Extended Access Control Research Articles

Extended Access Control on electronic passport with the aim of overcoming limited computing resources

In this project, Extended Access Control on the electronic passport was designed to overcome limited computing resources. Today, experts are looking for safer ways to identify and authenticate authenticity. One of the most successful of these ways is the use of biometrics. In this project, in order to reduce the volume of computing, the Fast Exponential method has also been added to Diffie- Hellman, as well as to enhance the security of the proposed research protocol and reduce the success rate of attacks such as a man-in-the-middle attack to steal information, from fingerprint to extract some of the required parameters of the Diffie-Hellman method (parameters q and g) is used. To this end, three different scenarios were raised. The results of the simulation showed that the proposed method reduces the computational load of the classical Diffie-Hellman method and, therefore, reduces the run-time. Also, the results showed that the first scenario is better than the other two scenarios in terms of both runtime and computational load.

Research on extended access control mechanism in online social network

Research on extended access control mechanism in online social network

Hybrid Role and Attribute Based Access Control Applied in Information Systems

Abstract It this paper it is proposed a new access control model – Hybrid Role and Attribute Based Access Control (HRABAC). It is an extension of Role-Based Access Control (RBAC). HRABAC is designed for information systems and enterprise software and combines the advantages of RBAC and Attribute-Based Access Control (ABAC). HRABAC is easy configurable, fine-grained and supports role hierarchies. The proposed model HRABAC describes the access control scheme in Laravel package laravelroles/rolespermissions, which is developed by the author of the paper, as an answer to the requirements of practice of fine-grained and easy configurable access control solution. Laravel is chosen, because it is the most popular and the most widely used PHP framework. The package laravelroles/rolespermissions is developed on Laravel so that maximum number of programmers could use it. This package contains working and tested functionalities for managing users, roles and permissions, and it is applied in accounting information system.

A Secure Internet of Things Smart Home Network: Design and Configuration

Many home IoT devices are joining IoT networks by gaining access to some home gateway that configures smart, multimedia, and home networks. To enable secure IoT-based home networking services, (1) an IoT network should be effectively designed and configured with a IoT server, (2) a messaging protocol is required to exchange information between the IoT server and IoT devices, and (3) the home gateway should monitor all safety aspects in both inbound and outbound traffic of the home network. However, not all home network users put in consideration the need for an adequate security posture. Instead, many users still rely on the minimum home network security by setting an easiest-to-guess password to restrict unauthorized access to their home gateway. In this paper, we propose a network design and configuration that enables secure IoT services with MQTT messaging protocol for home networks. With the proposed network design, a home network is interconnected to external networks through a home gateway. To separate the IoT-subnet from other parts of home network, the home gateway subdivides a home network into an inside-subnet and an IoT-subnet with a private IP address using subnet masking. The IoT server, located in the IoT-subnet can be implemented with either a general HTTP server or a security server that acts as an MQTT broker. The secure communications among network entities are governed by a home gateway operating a well-configured extended access control. The effectiveness of the proposed design and configuration is verified through a simulation by showing that it does not impose any significant performance degradation for reinforced security. We expect the proposed configuration to help facilitate interconnection among heterogeneous network entities.

Extending access control in AWS IoT through event-driven functions: an experimental evaluation using a smart lock system

Extending access control in AWS IoT through event-driven functions: an experimental evaluation using a smart lock system

Attribute-based Fine-grained Extended Access Control Mechanism for Online Social Networks

The development of online social networks allows users to communicate with each other and share their resources when and where. However, in the process of data dissemination, the user loses control of the private information if the user shares resources into the social network, which may lead to privacy leakage. In order to solve the above problems, the paper proposes an extended access control mechanism for online social networks. This mechanism not only controls the operation rights of direct users, but also controls the assignable rights of indirect users, achieving the purpose of extended authorization. In this paper, the attribute modeled as a five-tuple is defined in detail, and requirement of each attribute is described. Furthermore, we assign different weights to different operation types of resources, and judge whether the resource operation is satisfied by calculating the degree of trust and the weight, thus determine user’s permissions. Finally, through case analysis and scheme comparison, we prove that the extended authorization mechanism can effectively control the spread of information and protect user’s privacy.

An Extended Attribute-Based Access Control (ABAC) Model for Distributed Collaborative Healthcare System

The healthcare system is a real example of a distributed collaborative system, which aims to improve the patient's healthcare. The most important requirements of the healthcare system are the sensitivity of the medical data processed, large numbers of medical and para-medical interveners, as well as the medical treatment activity is a non-static process. Protecting data from unauthorized access and data sharing security in the healthcare environment is a critical process that influences system credibility. To achieve this goal and to meet the requirements of the healthcare system, the authors propose an extended Attribute-Based Access Control (ABAC) model by introducing the medical activity concept. This article defines the medical activity concept as an abstraction of collaboration in a care unit, defined by a medical activity purpose, in which the collaborators (or actors) realize their tasks in order to achieve the treatment purpose. The current access control model ABAC and these variants do not take into account the (business process) activity concept in the decision mechanism. In this paper, the authors propose a new access control model, called Medical-Activity-Attribute-Based Access Control (MA-ABAC), which can effectively enhance the security for healthcare system and produce more perfect and flexible mechanism of access control; order to strongly respond to the requirements of the distributed healthcare environment.

Development of secure automated management systems based on web technologies

This paper discusses security problems of developing municipal management information systems for Department of Municipal Procurement of the Krasnoyarsk City Administration (Russia). Authors describe the problem, goals, and tasks to be solved. Some security aspects are given, as well as original extended role-based security access control model for web applications and web services. This work describes two information systems developed by specialists of the Institute of Computational Modelling of the Siberian Branch of the Russian Academy of Sciences using described approaches. The systems have been in production for several years. The methods used to protect information are given, the structure of software is presented.

An extended access control model for permissioned blockchain frameworks

In distributed environment, a digital transaction or operation requires transparency and trust among multiple stakeholders. Several approches address such issues however, among these blockchain provides a viable solution which has received wide acceptance in the recent past. Permissioned blockchain solutions adopt more efficient consensus algorithms and smart contracts. There are many smart-contract solutions exists (such as, etherium, IBM blockchain, hyperledger fabric), however, much of them mainly follow traditional access control models. A role-based access control model provides controlled access of resources to members. This research work presents an extended usage control model known as DistU (Distributed Usage Control). DistU is proposed to capture all possible access control models required by a business for permissioned blockchain frameworks. DistU can monitor a resource continuously during the operation and update the attributes accordingly, performing different actions, such as denying or revoking permissions. We believe that the proposed DistU usage control model can provide a fine-grained control for blockchain resource management. The paper also contributes to provide a protoype implementation of fine-grained permission model on Hyperledger Fabric. The reason of selecting Fabric for this research is that, it is the first execute-order achitecture blockchain that provides a platform to develop general business applciations. Secondly, it is an opensource operating system of permissioned blockchain with huge industry support.

Privacy Protection and Data Security in Cloud Computing: A Survey, Challenges, and Solutions

Privacy and security are the most important issues to the popularity of cloud computing service. In recent years, there are many research schemes of cloud computing privacy protection based on access control, attribute-based encryption (ABE), trust and reputation, but they are scattered and lack unified logic. In this paper, we systematically review and analyze relevant research achievements. First, we discuss the architecture, concepts and several shortcomings of cloud computing, and propose a framework of privacy protection; second, we discuss and analyze basic ABE, KP-ABE (key policy attribute-based encryption), CP-ABE (ciphertext policy attribute-based encryption), access structure, revocation mechanism, multi-authority, fine-grained, trace mechanism, proxy re-encryption (PRE), hierarchical encryption, searchable encryption (SE), trust, reputation, extension of tradition access control and hierarchical key; third, we propose the research challenge and future direction of the privacy protection in the cloud computing; finally, we point out corresponding privacy protection laws to make up for the technical deficiencies.

An extended Access Control with Uncertain Context

While new information technology advances have made information access and acquisition methods much more diverse and easier, there are side effects that allow illegal access using diverse and high-performance tools. In order to cope with such threats, there are access control methods in database technology, and various studies are being conducted to extend traditional access control to cope with new computing environments. In this paper, we propose an extended access control with uncertain context-awareness. It enables appropriate security policy enforcement even if the contextual constraints specified by the security policy does not match those accompanied by access request query. We extract semantic implications from context tree, and define the argument that can quantitatively measure the semantic difference between two nodes in the context tree. It is used to semantically enforce the security policy, and to prevent the excessive authorization caused by the implication.

Greedy and evolutionary algorithms for mining relationship-based access control policies

Relationship-based access control (ReBAC) provides a high level of expressiveness and flexibility that promotes security and information sharing. We formulate ReBAC as an object-oriented extension of attribute-based access control (ABAC) in which relationships are expressed using fields that refer to other objects, and path expressions are used to follow chains of relationships between objects. ReBAC policy mining algorithms have potential to significantly reduce the cost of migration from legacy access control systems to ReBAC, by partially automating the development of a ReBAC policy from an existing access control policy and attribute data. This paper presents two algorithms for mining ReBAC policies from access control lists (ACLs) and attribute data represented as an object model: a greedy algorithm guided by heuristics, and a grammar-based evolutionary algorithm. An evaluation of the algorithms on four sample policies and two large case studies demonstrates their effectiveness.

In-depth Analysis of the Security Mechanism for Extended Access Control of Electronic Documents

In-depth Analysis of the Security Mechanism for Extended Access Control of Electronic Documents

Content dependent information flow control

Information flow control extends access control by not only regulating who is allowed to access what data but also the subsequent use of the data. Applications within communications systems require such information flow control to be dependent on the actual contents of the data.We develop a combined Hoare logic and type system for enforcing content dependent information flow policies dealing with both integrity and confidentiality. We establish the soundness of the Hoare logic with respect to an instrumented operational semantics and illustrate the development on a running example. We also argue that a well-established approach to non-interference fails to distinguish between integrity and confidentiality.The development is performed for programs written in a concurrent language with synchronous communication and separate data domains.

Quantitative Analysis Method of EXRBAC Model withN-Dimensional Security Entropy

On how to evaluate the performance of access control models, a method ofN-dimensional security entropy is described in this paper. According to the definition and description of the information entropy in information theory, the definition of the One-dimensional Security Entropy is introduced and the one-dimensional security entropy in Discretionary-access Control model is discussed firstly. Then theN-dimensional security entropy is extended based on the unauthorized access, and by means of theN-dimensional security entropy, the quantitative security performance is measured in RBAC model. In order to measure the security of management information system with complex role level, an extension of RBAC access control (EXRBAC) model is presented in this paper, which could get quantitative analysis withN-dimensional security entropy methods. Through analyzing and comparing the security performance of these three access control models, it is shown that the EXRBAC model performance is improved in multi-class and multi-level roles condition.

Adaptive Security in ODMAC for Multihop Energy Harvesting Wireless Sensor Networks

Energy Harvesting Wireless Sensor Networks (EH-WSNs) represent an interesting new paradigm where individual nodes forming a network are powered by energy sources scavenged from the surrounding environment. This technique provides numerous advantages, but also new design challenges. Securing the communications under energy constraints represents one of these key challenges. The amount of energy available is theoretically infinite in the long run but highly variable over short periods of time, and managing it is a crucial aspect. In this paper we present an adaptive approach for security in multihop EH-WSNs which allows different nodes to dynamically choose the most appropriate energy-affecting parameters such as encryption algorithm and key size, providing in this way energy savings. In order to provide evidence of the approach's feasibility in a real-world network, we have designed and implemented it as extension of on-demand medium access control (ODMAC), a receiver-initiated (RI) MAC protocol specifically designed and developed to address the foundational energy-related needs of Energy Harvesting Wireless Sensor Networks.

Towards a more secure and scalable verifying PKI of eMRTD

The new electronic passport stores biometric data on a contactless readable chip to uniquely link the travel document to its holder. This sensitive data is protected by a complex protocol called Extended Access Control (EAC) against unlawful readouts

Implementation of security and privacy in ePassports and the extended access control infrastructure

Several researchers have analyzed the security characteristics and weaknesses of electronic passports (machine readable travel documents) introduced by the International Civil Aviation Organization (ICAO) in its Document 9303. However, little, if any, work has focused on the public key infrastructures necessary to manage the certificates that underpin the security measures. This paper discusses the key aspects related to the management of keys and certificates to implement security and privacy measures for machine readable travel documents issued by European Union member states. In particular, the paper concentrates on extended access control and the associated Single Point of Contact (SPOC) protocol.

Extended Access Control and Recommendation Methods for Enterprise Knowledge Management System

Knowledge Management (KM) is one of the hotspots for research in the past decade. In most cases, the number of users in a Knowledge Management System (KMS) is very large, and they are from varied departments, even other companies. In this paper, some defects when existing methods about access control and recommendation are deployed in KMS are analyzed to show that these widely-used approaches need to be extended. To overcome the deficiencies of previous work, this paper proposes an extended Role-Based Access Control (RBAC) method and a hybrid recommendation approach for Knowledge Management System. Also, a real-life system is presented to verify the proposed methodology.

Context-Aware Access Control Model for Cloud Computing

In view of malicious insider attacks on cloud computing environments, a new ContextAware Access Control Model for cloud computing (CAACM) was presented. According to the characteristic of cloud computing, we take spatial state, temporal state and platform trust level as context. The model establishes mechanisms of authorization from cloud management role to objects, which enables dynamic activation of role permission by associating cloud management role with context. It also achieves fine-grained access control on cloud objects by supervising the permission of management role in full life cycle. Moreover, it introduces the concept of exclusive managerial role, which extends access control from static protection on resources to dynamic authorization on managerial roles. Further, it describes the approach of role permission activation systematically. CAACM formally proves to be safe and it lays the groundwork for the deployment of CAACM in cloud computing systems.