Multilevel Security Model Research Articles

Security-Aware Deadline Constraint Task Scheduling using Hybrid Optimization of Modified Flying Squirrel Genetic Chameleon Swarm Algorithm

Cloud computing enables cost-effective resource sharing in hybrid clouds to tackle the problem of insufficient resources by elastically scaling the service capability based on the users’ needs. However, task scheduling (TS) in cloud environments is challenging due to deadline-based performance and security constraints. To remove the existing drawbacks based on deadline and security constraints, a Security-Aware Deadline Constraint TS (SADCTS) approach is presented using a hybrid optimization algorithm of the Modified Flying Squirrel Genetic Chameleon Swarm Algorithm (MFSGCSA). The proposed MFSGCSA is developed by integrating the genetic operators into CSA and combining it with the modified Flying Squirrel Optimization (FSO) algorithm in which the position update and global search equations are enhanced by adaptive probability factor to reduce the local optimum problem. In this SADCTS approach, the task assignment process is modeled into an NP-hard problem concerning a multi-level security model using user authentication, integrity, and confidentiality. This maximizes tasks’ completion rate and decreases the resource costs to process tasks with different deadline limitations. The optimal schedule sequence is obtained by MFSGCSA, where tasks are scheduled concurrently based on security constraints, demand, and deadlines to improve the prominence of cost, energy, and makespan. Experiments are simulated using the CloudSim toolkit, and the comparative outcomes show that the suggested SADCTS approach reduced the makespan, cost, and energy by 5-20% more than the traditional methods. Thus, SADCTS provides less task violation of 0.0001%, high energy efficiency of 700GHz/W, high resource utilization of 92%, less cost efficiency of 72GHz/$, and less makespan of 480minutes to satisfy the necessary security and deadline requirements for TS in shared resource hybrid clouds.

HMAC-R: Hash-based message authentication code and Rijndael-based multilevel security model for data storage in cloud environment

HMAC-R: Hash-based message authentication code and Rijndael-based multilevel security model for data storage in cloud environment

Multi-Level Security Model Developed to Provide Data Privacy in Distributed Database Systems

Multi-Level Security Model Developed to Provide Data Privacy in Distributed Database Systems

Multi-level security model in distributed database systems

Multi-level security model in distributed database systems

Multi-level security model for privacy preserving in the cloud workflow scheduling

The traditional security provisioning is concentrating on the authentication of all the data that are critical or no critical results in the increase in computational time and cost. Further, the me...

Multi-level security model for privacy preserving in the cloud workflow scheduling

Multi-level security model for privacy preserving in the cloud workflow scheduling

Investigating the Cost of Transfer Delay on the Performance of Security in Cloud Computing

This study presents a performance evaluation of the deployment of partitioned workflows over hybrid clouds taking into account the cost of transfer data delay. This paper extends previous work on the cost of security in cloud computing based on the multi-level security model. This research aims to provide performance predictions of different deployment options in public and private clouds in terms of the computation and communication costs. The Markovian process algebra PEPA is used to evaluate the models behaviour under different scenarios.

Cost Effective, Reliable and Secure Workflow Deployment over Federated Clouds

The significant growth in cloud computing has led to increasing number of cloud providers, each offering their service under different conditions – one might be more secure whilst another might be less expensive or more reliable. At the same time user applications have become more and more complex. Often, they consist of a diverse collection of software components, and need to handle variable workloads, which poses different requirements on the infrastructure. Therefore, many organisations are considering using a combination of different clouds to satisfy these needs. It raises, however, a non-trivial issue of how to select the best combination of clouds to meet the application requirements. This paper presents a novel algorithm to deploy workflow applications on federated clouds. First, we introduce an entropy-based method to quantify the most reliable workflow deployments. Second, we apply an extension of the Bell-LaPadula Multi-Level security model to address application security requirements. Finally, we optimise deployment in terms of its entropy and also its monetary cost, taking into account the cost of computing power, data storage and inter-cloud communication. We implemented our new approach and compared it against two existing scheduling algorithms: Extended Dynamic Constraint Algorithm (EDCA) and Extended Biobjective dynamic level scheduling (EBDLS). We show that our algorithm can find deployments that are of equivalent reliability but are less expensive and meet security requirements. We have validated our solution through a set of realistic scientific workflows, using well-known cloud simulation tools (WorkflowSim and DynamicCloudSim) and a realistic cloud based data analysis system (e-Science Central).

Reliability Architecture for Collaborative Robot Control Systems in Complex Environments

Many different kinds of robot systems have been successfully deployed in complex environments, while research into collaborative control systems between different robots, which can be seen as a hybrid internetware safety-critical system, has become essential. This paper discusses ways to construct robust and secure reliability architecture for collaborative robot control systems in complex environments. First, the indication system for evaluating the real-time reliability of hybrid internetware systems is established. Next, a dynamic collaborative reliability model for components of hybrid internetware systems is proposed. Then, a reliable, adaptive and evolutionary computation method for hybrid internetware systems is proposed, and a timing consistency verification solution for collaborative robot control internetware applications is studied. Finally, a multi-level security model supporting dynamic resource allocation is established.

A Case Study in Inspecting the Cost of Security in Cloud Computing

The growing demands of business and the competition in the provision of services has led to many enterprises outsourcing IT provision using cloud computing to handle business processes and data management. Ideally, the benefits that are offered by cloud computing technology can accommodate the rapidly increased demands of the organizations and individual customers. However, the usage of cloud computing has potential security concerns. The proposed research will put forward an approach for investigating the cost of security in cloud computing. The proposed method is based on a multi-level security model, which uses the distribution of partitioned workflows upon hybrid clouds. Furthermore, the PEPA Eclipse plug-in tool will be used to create a cost model that uses the valid deployment choices that generated by the multi-level security model. The outcomes that can be obtained by means of implementing this research will used to describe the evaluation of the performance. Thus, predictions of the performance can be derived as well as the potential cost of deployment under different options and scenarios.

A Novel Permission Hierarchy for RBAC for Dealing with SoD in MAC Models

Separation of duty (SoD) is a fundamental principle of computer security that has not been addressed sufficiently in multi-level security (MLS) mandatory access control (MAC) models, as realized through the adoption of the Bell-LaPadula (BLP) model. This is due to the lack of means at present to express SoD constraints in MAC. The primary objective of this paper is to overcome this but within a framework that allows for rigour and linguistic features to express SoD constraints, while retaining the core security properties of BLP, namely the Simple Security Property and |$\bigstar $|-Property. To this end, we propose a formal framework which bridges the BLP model with the more general hierarchical role-based access control (RBAC) model. Our framework is based on a hierarchy of permissions that is founded on a novel concept of permission capacity, determined on the basis of the security levels that characterize objects in MLS models. Such a hierarchy naturally provides a solid basis for defining role seniority and deriving a hierarchical ordering on roles within MLS models. SoD constraints are expressed by means of conflicting permissions that give rise to mutually exclusive roles.

Location-dependent disclosure risk based decision support framework for persistent authentication in pervasive computing applications

In pervasive computing applications (e.g. electronic health records), the amount of information permissible to be shared or accessed by mobile users results in high disclosure risks. Obfuscation techniques are desirable in reducing the impact of disclosing confidential information but with a significant loss of utility of information content. Thus, accesses to confidential data by mobile users need to be controlled so as to minimize the disclosure risks. To achieve these requirements, we propose a novel location-dependent disclosure risk based decision support framework for persistent authentication and data access management. We have derived the location dependent identity based disclosure risks at record level and file level by using the search theory and entropy. We have experimentally evaluated our proposed model using multi-level security model and fuzzy sets. We have further proved that our proposed technique can significantly reduce the impact of common privacy attacks by performing a comprehensive security analysis. In conclusion, this research presents a novel location-dependent disclosure risk-based decision support framework persistent authentication and a pragmatic data access management approach for highly privacy-sensitive pervasive computing applications.

Analysis and Improvement of the BLP Security Model

Bell-LaPadula model (BLP) model is the most classical multilevel computer security model. Based on the research of BLP model, this paper analyzes the main defects in BLP model and different improving methods, puts forward a principle or “read the nearest and write the nearest”, improves the BLP model more effective security and integrity.

Cross domain reference monitor and its data-centered multilevel security model

Cross domain reference monitor and its data-centered multilevel security model

A multi-level security model for partitioning workflows over federated clouds

Cloud computing has the potential to provide low-cost, scalable computing, but cloud security is a major area of concern. Many organizations are therefore considering using a combination of a secure internal cloud, along with (what they perceive to be) less secure public clouds. However, this raises the issue of how to partition applications across a set of clouds, while meeting security requirements. Currently, this is usually done on an ad-hoc basis, which is potentially error-prone, or for simplicity the whole application is deployed on a single cloud, so removing the possible performance and availability benefits of exploiting multiple clouds within a single application. This paper describes an alternative to ad-hoc approaches – a method that determines all ways in which applications structured as workflows can be partitioned over the set of available clouds such that security requirements are met. The approach is based on a Multi-Level Security model that extends Bell-LaPadula to encompass cloud computing. This includes introducing workflow transformations that are needed where data is communicated between clouds. In specific cases these transformations can result in security breaches, but the paper describes how these can be detected. Once a set of valid options has been generated, a cost model is used to rank them. The method has been implemented in a tool, which is described in the paper.

A logical specification and analysis for SELinux MLS policy

The SELinux mandatory access control (MAC) policy has recently added a multilevel security (MLS) model which is able to express a fine granularity of control over a subject's access rights. The problem is that the richness of the SELinux MLS model makes it impractical to manually evaluate that a given policy meets certain specific properties. To address this issue, we have modeled the SELinux MLS model, using a logical specification and implemented that specification in the Prolog language. Furthermore, we have developed some analyses for testing information flow properties of a given policy as well as an algorithm to determine whether one policy is compliant with another. We have implemented these analyses in Prolog and compiled our implementation into a tool for SELinux MLS policy analysis, called PALMS. Using PALMS, we verified some important properties of the SELinux MLS reference policy, namely that it satisfies the simple security condition and ⋆-property defined by Bell and LaPadula. We also evaluated whether the policy associated to a given application is compliant with the policy of the SELinux system in which it would be deployed.

A multidimensional approach to multilevel security

PurposeThe purpose of this paper is to propose and describe a concept for multilevel security (MLS) that may be advantageous in information systems with a limited number of security levels. The concept should also adapt to information systems with limited capacities.Design/methodology/approachAssuming that confidentiality, integrity and availability are mutually independent security attributes of a generic information object, security requirements are modelled as a multidimensional vector space. Each axis represents one dimension of security. An axis is divided into an arbitrary number of levels. The paper shows how rules from the classic MLS models may enforce one‐directional information flow simultaneously and independently along each axis. By controlling flow this way, insecure or undefined states cannot be reached.FindingsHandling different MLS properties independently enables an effective verification algorithm based on simple logical or binary operations. Verification of rights can be executed within a few clock cycles.Research limitations/implicationsFuture research includes formal in‐depth studies of potential applications in databases, sensor information, operating systems and communication networks.Practical implicationsSimple logical port circuits may implement the proposed verification method. The method is well suited for tamper proof devices immune to software‐based attacks.Originality/valueThe paper describes a MLS concept that combines dimensions of security, like confidentiality, integrity and availability. The concept intends to be a “light‐weight” alternative to classic MLS models.

Multilevel security model for ad hoc networks

Modern battlefield doctrine is based on mobility, flexibility, and rapid response to changing situations. As is well known, mobile ad hoc network systems are among the best utilities for battlefield activity. Although much research has been done on secure routing, security issues have largely been ignored in applying mobile ad hoc network theory to computer technology. An ad hoc network is usually assumed to be homogeneous, which is an irrational assumption for armies. It is clear that soldiers, commanders, and commanders-in-chief should have different security levels and computation powers as they have access to asymmetric resources. Imitating basic military rank levels in battlefield situations, how multilevel security can be introduced into ad hoc networks is indicated, thereby controlling restricted classified information flows among nodes that have different security levels.

A secure group key management scheme for hierarchical mobile ad hoc networks

In this paper, we present a secure group key management scheme for hierarchical mobile ad hoc networks. Our approach aims to improve both scalability and survivability of group key management for large-scale wireless ad hoc networks. To achieve our goal, we propose the following approaches: (1) a multi-level security model, which follows a modified Bell-La Padula security model that is suitable in a hierarchical mobile ad hoc networking environment, and (2) a decentralized group key management infrastructure to achieve such a multi-level security model. Our approaches reduce the key management overhead and improve resilience to any single point failure problem. In addition, we have developed a roaming protocol that is able to provide secure group communication involving group members from different groups without requiring new keys; an advantage of this protocol is that it is able to provide continuous group communication even when the group manager fails.

A Multi-Level Security Model with Least Privilege Support for Trusted Subject

The trusted subject supports of the existing multi-level security models are reviewed and a new model called DLS (discrete label sequence) is proposed. It decomposes the lifecycle of a trusted subject into a sequence of untrusted states (US). Each untrusted state is associated with a certain current security label, and only the predefined trusted request events (TRE) can trigger the transition from one US to the other. Thus, the current security level of a trusted subject is dynamically changed according to its application's logic. Definitions of secure states and rules to preserve security are also presented. Compared with the trusted subject implemented by security level range, this model gives a better support of least privilege and achieves the support within the MLS policy framework.