Principle Of Privilege Research Articles

Integrated model for open learning environment with dynamic multilayer authentication and hybrid access control using cloud

Objective: This study mainly focuses on secure and user-friendly open learning environment using the cloud. This will improve the quality of education, individual care and global education. Methods: To make a deep analysis of the existing massive open online courses learning environment and build a mobile application using PHP and MySQL. The application is simulated under Veracode and the authentication attack prevention time is noted. In this paper hybrid Access Control Model is compared with other Access Control Models and the results are discussed. Findings: This research work recommends a mobile application using dynamic multilevel authentication with hybrid access control for open learning environment. The mobile application has the features like device identification, freedom in preparing security index, a random question from the security index instead of a textual password, cherished graphics password, limited unauthorized attempts with time bound and hybrid access control. Dynamic multilayer authentication proves prone free from authentication attacks. Hybrid access control under dynamic policy management delivers flexible and fine-grained authorization. This model supports primarily least privilege principle, flexibility, scalability, trust level, supporting heterogeneity and temporal constraints with dynamic policy management. It shows better results than the traditional Access Control Models. Application: The proposed system suggests a highly secured and cost-effective mechanism for the open learning environment. Keywords: Access Control, Dynamic Multilevel Authentication, Hybrid Access Control Model, Ontology, Open Learning Environment

Attorney-client privilege (History and aim – constitutional view)

The basis of the attorney-client privilege is the duty of a lawyer to maintain the confidentiality of all facts about which he has learned in relation to the exercise of the legal profession. The content of the institution of attorney-client privilege must be interpreted in light of the purpose it should serve. The principle of attorney-client privilege is not absolute. On the one hand, the duty of attorney’s confidentiality is a guarantee of a confidential relation between the client and the attorney. It enables attorneys to provide the protection of the client’s constitutional rights stemming from the right to a fair trial or requirements of the rule of law. Therefore, it cannot be perceived as the privilege of an attorney, but more as the right of the client. Moreover, in no case shall the institution of confidentiality serve as a protective unit for committing criminal acts. At the same time, however, insensitive breaches of the institution of attorney-client privilege may constitute gross violations of constitutional rights, such as the rights of defence, the right to protection of private life, or right of free exercise of a profession. The case law of the European Court of Human Rights, as well as, the case law of the Constitutional Court of the Czech Republic confirm the mentioned postulates.

Impact of Excessive Access Permissions and Insider Threat Opportunity in the Financial Industry

The purpose of this qualitative, exploratory research study was to gain insights into the correlations between: (a) security threats related to the dangers of excessive access permissions in information systems (IS); and (b) the potential risk exposure to insider threat in the financial sector. The study examined the vulnerability risk to insider threats from the view of the possible connection to excessive access permissions which represent a gap in the literature. The central research question of the study was: What are the determinants that influence the applicability of internal security controls such as segregation of duties (SoD), the least privilege principle, the need-to-know concept and the relationship between access permissions and insider threat in IS? A sample of 15 financial sector professionals that included business users, IT personnel, and certified fraud examiners were interviewed to answer the central research question.

TNGuard: Securing IoT Oriented Tenant Networks Based on SDN

In the paradigm of infrastructure-as-a-service cloud computing involving an Internet of Things network, customers outsource their infrastructure to the cloud. An outsourced infrastructure is a virtual infrastructure that mimics the physical infrastructure of the precloud era; it is therefore referred to as a tenant network (TN) in this paper. This practice draws upon the notion of TN abstraction , which specifies how TNs should be managed. However, current virtual software-defined network (SDN) technology uses an SDN hypervisor to attain TNs, where the cloud administrator is given much-more-than-necessary privileges; thus, not only could violation of the security principle of least privilege occur, but the threat of a malicious or innocent-but-compromised administrator may be present. Motivated by this need, we propose the specification of TN abstraction, including its functions and security requirements. Then, we present a platform-independent concretization of this abstraction called TNGuard , which is an SDN-based architecture that protects the TNs while removing unnecessary privileges from the cloud administrator. In order to show that TNGuard concretizes the TN abstraction, we present an instantiation of TNGuard on the Xen virtualization platform with the Ryu controller. Experimental results show that the resulting system is practical, incurring a small performance overhead.

Expressive Policy-Based Access Control for Resource-Constrained Devices

Upcoming smart scenarios enabled by the Internet of Things envision smart objects that expose services that can adapt to user behavior or be managed with the goal of achieving higher productivity, often in multi-stakeholder applications. In such environments, smart things are cheap sensors (and actuators) and, therefore, constrained devices. However, they are also critical components because of the importance of the provided information. Therefore, strong security is a must. Nevertheless, existing feasible approaches do not cope well with the principle of least privilege; they lack both expressiveness and the ability to update the policy to be enforced in the sensors. In this paper, we propose an access control model that comprises a policy language that provides dynamic fine-grained policy enforcement in the sensors based on local context conditions. This dynamic policy cycle requires a secure, efficient, and traceable message exchange protocol. For that purpose, a security protocol called Hidra is also proposed. A security and performance evaluation demonstrates the feasibility and adequacy of the proposed protocol and access control model.

On the Privacy and Security of the Ultrasound Ecosystem

Abstract Nowadays users often possess a variety of electronic devices for communication and entertainment. In particular, smartphones are playing an increasingly central role in users’ lives: Users carry them everywhere they go and often use them to control other devices. This trend provides incentives for the industry to tackle new challenges, such as cross-device authentication, and to develop new monetization schemes. A new technology based on ultrasounds has recently emerged to meet these demands. Ultrasound technology has a number of desirable features: it is easy to deploy, flexible, and inaudible by humans. This technology is already utilized in a number of different real-world applications, such as device pairing, proximity detection, and cross-device tracking. This paper examines the different facets of ultrasound-based technology. Initially, we discuss how it is already used in the real world, and subsequently examine this emerging technology from the privacy and security perspectives. In particular, we first observe that the lack of OS features results in violations of the principle of least privilege: an app that wants to use this technology currently needs to require full access to the device microphone. We then analyse real-world Android apps and find that tracking techniques based on ultrasounds suffer from a number of vulnerabilities and are susceptible to various attacks. For example, we show that ultrasound cross-device tracking deployments can be abused to perform stealthy deanonymization attacks (e.g., to unmask users who browse the Internet through anonymity networks such as Tor), to inject fake or spoofed audio beacons, and to leak a user’s private information. Based on our findings, we introduce several defense mechanisms. We first propose and implement immediately deployable defenses that empower practitioners, researchers, and everyday users to protect their privacy. In particular, we introduce a browser extension and an Android permission that enable the user to selectively suppress frequencies falling within the ultrasonic spectrum. We then argue for the standardization of ultrasound beacons, and we envision a flexible OS-level API that addresses both the effortless deployment of ultrasound-enabled applications, and the prevention of existing privacy and security problems.

Designing Application Permission Models that Meet User Expectations

How should applications legitimately requiring access to sensitive resources to carry out their functionality be granted access to those resources? The answer to this question depends on users. This article introduces user-driven access control, an alternate permission model that adheres to the principle of least privilege while reducing the burden on users to make explicit permission decisions.

Information Systems: Secure Access and Storage in the Age of Cloud Computing

Given that cloud computing is a remotely accessed service, the connection between provider and customer needs to be adequately protected against all known security risks. In order to ensure this, an open and clear specification of all standards, algorithms and security protocols adopted by the cloud provider is required. In this paper, we review current issues concerned with security threats to cloud computing and present a solution based on our unique patented compression-encryption method. The method provides highly efficient data compression where a unique symmetric key is generated as part of the compression process and is dependent on the characteristics of the data. Without the key, the data cannot be decompressed. We focus on threat prevention by cryptography that, if properly implemented, is virtually impossible to break directly. Our security by design is based on two principles: first, defence in depth, where our proposed design is such that more than one subsystem needs to be violated to get both the data and their key. Second, the principle of least privilege, where the attacker may gain access to only part of a system. The paper highlights the benefits of the solution that include high compression ratios, less bandwidth requirements, faster data transmission and response times, less storage space, and less energy consumption among others.

Zasada uprzywilejowania pracownika – kilka uwag na tle zarysu sposobów ujmowania zasad prawa pracy

A brief analysis of ways of understanding the principles of the labour law, discussed in the article, situates the principle of employee privilege in the normative group of principles. Its content creating the model of the relation between the provisions of the acts constituting the basis of employment and labour law provisions, is based on the fact that these provisions cannot be less favourable than those provisions which perform the protective function of the labour law. In the author’s opinion, the principle which has constitutional legitimation in the principle of work protection, fulfils the same roles beside those assigned to the principles of lower rank (out of constituent). According to the author, a change in the approach of understanding certain constitutional terms referring to the work, does not change the position of the principle of preference as assigned strictly to the employment relationship. Due to these considerations, the author is sceptical about the possibility of extending the principle of employee privilege of employment to work under a non-employment contract, including employment under a contract of outwork.

English

SQLIA has been now a major threat to the growing popularity of web application. The main target of this attack is the database. This allows attackers to obtain unauthorised access to database .In this paper we survey different types of SQLIAs and prevention methods. To address this problem we propose a mixed approach for prevention of SQLIA .This paper ensures that the untrusted data are validated against a list of allowable values. Least privilege principle is applied to SQL account used by web application. We avoid query concatenation at almost all costs and use parameterized queries wherever possible.

Privacy‐preserving authorization method for mashups

AbstractMashups, which use multiple sources to create a new service, emerged as an evolution of Web 2.0. However, scalable access control for mashups is difficult. To enable a mashup to gather data from legacy applications and services, users must obey as the mashup host orders. These orders are created without any standard or limits about the privacy protection. This authorization approach violated the principle of least privilege and leaves users vulnerable to misuse of their private information by malicious mashups. To overcome the limitations, we introduce the privacy‐preserving authorization method for mashups, which encapsulates the data of backend services with different private sensitivity degrees before the authorization process executes. We also give the data–user relationship model to make standard for backend services when defining private sensitivity degrees of users' data. In this progress, standard encapsulation file and authorization file are created successively. In the end, the authorization steps, which could be set stored for regular use of the mashups, are created based on the authorization mechanism and authorization file. The proposed method mainly focuses on the users and backend services, which are the real data owners. Through this method, users have the ability to observe and control the data involved in the mashup, and the backend services can take the responsibility of their users' private information protecting. In the end of the paper, the application example and a series of experimental study are given to demonstrate the feasibility and efficiency of this method. Copyright © 2015 John Wiley & Sons, Ltd.

Pre-Authentication Design for Seamless and Secure Handover in Mobile WiMAX

Mobile WiMAX uses EAP-based authentication and key management for link layer security. One of the major challenges concerning the performance of mobile WiMAX is seamless handover. Research shows that a large portion of delay related to handover actually comes from user authentication and network entry and re-entry. In general, total delay associated with the handover process can be divided into three categories: i) link layer handover delay, ii) IP layer handover delay, and iii) security sub-layer handover delay. We propose a pre-authentication design that can provide seamless and safe connection when handover takes place. Our design is based on the least privilege principle; therefore, our approach guarantees backward/forward secrecy. We conduct research using an ns-2 simulation tool to measure the performance of our seamless handover. Our approach is validated using automated validation of Internet Security Protocols and Applications (AVISPA).

Reporting Obligation of Lawyers under the AML/ATF Law in Malaysia

Abstract Within the money laundering process, lawyers could become the potential vehicle for the launderers to conduct their illegal activities. In dealing with this problem, the Anti-Money Laundering and Terrorism Financing Act 2001 (AML/ATF) imposes a duty on the Malaysian lawyers to report any suspicious transactions to the authority. Employing a content analysis method, this conceptual paper examines such obligation and the impediments to reporting in many jurisdictions, including Malaysia. The lawyers’ reluctance to comply with their duties to report could be attributed to the culture of confidentiality and the fear of erosion of the principle of client-lawyer privilege.

A Permission verification approach for android mobile applications

Mobile applications build part of their security and privacy on a declarative permission model. In this approach mobile applications, to get access to sensitive resources, have to define the corresponding permissions in a manifest. However, mobile applications may request access to permissions that they do not require for their execution (over-privileges) and offer opportunities to malicious software to gain access to otherwise inaccessible resources. In this paper, we investigate on the declarative permissions model on which security and privacy services of Android rely upon. We propose a practical and efficient permission certification technique, in the direction of risk management assessment. We combine both runtime information and static analysis to profile mobile applications and identify if they are over-privileged or follow the least privilege principle. We demonstrate a transparent solution that neither requires modification to the underlying framework, nor access to the applications' original source code. We assess the effectiveness of our approach, using a randomly selected varied set of mobile applications. Results show that our approach can accurately identify whether an application is over-privileged or not, whilst at the same time guaranteeing the need of declaring specific permissions in the manifest.

Authorization query method for RBAC based on partial MAX-SAT solver

In order to ensure system security and reflect availability in authorization management,a method for querying authorization was proposed based on solvers for partial maximal satisfiability problem.Static authorization descriptions and dynamic mutually exclusive constraints were translated into hard clauses.The algorithm was adopted to update hard clauses and translate requested permissions into soft clauses.Soft clauses were effectively encoded,and the recursive algorithm was utilized to satisfy all hard clauses and as many soft clauses as possible.The experimental results show that the method can ensure system security,it follows the least privilege principle,and the query efficiency outperforms solvers for maximal satisfiability problem.

Handling least privilege problem and role mining in RBAC

For a given role-based access control (RBAC) configuration, user-role assignment satisfying least privilege principle (specified as LPUAP) is one of the most important problems to be solved in information security. LPUAP has been proved to be NP-hard. This paper gives several efficient greedy algorithms for handling this problem. Experiment results show that the output of our algorithms is almost optimal while the running time is greatly reduced. In another case where a RBAC configuration is to be set up, minimizing the descriptive set of roles (specified as Basic-RMP) and minimizing the administrative assignments for roles (specified as Edge-RMP) can greatly decrease the management costs. Both role mining problems (i.e., Basic-RMP and Edge-RMP) have also been proved to be NP-hard. This paper converts Basic-RMP to set cover problem and Edge-RMP to weighted set cover problem, and two algorithms respectively named $$GA_{Basic}$$GABasic algorithm for Basic-RMP and $$GA_{Edge}$$GAEdge algorithm for Edge-RMP, are designed. Experiment results show that the average similarity rate between role sets produced by $$GA_{Basic}$$GABasic algorithm and the original ones used in generating the dataset is above 90 %. However, in the process of converting role mining into Set Cover Problem, the number of candidate role set is very large. In order to reduce the complexity of the $$GA_{Basic}$$GABasic algorithm, this paper presents a new polynomial-time algorithm with a performance nearly the same as that of $$GA_{Basic}$$GABasic algorithm.

TCBAC: An Access Control Model for Remote Calibration System

In order to improve the reliability of remote calibration system, a task-constraint-based access control model named TCBAC is presented according to the characteristic of remote calibration system. TCBAC conducts access control according to task. It defines authorization constraints and execution constraints by the characteristics of task and the relation among tasks. Users can obtain a task authorization only when the authorization constraint is satisfied, and can execute a task only when the execution constraint is satisfied. The performance of TCBAC is analyzed by applying it to a remote calibration system and comparing it with DAC, MAC and RBAC which are commonly used access control models at present. The results show that TCBAC has the advantages of considering context and dynamics, it more fully satisfies the principle of least privilege and the principle of separation of duty and has good expansibility.

Role-based Trust Management Model in Multi-domain Environment

Based on the in-depth analysis of issues in dRBAC model, which include the lack of commission depth control in distributed environment, the inefficiency of cascading revocation of the authorization roles and the incapability of judging whether the commission violates the principles of RBAC model before it is done, this paper proposed MD-dRBAC Model, designed trust management mechanism for MD-dRBAC Model, which was used to control the access, established the credible authority commission tree and finally proposed the detection algorithm for implicit authorities upgrading to avoid violation of the least privilege principle in RBAC model Extensive security and performance analysis show that the proposed schemes are highly efficient and secure. DOI: http://dx.doi.org/10.11591/telkomnika.v11i1.1917

How to Find a Rigorous Set of Roles for Application of RBAC

Role-based access control (RBAC) has been adopted successfully by a variety of security system by reducing the complexity of the management of access control. The least privilege principle is a very important constraint policy of RBAC. Devising a complete and correct set of roles for supporting the least privilege principle has been recognized as one of the most important tasks in implementing RBAC. A key problem is how to find such sets of roles which have the least permissions. In fact, when the number of role-permission assignments is large, it is almost impossible to find a rigorous set of roles which has the completely same set of permissions required by a user. To address this problem, we research the problem how to find such the rigorous combinations obeying the principle of least permissions. By bringing forward the concept of the l east privilege mining problem, we describe the methods to resolve the problem and some instances of its applications, too. Moreover, the corresponding algorithms are displayed. Specially, by analyzing the complexity of least privilege mining problem, the method based on evolutionary algorithm is shown appreciate. Correspondingly, the experiments are accomplished to prove our opinions. Finally, the paper is concluded and some future work is posed.

Five Races, One Parliament? Xinhai in Xinjiang and the Problem of Minority Representation in the Chinese Republic

While the early Chinese parliament has been criticised as an ineffective shield against warlord machinations, this article brackets the question of its institutional efficiency and instead treats the National Assembly in terms of the visions of China that were expressed in the process of its construction. Debates on electoral divisions and rules for non- Han regions allow insight into the competing principles by which such territories might be incorporated into the new Chinese nation, and show that the ‘Five Races’ vision of China provided a meaningful vocabulary for non- Han elites to press for a greater say in the nation’s institutions. Although the electoral system preserved the principle of aristocratic privilege in the case of the Mongols and Tibetans, such concessions to ethnic difference could not be applied in Xinjiang, which had had provincial status since the 1880s. To some Muslims, this betrayed the Republic’s promise of equality among the ‘Five Races’, prompting calls for dedicated Muslim representation in the parliament.