Access Control Information Research Articles

Design of a software architecture supporting business-to-government information sharing to improve public safety and security

To ensure public safety and security, it is vitally important for governments to collect information from businesses and analyse it. Such information can be used to determine whether transported goods might be suspicious and therefore require physical inspection. Although businesses are obliged to report some information, they are reluctant to share additional information for fear of sharing competitively sensitive information, becoming liable and not being compliant with the law. These reasons are often overlooked in the design of software architectures for information sharing. In the present research, we followed a design science approach to develop a software architecture for business-to-government information sharing. Based on literature and a case study, we elicited the requirements an architecture that provides for the sharing of information should meet to make it acceptable to businesses. We then developed the architecture and evaluated it against the requirements. The architecture consists of a blockchain that stores events and rules for information sharing that are controlled by businesses. For each event, two parties use their private keys to encrypt its Merkle root to confirm that they know the data are correct. This makes it easy to check whether information is reliable and whether an event should be accepted. Access control, metadata and context information enable the context-based sharing of information. This is combined with the encryption and decryption of data to provide access to certain data within an organisation.

Privacy provision in eHealth using external services.

Privacy provision is a key issue for successful secure access to patients' health information. Current approaches do not always provide patients with the ability to define suitable rules to access to their information in a secure way. This paper presents an approach to give patients control over their information by means of external services. In this way, health information management and access control are kept independent and more secure.

What is intellectual property and how do you protect it?

Intellectual property (IP) theft is running rampant. Some organisations know it and disclose any loss of IP that occurs. Other organisations know it but keep their IP disclosures under wraps for as long as they can. The rest … well, they may be leaking IP at this very second and be none the wiser. Lack of information classification, information security policies and access control measures protecting IP can make for a very sticky situation. Almost every company has intellectual property of some sort, even if it doesn't know it. So how do you know if you have IP? And how can you protect it once you figure out what it is? Intellectual property (IP) theft is running rampant. Some organisations know it and disclose any loss of IP that occurs. Other organisations know it but keep their IP disclosures under wraps for as long as they can. Lack of information classification, information security policies and access control measures protecting IP can make for a very sticky situation. Almost every company has intellectual property of some sort, even if it doesn't know it. So how do you know if you have IP? And how can you protect it once you figure out what it is? Jamie Graves of ZoneFox looks at how you identify key IP in your organisation and develop a strategy to safeguard it.

О проблеме представления формальной модели политики безопасности операционных систем

In connection with the process of implementation by the Federal Service for Technical and Export Control of Russia Information Security Requirements for Operating Systems, the work analyzes the ways of fulfilling the requirements of the functional component ADV_SPM.1 Formal Security Policy Model, including defining the language, depth and detail of the presentation of the access control policy and information flows. Among other things, proposals are given on the composition of the main elements of the model, the use of tools for its verification. The practical possibility of applying the proposed approaches is considered by the example of the presentation of the description and verification of the mandatory entity-role security model for logical access control and information flows as the basis of the access control mechanism in the special-purpose operating system Astra Linux Special Edition.

Location attestation and access control for mobile devices using GeoXACML

Access control has been applied in various scenarios in the past for negotiating the best policy. Solutions with XACML for access control has been very well explored by research and have resulted in significant contributions to various sectors including healthcare. In controlling access to the sensitive data such as medical records, it is important to guarantee that the data is accessed by the right person for the right reason. Location of access requestor can be a good indication for his/her eligibility and reasons for accessing the data. To reason with geospatial information for access control, Geospatial XACML (eXtensible Access Control Markup Language) is proposed as a standard. However, there is no available implementation and architecture for reasoning with Geospatial XACML policies. This paper proposes to extend XACML with geohashing to implement geospatial policies. It also proposes an architecture for checking reliability of the geospatial information provided by clients. With a case study, we demonstrate how our framework can be used to control the privacy and data access of health service data in handheld devices.

Lightweight distributed secure data management system for health internet of things

Internet of Things (IoT) connects various kinds of sensors and smart devices using the internet to collect data. The adoption of IoT in medical care field will bring great convenient to both doctors and patients for effective illness monitoring and diagnosis. Due to the high value of medical data and the openness character of health IoT, the protection of data confidentiality is of crucial importance. In this paper, we propose a novel distributed secure data management with keyword search system for health IoT. Since the patients are usually managed by diverse medical institutions, the proposed system enables distributed access control of protected health information (PHI) among different medical domains. On the other hand, the accumulation of electronic health records (EHR) makes effective data retrieval a challenge task. Our scheme could provide efficient keyword search function on cross-domain PHI. For the resource limited devices in health IoT, it is an essential requirement to design lightweight algorithms in the secure data management system. The proposed system realizes lightweight data encryption, lightweight keyword trapdoor generation and lightweight data recovery, which leaves very few computations to user's terminal. The security of this system is reduced to the decisional bilinear Diffie-Hellman (DBDH) assumption. The comparison analysis is made between this scheme and other existing systems. The extensive experiments on both laptop and smart phone platforms show that the proposed scheme has greatly improved the computation efficiency and requires much less communication cost.

Governments’ Uses and Misuses of Freedom of Information Laws in Emerging European Democracies

This study tests the normative assumptions on the empowerment effects of freedom of information (FOI) legislation on the press–government relationship in the context of new democracies. In-depth interviews with journalists in Albania, Kosovo, and Montenegro imply that FOI laws can facilitate access to some previously unavailable official information. But, contrary to expectations, FOI laws are proving counterproductive for journalists who report stories beyond the official storyline, as government relies on this tool to control information access and the news agenda. The implication of these results for media freedom, agenda-building theory, and future transparency initiatives is discussed.

Self-adaptation and secure information flow in multiparty communications

Abstract We present a comprehensive model of structured communications in which self-adaptation and security concerns are jointly addressed. More specifically, we propose a model of multiparty, self-adaptive communications with access control and secure information flow guarantees. In our model, multiparty protocols (choreographies) are described as global types; security violations occur when process implementations of protocol participants attempt to read or write messages of inappropriate security levels within directed exchanges. Such violations trigger adaptation mechanisms that prevent the violations to occur and/or to propagate their effect in the choreography. Our model is equipped with local and global adaptation mechanisms for reacting to security violations of different gravity; type soundness results ensure that the overall multiparty protocol is still correctly executed while the system adapts itself to preserve the participants’ security.

Medical Information Security Analysis for Standardization Strategy in Korea

The present study analyzed the current state and related issues of standardization of personal medical information security by probing information security standards, guidelines, related statutes and certification programs in order for Korea to take initiatives in international standardization of security for ubiquitous healthcare (u-health). We chose essential elements of privacy, security and safety to investigate the international standardization status; in user privacy, user authentication, user ID security, and user identification, in health information security, data security, security infrastructure, accountability assurance, communication security, ID management and access control, non-repudiation, security management, and backup, storage, archiving, disposal, in safety, risk management, technology for emergency access, disassemble prevention and fixation, and equipment error check. As a result, we came up with the conclusion that Korea must immediately take the initiative of developing an international standard that addresses the overall safety of medical equipment, including emergency access, electrical malfunctioning management, and operational condition check.

An Overview on Access Control Models

Research in the field of information security systems and access control were initiated in the early seventies by United States Department of Defense, following the emergence of new technical, scientific and social challenges. Since, many models of security have been set up to answer to some specific needs with more or less accuracy in term of security. This manuscript gives a survey on the current security models with a specific classification in term of their use: Access Control, Flow Control and Administration. This manuscript is the subject of an assessment of advantages and drawbacks of access control models cited in literature and also the efficiency of their security policies. Finally, a presentation of the contributions of Flow Control and Administration models that allow the reinforcement of the security.

사물인터넷 센서퓨전 환경에서 동적인 상황을 고려한 데이터 접근제어 정책

ABSTRACT In order to delivery of the correct information in IoT environment, it is important to deduce collected information according to a user's situation and to create a new information. In this paper, we propose a control access scheme of information through context-aware to protect sensitive information in IoT environment. It focuses on the access rights management to grant access in consideration of the user's situation, and constrains(access control policy) the access of the data stored in network of unauthorized users. To this end, after analysis of the existing research 'CP-ABE-based on context information access control scheme', then include dynamic conditions in the range of status information, finally we propose a access control policy reflecting the extended multi-dimensional context attribute. Proposed in this paper, access control policy considering the dynamic conditions is designed to suit for IoT sensor fusion environment. Therefore, comparing the existing studies, there are advantages it make a possible to ensure the variety and accuracy of data, and to extend the existing context properties.Keywords:Internet of Things, Sensor Fusion, Context Awareness, Access Control Policy, Access Structure Tree

A Robust Method for Partially Occluded Face Recognition

Due to the wide application of face recognition (FR) in information security, surveillance, access control and others, it has received significantly increased attention from both the academic and industrial communities during the past several decades. However, partial face occlusion is one of the most challenging problems in face recognition issue. In this paper, a novel method based on linear regression-based classification (LRC) algorithm is proposed to address this problem. After all images are downsampled and divided into several blocks, we exploit the evaluator of each block to determine the clear blocks of the test face image by using linear regression technique. Then, the remained uncontaminated blocks are utilized to partial occluded face recognition issue. Furthermore, an improved Distance-based Evidence Fusion approach is proposed to decide in favor of the class with average value of corresponding minimum distance. Since this occlusion removing process uses a simple linear regression approach, the completely computational cost approximately equals to LRC and much lower than sparse representation-based classification (SRC) and extended-SRC (eSRC). Based on the experimental results on both AR face database and extended Yale B face database, it demonstrates the effectiveness of the proposed method on issue of partial occluded face recognition and the performance is satisfactory. Through the comparison with the conventional methods (eigenface+NN, fisherfaces+NN) and the state-of-the-art methods (LRC, SRC and eSRC), the proposed method shows better performance and robustness.

Unified Data Access Security on RevocableMulti Authority CP-ABE in Cloud

The cloud information administrations, it is typical for information to be put away in the cloud, as well as imparted crosswise over various Users. A few systems have been intended to permit both information holders and open verifiers to proficiently review cloud information trustworthiness without recovering the whole information from the cloud server. Be that as it may, open examining on the respectability of imparted information to these current systems will definitely uncover classified data character protection to open verifiers. Information access control is a successful approach to guarantee the information security in the cloud. Because of information outsourcing and untrusted cloud servers, the information access control turns into a testing issue in distributed storage frameworks. Our property renouncement technique can effectively attain to both forward security and retrogressive security.

Design of a Distributed Personal Information Access Control Scheme for Secure Integrated Payment in NFC

At the center of core technologies for a future cyber world, such as Internet of Things (IoT) or big data, is a context-rich system that offers services by using situational information. The field where context-rich systems were first introduced is near-field communication (NFC)-based electronic payments. Near-field Communication (NFC) integrated payment services collect the payment information of the credit card and the location information to generate patterns in the user’s consumption or movement through big data technology. Based on such pattern information, tailored services, such as advertisement, are offered to users. However, there is difficulty in controlling access to personal information, as there is a collaborative relationship focused on the trusted service manager (TSM) that is close knit to shared personal information. Moreover, in the case of Hadoop, among the many big data analytical technologies, it offers access control functions, but not a way to authorize the processing of personal information, making it impossible to grant authority between service providers to process information. As such, this paper proposes a key generation and distribution method, as well as a secure communication protocol. The analysis has shown that the efficiency was greater for security and performance compared to relation works.

VCC-SSF: Service-Oriented Security Framework for Vehicular Cloud Computing

Recently, as vehicle computing technology has advanced, the paradigm of the vehicle has changed from a simple means of transportation to a smart vehicle for safety and convenience. In addition, the previous functions of the Intelligent Transportation System (ITS) such as traffic accident prevention and providing traffic volume information have been combined with cloud computing. ITS services provide user-oriented broad services in the Vehicular Cloud Computing (VCC) environment through efficient traffic management, traffic accident prevention, and convenience services. However, existing vehicle services focus on providing services using sensing information inside the vehicle and the system to provide the service through an interface with the external infrastructure is insufficient. In addition, because wireless networks are used in VCC environments, there is a risk of important information leakage from sensors inside the vehicle, such as driver personal identification and payment information at the time of goods purchase. We propose the VCC Service-oriented Security Framework (VCC-SSF) to address the limitations and security threats of VCC-based services. The proposed framework considers security for convenient and efficient services of VCC and includes new user-oriented payment management and active accident management services. Furthermore, it provides authentication, encryption, access control, confidentiality, integrity, and privacy protection for user personal information and information inside the vehicle.

빅 데이터 환경에서 다중 속성 기반의 데이터 관리 기법

Abstract Put your information in the object-based sensors and mobile networks has been developed that correlate with ubiquitous information technology as the development of IT technology. However, a security solution is to have the data stored in the server, what minimal conditions. In this paper, we propose a data management method is applied to a hash chain of the properties of the multiple techniques to the data used by the big user and the data services to ensure safe handling large amounts of data being provided in the big data services. Improves the safety of the data tied to the hash chain for the classification to classify the attributes of the data attribute information according to the type of data used for the big data services, functions and characteristics of the proposed method. Also, the distributed processing of big data by utilizing the access control information of the hash chain to connect the data attribute information to a geographically dispersed data easily accessible techniques are proposed.Key Words : Big Data, Distribution Environment, Data Process, Multi-attribute

Desarrollo y validación psicométrica de la Escala de Privacidad en la Vivienda

The main objective of this research was to generate a reliable and valid scale that assessed dwelling privacy in Mexico City’s population. A scale was developed specifically for this purpose. The scale included 20 items with five options for answers (Never, few times, sometimes, frequently and always). The scale was applied to a sample of 200 Mexico City’s inhabitants in order to obtain its psychometrical validation. The distribution of the participants was as follow: age between 14 to 75; 110 women and 90 men: diverse occupations and school levels. A proper analysis took place in order to learn about the items discriminative power, reliability and valid factorial structure. The final scale was conformed by 11 items organized by three factors as follow: 1) Information Access Control, 2) Person Access Control and 3) Intimacy it explains 68% of variance and has a reliability of Cronbach Alpha =0.89. Afterwards a Confirmatory Factor Analysis was conducted to verify if the structure obtained from the Principal Component Analysis was correct, and a good fit was achieved (df=39, x2= 48.07, p=.151; CFI= .987; RMSEA= .032).

Typing access control and secure information flow in sessions

We consider a calculus for multiparty sessions with delegation, enriched with security levels for session participants and data. We propose a type system that guarantees both session safety and a form of access control. Moreover, this type system ensures secure information flow, including controlled forms of declassification. In particular, it prevents information leaks due to the specific control constructs of the calculus, such as session opening, selection, branching and delegation. We illustrate the use of our type system with a number of examples, which reveal an interesting interplay between the constraints of security type systems and those used in session types to ensure properties like communication safety and session fidelity.

Performance analysis of a cross-layered incremental redundancy hybrid automatic repeat request (CL IR-HARQ) mechanism

The performance of Hybrid Automatic Repeat reQuest (HARQ) in wireless networks has been extensively studied in recent years. Most of the HARQ performance results reported in the literature have been based on cross-layer techniques making use of Media Access Control (MAC) and physical layer information. In contrast, we present a performance analysis of a cross-layer approach that uses MAC and Internet Protocol (IP) layer information to efficiently control packet retransmissions in wireless networks. Evaluation results (using performance metrics such as packet error rate, retransmission efficiency, delay) obtained at the IP layer, using a two-state Gilbert Elliott channel model, demonstrate the significant performance improvements of the (MAC-IP) cross-layer strategy.

An authorization model for cross-enterprise collaborations

In the modern enterprise world, collaboration has emerged as a standard of best business practice. In order to build competitive advantages and minimize inefficiencies, organizations nowadays pursuit strategic alliances with partners outside the comfort of familiar security zones, loosen their hierarchical structures, exploit edge competencies, and aggregate diverse and heterogeneous sources of information. Nevertheless, such techniques dictate the concentration, use, and circulation of corporate information and sensitive personal data and, thus, ignite severe information confidentiality and privacy concerns. Hence, the employment of the appropriate collaboration technology is not sufficient; potential lack of successful protection mechanisms limits the effectiveness of partnerships and denies the respective investments to reach their full potential. In this paper, an authorization framework toward the protection of sensitive resources in the context of cross-enterprise scenarios is presented. The proposed framework is founded on the utilization of a semantic information model, which integrates individual privacy preferences, organizational access control rules and information handling policies into the authorization determination procedure. Partners within the framework are organized in a bridged federated architecture in order to build a secure communication network, within which semantic and trust interoperability is guaranteed. Copyright © 2014 John Wiley & Sons, Ltd.