Enforcement Of Access Control Policies Research Articles

A Novel System for Confidential Medical Data Storage Using Chaskey Encryption and Blockchain Technology

Secure storage of confidential medical information is critical to healthcare organizations seeking to protect patient's privacy and comply with regulatory requirements. This paper presents a new scheme for secure storage of medical data using Chaskey cryptography and blockchain technology. The system uses Chaskey encryption to ensure integrity and confidentiality of medical data, blockchain technology to provide a scalable and decentralized storage solution. The system also uses Bflow segmentation and vertical segmentation technologies to enhance scalability and manage the stored data. In addition, the system uses smart contracts to enforce access control policies and other security measures. The description of the system detailing and provide an analysis of its security and performance characteristics. The resulting images were tested against a number of important metrics such as Peak Signal-to-Noise Ratio (PSNR), Mean Squared Error (MSE), bit error rate (BER), Signal-to-Noise Ratio (SNR), Normalization Correlation (NC) and Structural Similarity Index (SSIM). Our results showing that the system provides a highly secure and scalable solution for storing confidential medical data, with potential applications in a wide range of healthcare settings.

Modeling and enforcing access control policies in conversational user interfaces

Conversational user interfaces (CUIs), such as chatbots, are becoming a common component of many software systems. Although they are evolving in many directions (such as advanced language processing features, thanks to new AI-based developments), less attention has been paid to access control and other security concerns associated with CUIs, which may pose a clear risk to the systems they interface with. In this paper, we apply model-driven techniques to model and enforce access-control policies in CUIs. In particular, we present a fully fledged framework to integrate the role-based access-control (RBAC) protocol into CUIs by: (1) modeling a set of access-control rules to specify permissions over the bot resources using a domain-specific language that tailors core RBAC concepts to the CUI domain; and (2) describing a mechanism to show the feasibility of automatically generating the infrastructure to evaluate and enforce the modeled access control policies at runtime.

Block chain based IAS protocol to enhance security and privacy in cloud computing

Cloud computing has become increasingly popular for data storage and processing, but security and privacy remain major concerns due to the potential for malicious attacks on wireless and mobile communication networks. In order to address these issues, researchers have proposed an IAS protocol that incorporates identity, access control, and secure authentication. To ensure the authenticity and security of data transmission in cloud computing, the proposed IAS protocol is implemented on top of blockchain technology. This allows for decentralized key management for recovery and revocation, as well as identity verification. To evaluate the effectiveness of this approach, the proposed model using Block Chain based Identity Management, Access Control and Secure Sharing (BC-IAS) is simulated on the cloud environment. The simulation assesses primary performance key metrics, including Data Access Rate, Message Delivery Ratio, End to End Delay and Energy consumption. Overall, the proposed BC-IAS protocol on top of blockchain technology shows promise for enhancing security and privacy in cloud computing. The proposed BC-IAS protocol on top of blockchain technology presents a promising solution for enhancing the security and privacy of cloud computing. The decentralized nature of blockchain technology ensures that data is stored in a tamper-proof and transparent manner, while the use of smart contracts allows for automated enforcement of access control policies. Moreover, the incorporation of identity verification and secure authentication ensures that only authorized users can access sensitive data, reducing the risk of data breaches and cyber-attacks.

An access control model based on blockchain master-sidechain collaboration

The centralized storage and centralized authorization approach in medical information systems can lead to data tampering and private information privacy leakage, while the traditional access control model has an overly simple authentication approach, relies excessively on trusted third-party organizations for the enforcement of access control policies, and has low efficiency in processing access requests. To address these problems, this paper proposes an access control model based on the collaboration of blockchain main and side chains, AC-BMS. Firstly, a password-based authentication scheme is designed based on doctors’ identity information; then Polygon side chain is designed to enhance the storage scalability of the blockchain; finally, the access node information on the main Ethereum chain is located on the side chain, and resources are obtained by executing Roll-up contracts deployed on the side chain. It is confirmed by simulation experiments in Hyperledger Fabric that the access efficiency and throughput of the blockchain access model proposed in this paper are improved when the number of accesses is multiplied, the average access time is saved by 2–3 s, the latency time is floating and stable, and the security, scalability, and availability are enhanced.

Janus: Hierarchical Multi-Blockchain-Based Access Control (HMBAC) for Multi-Authority and Multi-Domain Environments

Although there are several access control systems in the literature for flexible policy management in multi-authority and multi-domain environments, achieving interoperability and scalability, without relying on strong trust assumptions, is still an open challenge. We present HMBAC, a distributed fine-grained access control model for shared and dynamic multi-authority and multi-domain environments, along with Janus, a practical system for HMBAC policy enforcement. The proposed HMBAC model supports: (a) dynamic trust management between different authorities; (b) flexible access control policy enforcement, defined at the domain and cross-domain level; (c) a global source of truth for all entities, supported by an immutable, audit-friendly mechanism. Janus implements the HMBAC model and relies on the effective fusion of two core components. First, a Hierarchical Multi-Blockchain architecture that acts as a single access point that cannot be bypassed by users or authorities. Second, a Multi-Authority Attribute-Based Encryption protocol that supports flexible shared multi-owner encryption, where attribute keys from different authorities are combined to decrypt data distributedly stored in different authorities. Our approach was implemented using Hyperledger Fabric as the underlying blockchain, with the system components placed in Kubernetes Docker container pods. We experimentally validated the effectiveness and efficiency of Janus, while fully reproducible artifacts of both our implementation and our measurements are provided.

Managing access control issues in the choose your own device environment

Enterprise mobility is taking the business to another level. Organizations are nowadays managing to adopt varying enterprise mobility that helps run the transactions conducted in a bigger and better way. Despite their huge assistance, most enterprise mobilities are causing mayhem to most organizations that have integrated them as the sole strategy to keep things running. They are becoming inevitable and unstoppable trends that pose new security risks and challenges in controlling and managing corporate data and networks. If not well monitored, they can unwontedly lead to disclosing vital information, disruption of services, legal implications, financial issues, loss of productivity, and modify access policies. One such largely implemented enterprise mobility is choose your own de-vice. The intention of this paper is to propose a new framework that would help in managing the access control issues in the environment of choose your own device. The main aim of the proposed architecture is to reduce restrictions and enforce access control policies in choose your own device and the cloud.

Malicious changeload for the resilience evaluation of self-adaptive authorisation infrastructures

Self-adaptive systems are able to modify their behaviour and/or structure in response to changes that occur to the system, its environment, or even its goals. In terms of authorisation infrastructures, self-adaptation has shown to be a promising solution for enforcing access control policies and subject access privileges when mitigating insider threat. This paper describes the resilience evaluation of a self-adaptive authorisation infrastructure by simulating a case study related to insider threats. As part of this evaluation, a malicious changeload has been formally defined in order to describe scenarios of abuse in access control. This malicious changeload was then used to stimulate self-adaptation within a federated authorisation infrastructure. The evaluation confirmed the resilience of a self-adaptive authorisation infrastructure in handling abuse of access under repeatable conditions by consistently mitigating abuse under normal and high loads. The evaluation has also shown that self-adaptation had a minimal impact on the authorisation infrastructure, even when adapting authorisation policies while mitigating abuse of access.

Blockchain‐based access control for enterprise blockchain applications

SummaryAccess control is one of the fundamental security mechanisms of IT systems. Most existing access control schemes rely on a centralized party to manage and enforce access control policies. As blockchain technologies, especially permissioned networks, find more applicability beyond cryptocurrencies in enterprise solutions, it is expected that the security requirements will increase. Therefore, it is necessary to develop an access control system that works in a decentralized environment without compromising the unique features of a blockchain. A straightforward method to support access control is to deploy a firewall in front of the enterprise blockchain application. However, this approach does not take advantage of the desirable features of blockchain. In order to address these concerns, we propose a novel blockchain‐based access control scheme, which keeps the decentralization feature for access control–related operations. The newly proposed system also provides the capability to protect user's privacy by leveraging ring signature. We implement a prototype of the scheme using Hyperledger Fabric and assess its performance to show that it is practical for real‐world applications.

A Rigorous Framework for Specification, Analysis and Enforcement of Access Control Policies

Access control systems are widely used means for the protection of computing systems. They are defined in terms of access control policies regulating the access to system resources. In this paper, we introduce a formally-defined, fully-implemented framework for specification, analysis and enforcement of attribute-based access control policies. The framework rests on FACPL, a language with a compact, yet expressive, syntax for specification of real-world access control policies and with a rigorously defined denotational semantics. The framework enables the automated verification of properties regarding both the authorisations enforced by single policies and the relationships among multiple policies. Effectiveness and performance of the analysis rely on a semantic-preserving representation of FACPL policies in terms of SMT formulae and on the use of efficient SMT solvers. Our analysis approach explicitly addresses some crucial aspects of policy evaluation, such as missing attributes, erroneous values and obligations, which are instead overlooked in other proposals. The framework is supported by Java-based tools, among which an Eclipse-based IDE offering a tailored development and analysis environment for FACPL policies and a Java library for policy enforcement. We illustrate the framework and its formal ingredients by means of an e-Health case study, while its effectiveness is assessed by means of performance stress tests and experiments on a well-established benchmark.

Mitigating SQL Attacks on Enterprise Database

In today’s world, data is generated at a very rapid speed and final destination of such data is the database. Database securityassures the security of the information stored in the database against threats, be it insider or outsider threats. Data is stored in the database for easy and efficient way to manage these data. Considering the importance of data in an organization, it isabsolutely essential to secure the data stored in the database. A secure database is one which is shielded from different possibleattacks. For data protection, enforcement of access control policies based on data contents, subject qualifications and characteristics and other relevant contextual information, such as time mechanisms are used. Security models are required in thedesign and development of effective and efficient database systems. In this work, some of the attacks and threats that areencountered in database systems and the corresponding counter-measures, as well control methods were discussed. Ensuringsecurity for database is a very critical issue for companies. Hence as the complexity of database increases, we may tend to havemore complex security issues of database. The effectiveness of the developed system in protecting data stored in a database wasdemonstrated by attempting some attacks on the database. The system was able to thwart the attacks.

A Secure G-Cloud-Based Framework for Government Healthcare Services

Within the literature, we have witnessed in the healthcare sector, the growing demand for and adoption of software development in the cloud environment to cope with and fulfill current and future demands in healthcare services. In this paper, we propose a flexible, secure, cost-effective, and privacy-preserved cloud-based framework for the healthcare environment. We propose a secure and efficient framework for the government EHR system, in which fine-grained access control can be afforded based on multi-authority ciphertext-policy attribute-based encryption (CP-ABE), together with a hierarchical structure, to enforce access control policies. The proposed framework will allow decision-makers in Saudi Arabia to develop the healthcare sector and to benefit from the existing e-government cloud computing platform “Yasser,” which is responsible for delivering shared services through a highly efficient, reliable, and safe environment. This framework aims to provide health services and facilities from the government to citizens (G2C). Furthermore, multifactor applicant authentication has been identified and proofed in cooperation with two trusted authorities. The security analysis and comparisons with the related frameworks have been conducted.

AccConF: An Access Control Framework for Leveraging In-Network Cached Data in the ICN-Enabled Wireless Edge

The fast-growing Internet traffic is increasingly becoming content-based and driven by mobile users, with users more interested in data rather than its source. This has precipitated the need for an information-centric Internet architecture. Research in information-centric networks (ICNs) have resulted in novel architectures, e.g., CCN/NDN, DONA, and PSIRP/PURSUIT; all agree on named data based addressing and pervasive caching as integral design components. With network-wide content caching, enforcement of content access control policies become non-trivial. Each caching node in the network needs to enforce access control policies with the help of the content provider. This becomes inefficient and prone to unbounded latencies especially during provider outages. In this paper, we propose an efficient access control framework for ICN, which allows legitimate users to access and use the cached content directly, and does not require verification/authentication by an online provider authentication server or the content serving router. This framework would help reduce the impact of system down-time from server outages and reduce delivery latency by leveraging caching while guaranteeing access only to legitimate users. Experimental/simulation results demonstrate the suitability of this scheme for all users, but particularly for mobile users, especially in terms of the security and latency overheads.

GroupIt: Lightweight Group Key Management for Dynamic IoT Environments

With the proliferation of Internet of Things (IoT) devices that collect sensitive data, access control is more crucial than ever to safeguard IoT data from unauthorized use. To enforce access control policies without trusted online entity, one promising approach is to maintain a group key shared between a device and its current subscribers, such that the device can encrypt its data and only the subscribers can decrypt it. However, prior group key management (GKM) schemes fail to efficiently address new challenges introduced by the massive scale of IoT devices, dynamic memberships of users, and changes in the number of devices. This paper explores efficient GKM to accommodate multiple devices (in addition to multiple users) and to handle frequent membership and device number changes. Inspired by the observation that devices with similar functionalities often have similar access permissions, we propose a two-tier GKM architecture called GroupIt, in which each device is assigned to one of many predefined groups, and key management is performed within each group as well as between groups to improve efficiency. Despite being conceptually simple, GroupIt addresses technical challenges including: 1) preventing a malicious device from obtaining extra information about other devices in the same group and 2) ensuring forward/backward secrecy and preventing collusion attacks when gluing two existing GKMs together. The probability of a successful collusion attack quickly drops to 0.3% after five membership changes even in a small device group (e.g., 8). This paper provides both theoretical analysis and a proof-of-concept implementation based on Alljoyn, an opensource IoT communication framework to demonstrate the feasibility of GroupIt.

Modeling adaptive access control policies using answer set programming

Many of the existing management platforms such as pervasive computing systems implement policies that depend on dynamic operational environment changes. Existing formal approaches for automatically enforcing access control policies are primarily expressed in conventional logic programming, also known as monotonic logics, e.g., First Order Logic (FOL). The major issue with monotonic logics is that they are not devised to invalidate initial believes in the light of further observations. This limitation makes these traditional logical approaches less suitable for modeling and analyzing context-aware access control policies, where exceptional policies are introduced incrementally and adaptively during runtime. The inability to invalidate initial policies when an exception needs to be enforced might result in inconsistencies and violations that need to be resolved manually by human entities. To address the problems with conventional logical approaches and more importantly prevent such inconsistencies, this paper presents a non-monotonic logic-based reasoning scheme for modeling and analyzing adaptive access control policies. In the proposed formalism, unavailable context data and incomplete access control policies can be explicitly expressed. To do so, the paper distinguishes three kinds of policies: default, context-dependent and exception policies. The proposed formalism is based on Answer Set Programming (ASP), a non-monotonic logic programming language that allows elegant representation of unavailability of context data in adaptive systems. We devise non-monotonic policy inference rules such that, when exception policies are defined, they take precedence over default and context-dependent policies automatically. The results of two case studies are reported to demonstrate the feasibility of the proposed policy representation scheme compared to the Organizational-Based Access Control (OrBAC) model.

Using Ontologies to Share Access Control Information in Rural Business Process Outsourcing

ABSTRACT Organisations interact with each other for mutual benefits. Federation refers to one such interaction where each organisation functions independently yet is bound by contracts with others. Rural business process outsourcing (RBPO), multi-institution course management system, and video streaming services are a few examples of federations. Security of shared resources is an important concern in such scenarios. Since each organisation is independent, it is difficult to communicate the precise semantics of access control policies to other participating organisations for correct enforcement. Over the years, ontology has been employed across different domains and can be used for sharing access control semantics across organisations. In this work, we describe a network-aware digital object-based access control model (NA-DOBAM) as an extension of the popular role-based access control model to address the specific needs of security in federations. The relationship between web ontology language and NA-DOBAM model is studied. We have used an ontology-based approach for specification and implementation of NA-DOBAM in the context of RBPO where the access control policy depends on the structure of the users and objects along with the network state. We demonstrate the applicability of ontology for RBPO case studies for extracting meaningful access control information using queries as well as for enforcing access control policies including separation of duty and delegation.

Attribute-based Access Control for ICN Naming Scheme

Information Centric Networking (ICN) is a new network architecture that aims to overcome the weakness of existing IP-based networking architecture. Instead of establishing a connection between the communicating hosts, ICN focuses on the content, i.e., data, transmitted in network. Content copies in ICN can be cached at different locations. The content is out of its owner's control once it is published. Thus, enforcing access control policies on distributed content copies is crucial in ICN. Attribute-Based Encryption (ABE) is a feasible approach to enforce such control mechanisms in this environment. However, applying ABE in ICN faces two challenges: from management perspective, it is complicated to manage attributes in distributed manners; from privacy protection perspective, unlike in traditional networks, the enforced content access policies are public to all the ICN users. Thus, it is desirable that unauthorized content viewers are not able to retrieve the access policy. To this end, a privacy-preserving access control scheme for ICN and its corresponding attribute management solution are presented in this paper. The proposed approach is compatible with existing flat name based ICN architectures.

An Evaluation of the Proposed Framework for Access Control in the Cloud and BYOD Environment

As the bring your own device (BYOD) to work trend grows, so do the network security risks. This fast-growing trend has huge benefits for both employees and employers. With malware, spyware and other malicious downloads, tricking their way onto personal devices, organizations need to consider their information security policies. Malicious programs can download onto a personal device without a user even knowing. This can have disastrous results for both an organization and the personal device. When this happens, it risks BYODs making unauthorized changes to policies and leaking sensitive information into the public domain. A privacy breach can cause a domino effect with huge financial and legal implications, and loss of productivity for organizations. This is a difficult challenge. Organizations need to consider user privacy and rights together with protecting networks from attacks. This paper evaluates a new architectural framework to control the risks that challenge organizations and the use of BYODs. After analysis of large volumes of research, the previous studies addressed single issues. We integrated parts of these single solutions into a new framework to develop a complete solution for access control. With too many organizations failing to implement and enforce adequate security policies, the process needs to be simpler. This framework reduces system restrictions while enforcing access control policies for BYOD and cloud environments using an independent platform. Primary results of the study are positive with the framework reducing access control issues.

Rendezvous‐based access control for information‐centric architectures

SummaryInformation‐centric networking (ICN) has been in the spotlight of many research efforts as it shifts the focus from (endpoint) locations to content items themselves. By leveraging content centrism and by using content and content names as the main pillar of all (inter‐)networking functions, ICN architectures are expected to overcome many of the limitations of the current Internet architecture. Information‐centric networking paradigm also advocates a shift in security solutions: Instead of securing the communication channel, ICN security solutions should secure the content itself. Therefore, end users should be able to access content stored in various locations in the network—even unsecured—in a private and secure way. Similarly, content owners should not lose the governance of their content items, no matter the network location where they are stored. In this paper, we design, implement, and evaluate an access control delegation mechanism for the publish‐subscribe Internet architecture. Our solution does not introduce any new entity; instead it allows semitrusted publish‐subscribe Internet rendezvous points to enforce access control policies. Moreover, our solution leverages identity‐based proxy re‐encryption to protect content confidentiality in the presences of malicious publishers, ie, nodes that host content items and do not respect the access control decisions of the rendezvous point.

Content sensitivity based access control framework for Hadoop

Big data technologies have seen tremendous growth in recent years. They are widely used in both industry and academia. In spite of such exponential growth, these technologies lack adequate measures to protect data from misuse/abuse. Corporations that collect data from multiple sources are at risk of liabilities due to the exposure of sensitive information. In the current implementation of Hadoop, only file-level access control is feasible. Providing users with the ability to access data based on the attributes in a dataset or the user’s role is complicated because of the sheer volume and multiple formats (structured, unstructured and semi-structured) of data. In this paper, we propose an access control framework, which enforces access control policies dynamically based on the sensitivity of the data. This framework enforces access control policies by harnessing the data context, usage patterns and information sensitivity. Information sensitivity changes over time with the addition and removal of datasets, which can lead to modifications in access control decisions. The proposed framework accommodates these changes. The proposed framework is automated to a large extent as the data itself determines the sensitivity with minimal user intervention. Our experimental results show that the proposed framework is capable of enforcing access control policies on non-multimedia datasets with minimal overhead.

Privacy-preserving network provenance

Network accountability, forensic analysis, and failure diagnosis are becoming increasingly important for network management and security. Network provenance significantly aids network administrators in these tasks by explaining system behavior and revealing the dependencies between system states. Although resourceful, network provenance can sometimes be too rich, revealing potentially sensitive information that was involved in system execution. In this paper, we propose a cryptographic approach to preserve the confidentiality of provenance (sub)graphs while allowing users to query and access the parts of the graph for which they are authorized. Our proposed solution is a novel application of searchable symmetric encryption (SSE) and more generally structured encryption (SE). Our SE-enabled provenance system allows a node to enforce access control policies over its provenance data even after the data has been shipped to remote nodes ( e.g. , for optimization purposes). We present a prototype of our design and demonstrate its practicality, scalability, and efficiency for both provenance maintenance and querying.