Verification Of Access Control Policies Research Articles

Power IoT System Architecture Integrating Trusted Computing and Blockchain

With the construction of power Internet of Things, the network scale is constantly expanding, the network structure is increasingly complex, and the number of terminals is increasing rapidly, resulting in huge pressure on network security protection, and it is urgent to build a credible operation environment to ensure that the Internet of Things runs safely and reliably. This paper proposes a power Internet of Things architecture combining trusted computing and blockchain. The architecture ensures the credibility and security of the terminal based on remote integrity verification and access control policy verification. A method for malicious node detection based on blockchain (MMNDB) is placed in acquisition layer. It is used to monitor the status of each acquisition devices in time, detect the malicious terminal in time, isolate the suspicious terminal with low credibility from the power Internet of Things, and ensure credibility of the acquisition terminal and the data collected. Under premise of ensuring the communication efficiency of the power communication network, this architecture can greatly ensure the stable working of the power Internet of Things.

SGAC: A Multi-Layered Access Control Model with Conflict Resolution Strategy

AbstractThis paper presents SGAC (Solution de Gestion Automatisée du Consentement / automated consent management solution), a new healthcare access control model and its support tool, which manages patient wishes regarding access to their electronic health records (EHR). This paper also presents the verification of access control policies for SGAC using two first-order-logic model checkers based on distinct technologies, Alloy and ProB. The development of SGAC has been achieved within the scope of a project with the University of Sherbrooke Hospital (CHUS), and thus has been adapted to take into account regional laws and regulations applicable in Québec and Canada, as they set bounds to patient wishes: for safety reasons, under strictly defined contexts, patient consent can be overriden to protect his/her life (break-the-glass rules). Since patient wishes and those regulations can be in conflict, SGAC provides a mechanism to address this problem based on priority, specificity and modality. In order to protect patient privacy while ensuring effective caregiving in safety-critical situations, we check four types of properties: accessibility, availability, contextuality and rule effectivity. We conducted performance tests comparison: implementation of SGAC versus an implementation of another access control model, XACML, and property verification with Alloy versus ProB. The performance results show that SGAC performs better than XACML and that ProB outperforms Alloy by two order of magnitude thanks to its programmable approach to constraint solving.

Access Control Policy Verification

To ensure that an access control (AC) system is safe, there must be a reliable means to verify that the specified AC policy model conforms to the safety requirements and policy author's intentions. A general verification approach includes black-box and white-box testing, as well as the generation of sufficient test cases to check the correctness of model implementations.

Analysis and Verification of XACML Policies in a Medical Cloud Environment

The connectivity of devices, machines and people via Cloud infrastructure can support collaborations among doctors and specialists from different medical organisations. Such collaborations may lead to data sharing and joint tasks and activities. Hence, the collaborating organisations are responsible for managing and protecting data they share. Therefore, they should define a set of access control policies regulating the exchange of data they own. However, existing Cloud services do not offer tools to analyse these policies. In this paper, we propose a Cloud Policy Verification Service (CPVS) for the analysis and the verification of access control policies specified using XACML. The analysis process detects anomalies at two policy levels: a) intra-policy: detects discrepancies between rules within a single security policy (conflicting rules and redundancies), and b) inter-policies: detects anomalies between several security policies such as inconsistency and similarity. The verification process consists in verifying the completeness property which guarantees that each access request is either accepted or denied by the access control policy. In order to demonstrate the efficiency of our method, we also provide the time and space complexities. Finally, we present the implementation of our method and demonstrate how efficiently our approach can detect policy anomalies.

Introduction to the Special Issue on Reliability and Security of e-Health Information Systems

With the increasing population and aging society in several countries, healthcare providers aim to enhance the quality of the healthcare services while balancing the risk mitigation and service cost. Therefore, several new information technologies and innovative communication methodologies have evolved to improve the healthcare sector. ICT-based technologies help in decreasing the healthcare system overhead and increasing the quality of healthcare services. These technologies may include biosensors, computer aided diagnosis, Wireless Body Sensor Network (WBSN), mobile health, Radio Frequency Identification (RFID), cloud computing, communication protocols, electronic medical records, big data, and internet of things (IoT). Therefore, the complexity of healthcare systems has increased dramatically during the last two decades. Despite having several approaches developed for testing and verification of healthcare systems, ICT related medical incidents that led into losses of money, time, reputation, and in certain cases, lives, still happen frequently. It is believed that healthcare systems do not get enough testing and verification before being put into use, even though they are considered safety critical systems. This is due to the high cost of testing, short time to marker, and the lack of proper testing and verification techniques in the literature. Design errors, system usage problems, design reliability issues, compliance Issues, system failure and vulnerabilities in eHealth care system can lead to critical conditions or even death. The special issue publishes three papers that extended from papers presented at IEEE Healthcom 2015, in addition to two new submitted papers. The first paper in this issue by Pervez et al. titled Improvement Strategies for Device Interoperability Middleware (DIM) using Formal Reliability analysis, where the authors used probabilistic model checker PRISM for analyzing Device Interoperability Middleware (DIM).The second paper by Bhardwaj and Prasad is titled PRAVAH: Parameterised Information Flow Control in e-Health.The authors addressed the problem of enforcing information flow control (IFC) in hospital domains in eHealth systems using a parameterised lattice-based IFC framework called PRAVAH. The third paper by Ayache et al. is titled Analysis and verification of XACML policies in a medical cloud environment. The authors presented a Cloud Policy Verification Service (CPVS) for the analysis and the verification of access control policies specified using XACML. The fourth paper by Sadki and Bakkali is titled Resolving conflicting privacy policies in m-health based on prioritization. The authors presented resent an approach to resolve the problem of conflicting privacy policies in mobile health environments using AHP (Analytic Hierarchy Process) prioritization technique and reputation mechanism. The fifth paper by Gawanmeh et al. is titled Formal Analysis of a Microfluidic Device for Blood Cell Separation. The authors used formal analysis in order to formalize and validate the movement of blood cells in a microdevice under different forces for the purpose of cell separation. We would like to thank the editorial board of SCPE for the efforts they made to make this special issue, and all the reviewers for their efforts and feedback.

Industrial Cybersecurity: Improving Security Through Access Control Policy Models

The protection of a networked industrial control system (ICS) against cyberattacks and malicious behavior is a process that should be taken into account since the very beginning of the system?s conception. This is true, in particular, for the design and verification of access control policies that build up the core of any protection scheme. The aim of this article is to assess the general framework and shed some light on the research activities concerning the analysis and verification of access policies in ICSs, which are currently being carried out in our laboratory.

Automated verification of access control policies using a SAT solver

Managing access control policies in modern computer systems can be challenging and error-prone. Combining multiple disparate access policies can introduce unintended consequences. In this paper, we present a formal model for specifying access to resources, a model that encompasses the semantics of the xacml access control language. From this model we define several ordering relations on access control policies that can be used to automatically verify properties of the policies. We present a tool for automatically verifying these properties by translating these ordering relations to Boolean satisfiability problems and then applying a sat solver. Our experimental results demonstrate that automated verification of xacml policies is feasible using this approach.