Secure Access Control Mechanism Research Articles

DCapBAC: embedding authorization logic into smart things through ECC optimizations

In recent years, the increasing development of wireless communication technologies and IPv6 is enabling a seamless integration of smart objects into the Internet infrastructure. This extension of technology to common environments demands greater security restrictions, since any unexpected information leakage or illegitimate access to data could present a high impact in our lives. Additionally, the application of standard security and access control mechanisms to these emerging ecosystems has to face new challenges due to the inherent nature and constraints of devices and networks which make up this novel landscape. While these challenges have been usually addressed by centralized approaches, in this work we present a set of Elliptic Curve Cryptography optimizations for point and field arithmetic which are used in the design and implementation of a security and capability-based access control mechanism (DCapBAC) on smart objects. Our integral solution is based on a lightweight and flexible design that allows this functionality is embedded on resource-constrained devices, providing the advantages of a distributed security approach for Internet of Things (IoT) in terms of scalability, interoperability and end-to-end security. Additionally, our scheme has been successfully validated by using AVISPA tool and implemented on a real scenario over the Jennic/NXP JN5148 chipset based on a 32-bit RISC CPU. The results demonstrate the feasibility of our work and show DCapBAC as a promising approach to be considered as security solution for IoT scenarios.

안전한 보안 감시 시스템을 위한 효율적인 접근 제어 기법

사회 안전 서비스 제공을 위한 보안 감시 시스템이 보편화되어, 보안 감시 시스템에 대한 접근성이 확대되고, 향상되는 만큼 안정성 확보를 위한 접근제어 기법이 요구된다. ONVIF(Open Network Video Interface Forum)에서 제정하는 표준은 보안 감시용 스마트 카메라의 호환성을 목적으로 만든 표준으로, 클라이언트에게 제공될 웹서비스의 프레임워크를 정의하고 있다. 본 논문에서는 ONVIF 표준을 따르는 보안 감시 카메라 네트워크에서 안전한 시스템 접근을 위하여 웹 서비스의 정보 보호 기법을 수용하고, 웹서비스의 안전한 제공을 위한 효율적인 접근 제어 모델을 제안 한다. In recent general social surveillance systems, secure access control mechanism is needed. ONVIF establishes standards for interoperability between cameras and defines web service framework for it. In this paper we present an efficient attribute based access control mechanism for surveillance system networks which follow the ONVIF standards. It accommodates web service information security techniques and provides efficient secure access control.

Design of access control system for telemedicine secure XML documents

XML can supply the standard data type in information exchange format on a lot of data generated in running database or applied programs for a company by using the advantage that it can describe meaningful information directly. Accordingly since there are increasing needs for the efficient management and telemedicine security of the massive volume of XML data, it is necessary to develop a secure access control mechanism for XML. The existing access control has not taken information structures and semantics into full consideration due to the fundamental limitations of HTML. In addition, access control for XML documents allows read operations only, and there are problems of slowing down the system performance due to the complex authorization evaluation process. To resolve this problem, this paper designs and builds a XACS (XML Access Control System), which is capable of making fined-grained access control. This only provides data corresponding to its users' authority levels by authorizing them to access only the specific items of XML documents when they are searching XML documents in telemedicine. To accomplish this, XACS eliminates certain parts of the documents that are inaccessible and transmits the parts accessible depending on the users' authority levels. In addition, it can be expanded to existing web servers because XML documents are used based on the normal web sites. The telemedicine secure and the guidelines are provided to enable quick and precise understanding of the information, and thus the safety enhancement gets improved. Ultimately, this paper suggests an empirical telemedicine application to confirm the adequacy and validity using the proposed method.

A Location-based Secure Access Control Mechanism for Geospatial Data

due to the advancements in spatial data acquisition technologies, data acquisition technologies are producing mass high precision spatial data. To store such high precision data onto the database is a big challenge today. Spatial database is different from relational database as it contains data along with its location, so security concerns of spatial database are also different from relational data. Thus spatial data requires special security policies and implementation of these security policies. In this work, a secure access control mechanism for geospatial data is developed. In this method, security is provided on two levels. In first level, authorization to every user is provided; thus a user can access only that part of spatial database, over which he has authority to access. In second level, access is controlled over an image; based on the location over which a user needs to access data and access is provided only to that part of an image. Keywordspatial data, partial access, geographical information system, location-based, raster file formats

A New Approach for Providing Security Mechanism in Cloud with Possible Solutions and Results

In the field of IT technology, cloud computing is a next big thing in IT market. It is just internet based computing and on demand computing which gives reliability, scalability, availability compared to dedicated infrastructure. The main issues in cloud computing is security, trust and privacy issues. These issues arise at the time of deployment of cloud computing services in public and private cloud. In this paper security and privacy issues are reviewed and gives a proposed mechanism for securing data in cloud and also used Microsoft window azure tools for SACM (security access control mechanism) , and compare the system with SACM tools and NO SACM tools. The implementation result will show that security model is better than using SACM tools. It also defines web hosting in old manner and web hosting in cloud manner. In the future scope we can see multi tenancy security issues in cloud computing.

Implementation and performance analysis of multilevel security system in pervasive computing environment

This paper presents the design and implementation features of Centralized Pervasive Computing Environment/Multilevel Security (CPCE/MLS), a multilevel security (MLS) system in pervasive computing environment deployed in Local area network (LAN) with a Mandatory Access Control (MAC) mechanism. By introducing the server-storage terminals and implementing the multilevel security access control mechanism based on the Bell---LaPadula model, process creation supervision, and an auditing mechanism, the CPCE/MLS system is able to provide the security guarantee of the whole computing environment. As such, each terminal is controlled under an integrated security policy. The performance test results show that the CPCE/MLS system, without optimization, generates great overhead but achieves significantly better performance after the cache mechanism is added in the monitor agent and in the hook driver. The system with the hook driver cache mechanism is able to achieve the 95.9% throughput of the native system with 8 K and 16 K requested data blocksize.

Secure Access Mechanism for Cloud Storage

Emerging storage cloud systems provide continuously available and highly scalable storage services to millions of geographically distributed clients. A secure access control mechanism is a crucial prerequisite for allowing clients to entrust their data to such cloud services. The seamlessly unlimited scale of the cloud and the new usage scenarios that accompany it pose new challenges in the design of such access control systems. In this paper we present a capability-based access control model and architecture appropriate for cloud storage systems that is secure, flexible, and scalable. We introduce new functionalities such as a flexible and dynamic description of resources; an advanced delegation mechanism and support for auditability, accountability and access confinement. The paper details the secure access model, shows how it fits in a scalable storage cloud architecture, and analyzes its security and performance.

Flexible authorisation in dynamic e-business environments using an organisation structure-based access control model

In dynamic e-business and e-manufacturing environments, enterprises require a secure access control mechanism based on an access control model to manage employee authorisations flexibly. This study presents an organisation structure-based access control (OSAC) model based on a task-role-based access control (T-RBAC) model. The OSAC model emphasises that employee authorisations are generated directly based on their position in the enterprise organisational structure. The proposed model extends the concepts of static separation of duty (SSD), dynamic separation of duty (DSD), prerequisite, and cardinality constraints in the role-based access control (RBAC) model to present department and role relations that identify the cooperative interactive relations among roles across department boundaries to facilitate resource sharing among roles and simplify enterprise resource management. Various relations and applied examples are demonstrated using the class model in unified modelling language (UML). Examples of inappropriate use of relations that lead to violation of relation are also presented. To demonstrate the feasibility of the proposed model for most businesses, a case study involving an automobile component producer is presented and an OSAC model-based administrative management system is developed to ensure that appropriate resources can be legally used by the correct employees and at the right time. By applying the proposed model, administrators can easily manage resources based on an organisational structure perspective and the resource sharing capabilities of all departments can be improved.