Role-based Access Control Mechanism Research Articles

Blockchain-Based Security Configuration Management for ICT Systems

The world has become increasingly dependent on large-scale and distributed information and communication technology (ICT) infrastructures and systems in sectors such as energy, transport, banking, healthcare, water supply, and digital services, while their protection is considered of paramount importance and has already drawn remarkable attention from governments and key industry players. Establishing common approaches by leveraging existing frameworks and cyber security practices for improving the security postures of those systems is one of the major objectives for ensuring an adequate level of protection and avoiding the detrimental effects of disruptions on society and citizens. Configuration management (CM) is one of those common practices for establishing and maintaining the integrity and consistency of a system and its elements with regard to the function, performance, and status of technical and physical attributes, and it contributes to a desirable security posture throughout the lifecycle of a system. This study addresses the importance of CM, and while considering the corresponding frameworks, standards, and best practices, it proposes a permissioned blockchain-based approach, that inherits the benefits of the blockchain technology and ensures the integrity of the systems’ configuration across the complete lifecycle management of its products and services as an underlying model for mapping and integrating CM functions. Furthermore, this study briefly presents the benefits and challenges of the application of permissioned blockchain models and proposes a smart-contract-based role-based access control mechanism, in addition to presenting an operating concept based on brief but real-life lifecycle requirements of organizational configuration management.

A blockchain-based authority management framework in traceability systems

The frequent occurrence of product quality and food safety incidents in recent years has greatly lost the trust of consumers. Traceability systems are developed to trace status of products in processes of production, transportation, and sales. However, the tracing data stored in the traceability systems' centralised database can be tampered. In this paper, a blockchain-based authority management framework for traceability systems is proposed. Tracing data are stored on Hyperledger Fabric and interplanetary file system (IPFS) to reduce data storage space and improve data privacy protection on blockchain. In the framework, using the role-based access control (RBAC) mechanism, a blockchain-based RBAC model is presented by defining entities, functions, and rules. Additionally, components in four layers are designed in the framework. Strategies of operation flows are presented to achieve authority management in business applications. The framework not only guarantees the integrity of tracing data, but also prevents confidential information from being leaked. Compared with existing approaches, experiments show that the framework performs better in time and storage.

A blockchain-based authority management framework in traceability systems

The frequent occurrence of product quality and food safety incidents in recent years has greatly lost the trust of consumers. Traceability systems are developed to trace status of products in processes of production, transportation, and sales. However, the tracing data stored in the traceability systems' centralised database can be tampered. In this paper, a blockchain-based authority management framework for traceability systems is proposed. Tracing data are stored on Hyperledger Fabric and interplanetary file system (IPFS) to reduce data storage space and improve data privacy protection on blockchain. In the framework, using the role-based access control (RBAC) mechanism, a blockchain-based RBAC model is presented by defining entities, functions, and rules. Additionally, components in four layers are designed in the framework. Strategies of operation flows are presented to achieve authority management in business applications. The framework not only guarantees the integrity of tracing data, but also prevents confidential information from being leaked. Compared with existing approaches, experiments show that the framework performs better in time and storage.

An ECDSA Approach to Access Control in Knowledge Management Systems Using Blockchain

Access control has become problematic in several organizations because of the difficulty in establishing security and preventing malicious users from mimicking roles. Moreover, there is no flexibility among users in the participation in their roles, and even controlling them. Several role-based access control (RBAC) mechanisms have been proposed to alleviate these problems, but the security has not been fully realized. In this work, however, we present an RBAC model based on blockchain technology to enhance user authentication before knowledge is accessed and utilized in a knowledge management system (KMS). Our blockchain-based system model and the smart contract ensure that transparency and knowledge resource immutability are achieved. We also present smart contract algorithms and discussions about the model. As an essential part of RBAC model applied to KMS environment, trust is ensured in the network. Evaluation results show that our system is efficient.

Use of Purpose and Role Based Access Control Mechanisms to Protect Data Within RDBMS

Privacy is the key factor to handle personal and sensitive data, which in large chunks, is stored by database management systems (DBMS). It provides tools and mechanisms to access and analyze data within it. Privacy preservation converts original data into some unknown form, thus protecting personal and sensitive information. Different access control mechanisms such as discretionary access control, mandatory access control is used in DBMS. However, they hardly consider purpose and role-based access control in DBMS, which incorporates policy specification and enforcement. The role based access control (RBAC) regulates the access to resources based on the roles of individual users. Purpose based access control (PuBAC) regulates the access to resources based on purpose for which data can be accessed. It regulates execution of queries based on purpose. The PuRBAC system uses the policies of both, i.e. PuBAC and RBAC, to enforce within RDBMS.

A Data Security Enhanced Access Control Mechanism in Mobile Edge Computing

Mobile edge computing, with characteristics of position awareness, mobile support, low latency, decentralization, and distribution, has received widespread attention from industry and academia, and has been applied to application areas such as intelligent transportation, smart city, and real-time big data analysis. However, it also brings the new security threats, especially data security threats during data access that leads to unauthorized/unauthorized access, alteration and disclosure of data, affecting the confidentiality and integrity of the data. Therefore, access control, as an important method to ensure the security of user data during data access, began to be applied to mobile edge computing. However, the existing access control has the disadvantages of coarse-grain, poor flexibility and accuracy, lack of internal attack considerations, etc., which cannot meet the needs of data security in practical applications of mobile edge computing. In this paper, a data security enhanced Fine-Grained Access Control mechanism (FGAC) is proposed to ensure data security during data access in mobile edge computing. In FGAC, a dynamic fine-grained trusted user grouping scheme based on attributes and metagraphs theory was first designed. Secondly, the scheme was combined with the traditional role-based access control mechanism to assign roles to users based on user group credibility. And then, based on attribute matching the user authentication further verifies whether the user is allowed to perform the access operations to achieve fine-grained data protection. Experimental results show that FGAC can effectively identify malicious users and make group adjustments, while achieving fine-grained access control and assure the data security during the data access process in mobile edge computing.

A convolutional neural-based learning classifier system for detecting database intrusion via insider attack

Role-based access control (RBAC) in databases provides a valuable level of abstraction to promote security administration at the business enterprise level. With the capacity for adaptation and learning, machine learning algorithms are suitable for modeling normal data access patterns based on large amounts of data and presenting robust statistical models that are not sensitive to user changes. We propose a convolutional neural-based learning classifier system (CN-LCS) that models the role of queries by combining conventional learning classifier system (LCS) with convolutional neural network (CNN) for a database intrusion detection system based on the RBAC mechanism. The combination of modified Pittsburgh-style LCSs for the optimization of feature selection rules and one-dimensional CNNs for modeling and classification in place of traditional rule generation outperforms other machine learning classifiers on a synthetic query dataset. In order to quantitatively compare the inclusion of rule generation and modeling processes in the CN-LCS, we have conducted 10-fold cross-validation tests and analysis through a paired sampled t-test.

MD-UCON: A Multi-Domain Access Control Model for SDN Northbound Interfaces

In SDN (Software Defined Network) environments, for the security considerations of the upper-layer application behaviors, we need to consider adding an access control mechanism to the northbound interface of the SDN control layer to limit the capabilities of the upper-layer applications, thereby improving the security of the SDN. In addition, considering the performance and management requirements of SDN, access control features including cross-domain support should be considered. In this paper, we proposed an MD-UCON access control model with role mechanism extension based on UCON and role-based access control mechanism. At the same time, we introduced a cross-domain role mapping method to support cross-domain access authorization, thereby enabling the model to be applied to the application of access control for the SDN northbound interface.

Fast and Efficient Multiview Access Control Mechanism for Cloud Based Agriculture Storage Management System

Agriculture and its related industries are the backbone of many countries' economic growth. To achieve an efficient agricultural management system, remote sensing forecasting and GIS technology are providing information to users/stakeholders of various agricultural application uses. This information is huge in size and is stored in the cloud computing storage environment. Minimizing data access and storage costs on such an environment is desired. For achieving fine-grained role-based access control mechanisms, researchers are now focusing on ensuring such roles are enforced correctly. Existing models, though they are using role-based access control at various levels, are facing challenges like high computation rates and storage overhead. Currently, existing systems are using XML and UML for role and user creation. To address these research challenges, this article presents a model Fast and Efficient Multi View Access Control (FEMVAC) using the Amazon S3 public cloud environment for agriculture. The model minimizes storage overhead by adopting a banarization method over UML/XML method. The experimental outcome shows that the FEMVAC method is efficient compared with existing models.

An Enhancement Role and Attribute Based Access Control Mechanism in Big Data

To be able to leverage big data to achieve enhanced strategic insight and make informed decision, an efficient access control mechanism is needed for ensuring end to end security of such information asset. Attribute Based Access Control (ABAC), Role Based Access Control (RBAC) and Event Based Access Control (EBAC) are widely used access control mechanisms. The ABAC system is much more complex in terms of policy reviews, hence analyzing the policy and reviewing or changing user permission are quite complex task. RBAC system is labor intensive and time consuming to build a model instance and it lacks flexibility to efficiently adapt to changing user’s, objects and security policies. EBAC model considered only the events to allocate access controls. Yet these mechanisms have limitations and offer feature complimentary to each other. So in this paper, Event-Role-Attribute based fine grained Access Control mechanism is proposed, it provide a flexible boundary which effectively adapt to changing user’s, objects and security policies based on the event. The flexible boundary is achieved by using temporal and environment state of an event. It improves the big data security and overcomes the disadvantages of the ABAC and RBAC mechanisms. The experiments are conducted to prove the effectiveness of the proposed Event-Role-Attribute based Access Control mechanism over ABAC and RBAC in terms of computational overhead.

Efficient and Flexible Role-Based Access Control (EFRBAC) Mechanism for Cloud

The cloud reduces the user’s burden to many folds. But cloud providers and cloud users with dynamic relationship, are in distinct security domains. Amongst various challenges with cloud, the crucial one is to detect and protect the user’s data from unauthorized accesses. In cloud, users are not legendary by their predefined identities. Instead, they are providing accesses based on their characteristics and attributes. This work is focusing on available access control mechanisms and one that applicable for cloud environment. The paper also proposes an Efficient and Flexible Role-Based Access Control (EF-RBAC) mechanism for the cloud computing environment to achieve confidentiality and security. RBAC limits the accesses for resources within an organization to authorized users only and also guarantees that a user can solely access specific information they are authorized for by the organization policy. The proposed scheme adds flexibility to the RBAC for better cloud user’s experience.

Garbled role-based access control in the cloud

Security has always been a major concern in the cloud environment because outsourcing leads to the new security issues. Privacy risks related to the job assignment are the dominating hurdles in the wide organizations like research, military and intelligence. To address this issue Garbled Role-Based Access Control (GRBAC) mechanism is being offered in this paper having key component that obliviously assign roles to the users through (RSA Oblivious-Transfer). The design of the proposed model has been guided by the Role-Based Access Control and Dynamic Separation of Duty. The proposed model also includes the flexible authentication based on the user’s context information. GRBAC offers fine-grained security while algorithm does not have to be secret from adversary. Security of this model is based on the adopted Garbled Function (\(f_g\)). The proposed model is best suited for the organizations where available roles cannot be revealed to the users and assigned roles are not to be leaked even to the server.

Securing video cloud storage by ERBAC mechanisms in 5g enabled vehicular networks

With the growth of vehicular communication technologies, ubiquitous objects can be interacted and connected to the Internet. Generally, vehicles in VANETs should broadcast safety messages periodically. Since safety messages have been containing traffic interrelated information and sensitive to locality privacy, which is an essential to make sure ambiguity, dependability, and traceability the broadcast. Cooperative transmission is an effective approach for vehicular communications the progress wireless transmission capacity and reliability in fifth-generation (5G) small-cell networks. In this paper, one can analyze the safety communication, the traffic related information, accidents or other privacy aware information is in the form of video reporting service. This service is implemented a vehicular cloud to instantly the reporting videos for official authorities and an ambulance timer. However, due to high and secure traffic data, the vehicular cloud was built on dynamic resources; as a result, it experience of several inherent challenges, which is increasing the complexity on its implementation. Therefore, one can design secure communication system to use cryptography approach and also implement enhanced role-based access control (ERBAC) mechanism for providing the ability of the authority to view the video files in cloud storage system. Experimental results are provided to verify the proposed framework showing by its effectiveness of delivery on time with computational cost.

Enhanced Role Based Access Control Mechanism for Electronic Examination System

Over the years, e-learning and e- examination has become standard in many institutions of higher learning. It has been observed that examination questions and results can be easily intercepted by invalid users, thus the security of resources shared among valid users is not guaranteed. In order to solve these problems as it relates to access control, a Role based Examination System (RBES) was designed, developed and evaluated. RBES attempted to solve the security issue by the combination of two authentication techniques: text- based authentication and graphical password authentication. The Text-based authentication utilizes two text-based parameters namely the username and password. The graphical password authentication makes use of a finite set of controls (RBES chooses radio buttons) which are identified by numbers. These numbers constitute the password used for graphical authentication. To improve on resource sharing among users in the examination system, RBES proposes role management (role creation, role update, role removal) and user management (user creation, user update and user removal). The developed system made use of asp.net, C#, IIS server, WAMP server, Mysql and other tools for its development. RBES was tested by some legitimate and illegitimate users and the performance of the system was found to be satisfactory, hence RBES shows an efficient and reliable scheme that can be deployed in any examination or e-learning system. Finally the potential threats to the system were modeled and the use of weak passwords was found to be the most likely threat the system could be vulnerable to.

A Formal Verification Framework for Security Policy Management in Mobile IP Based WLAN

The continuous advancement of wireless technologies especially for enterprise Wireless local area networks (LANs), demands well defined security mechanisms with appropriate architectural support to overcome various security loopholes. Implementing security policies on the basis of Role based Access Control (RBAC) models is an emerging field of research in WLAN security. However, verifying the correctness of the implemented policies over the distributed network devices with changes in topology, remains unexplored in the aforesaid domain. The enforcement of organizational security policies in WLANs require protection over the network resources from unauthorized access. Hence, it is required to ensure correct distribution of access control rules to the network access points conforming to the security policy. In WLAN security policy management, the standard IP based access control mechanisms are not sufficient to meet the organizational requirements due to its dynamic topology characteristics. In an enterprise network environments, the role-based access control (RBAC) mechanisms can be deployed to strengthen the security perimeter over the network resources. Further, there is a need to model the time and location dependent access constraints. In this paper, we propose a WLAN security management system supported by a formal spatio-temporal RBAC (STRBAC) model and a Boolean satisfiability (SAT) based verification framework. The concept of mobile IP has been used to ensure fixed layer 3 address mapping for the mobile hosts in a dynamic scenario. The system stems from logical partitioning of the WLAN topology into various security policy zones. It includes a Global Policy Server (GPS) that formalises the organisational access policies and determines the high level policy configurations for different policy zones; a Central Authentication & Role Server (CARS) which authenticates the users (or nodes) and the access points (AP) in various zones and also assigns appropriate roles to the users. Every host has to register their unique MAC address to a Central Authentication and Role Server(CARS). Each policy zone consists of an Wireless Policy Zone Controller (WPZCon) that coordinates with a dedicated Local Role Server (LRS) to extract the low level access configurations corresponding to the zone access router. We also propose a formal spatio-temporal RBAC (STRBAC) model to represent the global security policies formally and a SAT based verification framework to verify the access configurations

MPHASiS: Mobile patient healthcare and sensor information system

Pervasive care and chronic disease management to reduce institutionalization is a priority for most western countries. The realization of next generation ubiquitous and pervasive healthcare systems will be a challenging task, as these systems are likely to involve a complex structure. Such systems will consist of various devices, ranging from resource-constrained sensors and actuators to complex multimedia devices, supporting time critical applications. This is further compounded by cultural and socio-economical factors that must be addressed for next generation healthcare systems to be widely diffused and used. In this study, the requirements for a vital sign monitoring solution space is derived and mPHASiS is developed based on these requirements. mPHASiS is an end to end solution not only providing sensor networking and vital sign monitoring but also closing the loop by signaling alert messages to the caregiver and allowing pervasive access to vital signs of a patient using smartphones over a heterogeneous network. A role based access control mechanism is developed to limit access to sensitive data. The end to end delay and delay variations for both vital sign data collection and pervasive access are analyzed. mPHASiS is developed as a complementary solution augmenting functionality of a hospital information system and can be loosely couple with the hospital information system using webservices.

SH-CRBAC: Integrating Attribute and Status Constraints into the RBAC Model in Smart Home Systems

The requirements for access control have been increased significantly in smart home systems. Many factors such as user ID, user location, service usage conditions and so on, regarded as authorization attributes, are important in making authorization decision in smart home systems. We investigate into the dynamic characteristics of the authorization in smart home systems and propose a new access-control model, SH-CRBAC, which aims to combine the advantages of attribute-based authorization mechanism and role-based access-control mechanism, and imposes attribute and status constraints on the RBAC model and enhances the generality and flexibility of authorization significantly in smart home systems. The status consistency of SH-CRBAC is analysed, and we also analyse the characteristics of SH-CRBAC through comparison with other popular existing authorization models in smart home systems.

CRBAC: Imposing multi-grained constraints on the RBAC model in the multi-application environment

Interactions between resources as well as services are one of the fundamental characteristics in the distributed multi-application environments. In such environments, attribute-based access control (ABAC) mechanisms are gaining in popularity while the role-based access control (RBAC) mechanism is widely accepted as a general mechanism for authorization management. This paper proposes a new access control model, CRBAC, which aims to combine the advantages of RBAC and ABAC, and integrates all kinds of constraints into the RBAC model. Unlike other work in this area, which only incorporates one or a few particular attribute constraints into RBAC, this paper analyses and abstracts the generic properties of the attribute constraints imposed on authorization systems. Based on these analyses and generalization, two constraints templates are presented, called authorization mapping constraint template and behaviour constraint template. The former template is able to automate the user-role and role-permission mapping, while the latter is used to restrict the behaviours of the authorization entities. The attribute constraints are classified into these two templates. Moreover, the state mechanism is introduced to build up the constraints among the statuses of the entities, and reflect the outcomes of the authorization control as well. Based on the presented templates and the state mechanism, the execution model is developed. A use case is proposed to show the authorization process of our proposed model. The extensive analyses are conducted to show its multi-grained constraints by comparing with other models.

Role-based access control for boxed ambients

Our society is increasingly moving towards richer forms of information exchange where mobility of processes and devices plays a prominent role. This tendency has prompted the academic community to study the security problems arising from such mobile environments, and in particular, the security policies regulating who can access the information in question. In this paper we describe a calculus for mobile processes and propose a mechanism for specifying access privileges based on a combination of the identity of the users seeking access, their credentials, and the location from which they seek it, within a reconfigurable nested structure. We define BACI R , a boxed ambient calculus extended with a Distributed Role-Based Access Control mechanism where each ambient controls its own access policy. A process in BACI R is associated with an owner and a set of activated roles that grant permissions for mobility and communication. The calculus includes primitives to activate and deactivate roles. The behavior of these primitives is determined by the process’s owner, its current location and its currently activated roles. We consider two forms of security violations that our type system prevents: (1) attempting to move into an ambient without having the authorizing roles granting entry activated and (2) trying to use a communication port without having the roles required for access activated. We accomplish (1) and (2) by giving a static type system, an untyped transition semantics, and a typed transition semantics. We then show that a well-typed program never violates the dynamic security checks.

SPECIFICATION AND VERIFICATION OF WORKFLOWS WITH RBAC MECHANISM AND SoD CONSTRAINTS

Security considerations, such as role-based access control (RBAC) mechanism and separation of duty (SoD) constraints, are important and integral to workflow systems. Since the definition of workflows with these security considerations is a complicated and error-prone process, rigorous verification techniques are desirable for uncovering logical errors and assuring correctness. We propose the use of an equation-based method — the OTS/CafeOBJ method to model, specify and verify workflows with such security considerations. Specifically, a workflow with the security considerations, is modeled as an OTS, a kind of transition system; the OTS is then specified in CafeOBJ, an algebraic specification language. We verify that the OTS has desired safety and liveness properties by using the CafeOBJ system as an interactive theorem prover. A case study on a sample workflow that deals with travel expense reimbursement is used to demonstrate our method.