Flexible Access Control Model Research Articles

Capability and Blockchain-Based Fine-Grained and Flexible Access Control Model

Currently, integrating blockchain into access control systems has become a new research trend. However, existing access control systems still have problems such as easy confusion of capability authorisation subjects, inflexible capability granting and revocation, insufficient granularity of capability, insecure capability transfer and lack of capability verification. To solve these problems, this work proposes Capability- & Blockchainbased Fine-grained and Flexible Access Control (CB2FAC), defines new capability authorisation rules, and designs an authorisation tree with capability revocation list to meet the needs of flexibility and timeliness of capability revocation. Finally, simulation experiments show that CB2FAC is flexible and secure in granting, revoking, granularity control and verification of capability, and significantly outperforms the existing schemes in terms of performance.

A Blockchain-Based Cross-Domain and Autonomous Access Control Scheme for Internet of Things

The volume, variety and value of data generated by Internet of Things (IoT) devices are expected to increase significantly in foreseeable future, hence, reinforcing the importance of secure and efficient access control solutions for these devices and their networks. However, existing access control solutions are not generally lightweight or scalable, particularly for geographically disperse, inexpensive resource constrained IoT devices. To tackle above challenges, we propose a lightweight consortium blockchain based architecture to enable intelligent autonomous access control for IoT devices. In our architecture, intelligent blockchain facilitates the storing of access policies, provision of authentication services for data access control, and trust evaluation for access request nodes through token accumulation mechanism. Specifically, the user's access request is approved only after it is confirmed by the blockchain network. To ensure the reliability of authenticity, a compromised resistant consensus algorithm is adapted and implemented to defend against at most <inline-formula><tex-math notation="LaTeX">$1/3$</tex-math></inline-formula> compromised authenticators. In addition, a cross-domain and flexible access control model is not only used to support data sharing among various users but can also be used for access control for exceptional blockchain situations. We explain how our system meets our design goals of reliability, availability, confidentiality, integrity, lightweight, security and scalability. In addition, we also analyze the proposed system's performance from computational, storage and network overheads (e.g., running cryptographic algorithms on a Raspberry Pi 4B), and the findings suggest that the time to run typical cryptographic algorithms is in the microsecond range.

Supervised Learning-Based Approach Mining ABAC Rules from Existing RBAC Enabled Systems

Attribute-Based Access Control (ABAC) is an emerging access control model. It is the more flexible, scalable, and most suitable access control model for today’s large-scale, distributed, and open application environments. It has become an emerging research area nowadays. However, Role-Based Access Control (RBAC) has been the most widely used and general access control model so far. It is simple in administration and policy definition. But user-to-role assignment process of RBAC makes it non-scalable for large-scale organizations with a large number of users. To scale up the growing organization, RBAC needs to be transformed into ABAC. Transforming existing RBAC systems into ABAC is complicated and time-consuming. In this paper, we present a supervised machine learning-based approach to extract attribute-based conditions from the existing RBAC system to construct ABAC rules at the primary level and simplify the process of the transforming RBAC system to ABAC.

A Right Transfer Access Control Model of Internet of Things Based on Smart Contract

Sensor nodes play a crucial role in the promotion of development of Internet of Things (IoT). Through this transaction, RO defines access control policies in script form based on ABAC's access control model to grant access right. The identity of all users in the model is identified by address. This paper builds a more flexible right transfer access control model by means of combining the Attribute-Based Access Control model (ABAC) and blockchain technology. Owing to the characteristics of ABAC’s attributes and right association, the massive problems of some sensor nodes can be solved. At the same time, for the sake of addressing the dynamic problems such as node access and right transfer, right transfer contract (TS) and access control contract (CS) are employed on the chain to ensure efficient and safe transmission of rights. To solve on-chain storage problems and ensure transparency of the operation, the idea of Rollup in Ethereum expansion is used to upload the final state of protocol policy and right exchange to the chain. Any user can know the policy and current right transfer status at any time. Finally, comparative and security analysis show that the model presented here can solve IoT devices’ massive and dynamic problems more effectively and it is more secure than the traditional models.

Attribute-Based Access Control for AWS Internet of Things and Secure Industries of the Future

Internet of Things (IoT) is revolutionizing and enhancing the quality of human lives in every aspect. With a disruption of IoT devices and applications, attackers are leveraging weak authentication and access control mechanisms on these IoT devices and applications to gain unauthorized access on user devices and data and cause them harm. Access control is a critical security mechanism to secure the IoT ecosystem which comprises cloud computing and edge computing services along with smart devices. Today major cloud and IoT service providers including Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure utilize some customized forms of Role-Based Access Control (RBAC) model along with specific authorization policies enabled by policy-based access control models. To enable fine-grained access control and overcome limitations of existing access control models, there is an imminent need to develop a flexible and dynamic access control model for securing smart devices, data and resources in the cloud-enabled IoT architecture. In this paper, we develop a formal attribute-based access control (ABAC) model for AWS IoT by building upon and extending previously developed access control model for AWS IoT, known as AWS-IoTAC model. We demonstrate the applicability of our proposed model through an industrial IoT use case and its implementation in the AWS IoT platform. Our proposed fine grained model for AWS IoT incorporates its existing capabilities and introduces new attributes for IoT entities and attribute-based policies for enabling expressive access control in AWS IoT. We also evaluate the performance of our model on the AWS cloud and IoT platform with the future smart industries use-case to depict the feasibility of our model in a real-world platform.

Permission-Based Separation of Duty in Dynamic Role-Based Access Control Model

A major development in the field of access control is the dominant role-based access control (RBAC) scheme. The fascination of RBAC lies in its enhanced security along with the concept of roles. In addition, attribute-based access control (ABAC) is added to the access control models, which is famous for its dynamic behavior. Separation of duty (SOD) is used for enforcing least privilege concept in RBAC and ABAC. Moreover, SOD is a powerful tool that is used to protect an organization from internal security attacks and threats. Different problems have been found in the implementation of SOD at the role level. This paper discusses that the implementation of SOD on the level of roles is not a good option. Therefore, this paper proposes a hybrid access control model to implement SOD on the basis of permissions. The first part of the proposed model is based on the addition of attributes with dynamic characteristics in the RBAC model, whereas the second part of the model implements the permission-based SOD in dynamic RBAC model. Moreover, in comparison with previous models, performance and feature analysis are performed to show the strength of dynamic RBAC model. This model improves the performance of the RBAC model in terms of time, dynamicity, and automatic permissions and roles assignment. At the same time, this model also reduces the administrator’s load and provides a flexible, dynamic, and secure access control model.

SeGoAC: A tree-based model for self-defined, proxy-enabled and group-oriented access control in mobile cloud computing

Designing an effective and secure group-oriented access control for mobile cloud storage services is an area of active research. For example, such schemes should provide user-friendly features that allow group members to be conveniently added or removed, privileges of group members to be assigned or revoked by authorized parties (e.g., group leaders), organizing of members into one or more sub-groups, forming of (multiple) hierarchical layers, etc. Specifically, privileges should be self-defined by group leaders, and access control can be carried out by group leaders as a proxy. In this paper, we propose a lightweight tree-based model designed to achieve self-defined, proxy-enabled and group-oriented access control (hereafter referred to as SeGoAC) for file storage access control in mobile cloud computing. SoGoAC is a flexible access control model that supports group access control, self-authorization and self-management iteratively, flexible self-defined accessing policies, user friendly features to grant and revoke privileges. We then demonstrate the utility of SeGoAC via extensive analysis.

Security of Mobile Agent Platforms using RBAC based on Dynamic Role Assignment

Mobile agent technology is a new trend in the network computing. It succeeds to capture researchers' and industry's interests long time ago, due to its innovative capabilities and attractive applications. Mobile agents are self-contained data and software modules, able to autonomously move from one host to another across the network, in order to perform their tasks and eventually return to their initiators. Despite their several qualities that make them suitable for various disciplines, where autonomy, dynamism and flexibility are strongly recommended, mobile agents still suffer from some limitations mainly related to the security issues raised by mobility. In this paper, we propose a novel approach to address the security problems evoked by platforms hosting mobile agents, particularly those caused by unauthorized access attacks. Our approach introduces a robust security policy for a Hospital, where a flexible role-based access control model (RBAC) is used and simulated as a set of cooperative agents. We implant a privilege management infrastructure (PMI) charged with issuing attribute certificates based on elliptic curve cryptography, in order to provide this model with a dynamic role assignment. Finally, practical experiments are conducted to evaluate our approach and prove its effectiveness, reliability and security.

Access Control Framework for Social Network System using Ontology

In recent years, we have seen unprecedented growth in the area of Online Social Networking (OSN) that is still keeping on day by day. Social networking websites such as Facebook, Google+, and Twitter are using widely by people to share personal and public information with friends, coworkers, colleagues, family and even with strangers .Facebook, one of the most popular social network sites, has million of active users and billions of pieces of content or data that use daily like web links, news stories, blog posts, notes, photo albums, etc. shared each month. To protect such kind for huge or big data or information need more secured and flexible access control model. There are so many access control policies are available for controlling online social network, but all social networking sites like Facebook or Twitter has their own access control mechanism that is not standard and still not more secured or flexible. To protect such kind of publically oriented user data need more dynamic access control model. In order to protect OSN, in this paper an innovative or dynamic access control framework for social networking systems using semantic web ontology has been proposed which addresses the protection of semantic-rich information in a knowledge base ontology

Practical access control management for distributed collaborative editors

The project summarized in this article aims at developing techniques to support access control in Real-Time Distributed Collaborative Editors (RCE). The ever-increasing role of RCE in academic, industry and society comforts the expansion of data sharing and raises growing concerns about controlling access to this data. Indeed, RCE allow for a human–computer–human interaction in a decentralized fashion. Thus, access control for RCE requires a careful design since they need dynamic access changes and low latency access to shared document while maintaining its consistency.In this article, we propose a flexible access control model where the shared document and its authorization policy are replicated in the local memory of each user. To deal with latency and dynamic access changes, we use an optimistic access control technique in such a way that enforcement of authorizations is retroactive. Our model is generic enough to be deployed on the top of the most of existing logging-based collaborative systems. Indeed, it does not entail overheads and it does not affect the convergence of the shared document. We show that naive coordination between updates of both copies can create security holes on the shared document, by permitting illegal modifications or rejecting legal modifications and present our solutions to avoid these problems. Finally, we present a prototype for managing authorizations in collaborative editing work in a decentralized fashion. Thus our model may be deployed easily on mobile devices over P2P networks.

Flexible Access Control Model in SaaS Applications Delivery Platform

Flexible Access Control Model in SaaS Applications Delivery Platform

Activity-oriented access control to ubiquitous hospital information and services

In hospital information systems, protecting the confidentiality of health information, whilst at the same time allowing authorized physicians to access it conveniently, is a crucial requirement. The need to deliver health information at the point-of-care is a primary factor to increase healthcare quality and cost efficiency. However, current systems require considerable coordination effort of hospital professionals to locate relevant documents to support a specific activity. This paper presents a flexible and dynamic access control model, Activity-Oriented Access Control (AOAC), which is based on user activity to authorize access permissions. A user is allowed to perform an activity if he/she holds a number of satisfactory attributes (i.e. roles, assignments, etc.) under a specified condition (e.g. time, location). Results of AOAC implementation in a realistic healthcare scenario have shown to meet two important requirements: protecting confidentiality of health information by denying an unauthorized access, and allowing physicians to conveniently browse medical data at the point-of-care. Furthermore, the average execution time was 0.078 s which allows AOAC to work in real-time.

Multi-domain lightpath authorization, using tokens

This paper highlights the concepts and results of our research, leading to demonstrations during the period 2005–2007 to develop a flexible and simple access control model, and corresponding support tools to provision multi-domain optical network resources on demand. We introduce the general network resources provisioning model that extends the Generic AAA Authorisation sequences for multi-domain scenarios, and explain how token based access control and policy enforcement can be used during the provisioned resource access. To build a solid conceptual foundation for the proposed token, based access control, the paper revisits existing token definition and proposes a new definition in the context of our research. We subsequently show the use of tokens during different stages of the lightpath provisioning process. The paper identifies and describes two major scenarios in multidomain lightpath provisioning: the chain and tree approaches. The proposed token concept allows a simple combination of access control enforcement at different networking layers: the packet layer, the path layer, and the service layer. We end with a brief description of a few demonstrations that proves the proposed concepts and illustrates its acceptance by a wider networking community.

Framework and prototype for a secure XML-based electronic health records system

Security of personal medical information has always been a challenge for the advancement of Electronic Health Records (EHRs) initiatives. eXtensible Markup Language (XML), is rapidly becoming the key standard for data representation and transportation. The widespread use of XML and the prospect of its use in the Electronic Health (e-health) domain highlights the need for flexible access control models for XML data and documents. This paper presents a declarative access control model for XML data repositories that utilises an expressive XML role control model. The operational semantics of this model are illustrated by Xplorer, a user interface generation engine which supports search-browse-navigate activities on XML repositories.

An application-layer based centralized information access control for VPN

With the rapid development of Virtual Private Network (VPN), many companies and organizations use VPN to implement their private communication. Traditionally, VPN uses security protocols to protect the confidentiality of data, the message integrity and the endpoint authentication. One core technique of VPN is tunneling, by which clients can access the internal servers traversing VPN. However, the tunneling technique also introduces a concealed security hole. It is possible that if one vicious user can establish tunneling by the VPN server, he can compromise the internal servers behind the VPN server. So this paper presents a novel Application-layer based Centralized Information Access Control (ACIAC) for VPN to solve this problem. To implement an efficient, flexible and multi-decision access control model, we present two key techniques to ACIAC—the centralized management mechanism and the stream-based access control. Firstly, we implement the information center and the constraints/events center for ACIAC. By the two centers, we can provide an abstract access control mechanism, and the material access control can be decided dynamically by the ACIAC’s constraint/event mechanism. Then we logically classify the VPN communication traffic into the access stream and the data stream so that we can tightly couple the features of VPN communication with the access control model. We also provide the design of our ACIAC prototype in this paper.

X-RDR

Although Web-based information systems (WISs) have been widely used by enterprises to accomplish business tasks through the Internet, there is little research on designing a flexible access control and delegation model for WISs. In this paper, we design a user-to-user and role-to-role delegation model (called X-RDR model) for WISs. The authorization and delegation policies are encoded in XML and the granularity of control can be as small as a text-field or button. Additionally, the proposed model supports single-step delegation, multi-step delegation, multiple delegation, partial delegation, separation of duties, and cascading revocation. A prototype was also implemented to demonstrate the feasibility of the proposed model.

A formal graph based framework for supporting authorization delegations and conflict resolutions

Authorization delegations and negations are two important features of a flexible access control model. When a system allows both authorization delegation and negation, conflict problems can become crucial since multiple administrators greatly increase the chance of conflicts. However the problem of handling conflicts in authorization delegations has not been explored by researchers. The existing conflict resolution methods seem limited for certain applications and cyclic authorizations can even lead to undesirable situations. This paper presents an authorization framework that can support authorization delegation for both positive and negative authorizations. A conflict resolution method based on the underlying grant-connectivity relation is proposed, which gives higher priorities to the predecessors to achieve controlled delegation. For conflicts where grantors are not grant-connected, our model supports multiple resolution policies so that users can select the specific one that best suits their requirements. In addition, cyclic authorizations are avoided and cascade overriding is supported when an administrative privilege is overridden. We give a formal description of our model and describe in detail the algorithms to implement the model. Our model is represented using labeled digraphs that provide a formal basis for proving the semantic correctness of our model.

A logical framework for reasoning about access control models

The increased awareness of the importance of data protection has made access control a relevant component of current data management systems. Moreover, emerging applications and data models call for flexible and expressive access control models. This has led to an extensive research activity that has resulted in the definition of a variety of access control models that differ greatly with respect to the access control policies they support. Thus, the need arises for developing tools for reasoning about the characteristics of these models. These tools should support users in the tasks of model specification, analysis of model properties, and authorization management. For example, they must be able to identify inconsistencies in the model specification and must support the administrator in comparing the expressive power of different models. In this paper, we make a first step in this direction by proposing a formal framework for reasoning about access control models. The framework we propose is based on a logical formalism and is general enough to model discretionary, mandatory, and role-based access control models. Each instance of the proposed framework corresponds to a C-Datalog program, interpreted according to a stable model semantics. In the paper, besides giving the syntax and the formal semantics of our framework, we show some examples of its application. Additionally, we present a number of dimensions along which access control models can be analyzed and compared. For each dimension, we show decidability results and we present some examples of its application.

Practical safety in flexible access control models

Assurance that an access control configuration will not result in the leakage of a right to an unauthorized principal, called safety , is fundamental to ensuring that the most basic of access control policies can be enforced. It has been proven that the safety of an access control configuration cannot be decided for a general access control model, such as Lampson's access matrix, so safety is achieved either through the use of limited access control models or the verification of safety via constraints. Currently, almost all safety critical systems use limited access control models, such as Bell--LaPadula or Domain and Type Enforcement, because constraint expression languages are far too complex for typical administrators to use properly. However, researchers have identified that most constraints belong to one of a few basic types, so our goal is to develop a constraint expression model in which these constraints can be expressed in a straightforward way and extensions can be made to add other constraints, if desired. Our approach to expressing constraints has the following properties: (1) an access control policy is expressed using a graphical model in which the nodes represent sets (e.g., of subjects, objects, etc.) and the edges represent binary relationships on those sets and (2) constraints are expressed using a few, simple set operators on graph nodes. The basic graphical model is very simple, and we extend this model only as necessary to satisfy the identified constraint types. Since the basic graphical model is also general, further extension to support other constraints is possible, but such extensions should be made with caution as each increases the complexity of the model. Our hope is that by keeping the complexity of constraint expression in check, flexible access control models, such as role-based access control, may also be used for expressing access control policy for safety-critical systems.