Role-based Access Control Model Research Articles

Cedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization

Cedar is a new authorization policy language designed to be ergonomic, fast, safe, and analyzable. Rather than embed authorization logic in an application’s code, developers can write that logic as Cedar policies and delegate access decisions to Cedar’s evaluation engine. Cedar’s simple and intuitive syntax supports common authorization use-cases with readable policies, naturally leveraging concepts from role-based, attribute-based, and relation-based access control models. Cedar’s policy structure enables access requests to be decided quickly. Cedar’s policy validator leverages optional typing to help policy writers avoid mistakes, but not get in their way. Cedar’s design has been finely balanced to allow for a sound and complete logical encoding, which enables precise policy analysis, e.g., to ensure that when refactoring a set of policies, the authorized permissions do not change. We have modeled Cedar in the Lean programming language, and used Lean’s proof assistant to prove important properties of Cedar’s design. We have implemented Cedar in Rust, and released it open-source. Comparing Cedar to two open-source languages, OpenFGA and Rego, we find (subjectively) that Cedar has equally or more readable policies, but (objectively) performs far better.

A secure framework for effective workload resource management

An efficient and dynamic role-based access-control (RBAC) model is presented in this work which utilizes access-control for internet of things (IoT) nodes while minimizing storage and computational overhead. Also, for the identification of the malicious packets at the gateway server, a machine learning method has been presented. In addition, a framework for data management techniques in the IoT environment is designed to ensure efficient and secure storage, management, and processing of IoT data. The results have been evaluated by using the Montage and Cybershake workload in terms of energy consumption, processing time, detection accuracy and misclassification rate. The results show that the proposed secure framework for effective workload resource management (SFE-WRM) attains better performance in comparison to the reliable and energy‐efficient route selection (REERS) and FTA-WRM method. Also, by using the security method, the proposed method provides better security to the IoT nodes during the data aggregation and processing of the workload. The ultimate aim of this work is to provide a solution for the development of a secure and efficient IoT environment that can address critical security challenges and enable the widespread adoption of IoT devices and services.

Improvement of Permission Management System Based on RBAC(Role-Based Access Control) Model

Improvement of Permission Management System Based on RBAC(Role-Based Access Control) Model

Identity and Access Control Techniques for Enhanced Data Communication in Cloud

The preservation of sensitive data and prevention of unauthorized access are critical objectives in cloud computing environments, necessitating the implementation of robust security measures. The present study delves into the amalgamation of the Hierarchical Role Based Access Control Model (HR-ACM), Composikey, a composite key encryption algorithm, and Interactive Tree Based zero knowledge protocol (ITZKP) to construct a robust security framework for cloud security. This study presents an investigation into the viability and efficacy of integrating HRACM, Composikey, and ITZKP as a means of augmenting security measures and reducing potential hazards in cloudbased systems. The execution times comparison of the Composikey, IBPRE, and KPRE models were compared for different filesizes (1 KB to 2 GB) to evaluate the performance of the HRACM method. As roles increase, RBAC a execution time increases significantly. The HRACM Method takes 0.001 to 0.002 seconds to implement across all role counts. The results show that the HRACM Method is more efficient and time-effective than the RBAC Method. The response time measured in microseconds for the existing ZKP and Libra systems for different file sizes, ranging from 1KB to 1 GB. The results reveal that the verifier time for the ITZKP system aligns closely with the existing systems, demonstrating its ability to perform efficient verification processes. These findings collectively demonstrate the potential of the integrated security framework in enhancing cloud security.

МЕТОДЫ ОБЕСПЕЧЕНИЯ БЕЗОПАСНОСТИ БАЗ ДАННЫХ

The article introduces the main trends in the development of databases that generate new threats regarding their availability, integrity and confidentiality. It provides an overview of literature sources. The article describes modern approaches to the tasks of ensuring the security of database operation. It also determines suitability database protection methods to the potential threats characteristic of them, shows the sources of these threats. Article containes example of corporate information and educational system of the East Kazakhstan University named after S. Amanzholov, where has been implemented such elements of the information security policy as basic security mechanisms (network filtering of information flows, installation of anti-virus software), role-based access control model, mandatory management of granting powers to authorized users, logging of user actions for ensuring the procedure of non-repudiation. At the end, has been formulated recommendations for the expanded use of the metadata mechanism and the improvement of authentication procedures.

Temporal Role Access Control Model for New Power Systems Based on Trust Degree

With the continuous development of information construction in the new power system and the power information network system, users have their own role identities in the corresponding business systems, and access permissions change over time. Traditional access control permanently assigns user roles, which has made the issue of power information security increasingly prominent. This article introduces time constraints in the role-based access control of the new power system. Building on the research of GTRBAC, a trust-based time-constrained role-based access control model for the new power system is proposed. The model’s semantics, execution model, and formal verification are defined.

Role mining under User-Distribution cardinality constraint

Role-based access control (RBAC) defines the methods complex organizations use to assign their users permissions for accessing restricted resources. RBAC assigns users to roles, where roles determine the resources each user can access. The definition of roles, especially when there is a large number of users and many resources to handle, can be a very difficult and time consuming task. The class of tools and methodologies to elicit roles starting from existing user-permission assignments are referred to as role mining. Sometimes, to let the RBAC model be directly deployable in organizations, role mining can also take into account various constraints, like cardinality and separation of duty. Typically, these constraints are enforced to ease roles’ management and their use is justified as role administration becomes convenient. In this paper, we focus on the User-Distribution cardinality constraint which places a restriction the number of users that can be assigned to a given role. In this scenario, we present a simple heuristic that improves over the state-of-the-art. Furthermore, to address a more realistic situation, we provide the User-Distribution model with the additional constraint that avoids the generation of roles sharing identical set of permissions. Similarly, within this context, we describe a heuristic enabling the computation of a solution in the new model. Additionally, we assess both heuristics’ performances using real-world datasets.

Hybrid Approaches (ABAC and RBAC) Toward Secure Access Control in Smart Home IoT

Smart homes are interconnected homes in which a wide variety of digital devices with limited resources communicate with multiple users and among themselves using multiple protocols. The deployment of resource-limited devices and the use of a wide range of technologies expand the attack surface and position the smart home as a target for many potential security threats. Access control is among the top security challenges in smart home IoT. Several access control models have been developed or adapted for IoT in general, with a few specifically designed for the smart home IoT domain. Most of these models are built on the role-based access control (RBAC) model or the attribute-based access control (ABAC) model. However, recently some researchers demonstrated that the need arises for a hybrid model combining ABAC and RBAC, thereby incorporating the benefits of both models to better meet IoT access control challenges in general and smart homes requirements in particular. In this paper, we used two approaches to develop two different hybrid models for smart home IoT. We followed a role-centric approach and an attribute-centric approach to develop HyBAC <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$_{RC}$</tex-math></inline-formula> and HyBAC <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$_{AC}$</tex-math></inline-formula> , respectively. We formally define these models and illustrate their features through a use case scenario demonstration. We further provide a proof-of-concept implementation for each model in Amazon Web Services (AWS) IoT platform. Finally, we conduct a theoretical comparison between the two models proposed in this paper in addition to the EGRBAC model (RBAC model for smart home IoT) and HABAC model (ABAC model for smart home IoT), which were previously developed to meet smart homes' challenges.

Blockchain-Based Secure Smart Health IoT solution Using RBAC Architecture

The revolution of Internet technology, which led to connecting everything through the World Wide Web, the Internet of Things (IoT) emerged to serve this need. IoT technology connects different devices, hardware, and software together, which are created to provide services and facilitate human life. The most critical application is in the health sector, where data privacy, security, and accessibility are demanding and agonizing challenges. In this paper, we use a block chain (BC) model that enforces the Role-Based Access Control (RBAC) model to address privacy and security concerns as well as the limited nature of IoT devices. The paper's concept is to divide the network according to the assigned role, and authentication and data transfer are thoroughly discussed. The Architecture of the proposed system is shown and displayed in flowcharts, where each node has different permissions and privileges. In the experimental part, two scenarios are applied; one where the network (IoT devices) is connected through an MQTT broker as an intermediary, and the second with BC that controls the IoT, which uses proof of assignment as a consensus model. The data flow shows that with BC, the network is much more secure and holds the privacy and integrity of the data.

Improved Private Data Protection Scheme for Blockchain Smart Contracts

Data security and privacy protection are critical challenges that constrain the advancement of edge computing. Similarly, blockchain technology faces constraints in addressing security issues linked with edge computing due to its scalability limitations. To tackle these challenges and promote the development of blockchain technology, this paper presents a scheme that enhances privacy data protection in blockchain smart contracts using edge computing and a master-slave multichain architecture. Firstly, we propose a master-slave multichain architecture based on the traditional single chain and integrate it with a three-layer edge computing structure to address security issues on the edge side. We also design a signature authentication scheme utilizing ECC integrated with blockchain encryption technology. Secondly, we incorporate the role-based access control (RBAC) model with smart contracts to finely divide user privileges, construct an interdomain role-based access control (ID-RBAC) model, and provide detailed access authentication process designs for both within and between domains. Finally, experimental results demonstrate that our proposed scheme can effectively resist various attacks, significantly improve algorithm efficiency, and maintain a system overhead of less than 160 p, with a maximum transaction throughput of nearly 310 tx/s.

NDN-RBE: An Accountable Privacy Aware Access Control Framework For NDN

Abstract Named Data Networking (NDN) is an emerging network architecture. An important characteristic of NDN is its in-network cache, which enables Data packets to be available from multiple locations on the Internet. Hence the enforcement of access control mechanisms becomes even more critical in the NDN. This paper proposes a novel access control scheme referred to as Role-Based Encryption for NDN (NDN-RBE), which uses a broadcast encryption mechanism to achieve secure data access control. Our scheme uses the role inheritance property of the traditional Role-Based Access Control (RBAC) model to achieve efficient data access control over hierarchical content. This makes our scheme particularly suitable for large-scale real-world content-centric services like Netflix. Our scheme also supports additional design features such as anonymous signature-based authentication, batch signature verification and two types of privilege revocations. In addition, our formal security analysis demonstrates that our scheme is provably secure against Chosen Plaintext Attacks. Our performance and functionality comparison show that our scheme outperforms other notable existing works in terms of security, functionality, computation, communication and storage overhead. Furthermore, our experimental results show an improvement in content delivery time of the order of 15 percent compared with the other closely related works.

A Blockchain-Based Trustworthy Model Evaluation Framework for Deep Learning and Its Application in Moving Object Segmentation.

Model evaluation is critical in deep learning. However, the traditional model evaluation approach is susceptible to issues of untrustworthiness, including insecure data and model sharing, insecure model training, incorrect model evaluation, centralized model evaluation, and evaluation results that can be tampered easily. To minimize these untrustworthiness issues, this paper proposes a blockchain-based model evaluation framework. The framework consists of an access control layer, a storage layer, a model training layer, and a model evaluation layer. The access control layer facilitates secure resource sharing. To achieve fine-grained and flexible access control, an attribute-based access control model combining the idea of a role-based access control model is adopted. A smart contract is designed to manage the access control policies stored in the blockchain ledger. The storage layer ensures efficient and secure storage of resources. Resource files are stored in the IPFS, with the encrypted results of their index addresses recorded in the blockchain ledger. Another smart contract is designed to achieve decentralized and efficient management of resource records. The model training layer performs training on users' servers, and, to ensure security, the training data must have records in the blockchain. The model evaluation layer utilizes the recorded data to evaluate the recorded models. A method in the smart contract of the storage layer is designed to enable evaluation, with scores automatically uploaded as a resource attribute. The proposed framework is applied to deep learning-based motion object segmentation, demonstrating its key functionalities. Furthermore, we validated the storage strategy adopted by the framework, and the trustworthiness of the framework is also analyzed.

Design and Implementation of the Zero Trust Model in the Power Internet of Things

As a novel network security scheme, the zero trust model can effectively improve the traditional role-based access control model in the public network by continuous trust evaluation and dynamic authorization. As a private network for collecting the health status data of the power equipment, the terminals in the power Internet of Things (IoT) have the characteristics of fixed and controllable hardware, software, and users, and the main network security threat of the power IoT comes from the risk of terminals being damaged or forged. Therefore, based on the analysis of the key connotation of the zero trust and the security characteristics of the power IoT, this paper proposes a novel zero trust model and framework to synthetically evaluate the security status of the power IoT based on the behaviour and characteristics of the terminals. The analysis based on the stochastic Petri net and simulation results show that the proposed model can effectively address network security problems and significantly improve the level of security protection of the power IoT.

Concept of Joint Functioning of Access Control Systems

Modern integrated information and telecommunication systems are upgraded on a continuous basis. Such systems contain both new and old components. The approaches to developing individual components of access control systems are different in the majority of cases. As a rule, modernization of outdated but efficient systems that have been operating without any failures for long periods of time is economically unfeasible. Such an approach requires that different subsystems function based on shared data. This necessitates the coordination of various access control systems in order to ensure proper information security levels. This article examines how joint functioning of various versions of access control systems deployed in IT and telecommunication spheres may be achieved at the stage of their modernization. Potential ways in which information flows may bypass the security policies of one of the access control systems concerned are determined. The authors discuss traditional access control models. For role-based and thematic access control models, specific hypotheses are formulated to comply with security policies when different versions of access control systems work together. The structure of the model assuming that different versions of access control systems operate jointly has been developed. Based on the model, the necessary and sufficient conditions are determined under which unauthorized information flows are prevented. The security theorem for the joint functioning of different versions of access control systems is presented and proved. The results of the study showed that the methodological basis for coordinating access control models applicable to information and telecommunication systems undergoing modernization consists in observing, separately, the equality of information flows between shared objects in each of the versions of the access control systems. The approaches developed in this article can be extended to combined access control systems.

Multi-domain authorization and decision-making method of access control in the edge environment

The problem of mutual trust between users and edge nodes in an edge computing environment is a sufficient guarantee for the double security of edge computing service users and service providers. How to achieve the user's security and credibility and ensure the trust of the edge service nodes is a serious challenge facing the security of edge computing. Therefore, the research target of this paper is to establish the mutual trust relationship between users and edge service nodes and to formulate dynamic access control strategies. While realizing user security and trustworthiness in the edge environment, it also ensures the trustworthiness of service nodes. The research content of this paper is the access control model of mutual trust between nodes and users in the edge computing environment. This model closely combines trust management with the RBAC (Role Based Access Control) model. Given the multi-domain characteristics of the edge computing environment, the intra-domain access control and cross-domain access control strategies based on mutual trust are implemented, which realizes the improvement and expansion of the RBAC model in the edge computing environment. The performance of EUSMTM is compared and analyzed through simulation experiments, and the validity of the trust model between users and edge servers is verified. Then through the comparative experiment of two-way trust and one-way trust between edge users and edge servers, the advantages of access control based on two-way trust in the EUSMTM model are analyzed.

FORMAL DECISION MODELING FOR ROLE-BASED ACCESS CONTROL POLICIES

Role-Based Access Control (RBAC) has been widely used in information systems, including so-called critical systems. In business, workflows are used to control the flow of processes. One of the major issues concerning these processes is to be able to verify that a proposed process model strictly corresponds to the specifications to which it is supposed to respond. Access control models describe the frameworks that dictate permissions. The RBAC model is generally static, i.e. the access control decisions are: grant or deny. Dynamic and flexible access control is required. In order to increase the flexibility of access control, the notion of decision has been proposed. Decisions execute the requirements to be fulfilled. The main of this article is to use the decision to produce a dynamic model. Our model augments the dynamics of the RBAC model. It allows dynamically assigning permissions. For illustration, Feather's meeting management system is used. Finally, first-order logic is used to analyze the validity of the proposed model.

DRBAC-Healthchain (DRBAC-HC): Decentralized Role Based Access Control Framework For Achieving Security And Privacy Using Blockchain In Healthcare System

With the Internet of Things' (IoTs) rapid expansion, effect, and potential, the healthcare industry is shifting to a new paradigm that permits wearable devices to collect patient medical data and use it for monitoring and diagnosis. Tamper-proof data and avoidance of the centralized record-keeping mechanism are crucial requirements in any wellness system due to its exigent and precise necessity of data requests. Along with the same, transactions’ auditability and revocation of access rights upon certain records for specific stakeholders are also a few of the other prerequisites in the medical segment. Blockchain, as a distributed ledger, offers a solution for securely storing data while providing transparency in transactions and interactions among stakeholders. Synchronous interaction among patient, doctor, pharmacy, consultant, hospital, etc. with all possible data security is another concern that could be resolved through the usage of Blockchain’s smart contracts wherein interaction among these stakeholders is permitted in a traceable and irreversible mode. The purpose of this paper is to discuss the potential use of Blockchain technology in the healthcare sector to achieve data security, transparency, and reliability without the involvement of a trusted third party. In terms of security and privacy, we survey and provide an exhaustive review of Blockchain-based access control systems for the healthcare system. In addition, for the healthcare system, we propose and implemented a decentralized role-based access control model based on Ethereum smart contract.

Post-Quantum Cryptographic Access Control Based on Hierarchical RBAC Model

The paper considers the isogeny-based cryptographically enforced data access control scheme CSIDH-HRBAC for untrusted cloud. CSIDH-HRBAC is based on a role-based access control model with support for a role hierarchy system. The proposed scheme implies the presence of a trusted party that manages cryptographic keys associated with users, roles, files. The basic procedures for gaining access to data, revoking access rights, adding new entities and updating parameters are given. Typical scenarios of attacks on the proposed scheme are considered, including role substitution, collusion by participants to compute the parent role key, attempt to access data after role revocation from user. To evaluate the performance of cryptographic operations, the simulation of the basic procedures was performed. The advantages and limitations of the CSIDH-HRBAC scheme are discussed. In particular, the need for protection against threats from the administrator, the prospect of using lattice-based post-quantum cryptographic primitives is noted.

A framework for privacy-aware and secure decentralized data storage

Blockchain technology gained popularity thanks to its decentralized and transparent features. However, it suffers from a lack of privacy as it stores data publicly and has difficulty to handle data updates due to its main feature known as immutability. In this paper, we propose a decentralized data storage and access framework that combines blockchain technology with Distributed Hash Table (DHT), a role-based access control model, and multiple encryption mechanisms. Our framework stores metadata and DHT keys on the blockchain, while encrypted data is managed on the DHT, which enables data owners to control their data. It allows authorized actors to store and read their data in a decentralized storage system. We design REST APIs to ensure interoperability over the Web. Concerning data updates, we propose a pointer system that allows data owners to access their update history, which solves the issue of data updates while preserving the benefits of using the blockchain. We illustrate our solution with a wood supply chain use case and propose a traceability algorithm that allows the actors of the wood supply chain to trace the data and verify product origin. Our framework design allows authorized users to access the data and protects data against linking, eavesdropping, spoofing, and modification attacks. Moreover, we provide a proof-of-concept implementation, security and privacy analysis, and evaluation for time consumption and scalability. The experimental results demonstrate the feasibility, security, privacy, and scalability of the proposed solution.

A novel system for medical equipment supply chain traceability based on alliance chain and attribute and role access control

With the increasing sales of the medical device market, the medical incidents caused by passive medical devices are increasing, which needs to be solved from the medical device supply chain. In addition, there are complex rights retrieval and assignment problems in the medical device supply chain system, and the traditional Role-based Access Control (RBAC) model is no longer suitable for the actual application environment of the supply chain.This article combines the traditional RBAC model and the Attribute-based Access Control (ABAC) model for access control management in the medical device supply chain to overcome the limitations abovementioned, taking advantage of the ABAC model’s flexibility to achieve granular and dynamic management of permissions, as also the RBAC model to simplify the permissions management of the entire system. Blockchain technology’s traceability, non-tampering, and decentralization features are essential to eliminate passive and inferior medical equipment sales activities, solving the problem of mutual mistrust and ‘Information Silo’ between the two sides of medical device transactions. The access control model is implemented in the blockchain’s smart contract, providing granular and dynamic authority management for the medical equipment supply chain and guaranteeing the security and privacy of medical device information in the supply chain. Three smart contracts on Hyperledger Fabric are designed for device management information, storage of implemented access control models, and implementation of access control policies. Experimental results show that the entire system is stable, ensuring high throughput and high security and promising.