Temporary Delegation Research Articles

Adaptation of French general practitioners for the management of nursing home patients during COVID-19 in 2020: a multilevel analysis.

To describe French general practioners' (GPs) adaptation strategies to ensure follow-up care of nursing home patients during the first wave of COVID-19 (May 2020) and to identify factors associated with each strategy. A national cross-sectional study was conducted with online questionnaires in May 2020 among GPs practicing in France (metropolitan and overseas) and usually providing nursing home visits before pandemic. The outcome was defined as the GPs' adaptation strategies for managing nursing home patients and was categorized into four groups: Maintenance of Nursing Home Visits NHV (reference), Stopping NHV, Numeric adaptation (teleconsultations only), Mixed adaptation (NHV and teleconsultations). The probability of adaptation strategies was analyzed by multilevel logistic models in which the GPs represented level 1 and the counties level 2. We applied three random-intercept multilevel logistic models with the county of GP's practice as random effect. This analysis included 2,146 responses by GPs coming from 98 French counties. Overall, 40.4% of GPs maintained NHV, while other strategies were: Stopping visits (24.1%), Numeric adaptation (15.4%), Mixed adaptation (20.1%). Several individual (age, training GP, perceived status of being at high risk of severe COVID, compliance with temporary delegation of the patient's management) and territorial factors (excess mortality rate due to COVID-19, GPs' density, proportion of over-75s, presence of reinforcement measures for nursing home patients) were identified as associated with each strategy. This study highlights a rapid adaptation of general practice to keep supporting nursing home patients. Heterogeneity of adaptation strategies could reflect both the lack of national guidelines and the heterogeneity among GPs' usual practices. Policymakers should take actions at a territorial level (subnational) to strengthen support to nursing home patients considering adaptations to the local context of the pandemic outbreak and perspective of local actors.

DFE-IP: Delegatable functional encryption for inner product

Functional encryption for inner product (FE-IP) allows an authorized user to obtain the inner product of the vectors embedded in his/her secret key and a ciphertext, respectively. Therefore, it is an elegant tool to implement secure computation over encrypted data. Existing FE-IP schemes mainly considered security and function privacy issues, but did not address the decryption delegation problem. However, in practice, delegating decryption is desirable when an authorized user is unavailable to access the system due to leaving, network problems, etc.In this paper, a delegatable FE-IP (DFE-IP) scheme is proposed to support decryption delegation. Our scheme provides the following important features: (1) a delegator can delegate his/her decryption power to a delegatee; (2) a proxy is not required to re-encrypt ciphertexts; (3) it supports temporary delegation and flexible revocation. We first formalize our DFE-IP scheme including definition and security model, and then describe a concrete construction. Furthermore, the implementation and evaluation are provided to show its efficiency. Finally, its security is formally proven. The novelty is to implement temporary decryption delegation in FE-IP when authorized users are unavailable to access the system.

LEGAL REGIME OF MARTIAL LAW: THEORETICAL AND METHODOLOGICAL ASPECTS

Theoretical and methodological approaches to determining the essence and content of the legal regime of martial law have been studied. The concept of martial law as a special legal regime is analyzed. The normative-legal interpretation of the concept of «martial law» in national Ukrainian legislation is shown. It is emphasized that martial law in its conceptual meaning is a special, i.e. extraordinary in relation to the normal, everyday conditions of life in society, a legal regime, the purpose of which is to legally ensure the implementation of the defense of the state as its key foreign policy function, which requires the temporary introduction of a number of extraordinary institutional mechanisms and constitutional restrictions, and the main objects of legal protection are state sovereignty and territorial integrity as the highest constitutional values. It was determined that the fundamental importance of martial law as a special legal regime is manifested in the list of extraordinary powers of competent public authorities, because martial law, by its internal legal nature, actually constitutes the organizational and managerial response of the state to the occurrence of an armed threat to its vital interests and the highest constitutional values, that is, it is about an extraordinary event and the extraordinary, special, temporary legal regime corresponding to this event. A comparative comparison of the legislation on the legal regime of martial law of different states was carried out, which made it possible to attribute the following to the classic constitutional-legal restrictions and institutional-functional features: restrictions on freedom of movement; restriction of freedom of assembly; restriction of freedom of speech; limitation of the right to judicial review of cases; restriction of the right to inviolability of property; the possibility of temporary delegation of judicial and executive power to military courts and military command, respectively. It has been proven that with the relatively static nature of the etymological content of the term «martial law» itself, at the same time, in a concrete and historical context, there are quite noticeable changes in the legal regulation of its individual elements. Key words: martial law, constitutional rights, legal restrictions, state defense, act of aggression.

Secure and Temporary Access Delegation With Equality Test for Cloud-Assisted IoV

With the continuous development of the Internet of Vehicles (IoV), the cloud-assisted IoV is becoming an emerging and attractive paradigm, in which a growing number of IoV users use the cloud server to store the data collected from their smart devices, thereby relieving local costs to a great extent. In this case, considering that the third-party cloud as a commercial mechanism cannot guarantee data security, users choose to encrypt their own data before uploading it to the cloud server. Although the privacy and confidentiality of the uploaded data can be protected, the encryption method hinders data search due to its inherent “decrypt all-or-nothing” feature. To achieve encryption and data search on privacy-preserving data, many existing works of literature design various public key encryption with keyword search schemes that, however, suffers the disadvantage that they can work only between ciphertext encrypted under the same public key, which means that it is not suitable for some computations on cloud. Furthermore, most schemes also have failed to find out how to delegate the searched data securely and efficiently when the data owner is not convenient to address the data. Therefore, this study tends to test the equivalence between messages encrypted under different public keys for basic secure computation and delegating the right of decrypting searched data to the specified user. Then, a lightweight proxy re-encryption scheme with the equality test and temporary delegation (PRE-ET-TD) was put forward for the cloud-assisted IoV. Besides, the proposed scheme is collusion-resistant and proven secure against chosen ciphertext attack (CCA) in the random oracle model. Meanwhile, the experimental simulation indicates that the presented PRE-ET-TD is feasible and efficient.

KAPRE: Key-aggregate proxy re-encryption for secure and flexible data sharing in cloud storage

Key-aggregate cryptosystems (KAC) have attracted significant attention from the research community because of their elegance and efficiency in enforcing predefined access control policies for outsourced data. The data owner computes a constant-size aggregate key that is capable of decrypting a subset of outsourced data items. Based on the access control policy, the data owner securely transmits the aggregate key to a user authorized for the corresponding subset of data items. For practical access control scenarios, a KAC needs to satisfy additional flexibility requirements. We propose a practically motivated, novel cryptographic primitive called key-aggregate proxy re-encryption that allows temporary delegation of decryption capabilities of an aggregate key to one or more other aggregate keys without carrying out any secure transmissions. The existing key-aggregate cryptosystems face two important issues in highly dynamic environments, namely the non-revocability of aggregate keys and the need to securely transmit the aggregate key(s) to enhance the access capabilities of the user(s). The proposed key-aggregate proxy re-encryption is a significant enhancement to the existing KACs in that it features temporary delegation of decryption capabilities without needing any secure transmissions for carrying out or revoking the temporary delegation(s). We propose two variants of key-aggregate proxy re-encryption. The first variant delegates decryption capabilities of an aggregate key to a set of aggregate keys and the second variant delegates decryption capabilities of one aggregate key to another unique aggregate key. We present formal security definitions of both the proposed variants of key-aggregate proxy re-encryption under chosen-plaintext and chosen-ciphertext attacks. We present concrete constructions for both the variants of key-aggregate proxy re-encryption and formally prove the chosen-ciphertext security in the random oracle model. Also, we show that both of our constructions satisfy the temporary delegation property. Finally, we analyze the performance of our key-aggregate proxy re-encryption schemes to confirm their practical applicability.

Temporal Context-Based Delegation

ABSTRACTIn this paper, we put forward a dynamic delegation model based on a temporal context. Delegation is the process of granting a specific authorization from a user to another user of the same system to carry out some functions on his behalf. Despite the importance of delegation, it is formalized in very little security policies because of its complexity. Indeed delegation provides resiliency and flexibility regarding the management procedure. Our goal consists of redefining delegation for OrBAC using temporal nonmonotonic description logic. OrBAC is an access control model; it provides the mean to specify contextual authorizations, which facilitates modeling delegation features such as temporary delegation, multiple delegation, revocation, etc. The description logic that we use for the re-formalization process is TDLδε. This logic gives the mean to specify nonmonotonic authorizations and a better representation of the temporal aspects specific to a given delegation. The motivation behind this new representation is to augment the expressivity of the new model to offer a better way to represent and to manage the delegation’s characteristics.

Dynamic Delegation Based on Temporal Context

Delegation is a very important part of the administrative process in access control systems; it provides resiliency and flexibility regarding to the management procedure. Delegation is the process of granting a specific authorization from a user to another user of the same system to carry out some functions on his behalf. The delegation, although widely used, is modeled in very little security policies because of its complexity. In this paper we aim to consider the delegation dynamically based on temporal context, to this end we redefine delegation for OrBAC using temporal nonmonotonic description logic. OrBAC is an access control model; it provides the mean to specify contextual authorizations, which facilitates modeling delegation features such as temporary delegation, multiple delegation, revocation, etc. The description logic that we use for the re-formalization process is T- JClassicδɛ. This logic gives the mean to specify nonmonotonic authorizations, and a better representation of the temporal aspects specific to a given delegation. This new representation augments the expressivity of the model and therefore it facilitates even more the representation and the management of the delegation characteristics.

Comments on “Unidirectional Chosen-Ciphertext Secure Proxy Re-Encryption”

Libert and Vergnaud proposed a unidirectional proxy re-encryption scheme with temporary delegation (IEEE Trans. Inf. Theory, vol. 57, no. 3, pp. 1786-1802, Mar. 2011). They claimed that the scheme is chosen ciphertext secure in the chosen key model. However, their proof has a minor error in the simulation of the re-encryption oracle. The adversary is able to distinguish between the simulated environment and the real attack environment by using responses from the re-encryption oracle. Fortunately, we can amend the proof without any modification of the original scheme.

Validation of Temporary Delegation and Revocation of Roles with UML and OCL

Organizations having a large number of employees face several difficulties to separate job assignments to individual users. The situation becomes more complex when job assignments are delegated to those users who fulfill some explicit conditions. The delegation models developed so far discuss various issues regarding delegation of roles, but no mechanism has been developed to specify and validate constraints which are applied in course of temporary delegating (temporal delegation) and revoking a role to and from a user. This paper proposes a validation mechanism for flexible delegation and revocation of job roles to and from users with specific conditions. Also, we attempt to specify and validate n-level delegation and cascading/non-cascading revocation processes in an organization. I. INTRODUCTION Security has been a major issue in the development of software for networked organizations. As the number of employees of an organization may vary with variable job assignments, therefore it becomes complicated to manage job assignments to various users. To cope with such situations Role Based Access Control Model (RBAC) (1) was proposed for advanced access control as it reduces complexity and cost of security administration in specifically those applications which are networked and are accessed by large number of users with variable job assignments. In various organizations, users have permissions to delegate their job rights to other users at specific time periods with some restrictions. In the same way users can revoke the delegated rights after some time period. Almost all major organizations facilitate their users to delegate their job assignments to other users when work load of users cross certain limits or when the authorized user is unavailable. Therefore, delegation of rights and roles are followed by certain constraints which must be accomplished and only after that, job assignments be delegated to other users. For example, Ahmed delegates task review voucher to Mariam on wednesdays during a staff meeting or Dr. Sohail delegates treat patient task to a nurse when he is at home. The delegation models developed by (3), (4), (5) deal with on delegation of rights to other users, but have not specified any constraint in a formal language which limit temporal delegation of rights of one user to others. Therefore, it is required to develop a mechanism to specify and validate constraints applied on temporary delegation of roles and revocation of roles, that is, for short period of time when the actual user is engaged in some other activity or not available, with the help of a formal language so as to ensure that job assignments are granted and revoked accurately. In this article, we propose a delegation/revocation mechanism with the help of pre conditions and post conditions applied on delegation and revocation methods of an organization. In addition, the reason behind this paper is to specify constraints on delegation in a formal language and validate them with the help of a tool. We use the Unified Modeling language (UML) and the Object Constraint Language (OCL) for the specification of delegation and revocation schemes. We validate the delegation constraints with the help of the USE tool (UML-based specification environment), a validation tool for UML models and OCL constraints (2).

Dynamic authorization scheme based on delegation in distributed system

Concerning the authority in distributed environment for collaboration,a dynamic authorization scheme was presented based on delegation and RBAC model.The scheme supports partial role delegation,by expanding element sets of RBAC model,enlarging static authorization operations,and allowing the delegator to create temporary delegation roles and assign others(the delegatee) to the particular roles.The scheme was implemented by three-level frameworks,and the operating process about how to authorize dynamically in delegation model was described.The application shows that the scheme can adapt to distributed and dynamic environment,and follow the least privilege principle.

가용 시간을 이용한 역할 기반 위임 모델

기존의 RBAC(Role Based Access Control) 모델들은 사용자간의 역할 위임이나 역할 분리를 운용하기에는 역부족이다. 이에 RBAC을 바탕으로 역할이나 권한을 다른 사용자에게 위임하는 모델인 RBDM(Roie Based Delegation Model)이 연구되고 있다. 반면에, 역할을 위임 받은자의 악의적인 남용을 막을 수 있는 방안이 필요하다. 본 논문은 역할의 위임으로 인하여 위임 받은자의 악의적인 도용을 막기 위한 모델로서 위임 역할에 대한 폐지 절차를 시간상으로 제한을 두고, 위임하는 역할에 대하여 원사용자의 권한을 그대로 유지함으로써 위임으로 인한 역할간 계층구조의 보안상 취약점을 보완하고자 한다. 즉, 역할을 위임하고자 할때에는 위임에 대한 유효 기간을 같이 부여하는 기법으로 위임된 역할의 사용 권한을 시간상으로 폐지할 수 있게 한다. 또한, 위임된 역할에 대해서는 원사용자의 역할에 대한 권한을 계속 보유할 수 있도록 함으로써 위임으로 인하여 역할에 대한 사용이 정당하지 않은 경우에는 언제든지 회수가 가능할 수 있게 하였다. 본 제안 기법인 T-RBDM (Time-out based RBDM)은 기존의 위임 모델인 RBDM0, RBDM1, PBDM과 비교 분석함으로 기존의 위임 모델에 비해 보안 측면에서 더 강인함을 보인다. The existing RBAC models are not sufficient for managing delegations or separation of roles. Researches have been done on RBDM(Role Based Delegation Model) that deal with delegating role or permission to other users. In this paper, we divide the delegated roles into two groups: periodic and temporary delegation roles. When a role is delegated, a time period is assigned together, which is used to revoke the permission of delegated role automatically. In our model, the role of monotonic delegation by an original user can be revoked at any time in case of malicious use by the delegated user. The contribution of our model is that the malicious use of delegated role can be prohibited and security vulnerability in the role hierarchy due to role delegations can be alleviated. The proposed model, T RBDM(Time out Based RBDM) is analyzed and compared with the conventional models, such as RBDM0, RBDM1 and PBDM. Our model shows an advantage over other models in terms of security robustness.

Secure agent computation: X.509 Proxy Certificates in a multi-lingual agent framework

Mobile agent technology presents an attractive alternative to the client–server paradigm for several network and real-time applications. However, for most applications, the lack of a viable agent security model has limited the adoption of the agent paradigm. This paper describes how the security infrastructure for computational Grids using X.509 Proxy Certificates can be extended to facilitate security for mobile agents. Proxy Certificates serve as credentials for Grid applications, and their primary purpose is the temporary delegation of authority. We are exploiting the similarities between Grid applications and mobile agent applications, and motivate the use of Proxy Certificates as credentials for mobile agents. Further, we propose extensions for Proxy Certificates to facilitate the characteristics of mobile agent applications, and present mechanisms that achieve agent-to-host authentication, restriction of agent privileges, and secure delegation of authority during spawning of new agents.

Sicherer mobiler Dienstezugang — Gastarbeitsplätze in Intranets

Project-oriented collaborations between independent organisations often demand a temporary delegation of staff mem bers of one or more organisations into the intranet environment of one hosting partner The paper discusses the security risks arising from this scenario especially when delegated staff need continuing access to services in their home intranets. In contrast to usual mobility support technologies, a secure solution for intranet connectivity adapted to this scenario is developed, and, in above, elements for a tailored service access management are sketched, reflecting the location of the user requiring service access.

Dutch Commander-in-Chief Case.

Belligerent Occupation — Administration of Occupied Territory — Temporary Delegation of Governmental Authority by Occupying Power to Commander-in-Chief of Forces of Occupied State — German Occupation of Holland.