Role-based Access Control Research Articles

Designing a Robust Security Framework for Safeguarding Cloud Computing Environments in the Age of Cyber Threats

As online threats grow, it is very important to keep cloud computer settings safe. This paper suggests a complete security system that will keep cloud platforms and data safe from different threats. To make a multi-layered defense system, the framework combines a number of important parts, such as encryption methods, access control systems, and intruder detection systems. Strong encryption methods, like AES (Advanced Encryption Standard) and RSA (Rivest-Shamir-Adleman), are at the heart of the system. They protect the privacy and security of data. Strong key management techniques go along with these methods to keep encryption keys safe and stop people from getting in without permission. Based on the principle of least privilege, access control methods are very important for making sure that only the right people can use resources. Tough access rules are put in place with role-based access control (RBAC) and attribute-based access control (ABAC). In addition, the framework has an intrusion detection system (IDS) that constantly checks cloud settings for any strange activity. Machine learning techniques are used by the IDS to find and stop possible threats in real time. This security strategy covers all aspects of protecting cloud computing settings and adapts to the changing nature of cyber dangers. By using this framework, businesses can make their cloud systems safer and keep private data safe from threats and people who aren't supposed to see it.

Enhanced Adaptable and Distributed Access Control Decision Making Model Based on Machine Learning for Policy Conflict Resolution in BYOD Environment

Organisations are adopting new IT strategies such as “Bring Your Own Device” (BYOD) and remote working. These trends are highly beneficial both for enterprise owners and employees in terms of increased productivity and reduced costs. However, security issues such as unauthorised access as well as privacy concerns pose significant obstacles. These can be overcome by adopting access control techniques and a dynamic security and privacy policy that governs these issues where they arise. Policy decision points in traditional access control systems, such as role-based access control (RBAC), attribute-based access control (ABAC), or relationship-based access control (ReBAC), may be limited because the status of access control can vary in response to minor changes in user and resource properties. As a result, system administrators rely on a solution for constructing complex rules with many conditions and permissions for decision control. This results in access control issues, including policy conflicts, decision-making bottlenecks, delayed access response times and mediocre performance. This paper proposes a policy decision-making and access control-based supervised learning algorithm. The algorithm enhances policy decision points (PDPs). This is achieved by transforming the PDP’s problem into a binary classification for security access control that either grants or denies access requests. Also, a vector decision classifier based on the supervised machine learning algorithm is developed to generate an accurate, effective, distributed and dynamic policy decision point (PDP). Performance was evaluated using the Kaggle-Amazon access control policy dataset, which compared the effectiveness of the proposed mechanism to previous research benchmarks in terms of performance, time and flexibility. The proposed solution obtains a high level of privacy for access control policies because the PDP does not communicate directly with the policy administration point (PAP). In conclusion, PDP-based ML generates accurate decisions and can simultaneously fulfill multiple massive policies and huge access requests with 95% Accuracy in a short response time of around 0.15 s without policy conflicts. Access control security is improved by making it dynamic, adaptable, flexible and distributed.

Fortidrop: Cloud-based secure file-sharing tool using Cryptography

The increasing prevalence of data breaches and cyber risks has made secure file sharing a crucial requirement in today's digital world. A cloud- based file-sharing solution has been developed, employing various cryptographic techniques to address this. This tool ensures the secrecy, integrity, and authenticity of shared files. It utilizes symmetric encryption to encrypt file contents, allowing only authorized users with the decryption key to access the file. Asymmetric encryption is used to securely share the decryption key, while digital signatures verify the integrity and authenticity of transferred files. Robust authentication technologies, such as multi-factor authentication, and role-based access control are implemented to ensure authorized user access and manage permissions. End-to-end encryption further enhances security by encrypting files on the sender's device and decrypting them on the recipient's device without intermediary server involvement. This technology significantly improves the security and privacy of shared files, reducing the risk of data breaches and unauthorized access. Keywords - Cyber Security, File Sharing, MFA Cryptography, Symmetric Encryption, Cloud Computing

Architecture-based attack propagation and variation analysis for identifying confidentiality issues in Industry 4.0

AbstractExchanging data between entities is an essential part of Industry 4.0. However, the data exchange should not affect the confidentiality. Therefore, data should only be shared with the intended entities. In exceptional scenarios, it is unclear whether data should be shared or not and what the impact of the access decision is. Runtime access control systems such as role-based access control often do not consider the impact on the overall confidentiality. Static design-time analyses often provide this information. We use architectural design-time analyses together with an uncertainty variation metamodel mitigating uncertainty to calculate impact properties of attack paths. Runtime access control approaches can then use this information to support the access control decision. We evaluated our approach on four case studies based on real-world examples and research cases.

Authorization Recycling in Attribute-Based Access Control

In most access control scenarios, the communication between the PDP (policy decision point) and the PEP (policy enforcement point) can cause high authorization overhead. Authorization recycling enables PEP to use the previous access control decisions fetched from the PDP to handle some upcoming access control requests, reduce authorization costs, and increase the efficiency of access control decision-making. Inspired by the RBAC (role-based access control) authorization recycling mechanism, this article first presents an ABAC (attribute-based access control) model based on Boolean expressions of subject and object attributes. It then proposes an authorization recycling approach for this model. In this approach, we provide construction and update methods for authorization data caches and access control decision-making rules for SDP (secondary decision point) by using the caches. The proposed approach can deduce precise and approximate access control decisions from the cache of authorization data, reducing communication between the PEP and the PDP. Finally, the feasibility of the proposed method is verified by conducting a small-scale test. ABAC, SDP, authorization recycling, and authorization caching.

Dynamic Optimization of Role Concepts for Role-Based Access Control Using Evolutionary Algorithms

To ensure the security of current information systems, role-based access control (RBAC) is a widely used concept. For this purpose, based on an initial assignment of permissions to users, permissions are grouped to roles, which are then assigned to users. The corresponding (NP-complete) optimization problem, the so-called role mining problem (RMP), aims at finding a minimal set of roles and a corresponding assignment of those roles to users. Previously, the RMP has been considered as a static optimization problem. However, the application of RBAC in real business use cases requires the inclusion of dynamically occurring events that reflect changes in the business environment of companies, as well as events that result from direct user interaction with the role mining process. Therefore, in this paper, we provide a comprehensive overview and classification of the most relevant events for role mining and present methods for integrating them into the framework of an evolutionary role mining algorithm. The functional performance of these methods as well as the overall performance gain of dynamic role mining compared to the static approach is then examined in a series of experiments.

A Role-Based Encryption (RBE) Scheme for Securing Outsourced Cloud Data in a Multi-Organization Context

Role-Based Encryption (RBE) is an emerging new technique that integrates role based access control (RBAC) model with encryption. RBE embeds RBAC access policies in encrypted data itself so that only users belonging to appropriate roles are able to decrypt and access the data. However, the existing RBE schemes have been focusing on the single-organization cloud storage system, where the stored data can be accessed by users of the same organization. This paper presents a novel RBE scheme with efficient user revocation for the multi-organization cloud storage system, where the data from multiple independent organizations are stored and can be accessed by the authorized users from any other organization. Additionally, an outsourced decryption mechanism is introduced which enables the users to delegate expensive cryptographic operations to the cloud, thereby reducing the overhead on the end-users. Security and performance analyses of the proposed scheme demonstrate that it is provably secure against Chosen Plaintext Attack and can be useful for practical applications due to its low computation overhead.

A Multi-Blockchain-Based Cross-Domain Authentication and Authorization Scheme for Energy Internet

The expansion of the scale of the Power Internet of Things stimulated by the development of the Energy Internet makes the growth in demand for the effective authentication and access control technologies in the cross-domain data exchange. Based on the cross-chain technology of the blockchain and the cuckoo filter, this paper proposes a cross-domain authentication scheme for Power Internet of Things. Firstly, a cross-chain authentication architecture is established. Combined with the existing authentication technologies used in intra-domain authentication, a cross-domain authentication process based on the cross-chain technology is proposed to realize the automatic transmission of the authentication credentials from application domain to authentication domain. The cuckoo filter is deployed on the blockchain as smart contracts, and the user certificate fingerprint is inserted into the filter to realize user registration, query, and revocation, which reduces the cost of the user certificate management. Experimental results show the effectiveness and feasibility of our scheme. Based on the proposed authentication scheme, a cross-domain access control scheme based on roles and object classes is presented, by treating the object classes as controlled objects and then applying the role-based access control to the object classes, on the condition that the heterogeneous domains in the Energy Internet have the same kinds of resources.

Application of Data Collected by Endpoint Detection and Response Systems for Implementation of a Network Security System based on Zero Trust Principles and the EigenTrust Algorithm

Traditionally, security systems for enterprises have implicit access based on strong cryptography, authentication and key sharing, wherein access control is based on Role Based Access Control (RBAC), in which roles such as manager, accountant and so on provide a way of deciding a subject's authority. However, years of post-attack analysis on enterprise networks has shown that a majority of times, security breaches occur intentionally or accidently due to implicitly trusted people of an enterprise itself. Zero Trust Architecture works on the principle of never granting trust implicitly, but rather continuously evaluating the trust parameters for each resource access request and has a strict, but not rigid, set of protocols for access control of a subject to resources. Endpoint Detection and Response (EDR) systems are tools that collect a large number of attributes in and around machines within an enterprise network to have close visibility into sophisticated intrusion. In our work, we seek to deploy EDR systems and build trust algorithms using tactical provenance analysis, threshold cryptography and reputation management to continuously record data, evaluate trust of a subject, and simultaneously analyze them against a database of known threat vectors to provide conditional access control. However, EDR tools generate a high volume of data that leads to false alarms, misdetections and correspondingly a high backlog of tasks that makes it infeasible, which is addressed using tactical provenance analysis and information theory.

Secure Role Based Access Control Data Sharing Approach and Cloud Environment

the primary objective of cloud storage is to maintain data integrity, which involves implementing measures to prevent unauthorized access and ensuring that data can be regenerated if mishandled. To achieve this, a proxy server will be assigned the task of protecting and restoring data in case of unauthorized modifications. Users' data will be stored in both public and private areas of the cloud, with only public data being accessible to users and private data being kept more secure. Cloud storage offers users various redundancy configurations to balance performance and fault tolerance, with data availability being critical in distributed storage systems, especially when node failures are common in real-life scenarios. In this research, a proposed aes 128 encryption algorithm and role-based access control (rbac) scheme are explored to provide secure data storage and sharing, as well as a secure user access policy. Additionally, a backup server approach is used as a proxy storage server for ad hoc data recovery for all distributed data servers. The experiment's analysis is proposed in both public and private cloud environments, utilizing keywords such as rbac, elgamal encryption scheme, proxy key generation, advanced encryption standard (aes), and more

Design and Implementation of the Zero Trust Model in the Power Internet of Things

As a novel network security scheme, the zero trust model can effectively improve the traditional role-based access control model in the public network by continuous trust evaluation and dynamic authorization. As a private network for collecting the health status data of the power equipment, the terminals in the power Internet of Things (IoT) have the characteristics of fixed and controllable hardware, software, and users, and the main network security threat of the power IoT comes from the risk of terminals being damaged or forged. Therefore, based on the analysis of the key connotation of the zero trust and the security characteristics of the power IoT, this paper proposes a novel zero trust model and framework to synthetically evaluate the security status of the power IoT based on the behaviour and characteristics of the terminals. The analysis based on the stochastic Petri net and simulation results show that the proposed model can effectively address network security problems and significantly improve the level of security protection of the power IoT.

Blockchain-Based Security Configuration Management for ICT Systems

The world has become increasingly dependent on large-scale and distributed information and communication technology (ICT) infrastructures and systems in sectors such as energy, transport, banking, healthcare, water supply, and digital services, while their protection is considered of paramount importance and has already drawn remarkable attention from governments and key industry players. Establishing common approaches by leveraging existing frameworks and cyber security practices for improving the security postures of those systems is one of the major objectives for ensuring an adequate level of protection and avoiding the detrimental effects of disruptions on society and citizens. Configuration management (CM) is one of those common practices for establishing and maintaining the integrity and consistency of a system and its elements with regard to the function, performance, and status of technical and physical attributes, and it contributes to a desirable security posture throughout the lifecycle of a system. This study addresses the importance of CM, and while considering the corresponding frameworks, standards, and best practices, it proposes a permissioned blockchain-based approach, that inherits the benefits of the blockchain technology and ensures the integrity of the systems’ configuration across the complete lifecycle management of its products and services as an underlying model for mapping and integrating CM functions. Furthermore, this study briefly presents the benefits and challenges of the application of permissioned blockchain models and proposes a smart-contract-based role-based access control mechanism, in addition to presenting an operating concept based on brief but real-life lifecycle requirements of organizational configuration management.

Efficient Medical Data Transmission in Mobile Hospital Systems with Wireless Body Area Network

Wireless Body Area Networks (WBANs) are expected to play a major role in the field of patient- health monitoring shortly. One of the challenges is to establish secure communication architecture between sensors and users, whilst addressing the prevalent security and privacy concerns. In this paper, we propose communication architecture for BANs and design a scheme to secure the data communications between implanted /wearable sensors and the data sink/data consumers (doctors or nurses) by employing Cipher text-Policy Attribute-Based Encryption (CP-ABE) and signature to store the data in cipher text format at the data sink, hence ensuring data security. Our scheme achieves a role-based access control by employing an access control tree defined by the attributes of the data. We also design two protocols to securely retrieve the sensitive data from a BAN and instruct the sensors in a BAN. We analyze the proposed scheme and argue that it provides message authenticity and collusion resistance, and is efficient and feasible. We also evaluate its performance in terms of energy consumption and communication/computation overhead. Keywords: Wireless Body Area Networks, Encryption, data sink, secure data communication.

Concept of Joint Functioning of Access Control Systems

Modern integrated information and telecommunication systems are upgraded on a continuous basis. Such systems contain both new and old components. The approaches to developing individual components of access control systems are different in the majority of cases. As a rule, modernization of outdated but efficient systems that have been operating without any failures for long periods of time is economically unfeasible. Such an approach requires that different subsystems function based on shared data. This necessitates the coordination of various access control systems in order to ensure proper information security levels. This article examines how joint functioning of various versions of access control systems deployed in IT and telecommunication spheres may be achieved at the stage of their modernization. Potential ways in which information flows may bypass the security policies of one of the access control systems concerned are determined. The authors discuss traditional access control models. For role-based and thematic access control models, specific hypotheses are formulated to comply with security policies when different versions of access control systems work together. The structure of the model assuming that different versions of access control systems operate jointly has been developed. Based on the model, the necessary and sufficient conditions are determined under which unauthorized information flows are prevented. The security theorem for the joint functioning of different versions of access control systems is presented and proved. The results of the study showed that the methodological basis for coordinating access control models applicable to information and telecommunication systems undergoing modernization consists in observing, separately, the equality of information flows between shared objects in each of the versions of the access control systems. The approaches developed in this article can be extended to combined access control systems.

Securing Your Applications with Role-Based Access Control in SAP BTP Cockpit

In today’s interconnected digital landscape, securing applications and data against cyber threats is paramount. SAP Business Technology Platform (BTP) offers a robust solution for managing cloud applications, and at its core lies the SAP BTP Cockpit, a centralized hub for application management and monitoring. This white paper delves into the significance of role-based access control (RBAC) in SAP BTP Cockpit, elucidating its role in safeguarding applications and data, and providing insights into best practices for implementing RBAC effectively.

End-to-End Database Software Security

End-to-end security is essential for relational database software. Most database management software provide data protection at the server side and in transit, but data are no longer protected once they arrive at the client software. In this paper, we present a methodology that, in addition to server-side security, protects data in transit and at rest on the application client side. Our solution enables flexible attribute-based and role-based access control, such that, for a given role or user with a given set of attributes, access can be granted to a relation, a column, or even to a particular data cell of the relation, depending on the data content. Our attribute-based access control model considers the client’s attributes, such as versions of the operating system and the web browser, as well as type of the client’s device. The solution supports decentralized data access and peer-to-peer data sharing in the form of an encrypted and digitally signed spreadsheet container that stores data retrieved by SQL queries from a database, along with data privileges. For extra security, keys for data encryption and decryption are generated on the fly. We show that our solution is successfully integrated with the PostgreSQL® database management system and enables more flexible access control for added security.

Multi-domain authorization and decision-making method of access control in the edge environment

The problem of mutual trust between users and edge nodes in an edge computing environment is a sufficient guarantee for the double security of edge computing service users and service providers. How to achieve the user's security and credibility and ensure the trust of the edge service nodes is a serious challenge facing the security of edge computing. Therefore, the research target of this paper is to establish the mutual trust relationship between users and edge service nodes and to formulate dynamic access control strategies. While realizing user security and trustworthiness in the edge environment, it also ensures the trustworthiness of service nodes. The research content of this paper is the access control model of mutual trust between nodes and users in the edge computing environment. This model closely combines trust management with the RBAC (Role Based Access Control) model. Given the multi-domain characteristics of the edge computing environment, the intra-domain access control and cross-domain access control strategies based on mutual trust are implemented, which realizes the improvement and expansion of the RBAC model in the edge computing environment. The performance of EUSMTM is compared and analyzed through simulation experiments, and the validity of the trust model between users and edge servers is verified. Then through the comparative experiment of two-way trust and one-way trust between edge users and edge servers, the advantages of access control based on two-way trust in the EUSMTM model are analyzed.

FORMAL DECISION MODELING FOR ROLE-BASED ACCESS CONTROL POLICIES

Role-Based Access Control (RBAC) has been widely used in information systems, including so-called critical systems. In business, workflows are used to control the flow of processes. One of the major issues concerning these processes is to be able to verify that a proposed process model strictly corresponds to the specifications to which it is supposed to respond. Access control models describe the frameworks that dictate permissions. The RBAC model is generally static, i.e. the access control decisions are: grant or deny. Dynamic and flexible access control is required. In order to increase the flexibility of access control, the notion of decision has been proposed. Decisions execute the requirements to be fulfilled. The main of this article is to use the decision to produce a dynamic model. Our model augments the dynamics of the RBAC model. It allows dynamically assigning permissions. For illustration, Feather's meeting management system is used. Finally, first-order logic is used to analyze the validity of the proposed model.

DRBAC-Healthchain (DRBAC-HC): Decentralized Role Based Access Control Framework For Achieving Security And Privacy Using Blockchain In Healthcare System

With the Internet of Things' (IoTs) rapid expansion, effect, and potential, the healthcare industry is shifting to a new paradigm that permits wearable devices to collect patient medical data and use it for monitoring and diagnosis. Tamper-proof data and avoidance of the centralized record-keeping mechanism are crucial requirements in any wellness system due to its exigent and precise necessity of data requests. Along with the same, transactions’ auditability and revocation of access rights upon certain records for specific stakeholders are also a few of the other prerequisites in the medical segment. Blockchain, as a distributed ledger, offers a solution for securely storing data while providing transparency in transactions and interactions among stakeholders. Synchronous interaction among patient, doctor, pharmacy, consultant, hospital, etc. with all possible data security is another concern that could be resolved through the usage of Blockchain’s smart contracts wherein interaction among these stakeholders is permitted in a traceable and irreversible mode. The purpose of this paper is to discuss the potential use of Blockchain technology in the healthcare sector to achieve data security, transparency, and reliability without the involvement of a trusted third party. In terms of security and privacy, we survey and provide an exhaustive review of Blockchain-based access control systems for the healthcare system. In addition, for the healthcare system, we propose and implemented a decentralized role-based access control model based on Ethereum smart contract.

Towards for Designing Educational System Using Role-Based Access Control

Towards for Designing Educational System Using Role-Based Access Control