Logical Access Control Research Articles

Medical Systems Data Security and Biometric Authentication in Public Cloud Servers

Advances in distributed computing and virtualization allowed cloud computing to establish itself as a popular data management and storage option for organizations. However, unclear safeguards, practices, as well as the evolution of legislation around privacy and data protection, contribute to data security being one of the main concerns in adopting this paradigm. Another important aspect hindering the absolute success of cloud computing is the ability to ensure the digital identity of users and protect the virtual environment through logical access controls while avoiding the compromise of its authentication mechanism or storage medium. Therefore, this paper proposes a system that addresses data security wherein unauthorized access to data stored in a public cloud is prevented by applying a fragmentation technique and a NoSQL database. Moreover, a system for managing and authenticating users with multimodal biometrics is also suggested along with a mechanism to ensure the protection of biometric features. When compared with encryption, the proposed fragmentation method indicates better latency performance, highlighting its strong potential use-case in environments with lower latency requirements such as the healthcare IT infrastructure.

Framework for Evaluation of Effectiveness of Integrated Financial Management Information Systems Architecture Implemented in Public Hospitals in Kenya.

Integrated Financial Management Information System (IFMIS), is an enterprise resource planning application that captures all functional processes and relevant financial flows within Public expenditure management. IFMIS is being adopted by the Public hospitals to promote efficiency, effectiveness, accountability, transparency, security of data management and comprehensive reporting. However the Public hospitals are loosing a lot of money through scandals and this has compromised service delivery to the Public. Therefore, the purpose of this study was to investigate the effectiveness of IFMIS as used in Public procurement services in Public Hospitals in Kenya and come up with an enhanced secure technical architecture. The objectives of the study were: to asses the extent to which IFMIS has been implemented in Public procurement services in Public hospitals in Kenya, to evaluate the effectiveness of IFMIS in enforcing logical access and technical controls in Public procurement services in Public Hospitals in Kenya and to develop a framework that will evaluate the effectiveness of IFMIS architecture that is implemented in Public procurement services in Public hospitals in Kenya .The study used mixed method research design targeting users of IFMIS. Stratified sampling was used to select the target population of 132 in 4 hospitals in Kenya. The target population was from 5 homogeneous stratum comprising of 44 Procurement Assistants, 36 Finance Assistants, 12 Audit Assistants, 28 Medical Practioneers and 12 ICT Staff. Proportional allocation method was used to calculate the sample size which was 99 respondents. The data was collected through questionnaires and direct observation. Content validity was done to ascertain the validity of the research instruments. Reliability of the instruments was carried out using test-retest technique. Internal consistence of data was computed using Cronbach Alpha Computation. Analysis of Quantitative and qualitative data was through descriptive and inferential statistics methods and content analysis respectively. The study developed a framework of enhanced technical architecture of IFMIS that would streamline procurement services in Public hospitals and improve provision of quality health care.

Logical Attacks and Countermeasures for Fingerprint On-Card-Comparison Systems.

Digital fingerprints are being used more and more to secure applications for logical and physical access control. In order to guarantee security and privacy trends, a biometric system is often implemented on a secure element to store the biometric reference template and for the matching with a probe template (on-card-comparison). In order to assess the performance and robustness against attacks of these systems, it is necessary to better understand which information could help an attacker successfully impersonate a legitimate user. The first part of the paper details a new attack based on the use of a priori information (such as the fingerprint classification, sensor type, image resolution or number of minutiae in the biometric reference) that could be exploited by an attacker. In the second part, a new countermeasure against brute force and zero effort attacks based on fingerprint classification given a minutiae template is proposed. These two contributions show how fingerprint classification could have an impact for attacks and countermeasures in embedded biometric systems. Experiments show interesting results on significant fingerprint datasets.

A review on iris recognition system for person identification

Iris is an evenly highlighted radial membrane with complex patterns that are perceptible upon near inspection, which exists behind the cornea of the eye with a changeable circular opening called the pupil. Iris Recognition System is a technique of identifying people using those complex distinctive features in patterns. Generally, Iris recognition system is used in security allied applications such as, authenticating PCs, network and mobile devices, physical and logical premises access control, national border control, secure banking and financial transactions, national identity like AADHAAR in India etc. This paper reviews the state-of-art design and implementation of various iris recognition systems. The contributions of the paper include: 1) conferring the importance, applications and deployment of iris recognition system related to human identification; 2) providing an analysis on iris recognition methods in effect; 3, discussing the present research defies; 4) providing commendations for the future research on iris recognition system.

A Conceptual Study on Image Enhancement Techniques for Fingerprint Images

Biometrics is an emerging field of research in recent years and has been devoted to the identification of individuals using one or more intrinsic physical or behavioral traits. Fingerprints are the prominent and widely acceptable biometric features compared to face, speech, iris, and other types of biometrics. Fingerprint characteristic or features are unique for everyone and which cannot change throughout the lifetime. Fingerprint biometrics is having applications in diverse fields like attendance system, criminology, mobile applications and logical access control system. This is the purpose behind the popularity of fingerprints as the biometric identifier. The biometric image captured through mobile supportive devices like the mobile camera or USB Fingerprint contains low-quality images. In fingerprint recognition system the quality of the image plays a very important role while matching two fingerprints. Most of the fingerprint recognition systems result in poor matching due to impurity or noisy images. So there is high necessity and scope for image preprocessing and enhancement techniques in order to improve the quality of fingerprint image and to obtain high accuracy in the matching process. In this paper, we discuss some approaches and methods for reducing noise or impurities and to improve the quality of the image before matching them. These techniques help the fingerprint recognition system to become robust and to obtain high quality in the matching process.

A Conceptual Study on Image Enhancement Techniques for Fingerprint Images

Biometrics is an emerging field of research in recent years and has been devoted to the identification of individuals using one or more intrinsic physical or behavioral traits. Fingerprints are the prominent and widely acceptable biometric features compared to face, speech, iris, and other types of biometrics. Fingerprint characteristic or features are unique for everyone and which cannot change throughout the lifetime. Fingerprint biometrics is having applications in diverse fields like attendance system, criminology, mobile applications and logical access control system. This is the purpose behind the popularity of fingerprints as the biometric identifier. The biometric image captured through mobile supportive devices like the mobile camera or USB Fingerprint contains low-quality images. In fingerprint recognition system the quality of the image plays a very important role while matching two fingerprints. Most of the fingerprint recognition systems result in poor matching due to impurity or noisy images. So there is high necessity and scope for image preprocessing and enhancement techniques in order to improve the quality of fingerprint image and to obtain high accuracy in the matching process. In this paper, we discuss some approaches and methods for reducing noise or impurities and to improve the quality of the image before matching them. These techniques help the fingerprint recognition system to become robust and to obtain high quality in the matching process.

О проблеме представления формальной модели политики безопасности операционных систем

In connection with the process of implementation by the Federal Service for Technical and Export Control of Russia Information Security Requirements for Operating Systems, the work analyzes the ways of fulfilling the requirements of the functional component ADV_SPM.1 Formal Security Policy Model, including defining the language, depth and detail of the presentation of the access control policy and information flows. Among other things, proposals are given on the composition of the main elements of the model, the use of tools for its verification. The practical possibility of applying the proposed approaches is considered by the example of the presentation of the description and verification of the mandatory entity-role security model for logical access control and information flows as the basis of the access control mechanism in the special-purpose operating system Astra Linux Special Edition.

Unpicking PLAID: a cryptographic analysis of an ISO-standards-track authentication protocol

The Protocol for Lightweight Authentication of Identity (PLAID) aims at secure and private authentication between a smart card and a terminal. Originally developed by a unit of the Australian Department of Human Services for physical and logical access control, PLAID has now been standardized as an Australian standard AS-5185-2010 and is currently in the fast-track standardization process for ISO/IEC 25185-1. We present a cryptographic evaluation of PLAID. As well as reporting a number of undesirable cryptographic features of the protocol, we show that the privacy properties of PLAID are significantly weaker than claimed: using a variety of techniques, we can fingerprint and then later identify cards. These techniques involve a novel application of standard statistical and data analysis techniques in cryptography. We discuss potential countermeasures to our attacks and comment on our experiences with the standardization process of PLAID.

Complete Architecture of a Robust System of Face Recognition

human face recognition is a hard topic because of the multitude of parameters involved (e.g. variation in pose, illumination, facial expression, partial occlusions), it is very important to be interested and to invest in it viewed her many fields of application (identity authentication, physical and logical access control, video surveillance, human-machine interface...). The work presented in this paper is in this context. Its objective is the implementation of a complete architecture of a robust face recognition system. In a first time, a new approach has been developed for the detection of faces in a 2D color image. Secondly, is focused on the feature extraction using an original approach which includes the Gabor descriptor and a pose estimator. Finally, to validate this research, the developed system is tested on standard databases: Caltech_Web, AT&T and Color FERET. Keywordsrecognition, face detection, Gabor wavelets, pose estimator, Supports Vectors Machines.

Risk adaptive hybrid RFID access control system

AbstractDynamic environments pose a challenge for traditional access control models where permissions are granted or revoked merely based on predefined and static access policies making them incapable of dynamically adapting to changing conditions. Risk adaptive access control models have been gaining more attention in the research community as an alternative approach to overcome the limitations of traditional access control models. Radio Frequency Identification (RFID) is an emerging technology widely utilized in both physical and logical access control systems because of its contactless nature, low cost, high read/write speed and long distance operation. Serverless RFID system architecture offers better availability assurance and lower implementation cost, while access rights management is easier in server‐based architecture. In this study, we continue to build on our previous research on the privacy and security of RFID access control systems without a backend database in order to overcome its limitations. We propose a hybrid design for a risk adaptive RFID access control system; that is, dynamically alternating between two access control modes, online (server‐based) and offline (serverless), to adapt to the level of risk depending on rule‐based risk scenarios and current risk value. The proposed design combines features of both serverless and risk adaptive access control systems. Copyright © 2015 John Wiley & Sons, Ltd.

Behind Closed Doors: Let's PLAI

This article provides insights and recommendations on designing and implementing converged physical and logical access control systems. Existing standards and models, either without modification or with clarifying enhancements, are available to assist in this effort. The PSIA Physical-Logical Access Interoperability (PLAI) specification combines the enhanced features of physical security, role-based AC, and attribute-based AC to provide facilities management "behind closed doors".

An Impact of Biometric System Applications Services on Biometric Service Market

ISO (the International organization for stadardiization) and IEC (the International Electrotechnical commission) form the specialized system for worldwide standardization. The first standard of this deals with the threat and countermeasure of biometrics and biometric system application models. Additionally, this international standard provides requirements and guidelines for the secure and privacy –compliant management and processing of biometric information. We analyze here that inclination of people towards biometric for using it as a security measure is mainly due to Identity Theft. we study various biometric system application models and analyzed that because of Identity theft problem most companies provides physical access control and logical access control services in perspective of three factors that is Business case, Technical performance and User acceptance.

Securing access control through convergence

Where security and identity authentication are paramount, an identity assurance programme within the walls of government needs to be highly customised and capable of meeting a stringent check-list – durability, resilience, compliance, counterfeit resistant and tamper-proof. With the additional need for future-proofing, while still facilitating integration with legacy infrastructure, the security industry must continue to innovate on all fronts to deliver new programmes to specification, on time and on budget. Moreover, as employee culture shifts from workstations to phones and tablets, government agencies are not immune. All organisations need to find a means of accommodating all the different users in their operating environment, while simultaneously locking down resources in order to protect them from threats. Just as the lines of a distinct, defensible security perimeter are fading, so too are the lines between physical and online security. But the obligation of any organisation remains unchanged – to ensure its resources are secure. The adoption in the workplace of mobile devices has forced many to rethink the way in which access credentials are managed. A strong authentication solution that offers a means of issuing and managing credentials to provide different levels of security is critical. Ian Lowe of HID Identity Assurance explains how a converged physical and logical access control solution is an utmost necessity.

Privacy and Security Assessment of Biometric Template Protection

Abstract Template-Protection-Techniken stellen eine wichtige Ergänzung zu biometrischen Systemen, um das gewünschte Sicherheitsniveau zu erreichen und die Anforderungen an den Schutz der Privatsphäre zu erfüllen. Diese Techniken ermöglichen Erneuerung und Widerruf der Referenzendaten in biometrischen Systemen. In dieser Arbeit wird ein systematisches Evaluierungsframework entwickelt, das sich an die wesentlichen Kriterien und Anforderungen an biometrische Template-Protection-Verfahren festhält. Seine Anwendbarkeit wird durch die Analyse der verschiedenen Algorithmen demonstriert. Die in dieser Arbeit präsentierte Evaluierung ist grundlegend für eine vollständige Analyse. Darüber hinaus ermöglicht es einen Nachweis der Sicherheit und Einhaltung der Privatsphäre. Es schafft eine Basis für Zertifizierung und Benchmark der Template-Protection-Verfahren.

Pensource - Evaluating Information Security in a Software Services Company

This teaching case focuses on the importance of a formal evaluation of information security practices using established frameworks. Such an evaluation is especially essential for organizations dealing with sensitive customer information. This case first presents the prevailing security practices of PenSource, a pension services company. A description of security practices of PenSource is provided using three approaches: a narrative description, a diagram of PenSource's network infrastructure, and answers to a questionnaire eliciting information on existing practices on many dimensions such as security organization, policies and standards, and logical access controls. A set of questions to facilitate a reader to analytically reflect on how to improve the current practices of information systems security of the focal organization is included.

The evolving biometric marketplace to 2006

The International Biometric Industry Association (IBIA) is forecasting rapid industry revenue growth to reach US$2 billion by 2006. Behind this spectacular rise the Association is predicting that embedded biometric mobile devices will become an important new category to overtake physical and logical access control and time/attendance applications over the next four years.

Security and data integrity for LANs and WANs

In a distributed computing environment, ownership of the security problem is avoided by management and users alike. Not only integrity and confidentiality, but also network (i.e. information, availability must be considered). Management has begun to realize that the security provided in the mainframe era has not been provided in the distributed environment. What must be considered now are the following issues: logical access controls access all platforms; improved network and platform reliability, and the ability to recover readily from disruption and disasters. Concludes that information security is absolutely vital to the survival of today′s enterprises and therefore should be given the emphasis it deserves at all enterprise levels.

Electronic eavesdropping onto information systems: What can the auditor do?

The effective protection of information stored in an electronic form requires a complex mixture of physical, administrative, logical access controls and data structuring/ encoding. Physical security of assets is an important consideration, but the key planning and operational aspects have been left to others, security management, line management etc. Network security, the protection of information during electronic transmission, has depended upon the utilisation of encryption techniques. The confidentiality and integrity of the data, and the knowledge associated with the administrative environment of the communication (e.g. the identity of the sender and the recipient) can be assured by a selection of graded encryption/de-encryption processes. The internal auditor is playing a greater role in recommending and supporting the encipherment of sensitive data both in transmission and in storage. Data when being used by humans, however, needs to be in a human readable form and not enciphered. Access to electronic information is invariably through the ubiquitous workstation. Good security is achieved by a mixture of administrative processes and logical access control, identification/authentication controls — passwords etc. The auditing profession has emphasised the need for good administrative controls surrounding an adequate set of software and, increasingly, hardware facilities. These embrace authentication of the user, authorisation over access to systems resources and the auditing of what has actually taken place. Physical security over resources has been primarily left to the security manager. New classes of technical threats to information resources may need a redistribution of planning, operational and monitoring responsibilities. One such threat, not yet fully understood, in the non-defence sector is the possible loss of valuable information by unauthorised monitoring of electronic emanations from office automation. Workstations especially may be considered increasingly at risk from remote electronic eavesdropping. There is a need for practical, marketable generic solutions to this problem to be integrated with the current security controls to produce a ‘secure commercial multi-functional workstation’. There has been little published material on the electronic propagation of workstations, or associated electronic storage and transmission devices and the associated eavesdropping opportunities into various networked/distributed electronic information systems. Solutions that would be economically acceptable (or even technically viable!) in the commercial sector have been restricted by a lack of understanding of technical issues. This article outlines some current research into solutions for non-defence organisations, where electronic hardening to defence ‘Tempest’ standards may be neither politically acceptable nor commercially viable! This research falls into the two major categories of administrative improvement and physical changes to equipment and/or the working environment. The technical aspects are considered first, to establish a base understanding of the extent of the problem.

A proposal for an automated logical access control standard (ALACS)

This paper is a proposal for a standard for the user-system interface protocol. The standard was developed when we noticed that clerical employees in business offices were being asked to use several different computer systems (via terminal-type devices). Each of these systems was implemented for unique applications. And, although in some cases multiple units were from the same manufacturer, each had a different sign-on protocol. Our interest is mostly in security, and we noticed that the result of this welter of varying processes was almost invariably the posting of "how to sign on" instructions, including passwords. Hence, the ALACS proposal.The proposal has been given to IEEE for consideration, and to the National Bureau of Standards, who are working on similar ideas.