Context-aware Access Control Research Articles

Adaptive context-aware access control for IoT environments leveraging fog computing

The increasing use of the Internet of Things (IoT) has driven the demand for enhanced and robust access control methods to protect resources from unauthorized access. A cloud-based access control approach brings significant challenges in terms of communication overhead, high latency, and complete reliance. In this paper, we propose a Fog-Based Adaptive Context-Aware Access Control (FB-ACAAC) framework for IoT devices, dynamically adjusting access policies based on contextual information to prevent unauthorised resource access. The main purpose of FB-ACAAC is to provide adaptability to changing access behaviors and context by bringing decision-making and information about policies closer to the end nodes of the network. FB-ACAAC improves the availability of resources and reduces the amount of time for information to be processed. FB-ACAAC extends the widely used eXtensible Access Control Markup Language (XACML) to manage access control decisions. Traditional XACML-based methods do not take into account changing environments, different contexts, and changing access behaviors and are vulnerable to certain types of attacks. To address these issues, FB-ACAAC proposes an adaptive context-aware XACML scheme for heterogeneous distributed IoT environments using fog computing and is designed to be context-aware, adaptable, and secure in the face of unauthorised access. The effectiveness of this new scheme is verified through experiments, and it has a low processing time overhead while providing extra features and improved security.

A Weighted GraphSAGE-Based Context-Aware Approach for Big Data Access Control.

Context information is the key element to realizing dynamic access control of big data. However, existing context-aware access control (CAAC) methods do not support automatic context awareness and cannot automatically model and reason about context relationships. To solve these problems, this article proposes a weighted GraphSAGE-based context-aware approach for big data access control. First, graph modeling is performed on the access record data set and transforms the access control context-awareness problem into a graph neural network (GNN) node learning problem. Then, a GNN model WGraphSAGE is proposed to achieve automatic context awareness and automatic generation of CAAC rules. Finally, weighted neighbor sampling and weighted aggregation algorithms are designed for the model to realize automatic modeling and reasoning of node relationships and relationship strengths simultaneously in the graph node learning process. The experiment results show that the proposed method has obvious advantages in context awareness and context relationship reasoning compared with similar GNN models. Meanwhile, it obtains better results in dynamic access control decisions than the existing CAAC models.

SoK: Context and Risk Aware Access Control for Zero Trust Systems

Evolving computing technologies such as cloud, edge computing, and the Internet of Things (IoT) are creating a more complex, dispersed, and dynamic enterprise operational environment. New security enterprise architectures such as those based on the concept of Zero Trust (ZT) are emerging to meet the challenges posed by these changes. ZT systems treat internal and external networks as untrusted and subject both to the same security checking and control to prevent data breaches and limit internal lateral movement. Context awareness is a notion from the field of ubiquitous computing that is used to capture and react to the situation of an entity, based on the dynamics of a particular application or system context. The idea has been incorporated into several access control models. However, the overlap between context-aware access control and zero-trust security has not been fully explored. In this SoK, we conduct a systematic examination of ZT, context awareness, and risk-based access control to explore the critical elements of each and to identify areas of overlap and synergy to enhance the operation and deployment of ZT systems.

Experience-Based Access Control in UbiComp: A New Paradigm

Experience is a sociological concept and builds over time. In a broader sense, the human-centered equivalents of experience and trust apply to D2D interaction. Ubiquitous computing (UbiComp) embeds intelligence and computing capabilities in everyday objects to make them effectively communicate, share resources, and perform useful tasks. The safety of resources is a serious problem. As a result, authorization and access control in UbiComp is a significant challenge. Our work presents experience as an outcome of history (HI), reliability (RL), transitivity (TR), and Ubiquity (UB). This experience model is easily adaptable to a variety of self-regulating context-aware access control systems. This paper proposes a framework for Experience-Based Access Control (EX-BAC) with all major services provided by the model. EX-BAC extends attribute-based access control. It uses logical device type and experience as context parameters for policy design. When compared with the state-of-the-art, EX-BAC is efficient with respect to response time.

Context aware access control for home voice assistant in multi-occupant homes

Home Voice Assistants (HVAs) like the Amazon Echo or the Google Home are increasingly being used to control smart devices in a smarthome. A HVA device takes in a spoken command (“Turn off the living-room lights and television”), and converts it into commands for respective devices. This paper presents CANVAS system, an Context AwareNess for Voice ASsistants system designed for multi-occupant smarthomes. CANVAS is designed to be run on a HVA, and makes use of the sounds in the home to provide additional context information to decide whether to execute the command, prompt for confirmation, or reject the command entirely. CANVAS also includes a pictorial utility to help non-expert users configure these rules. Our experiments indicate that CANVAS has a low computational overhead, making it suitable to be executed in HVAs. Our experiments Mechanical Turk suggest that the pictorial configuration utility is also intuitive.

A Survey of Context-Aware Access Control Mechanisms for Cloud and Fog Networks: Taxonomy and Open Research Issues

Over the last few decades, the proliferation of the Internet of Things (IoT) has produced an overwhelming flow of data and services, which has shifted the access control paradigm from a fixed desktop environment to dynamic cloud environments. Fog computing is associated with a new access control paradigm to reduce the overhead costs by moving the execution of application logic from the centre of the cloud data sources to the periphery of the IoT-oriented sensor networks. Indeed, accessing information and data resources from a variety of IoT sources has been plagued with inherent problems such as data heterogeneity, privacy, security and computational overheads. This paper presents an extensive survey of security, privacy and access control research, while highlighting several specific concerns in a wide range of contextual conditions (e.g., spatial, temporal and environmental contexts) which are gaining a lot of momentum in the area of industrial sensor and cloud networks. We present different taxonomies, such as contextual conditions and authorization models, based on the key issues in this area and discuss the existing context-sensitive access control approaches to tackle the aforementioned issues. With the aim of reducing administrative and computational overheads in the IoT sensor networks, we propose a new generation of Fog-Based Context-Aware Access Control (FB-CAAC) framework, combining the benefits of the cloud, IoT and context-aware computing; and ensuring proper access control and security at the edge of the end-devices. Our goal is not only to control context-sensitive access to data resources in the cloud, but also to move the execution of an application logic from the cloud-level to an intermediary-level where necessary, through adding computational nodes at the edge of the IoT sensor network. A discussion of some open research issues pertaining to context-sensitive access control to data resources is provided, including several real-world case studies. We conclude the paper with an in-depth analysis of the research challenges that have not been adequately addressed in the literature and highlight directions for future work that has not been well aligned with currently available research.

Achieving security scalability and flexibility using Fog-Based Context-Aware Access Control

In the cyberspace environment, access control is one of the foremost fundamental safeguards used to prevent unauthorized access and to minimize the impact from security breaches. Fog computing preserves many benefits for the integration of both internet of things (IoT) and cloud computing platforms. Security in Fog computing environment remains a significant concern among practitioners from academia and industry. The current existing access control models, like the traditional Context-Aware Access Control (CAAC), are limited to access data from centralized sources, and not robust due to lack of semantics and cloud-based service. This major concern has not been addressed in the literature, also literature still lacks a practical solution to control fog data view from multiple sources.This paper critically reviews and investigates the limitations of current fog-based access control. It considers the trade-off between latency and processing overheads which has not been thoroughly studied before. In this paper, a new generation of Fog-Based Context-Aware Access Control (FB-CAAC) framework is proposed to enable flexible access control data from multiple sources. To fill the gap in the literature this paper introduces (i) a general data model and its associated mapping model to collate data from multiple sources. (ii) a data view model to provide an integrated result to the users, dealing with the privacy requirements of the associated stakeholders, (iii) a unified set of CAAC policies with an access controller to reduce both administrative and processing overheads, and (iv) a data ontology to represent the common classes in the relevant data sets. The applicability of FB-CAAC proposal is demonstrated via a walkthrough of the entire mechanism along with several case studies and a prototype testing. The results show the efficiency, flexibility, effectiveness, and practicality of FB-CAAC for data access control in fog computing environment.

A Secured System for Internet Enabled Host Devices

In the world of wireless communication, heterogeneous network topologies such as Wi-Fi and Long-Term Evolution (LTE) the topologies authentication service delivery forms a major challenge with access control; which is sought to be addressed. In this paper, we propose a security model by adapting Capability-based Context Aware Access Control (CCAAC) model for internet-enabled devices for defense against hacking or unauthorized access. The steps applied during the programming of this web application was followed through using the Elliptic-Curve Diffie–Hellman (ECCDH) algorithm so that the initiation of a random prime number between a range, the encryption and exchange of the devices public keys to the decryption are interpreted the right way to the machine making use of it. The results established a security model that has a good chance of being effective against present cyber-attacks other security loopholes.

Decentralized Context Aware Access Control Model for Internet of Things

Access control mechanisms are a primary security requirement in Internet of Things applications. Traditional access control mechanisms are inefficient while applying directly to IoT applications. Various proposals have been made to adapt traditional access control models for IoT applications. These proposals are either centralized or distributed approaches. In centralized approach, for each access request, it is required that device access central control server to verify access rights via multiple message exchanges. This results in communication overhead at a device side. A single point of failure is also possible if the central server fails. In distributed approach, for each access control request, reliance is still there on a central unit, which again results into communication overhead and possibility of a single point of failure. In IoT applications, access rights are also dependent on various characteristics of the entities involved at the specific instance of access request. These characteristics are interpreted by providing context awareness to the access control models. Context aware access control models are used to provide fine-grained access rights in IoT applications. We propose a decentralized context aware access control model in this paper. Our design results in lesser communication overhead with the central unit and removes single point of failure. Our model uses contextual information to provide fine-grained access control mechanism. Our model provides greater flexibility to users to easily add/modify access control policies for different entities.

Sentient-based Access Control model: A mitigation technique for Advanced Persistent Threats in Smartphones

This research sheds light on the nature of an advanced persistent threat (APT) on smartphones by analysing real APT attack cases targeting smartphone users. Based on the research, context-aware access control is the best technique to minimise APT instigated by social engineering attacks in smartphones. Therefore, this research proposes an access control model known as sentient-based access control model (SENSATE), which combines role- and attribute-based and multi-level security to maintain information integrity and confidentiality that can be infringed through social engineering attacks. The implementation of existing smartphone sensors in the design of SENSATE is a novel approach in the fight against smartphone cybercrimes, such as APT.

Context-Aware Adaptive Remote Access for IoT Applications

The rapid growth of communication networking, ubiquitous sensing, and signal processing has spurred the emergence of the Internet of Things (IoT) era. As a novel cutting-edge technology, the IoT enables a plethora of smart-devices equipped with diverse computing, sensing, and actuation capabilities to be connected to the Internet. Thus, it promises to provide a revolutionary and fully connected “smart” world while greatly developing economies and enhancing the quality of life. IoT is indeed an emergent global phenomenon, where real-time remote access to data and applications opens new unprecedented opportunities for ubiquitous monitoring and managing. In such dynamic, interconnected, and heterogeneous environment where the context conditions (location, time, situation sensitivity, etc.) are continuously and frequently changing, context-aware and adaptive solutions for data access are required to respond to the applications’ needs. Nevertheless, until now, no schemes provide concrete context-aware access control mechanisms in IoT. In this article, we design a novel context-aware attribute-based access control (CAABAC) that considers the dynamic context changes. The proposed approach incorporates the contextual information with the ciphertext-policy attribute-based encryption (CP-ABE) to guarantee adaptive contextual access to data. The extensive analysis and simulations prove both the effectiveness and efficiency of the proposed scheme. Specifically, context-aware and adaptive remote access is enabled while outperforming other benchmarked schemes in terms of storage, communication, and computational cost.

A Survey of Efficient Trust Management Schemes in Mobile Ad-Hoc Network

Mobile Ad Hoc Networks (MANETs) are comprised of an arrangement of self-sorting mobile hosts furnished with wireless interaction devices gathered in groups without the need of any settled framework as well as centralized organization to maintain a system over radio connections. Every mobile node can react as a host and also, the router freely utilizes the wireless medium inside the correspondence range to deal with the interaction between huge quantities of individual mobile nodes by framing a correspondence system and trading the information among them without using any described group of the base station. A trust-based model in MANET estimates and sets up trust relationship among objectives. Trust-based routing is utilized to keep away data from different attackers like a wormhole, DOS, black-hole, selfish attack and so forth. Trust can be executed in different steps like reputation, subjective rationale and from the supposition of the neighboring node. A trust estimation approach not just watches the behavior of neighbor nodes, additionally it screens the transmission of the information packet in the identification of the route for exact estimation of trust value. A survey is carried out to find some of the limitations behind the existing works which has been done by the researchers to implement various approaches thus to build the trust management framework. Through the survey, it is observed that existing works focused only on the authenticated transmission of the message, how it transmits packets to the destination node securely using a trust-based scheme. And also, it is observed that the routing approach only focused on the key management issues. Certain limitation observed in the implemented approaches of existing work loses the reliability of framework. Thus, to withstand these issues it is necessary to establish a reliable security framework that protects the information exchanged among the users in a network while detecting various misbehaving attacks among the users. Confidentiality, as well as the integrity of information, can be secured by combining context-aware access control with trust management. The performance parameters should be evaluated with the previous works packet delivery ratio, packet drop, detection accuracy, number of false positives, and overhead.

Context-aware access control and anonymous authentication in WBAN

The emergence of the Internet of Things (IoT) as the next generation megatrend has paved the way for pervasive, ubiquitous and proficient healthcare monitoring systems. In the diverse kinds of networks, Wireless Body Area Network (WBAN) has been perceived as one of the most promising wireless sensor technologies for improving healthcare services thanks to its potential for continuous and real-time monitoring of health conditions. However, the open nature of wireless communication introduces wide security and privacy concerns as personal health information could be exposed to unauthorized parties or even malicious adversaries. Furthermore, in such a dynamic and heterogeneous environment where the context conditions continuously and frequently change, adaptive and context-aware solutions become mandatory to satisfy burgeoning security and privacy requirements. Therefore, it is indispensable to adaptively secure the extra-body communication between the smart portable device held by the WBAN client and the healthcare providers while considering the dynamic context changes. In this paper, we propose a context-aware access control and anonymous authentication approach based on a secure and efficient Hybrid Certificateless Signcryption (H-CLSC) scheme. Particularly, it incorporates the merits of Ciphertext-Policy Attribute-Based Signcryption (CP-ABSC) and Identity-Based Broadcast Signcryption (IBBSC) in order to meet the security requirements and provide adaptive contextual privacy. From a security perspective, the proposed mechanism achieves confidentiality, integrity, anonymity, context-aware privacy, key escrow resistance, public verifiability, and ciphertext authenticity. Performance analysis proves the efficiency and the effectiveness of the H-CLSC scheme compared to benchmark schemes in terms of functional security, storage, communication, and computational cost.

CaACBIM: A Context-aware Access Control Model for BIM

A building information model (BIM) is of upmost importance with a full life-time cycle in architecture engineering and construction industry. Smart construction relies on BIM to manipulate information flow, data flow, and management flow. Currently, BIM has been explored mainly for information construction and utilization, but there exist few works concerning information security, e.g., audits of critical models and exposure of sensitive models. Moreover, few BIM systems have been proposed to make use of new computing paradigms, such as mobile cloud computing, blockchain and Internet of Things. In this paper, we propose a Context-aware Access Control (CaAC) model for BIM systems on mobile cloud architectures. BIM data can be confidentially accessed according to contexts in a fine-grained manner. We describe functions of CaAC formally by illustrating location-aware access control and time-aware access control. CaAC model can outperform role-based access control for preventing BIM data leakage by distinguishing contexts. In addition, grouping algorithms are also presented for flexibility, in which basic model (user grouping based on user role permissions) and advanced model (user grouping based on user requests) are differentiated. Compared with the traditional role-based access control model, security and feasibility of CaAC are remarkably improved by distinguishing an identical role with multiple contexts. The average efficiency is improved by 2 n / ( 2 n − p − q ) , and time complexity is O ( n ) .

Context-Aware Policy Enforcement for PaaS-Enabled Access Control

It is generally conceded that, due to security and privacy concerns, enterprises and users are reluctant to embrace the cloud computing paradigm and hence benefit from the cost reductions and the increased flexibility or business agility that this paradigm brings about. These concerns stem mainly from the significantly-expanded attack surfaces that result from the heterogeneous nature of cloud services and the dynamicity inherent in cloud environments. In order to alleviate these concerns, effective and flexible access control approaches are required to consider the contextual parameters that characterise data access requests in the cloud. In this respect, this work presents PaaSword: a novel holistic access control framework—essentially a PaaS offering—that extends the popular XACML standard with semantic reasoning capabilities that support the federation of effective context-aware access control policies and their infusion into cloud applications with minimal manual intervention and effort. To determine the performance of our solution, a comparative evaluation test is presented and discussed, against a well-known reference implementation of the XACML standard, namely the open source WSO2 Balana engine.

Modeling adaptive access control policies using answer set programming

Many of the existing management platforms such as pervasive computing systems implement policies that depend on dynamic operational environment changes. Existing formal approaches for automatically enforcing access control policies are primarily expressed in conventional logic programming, also known as monotonic logics, e.g., First Order Logic (FOL). The major issue with monotonic logics is that they are not devised to invalidate initial believes in the light of further observations. This limitation makes these traditional logical approaches less suitable for modeling and analyzing context-aware access control policies, where exceptional policies are introduced incrementally and adaptively during runtime. The inability to invalidate initial policies when an exception needs to be enforced might result in inconsistencies and violations that need to be resolved manually by human entities. To address the problems with conventional logical approaches and more importantly prevent such inconsistencies, this paper presents a non-monotonic logic-based reasoning scheme for modeling and analyzing adaptive access control policies. In the proposed formalism, unavailable context data and incomplete access control policies can be explicitly expressed. To do so, the paper distinguishes three kinds of policies: default, context-dependent and exception policies. The proposed formalism is based on Answer Set Programming (ASP), a non-monotonic logic programming language that allows elegant representation of unavailability of context data in adaptive systems. We devise non-monotonic policy inference rules such that, when exception policies are defined, they take precedence over default and context-dependent policies automatically. The results of two case studies are reported to demonstrate the feasibility of the proposed policy representation scheme compared to the Organizational-Based Access Control (OrBAC) model.

Context-aware access control with imprecise context characterization for cloud-based data resources

Computing technologies are increasingly dynamic and ubiquitous in everyday life nowadays. Context information plays a crucial role in such dynamically changing environments and the different types of contextual conditions bring new challenges to context-sensitive access control. This information mostly can be derived from the crisp sets. For example, we can utilize a crisp set to derive a patient and nurse are co-located in the general ward of the hospital or not. Some of the context information characterizations cannot be made using crisp sets, however, they are equally important in order to make access control decisions. Towards this end, this article proposes an approach to Context-Aware Access Control using Fuzzy logic (FCAAC) for data and information resources. We introduce a formal context model to represent the fuzzy and other contextual conditions. We also introduce a formal policy model to specify the policies by utilizing these conditions. Using our formal approach, we combine the fuzzy model with an ontology-based approach that captures such contextual conditions and incorporates them into the policies, utilizing the ontology languages and the fuzzy logic-based reasoning. We introduce a unified data ontology and its associated mapping ontology in terms of facilitating access control to cloud-based data resources. We justify the feasibility of our approach by demonstrating the practicality through a prototype implementation, several healthcare case studies and a usability study. Finally, we demonstrate an experimental evaluation in terms of query response time. The experiment results demonstrate the satisfactory performance of our proposed FCAAC approach.

A Policy Model and Framework for Context-Aware Access Control to Information Resources†

In today’s dynamic ICT environments, the ability to control users’ access to information resources and services has become ever important. On the one hand, it should provide flexibility to adapt to the users’ changing needs, while on the other hand, it should not be compromised. The user is often faced with different contexts and environments that may change the user’s information needs. To allow for this, it is essential to incorporate the dynamically changing context information into the access control policies to reflect different contexts and environments through the use of a new context-aware access control (CAAC) approach with both dynamic associations of user-role and role-permission capabilities. Our proposed CAAC framework differs from the existing access control frameworks in that it supports context-sensitive access control to information resources and dynamically re-evaluates the access control decisions when there are dynamic changes to the context. It uses the dynamic context information to specify the user-role and role-permission assignment policies. We first present a formal policy model for our framework, specifying CAAC policies. Using this model, we then introduce a policy ontology for modeling CAAC policies and a policy enforcement architecture which supports access to resources according to the dynamically changing context information. In addition, we demonstrate the feasibility of our framework by considering (i) the completeness, correctness and consistency of the ontology concepts through application to healthcare scenarios and (ii) the performance and usability testing of the framework when using desktop and mobile-based prototypes.

A context-aware system to secure enterprise content: Incorporating reliability specifiers

The sensors of a context-aware system extract contextual information from the environment and relay that information to higher-level processes of the system so to influence the system’s control decisions. However, an adversary can maliciously influence such controls indirectly by manipulating the environment in which the sensors are monitoring, thereby granting privileges the adversary would otherwise not normally have. To address such context monitoring issues, we extend CASSEC by incorporating sentience-like constructs, which enable the emulation of “confidence”, into our proximity-based access control model to grant the system the ability to make more inferable decisions based on the degree of reliability of extracted contextual information. In CASSEC 2.0, we evaluate our confidence constructs by implementing two new authentication mechanisms. Co-proximity authentication employs our time-based challenge-response protocol, which leverages Bluetooth Low Energy beacons as its underlying occupancy detection technology. Biometric authentication relies on the accelerometer and fingerprint sensors to measure behavioral and physiological user features to prevent unauthorized users from using an authorized user’s device. We provide a feasibility study demonstrating how confidence constructs can improve the decision engine of context-aware access control systems.

Enhancing NoSQL datastores with fine-grained context-aware access control: a preliminary study on MongoDB

NoSQL datastores are getting increasing attention by companies and organisation for the ease and efficiency of handling high volumes of heterogeneous and unstructured data. Nowadays, as majority of these systems are available as cloud based services, this potentially favours their use even among small companies that could not afford the management of server farms for local cluster based solutions. However, besides all their benefits in terms of performance, availability and scalability as well as support for advanced analysis forms, NoSQL datastores also have some weaknesses, such as poor natively provided support for data protection. Recent surveys show that several companies consider the poor support for security features of NoSQL databases as a valid reason not to use them (Intel Co., 2013). In this paper, we do a first step to overcome these weaknesses by first proposing a roadmap to enhance the data protection functionalities of NoSQL datastores. Then, we illustrate our preliminary experience of designing an enhanced access control mechanism for MongoDB (http://www.mongodb.org), which, according to recent surveys (DB-Engines Ranking, 2017) ranks as the most popular NoSQL database.