to key storage cost. With a goal to minimize the maximum key storage needed at any user, key compression based on key linking, that is, deriving one key from another without compromising security, is studied. A lower bound on key storage needed for a general access structure with key derivation is derived. This bound demonstrates the theoretic limit of any systems which do not trade off security and can be viewed as a negative result to provide ground for designs with security tradeoff. A provably secure key derivation scheme based on pseudorandom functions is given, along with an algorithm to find the optimal key linking pattern for any given access structure. Using the key linking framework, a number of key pre-distribution schemes in the literature are analyzed.

A capability-based security approach to manage access control in the Internet of Things

Resource and information protection plays a relevant role in distributed systems like the ones present in the Internet of Things (IoT). Authorization frameworks like RBAC and ABAC do not provide scalable, manageable, effective, and efficient mechanisms to support distributed systems with many interacting services and are not able to effectively support the dynamicity and scaling needs of IoT contexts that envisage a potentially unbound number of sensors, actuators and related resources, services and subjects, as well as a more relevance of short-lived, unplanned and dynamic interaction patterns. Furthermore, as more end-users start using smart devices (e.g. smart phones, smart home appliances, etc.) the need to have more scalable, manageable, understandable and easy to use access control mechanisms increases. This paper describes a capability based access control system that enterprises, or even individuals, can use to manage their own access control processes to services and information. The proposed mechanism supports rights delegation and a more sophisticated access control customization. The proposed approach is being developed within the European FP7 IoT@Work project to manage access control to some of the project’s services deployed in the shop floor.

Identity Authentication and Capability Based Access Control (IACAC) for the Internet of Things

In the last few years the Internet of Things (IoT) has seen widespreadapplication and can be found in each field. Authentication and accesscontrol are important and critical functionalities in the context of IoTto enable secure communication between devices. Mobility, dynamicnetwork topology and weak physical security of low power devices in IoTnetworks are possible sources for security vulnerabilities. It ispromising to make an authentication and access control attack resistant andlightweight in a resource constrained and distributed IoT environment.This paper presents the Identity Authentication and Capability basedAccess Control (IACAC) model with protocol evaluation and performanceanalysis. To protect IoT from man-in-the-middle, replay and denial ofservice (Dos) attacks, the concept of capability for access control isintroduced. The novelty of this model is that, it presents an integratedapproach of authentication and access control for IoT devices. Theresults of other related study have also been analyzed to validate andsupport our findings. Finally, the proposed protocol is evaluated byusing security protocol verification tool and verification results showsthat IACAC is secure against aforementioned attacks. This paper alsodiscusses performance analysis of the protocol in terms of computationaltime compared to other existing solutions. Furthermore, this paper addresseschallenges in IoT and security attacks are modelled with the use casesto give an actual view of IoT networks.

Secure Access Mechanism for Cloud Storage

Emerging storage cloud systems provide continuously available and highly scalable storage services to millions of geographically distributed clients. A secure access control mechanism is a crucial prerequisite for allowing clients to entrust their data to such cloud services. The seamlessly unlimited scale of the cloud and the new usage scenarios that accompany it pose new challenges in the design of such access control systems. In this paper we present a capability-based access control model and architecture appropriate for cloud storage systems that is secure, flexible, and scalable. We introduce new functionalities such as a flexible and dynamic description of resources; an advanced delegation mechanism and support for auditability, accountability and access confinement. The paper details the secure access model, shows how it fits in a scalable storage cloud architecture, and analyzes its security and performance.

Dynamic management of capabilities in a network aware coordination language

We introduce a capability-based access control model integrated into a linguistic formalism for modeling network aware systems and applications. Our access control model enables specification and dynamic modification of policies for controlling process activities (mobility of code and access to resources). We exploit a combination of static and dynamic checking and of in-lined reference monitoring to guarantee absence of run-time errors due to lack of capabilities. We illustrate the usefulness of our framework by using it for implementing a simplified but realistic scenario. Finally, we show how the model can be easily tailored for dealing with different forms of capability acquisition and loss, thus enabling different possible variations of access control policies.

Dynamically authorized role-based access control for grid applications

Grid computing is concerned with the sharing and coordinated use of diverse resources in distributed “virtual organizations”. The heterogeneous, dynamic and multi-domain nature of these environments makes challenging security issues that demand new technical approaches. Despite the recent advances in access control approaches applicable to Grid computing, there remain issues that impede the development of effective access control models for Grid applications. Among them there are the lack of context-based models for access control, and reliance on identity or capability-based access control schemes. An access control scheme that resolve these issues is presented, and a dynamically authorized role-based access control (D-RBAC) model extending the RBAC with context constraints is proposed. The D-RABC mechanisms dynamically grant permissions to users based on a set of contextual information collected from the system and user's environments, while retaining the advantages of RBAC model. The implementation architecture of D-RBAC for the Grid aplication is also described.

A Trust-Based Context-Aware Access Control Model for Web-Services

A key challenge in Web services security is the design of effective access control schemes that can adequately meet the unique security challenges posed by the Web services paradigm. Despite the recent advances in Web based access control approaches applicable to Web services, there remain issues that impede the development of effective access control models for Web services environment. Amongst them are the lack of context-aware models for access control, and reliance on identity or capability-based access control schemes. Additionally, the unique service access control features required in Web services technology are not captured in existing schemes. In this paper, we motivate the design of an access control scheme that addresses these issues, and propose an extended, trust-enhanced version of our XML-based Role Based Access Control (X-RBAC) framework that incorporates trust and context into access control. We outline the configuration mechanism needed to apply our model to the Web services environment, and provide a service access control specification. The paper presents an example service access policy composed using our framework, and also describes the implementation architecture for the system.

Operating System Design With Security As An Objective†

AbstractThe security of an operating system is not a consequence of the access control mechanism alone. Other design decisions such as overall system organization and selection of primitive operations for communication and synchronization contribute substantially to security. This is illustrated by a description of the security provided by a system design in which a capability-based access control mechanism interacts intimately with other system components.