eXtensible Access Control Markup Language Research Articles

Adaptive context-aware access control for IoT environments leveraging fog computing

The increasing use of the Internet of Things (IoT) has driven the demand for enhanced and robust access control methods to protect resources from unauthorized access. A cloud-based access control approach brings significant challenges in terms of communication overhead, high latency, and complete reliance. In this paper, we propose a Fog-Based Adaptive Context-Aware Access Control (FB-ACAAC) framework for IoT devices, dynamically adjusting access policies based on contextual information to prevent unauthorised resource access. The main purpose of FB-ACAAC is to provide adaptability to changing access behaviors and context by bringing decision-making and information about policies closer to the end nodes of the network. FB-ACAAC improves the availability of resources and reduces the amount of time for information to be processed. FB-ACAAC extends the widely used eXtensible Access Control Markup Language (XACML) to manage access control decisions. Traditional XACML-based methods do not take into account changing environments, different contexts, and changing access behaviors and are vulnerable to certain types of attacks. To address these issues, FB-ACAAC proposes an adaptive context-aware XACML scheme for heterogeneous distributed IoT environments using fog computing and is designed to be context-aware, adaptable, and secure in the face of unauthorised access. The effectiveness of this new scheme is verified through experiments, and it has a low processing time overhead while providing extra features and improved security.

DNA Cryptography for Enhanced Data Storage Security in Cloud Environments

Despite the persistent security challenges inherent in cloud systems, a distributed cloud environment necessitates an access control model that is contextually aware to effectively manage these challenges. This model should incorporate a role activation process based on the user's contextual information. Within this role activation process, the rationale behind data collection and usage is disclosed, enabling administrators to establish context-based policies. Consequently, role permissions are dynamically activated based on the association of roles with context. To mitigate complications in the role-based access control model, users are categorized into classes or groups, each with its own access control standards. Access to specific resources is determined by the user's identity upon request. Traditional access control models often fall short in cloud environments due to their inability to address all aspects of the diverse entities, resources, and users present. In the proposed access control system with perception reasoning, entities are expanded using Extensible Access Control Markup Language (XACML), while a trust module monitors user behavior dynamically, detecting and restricting malicious users attempting illegal data access. This includes assigning an identity tag to malicious users, which involves task and data classification along with database tagging.

HoBACDSL: HoBAC-focused Access Control Domain Specific Language

Access control (AC) in IoT (Internet of Things) systems presents significant challenges. These systems are evolving, heterogeneous, and dynamic, combined with the lack of appropriate tools to specify and design Access Control Policies (ACP). Despite various proposals, complexity persists, especially in restrictive environments like IoT. In this perspective, Higher-Order Attribute-Based Access Control (HoBAC) was proposed as a general AC model that extends Attribute Based AC (ABAC). It allows the design of flexible AC models and policies applicable to IoT and non-IoT systems. The work presented in this paper focuses on addressing the need for tools to support the adoption of HoBAC for IoT systems by proposing HoBACDSL, a Domain Specific Language (DSL). HoBACDSL abstracts the complexities of HoBAC and makes its concepts more accessible. We illustrate how this DSL is concretely used to specify, and generate AC policies in the Extensible Access Control Markup Language (XACML) standard for a Smart Home use case.

XACML for Mobility (XACML4M)-An Access Control Framework for Connected Vehicles.

The automotive industry is experiencing a transformation with the rapid integration of software-based systems inside vehicles, which are complex systems with multiple sensors. The use of vehicle sensor data has enabled vehicles to communicate with other entities in the connected vehicle ecosystem, such as the cloud, road infrastructure, other vehicles, pedestrians, and smart grids, using either cellular or wireless networks. This vehicle data are distributed, private, and vulnerable, which can compromise the safety and security of vehicles and their passengers. It is therefore necessary to design an access control mechanism around the vehicle data's unique attributes and distributed nature. Since connected vehicles operate in a highly dynamic environment, it is important to consider context information such as location, time, and frequency when designing a fine-grained access control mechanism. This leads to our research question: How can Attribute-Based Access Control (ABAC) fulfill connected vehicle requirements of Signal Access Control (SAC), Time-Based Access Control (TBAC), Location-Based Access Control (LBAC), and Frequency-Based Access Control (FBAC)? To address the issue, we propose a data flow model based on Attribute-Based Access Control (ABAC) called eXtensible Access Control Markup Language for Mobility (XACML4M). XACML4M adds additional components to the standard eXtensible Access Control Markup Language (XACML) to satisfy the identified requirements of SAC, TBAC, LBAC, and FBAC in connected vehicles. Specifically, these are: Vehicle Data Environment (VDE) integrated with Policy Enforcement Point (PEP), Time Extensions, GeoLocation Provider, Polling Frequency Provider, and Access Log Service. We implement a prototype based on these four requirements on a Raspberry Pi 4 and present a proof-of-concept for a real-world use case. We then perform a functional evaluation based on the authorization policies to validate the XACML4M data flow model. Finally, we conclude that our proposed XACML4M data flow model can fulfill all four of our identified requirements for connected vehicles.

Detecting conflict of heterogeneous access control policies

Policy conflicts may cause substantial economic losses. Although a large amount of effort has been spent on detecting intra-domain policy conflict, it can not detect conflicts of heterogeneous policies. In this paper, considering background knowledge, we propose a conflict detection mechanism to search and locate conflicts of heterogeneous policies. First, we propose a general access control model to describe authorization mechanisms of cloud service and a translation scheme designed to translate a cloud service policy to an Extensible Access Control Markup Language (XACML) policy. Then the scheme based on Multi-terminal Multi-data-type Interval Decision Diagram (MTMIDD) and Extended MTMIDD (X-MTMIDD) is designed to represent XACML policy and search the conflict among heterogeneous policies. To reduce the rate of false positives, the description logic is used to represent XACML policy and eliminate false conflicts. Experimental results show the efficiency of our scheme.

Research on Access Control Scheme of System Wide Information Management Based on Attribute Association

System wide information management (SWIM) involves civil aviation system control, intelligence, alarm, traffic, and other data. These data are transmitted in various forms, making SWIM system vulnerable to sensitive information leakage, data tampering, denial, and other security threats. In this article, an attribute-based air traffic management (ATM) information access control scheme is proposed to solve the security threat of SWIM. An improved extensible access control markup language (XACML) authorization model is established, combining linear secret sharing scheme (LSSS) matrix structure and monotone span program (MSP); an attribute association algorithm is designed to establish the attribute association relationship between services and users. Experimental results show that the attribute association algorithm improves the time complexity, but the algorithm can support richer policy representation capability, and the proposed ATM information access control scheme is more efficient and can effectively reduce the space cost. This scheme can achieve more fine-grained and flexible access control.

An efficient density peak cluster algorithm for improving policy evaluation performance

In recent years, the XACML (eXtensible Access Control Markup Language) is widely used in a variety of research fields, especially in access control. However, when policy sets defined by the XACML become large and complex, the policy evaluation time increases significantly. In order to improve policy evaluation performance, we propose an optimization algorithm based on the DPCA (Density Peak Cluster Algorithm) to improve the clustering effect on large-scale complex policy sets. Combined with this algorithm, an efficient policy evaluation engine, named DPEngine, is proposed to speed up policy matching and reduce the policy evaluation time. We compare the policy evaluation time of DPEngine with the Sun PDP, HPEngine, XEngine and SBA-XACML. The experiment results show that (1) when the number of requests reaches 10,000, the DPEngine evaluation time on a large-scale policy set with 100,000 rules is approximately 2.23%, 3.47%, 3.67% and 4.06% of that of the Sun PDP, HPEngine, XEngine and SBA-XACML, respectively and (2) as the number of requests increases, the DPEngine evaluation time grows linearly. Compared with other policy evaluation engines, the DPEngine has the advantages of efficiency and stability.

Embedding Risk-Based Anonymization into Data Access Control for Providing Individual-Level Health Data in a Secure Way.

Especially in biomedical research, individual-level data must be protected due to the sensitivity of the data that is associated with patients. The broad goal of scientific data re-use is to allow many researchers to derive new hypotheses and insights from the data while preserving privacy. Data usage control (DUC) as an attribute-based access mechanism promises to overcome the limitations of traditional access control models achieving that goal. Park and Sandhu provided the usage control (UCON) model as an instance of DUC, which defines policies that evaluate certain attributes. Here, we present an UCON-based architecture, which is augmented with risk-based anonymization as provided by the R package sdcMicro and an extensible Access Control Markup Language (XACML) environment with a core policy decision point as implemented by authzforce.

Extended Authorization Policy for Graph-Structured Data

The high increase in the use of graph databases also for business- and privacy-critical applications demands for a sophisticated, flexible, fine-grained authorization and access control (AC) approach. Attribute-based access control (ABAC) supports a fine-grained definition of authorization rules and policies. Attributes can be associated with the subject, the requested resource and action, but also the environment. Thus, this is a promising starting point. However, specific characteristics of graph-structured data, such as attributes on vertices and edges along a path from a given subject to the resource to be accessed, are not yet considered. The well-established eXtensible Access Control Markup Language (XACML), which defines a declarative language for fine-grained, attribute-based authorization policies, is the basis for our proposed approach—XACML for Graph-structured data (XACML4G). The additional path-specific constraints, described in graph patterns, demand for specialized processing of the rules and policies as well as adapted enforcement and decision-making in the access control process. To demonstrate XACML4G and its enforcement process, we present a scenario from the university domain. Due to the project’s environment, the prototype is built with the multi-model database ArangoDB. Finally, compliance of XACML4G with quality standards for access control systems administration and enforcement is assessed. The results are promising and further studies concerning performance and use in practice are planned.

Proposal for a Secure Data Sharing and Processing in Cloud Applications for Healthcare Domain

Information Technology (IT) services have become an inherent component in almost all sectors. Similarly, the health sector has been recently integrating IT to meet the growing demand for medical data exchange and storage. Currently, cloud has become a real hosting alternative for traditional on-permise software. In this model, not only do health organizations have access to a wide range of services but most importantly they are charged based on the usage of these cloud applications. However, especially in the healthcare domain, cloud computing deems challenging as to the sensitivity of health data. This work aims at improving access to medical data and securely sharing them across healthcare professionals, allowing real-time collaboration. From these perspectives, they propose a hybrid cryptosystem based on AES and Paillier to prevent the disclosure of confidential data, as well as computing encrypted data. Unlike most other solutions, the proposed framework adopts a proxy-based architecture to tackle some issues regarding privacy concerns and access control. Subsequently, this system typically guarantees that only authorized users can view or use specific resources in a computing environment. To this aim, they use eXtensible Access Control Markup Language (XACML) standard to properly design and manage access control policies. In this study, they opt for the (Abbreviated Language for Authorization) ALFA tool to easily formulate XACML policies and define complex rules. The simulation results show that the proposal offers simple and efficient mechanisms for the secure use of cloud services within the healthcare domain. Consequently, this framework is an appropriate method to support collaboration among all entities involved in medical information exchange.

A novel conflict detection method for ABAC security policies

Attributed-based access control (ABAC) is widely used in systems with large resources and users such as the Industrial Internet of Things (IIoT), Industrial information integration system, and so on. Attribute-based security policy is highly flexible and expressive, but conflicts between policies occur frequently, affecting the security and availability of the system. Based on analyzing the ABAC security policies represented by the eXtensible Access Control Markup Language (XACML), this study proposes a formal definition of explicit conflicting rules, probable-conflicting rules, and never-conflicting rules. Also, we found that conflicts occur on a pair of rules in which attribute expressions have overlapping values and that be applied to the same request. A new conflict detection method is proposed in which implicit conflicting rules are converted to explicit conflicting rules by completing the absent attribute expressions and then compare all the rules in pairs to detect all the probable conflicting rules in a rule set. In this way, we can analyze the conflicting probability of each pair of policy rules. Furthermore, we define two metrics to evaluate the conflict level of a rule set. Experiment results show that implicit conflicting rules are more numerous than explicit conflicting rules in the policy set. Also, with an increase in the number of attribute expressions in each rule, the conflicting level of a rule set is significantly reduced, which provides a reference for policymaking. With this method, administrators can formulate more robust and efficient security policies, improve the security and availability of systems.

A Decentralized Blockchain-based Architecture for a Secure Cloud-Enabled IoT

The integration of cloud computing and Internet of Things (IoT) offers a promising, rich platform for data collection and analysis in smart healthcare. In such a model, IoT devices collect data about patient health status through multiple intelligent sensors, whereas cloud offers scalable resources to quickly meet workload demands. Despite these remarkable improvements, the current architectures do not sufficiently address the security needs for patient medical records. In this perspective, and bearing in mind the specific characteristics of each technology, we propose a distributed security mechanism in a way that fits with IoT and cloud constraints. Our contribution to secure cloud-enabled IoT is twofold. First, we rely on OM-AM (Objective, Model, Architecture and Mechanism) for modeling and analysing the security and privacy requirements of smart healthcare. Second, we use blockchain architecture along with Attribute-Based Access Control (ABAC) model as a decentralized flexible system to support access control decisions. In particular, we rely on XACML (eXtensible Access Control Markup Language) to easily build and implement robust policies required for maintaining a secure IoT-based environment. The novelty of the proposed framework lies at smartly leveraging the recent technologies to keep health information confidential. In fact, putting blockchain and IoT together would undoubtedly create a totally new solution for remote patient monitoring. The simulation results show that the proposal is an efficient way of implementing ubiquitous and cognitive tools for smart healthcare systems.

An efficient policy evaluation engine with locomotive algorithm

The evaluation performance of PDP (policy decision point), especially in large-scale policy sets, is one of the most significant challenges in XACML (eXtensible Access Control Markup Language). With high time-consuming and extensive storage policies, large-scale policy sets are becoming more complicated when their evaluation performance need to be improved. Based on numericalization and batch processing, a new locomotive algorithm is proposed to design and implement a novel policy evaluation engine called XDPNBE that can efficiently deal with large-scale policy sets and make authorization decisions in multiple circumstances. XDPNBE enables efficient decisions within an attributed-based access control framework that has a strong promotion of evaluation performance. By simulating requests, XDPNBE is compared with the Sun PDP, XEngine, HPEngine and SBA-XACML. Experimental results show that if the number of requests reaches 10,000, the evaluation time of XDPNBE on the large-scale policy set with 120,000 rules is approximately 0.21%, 4.69%, 5.67% and 9.66% of that of the Sun PDP, XEngine, HPEngine and SBA-XACML, respectively.

An Attribute-Based Cross-Domain Access Control Model for a Distributed Multiple Autonomous Network

The distributed multiple autonomous network has become the main trend of modern information systems, such as Cloud, Service-Oriented Architecture (SOA) and Internet of Things (IoT). Access control in such a heterogeneous and dynamic system has become a major information security challenge, which hinders the sharing of resources and information. In this work, we present an Attribute-Based Access Control (ABAC) model for cross-domain access control. The proposed access control model comprises a boundary control server designed to provide cross-domain access control capability. An eXtensible Access Control Markup Language (XACML) policy model-based implementation is introduced. Process and implementation show the proposed model alleviates the security risk on the domain boundary during the cross-domain access control process.

Adaptive XACML access policies for heterogeneous distributed IoT environments

This paper addresses the access control issue for the comprehensive and distributed Internet of Things (IoT) environments. The typical eXtensible Access Control Markup Language (XACML) which implements the sophisticated access conditions in XML files, is widely used to guarantee access control decisions for the distributed IoT environments. To the best of our knowledge, the typical XACML-based access control schemes never consider the authentication run-time parameters. Moreover, the access control schemes that are mainly based on the typical XACML cannot secure themselves against some kinds of attacks, such as the Masquerade attack. Also, those schemes are not secure in opposition to Man-in-the-Middle (MITM) attack. Therefore, this paper proposes an adaptive XACML scheme that extends the typical XACML by integrating an access code generation and verification schemes for heterogeneous distributed IoT environments. Our adaptive XACML scheme considers some sensitive authentication run-time parameters before authorizing the user. Moreover, our scheme is proven secure against the Masquerade attack and MITM attack through hashing the generated access code using Message Digest Algorithm-5 (MD5) and Secure Hash Algorithm-1 (SHA-1) Checksum Utility. The experimental analysis of many different configurations supports the efficacy and efficiency of our adaptive XACML. It also shows exceptional compatibility and performance with different implementations. The processing time comparison between our adaptive XACML and Typical XACML, has shown that there is a low time overhead when using our adaptive XACML. This processing time overhead is nothing compared to the extra features that have been achieved in excess of the typical XACML and the security against Masquerade and MITM attacks. Therefore, our adaptive XACML scheme has the capability to be applied in various distinct distributed environments not only IoT.

ANNPDP: An Efficient and Stable Evaluation Engine for Large-Scale Policy Sets

As interactions between individuals and services increase, requests are more frequent and policy sets are larger. The evaluation performance of PDP (Policy Decision Point) plays a key role in the operation of a system. In order to solve bottlenecks of improving the PDP evaluation performance for large-scale policy sets, we propose an evaluation engine based on artificial neural networks, namely ANNPDP. We transform rules in a large-scale policy set described in the XACML (eXtensible Access Control Markup Language) into numerical rules. Evaluation networks are established and trained by the numerical rules. In order to ensure the accuracy, a misjudgment set is constructed for error corrections and stored by hash indexes. By simulating the arrival of requests, ANNPDP is compared with the Sun PDP, HPEngine, XEngine, and SBA-XACML. The experiment results show that ANNPDP has: 1) high performance: if the number of requests reaches 10,000, the evaluation time of ANNPDP on the large-scale policy set with 100,000 rules is approximately 0.46, 0.93, 0.71, and 1.43 percent of that of the Sun PDP, HPEngine, XEngine, and SBA-XACML, respectively, and 2) stability: as the size of the large-scale policy set and the number of requests increase, the evaluation time of ANNPDP grows linearly. ANNPDP can satisfy the requirements of an authorization system with large-scale policy sets.

An efficient policy evaluation engine for XACML policy management

In recent years, XACML (eXtensible Access Control Markup Language) has been widely used in the development of various applications, especially Web services. The evaluation time of a PDP (Policy Decision Point) grows significantly when the PDP loads a large-scale policy set coded in XACML. In order to improve the PDP evaluation performance, we propose an optimized policy evaluation engine, namely XDLEngine, and make the following contributions. First, XDLEngine has an advantage in the process of handling a large-scale policy set, and innovatively adopts the LDA (Latent Dirichlet Allocation) topic model to cluster policies. Second, according to the clustering results of the LDA model, we digitize and vectorize all rules in policy sets, which facilitates the rule matching. Third, the cosine similarity is introduced to classify the rules under each topic, which greatly reduces the number of comparisons in the process of rule matching and improves the matching efficiency of XDLEngine. Finally, due to the independence between different topics, we use a multi-threaded parallel search in the process of rule matching, which significantly lowers the evaluation time of XDLEngine. The experimental results show that when the number of requests reaches 20,000, the evaluation time of XDLEngine for a practical large-scale policy set with 120,000 rules is approximately 2.48%, 3.47% and 3.68% of that of the Sun PDP, XEngine and HPEngine, respectively.

Clustering and supervised response for XACML policy evaluation and management

To meet the increasingly complex requirements in access control using XACML (eXtensible Access Control Markup Language), it is necessary for a policy decision engine to deal with large-scale policy sets and intensively abundant requests efficiently. A practical policy evaluation engine, namely CSRM, is proposed to tackle this problem. The PDP (Policy Decision Point) in traditional policy decision engines is replaced by a new component ESPDP (Efficient Searching Policy Decision Point). CK-means algorithm is studied in this paper to perform clustering among all policies in a policy set. ESPDP is adopted to construct a virtual mapping table on the basis of the result of the CK-means algorithm. The virtual mapping table stores the relationship between subject attributes and policies, such that the irrelevant polices are excluded when rule search is carried out. Besides, the rules in every policy are merged according to particular principles, thus saving storage space and greatly speeding up rule search. When responding to intensive requests, a supervised response method is applied to determine an optimal rule search order by analyzing the response to the requests in a short period. The experimental results on four practical datasets demonstrate that our proposed CSRM outperforms some classic and state-of-the-art methods when dealing with large-scale policy sets. With high practicality and wide applicability, CSRM effectively eliminates the bottlenecks of improving PDP evaluation performance, and can respond to requests efficiently when handling large-scale policy sets.

Detection of Conflicts Between Resource Authorization Rules in Extensible Access Control Markup Language Based on Dynamic Description Logic

Detection of Conflicts Between Resource Authorization Rules in Extensible Access Control Markup Language Based on Dynamic Description Logic

A Graph and Clustering-Based Framework for Efficient XACML Policy Evaluation

EXtensible Access Control Markup Language (XACML) is one of the standardized languages for specifying access control policies. Policies described by the XACML are used to express the security requirement in the network and information system when we study authorization access control. With the aim to improve the Policy Decision Point (PDP) evaluation performance, we put forward a Graph and Clustering-Based Framework, employing the aggregate function. First, we partition the rule set into subsets. For the single value, we select the best partition quantity based on the aggregate function. As for the interval value, we handle with the start point and the finish point, respectively, in the same way as single value. Second, the policy set is split according to the partition of rule set. In this way, not only single values, but also interval values are taken into consideration. After that, we explore the searching tree to obtain the possibly matched rules. Finally, we construct the combining tree and output the policy decision on the basis of it. The experimental results show that our approach is orders of magnitude better than the Sun PDP. A comparison in evaluation performance between the redundancy detecting and eliminating engine and the Sun PDP, as well as XEngine and SBA-XACML, is made. Experimental results show that the evaluation performance of the PDP can be prominently improved by eliminating redundancies.