Search

Ever since databases became an ubiquitous part of enterprises or businesses, security and privacy became a requirement. Traditionally, privacy was realized through various methods of database access control and relied much on the use of statically defined views, which are essentially logical constructs imposed over database tables that can alter or restrict the data that can be viewed by an user. Privacy is about the responsible maintenance of private information. This responsibility is hard to define, which is why laws are necessary. With a vast accumulation of personal data in databases, there has been a heightened awareness and concern about the storage and use of private information leading to privacy-related guidelines, regulations and legislations, Compliance with these regulations has become one of the major concerns for organizations and companies. Traditionally, privacy in databases (DBs) have been addressed through access control techniques including multi-level security (MLS) based on mandatory access control (MAC), and restricted views to the users. As view definitions to comply with regulations became quite complex for accommodating all the restrictions in one view, explicit constructs for specifying privacy policies were introduced for complying with medical regulations like HIPAA (Health Insurance Portability and Accountability Act) from USA, in relational database systems. These enabled fine grained access control (FGAC) capable of enforcing disclosure control enunciated databases. Application of information flow control that is needed for multi-level security (MLS) databases to preserve privacy among multiple users but have their challenges like new abstractions for managing information flow in a relational database system, handling transactions and integrity constraints without introducing covert channels etc. As the DBs need to work alongside information flow controlled programming languages and operating systems for tracking flows, there is a need to enforce the security policy not only on the DBMS but also on the application platform. Due to the underlying requirement of decentralization, it calls for declassification/endorsement and santization requirements on the DB. In this paper, we shall first review some of the major privacy enhancing techniques used traditionally for DBs including MLS DBs, and then explore application of decentralized information flow control models for realizing information flow secure DBs in a robust manner. Towards the end, we shall also touch upon some of the roles of anonymization and psuedonymization including inference control and differential privacy in realizing privacy in practice.

Operating systems adopt kernel protection methods (e.g., mandatory access control, kernel address space layout randomization, control flow integrity, and kernel page table isolation) as essential countermeasures to reduce the likelihood of kernel vulnerability attacks. However, kernel memory corruption can still occur via the execution of malicious kernel code at the kernel layer. This is because the vulnerable kernel code and the attack target kernel code or kernel data are located in the same kernel address space. To gain complete control of a host, adversaries focus on kernel code invocations, such as function pointers that rely on the starting points of the kernel protection methods. To mitigate such subversion attacks, this paper presents multiple kernel memory (MKM), which employs an alternative design for kernel address space separation. The MKM mechanism focuses on the isolation granularity of the kernel address space during each execution of the kernel code. MKM provides two kernel address spaces, namely, i) the trampoline kernel address space, which acts as the gateway feature between user and kernel modes and ii) the security kernel address space, which utilizes the localization of the kernel protection methods (i.e., kernel observation). Additionally, MKM achieves the encapsulation of the vulnerable kernel code to prevent access to the kernel code invocations of the separated kernel address space. The evaluation results demonstrated that MKM can protect the kernel code and kernel data from a proof-of-concept kernel vulnerability that could lead to kernel memory corruption. In addition, the performance results of MKM indicate that the system call overhead latency ranges from $0.020~\mu \text{s}$ to $0.5445~\mu \text{s}$ , while the web application benchmark ranges from $196.27~\mu \text{s}$ to 6, $685.73~\mu \text{s}$ for each download access of 100,000 Hypertext Transfer Protocol sessions. MKM attained a 97.65% system benchmark score and a 99.76% kernel compilation time.

The root privilege escalation attack is extremely destructive to the security of the Android system. SEAndroid implements mandatory access control to the system through the SELinux security policy at the kernel mode, making the general root privilege escalation attacks unenforceable. However, malicious attackers can exploit the Linux kernel vulnerability of privilege escalation to modify the SELinux security labels of the process arbitrarily to obtain the desired permissions and undermine system security. Therefore, investigating the protection method of the security labels in the SELinux kernel is urgent. And the impact on the existing security configuration of the system must also be reduced. This paper proposes an optimization scheme of the SELinux mechanism based on security label randomization to solve the aforementioned problem. At the system runtime, the system randomizes the mapping of the security labels inside and outside the kernel to protect the privileged security labels of the system from illegal obtainment and tampering by attackers. This method is transparent to users; therefore, users do not need to modify the existing system security configuration. A tamper-proof detection method of SELinux security label is also proposed to further improve the security of the method. It detects and corrects the malicious tampering behaviors of the security label in the critical process of the system timely. The above methods are implemented in the Linux system, and the effectiveness of security defense is proven through theoretical analysis and experimental verification. Numerous experiments show that the effect of this method on system performance is less than 1%, and the success probability of root privilege escalation attack is less than 10−9.

Security is essential in mobile computing. And, therefore, various access control modules have been introduced. However, the complicated mobile runtime environment may directly impact on the integrity of these security modules, or even compels them to make wrong access control decisions. Therefore, for a trusted Flask based security system, it needs to be isolated from the dangerous mobile execution environment at runtime. In this paper, we propose an isolated Flask security architecture called iFlask to solve this problem for the Flask-based mandatory access control (MAC) system. iFlask puts its security server subsystem into the enclave provided by the ARM TrustZone so as to avert the negative impacts of the malicious environment. In the meanwhile, iFlask’s object manager subsystems which run in the mobile system kernel use a built-in supplicant proxy to effectively lookup policy decisions made by the back-end security server residing in the enclave, and to enforce these rules on the system with trustworthy behaviors. Moreover, to protect iFlask’s components which are not protected by the enclave, we not only provide an exception trap mechanism that enables TrustZone to enlarge its protection scope to protect selected memory regions from the malicious system, but also establish a secure communication channel to the enclave as well. The prototype is implemented on SELinux, which is the widely used Flask-based MAC system, and the base of SEAndroid. The experimental results show that SELinux receives reliable protection, because it resists all known vulnerabilities (e.g., CVE-2015-1815) and remains unaffected by the attacks in the test set. The propose architecture have very slight impact on the performance, it shows a performance degradation ranges between 0.53% to 6.49% compared to the naked system.

This article describes the features of mandatory access control model in unauthorized ac-cess data protection tools, which can affect its efficiency. Also, some flaws of unauthorized ac-cess data protection tools and possible scenarios of unauthorized access bypassing these tools are analyzed. The countermeasures and methods of its application, eliminating detected flaws are offered. The conclusions about necessarity of analyze of unauthorized access data protec-tion tools policies and revision of its severeness, if it is necessary, were made.

Among the access control methods for database security, there is Mandatory Access Control (MAC) model in which the security level is set to both the subject and the object to enhance the security control. Legacy MAC models have focused only on one thing, either confidentiality or integrity. Thus, it can cause collisions between security policies in supporting confidentiality and integrity simultaneously. In addition, they do not provide a granular security class policy of subjects and objects in terms of subjects' roles or tasks. In this paper, we present the security policy of Bell_LaPadula Model (BLP) model and Biba model as one complemented policy. In addition, Duties Separation and Data Coloring (DSDC)-MAC model applying new data coloring security method is proposed to enable granular access control from the viewpoint of Segregation of Duty (SoD). The case study demonstrated that the proposed modeling work maintains the practicality through the design of Human Resources management System. The proposed model in this study is suitable for organizations like military forces or intelligence agencies where confidential information should be carefully handled. Furthermore, this model is expected to protect systems against malicious insiders and improve the confidentiality and integrity of data

Efficient data storage and retrieval in many sectors led to the development of various modeling techniques such as relational model, Entity Attribute Value model and dynamic tables. The aim of this study is to classify the standard threats of the database according to the violation of security properties followed by the examination of different data models from their security viewpoint. A system is said to be secure if it follows three basic pillars of security i.e. confidentiality, integrity and availability. The current research analyses the security threats in database according to violation of basic pillars of security with detailed analysis of SQL injection attack for three data modeling techniques, namely relational model, Entity Attribute Value (EAV) model and dynamic tables. It presents a comparison of achieving security parameters by performing various experiments on the database stored in MySQL and proposes techniques for the application of mandatory access control in EAV model and dynamic table. After the rigorous survey and experiments performed, it has been found that EAV model is still not a completely secured model. The data leakage in EAV model is more and the application of security properties is relatively more complex than relational model and dynamic tables. Researches have been conducted in the past on these models but very few of them have discussed the security concerns of EAV model and dynamic tables. This paper tries to compare various data models based on security concerns and highlights the security issues in EAV model.

Health Information Exchange (HIE) provides a more complete health record with the aim to improve patient care with relevant data gathered from multiple Health Information Technology (HIT) systems. In support of HIE, the Health Level Seven (HL7) XML standard was developed to manage, exchange, integrate, and retrieve electronic health information. In 2011, the Fast Healthcare Interoperable Resources (FHIR) standard, based on HL7, was proposed to facilitate the development of mobile Health (mHealth) apps with HIT data sharing via a common modeling format. FHIR utilizes RESTful APIs enabled with a FHIR server for information usage and exchange in the cloud. FHIR has a security specification, but does not define actual security mechanisms for secure data exchange via service invocations. If services are the primary means of access, there must be a way to control who can invoke which service at which time. This paper proposes the use of Role-Based Access Control (RBAC) and Mandatory Access Control (MAC) to define permissions based on role and/or the sensitivity level of services. This is accomplished by evolving RBAC and MAC to support permissions on services (as opposed to the usual object view) at a model level applied to a setting where a mobile application is using RESTful APIs. The resulting service-based model is incorporated into the FHIR standard to control the access of who can invoke which services of FHIR RESTful APIs that manage the sensitive healthcare data; work is demonstrated via an mHealth application that interacts with the OpenEMR HIT system via the HAPI FHIR server. Keywords: Access control, FHIR, Healthcare systems, MAC, Mobile applications, RBAC

Cloud and data center applications increasingly leverage FPGAs because of their performance/watt benefits and flexibility advantages over traditional processing cores such as CPUs and GPUs. As the rising demand for hardware acceleration gradually leads to FPGA multi-tenancy in the cloud, there are rising concerns about the security challenges posed by FPGA virtualization. Exposing space-shared FPGAs to multiple cloud tenants may compromise the confidentiality, integrity, and availability of FPGA-accelerated applications. In this work, we present a hardware/software architecture for domain isolation in FPGA-accelerated clouds and data centers with a focus on software-based attacks aiming at unauthorized access and information leakage. Our proposed architecture implements Mandatory Access Control security policies from software down to the hardware accelerators on FPGA. Our experiments demonstrate that the proposed architecture protects against such attacks with minimal area and communication overhead.

The paper presents the concept of a model for managing access to virtual memory in a Linux-based operating system (OS). The concept is developed based on the analysis of approaches to memory management in the Linux-based OS. The model of process access control to virtual memory areas is justified and is based on the consideration of the process as the subject of access, and the area of virtual memory used by this process as the object of access (accordingly, the virtual memory of the process is a set of virtual memory areas). To implement this model in practice, it is proposed to use the permission flags of virtual memory areas. The proposed model can be an addition to the mandatory entity-role model of access and information flows security control in Linux-based OS or other standard models, where the subject is a user or process, and the object is a file.

To investigate the status quo of SEAndroid policy customization, we propose SEPAL, a universal tool to automatically retrieve and examine the customized policy rules. SEPAL applies the NLP technique and employs and trains a wide&deep model to quickly and precisely predict whether one rule is unregulated or not.Our evaluation shows SEPAL is effective, practical and scalable. We verify SEPAL outperforms the state of the art approach (i.e., EASEAndroid) by 15% accuracy rate on average. In our experiments, SEPAL successfully identifies 7,111 unregulated policy rules with a low false positive rate from 595,236 customized rules (extracted from 774 Android firmware images of 72 manufacturers). We further discover the policy customization problem is getting worse in newer Android versions (e.g., around 8% for Android 7 and nearly 20% for Android 9), even though more and more efforts are made. Then, we conduct a deep study and discuss why the unregulated rules are introduced and how they can compromise user devices. Last, we report some unregulated rules to seven vendors and so far four of them confirm our findings., 12 pages, 9 figures, accepted by WWW'21

Modern embedded systems include on-chip FPGA along with processors to meet the high computation demand by providing flexibility to users to add custom hardware accelerators. Any confidential or sensitive information may be processed by those custom accelerators or hardware Intellectual Properties (IPs). Existing accelerator usage models in embedded systems do not prevent illegal access to the IPs, which can be a severe security breach. In this paper, we present a hardware-software co-design approach for secured FPGA accelerated embedded system design. Our proposed security framework inherits Mandatory Access Control (MAC) based authentication policies running at software down to hardware accelerators in FPGA. It ensures secured processing of confidential data in the hardware to prevent software originated attacks at hardware IPs and information leaks. We have implemented a prototype of our proposed framework, which shows that it can be easily integrated while designing an embedded system with custom accelerator IPs. The experimental results show that the proposed framework establishes secured hardware execution with a negligible amount of area and performance overhead.

The AppArmor Linux Security Module (LSM) is widely used on Linux operating systems as it, among other things, provides mandatory access control (MAC) and isolates processes. This isolation helps meet the privacy requirements for critical applications. These application security policies are defined with profiles loaded into the Linux system kernel. However, these access control mechanisms are far from covering all the rising demands for confidentiality enforcement regarding critical applications. This paper conducts a risks and benefits analysis to assess whether a healthcare infrastructure can safely rely on the AppArmor LSM to protect its sensitive data. Thus, the general architecture of AppAmor comes to be detailed. Then, a static code analysis is performed to study the data structures found in the LSM. Finally, the outbreak of would-be side-channel attacks from userspace is discussed while offering mitigation methods. The result of this analysis shows that the AppArmor LSM is susceptible to side-channel attacks and should be used as part of a more comprehensive defense-in-depth strategy.

With today's prevalence of Internet-connected systems storing sensitive data and the omnipresent threat of technically skilled malicious users, computer security remains a critically important field. Because of today's multitude of vulnerable systems and security threats, it is vital that computer science students be taught techniques for programming secure systems, especially since many of them will work on systems with sensitive data after graduation. Teaching computer science students proper design, implementation, and maintenance of secure systems is a challenging task that calls for the use of novel pedagogical tools. This report describes the implementation of a compiler that converts mandatory access control specification Domain-Type Enforcement Language to the Java Security Manager, primarily for pedagogical purposes. The implementation of the Java Security Manager was explored in depth, and various techniques to work around its inherent limitations were explored and partially implemented, although some of these workarounds do not appear in the current version of the compiler because they would have compromised cross-platform compatibility. The current version of the compiler and implementation details of the Java Security Manager are discussed in depth.

The introduction of digital technologies into medical institutions promises great prospects, allowing of improving the quality of treatment and radically changing the approach to early diagnosis of dangerous diseases. However, this progress has a dangerous side effect - the risk of information security. The system of differentiation of access in many systems of medical establishments is not reliable due to the lack of active ways of cryptographic protection of information. In addition, most systems do not provide mandatory access control, and accordingly do not allow you to differentiate computer resources by secrecy and category. In some cases, it is not possible to set passwords to access some of the most important computer resources. Cryptographic protection is the basis for protecting information from theft. The disadvantage of modern diagnostic center systems is the high speed of cryptographic transformations, which forces users to abandon the encryption function.

The protection of sensitive information in computer systems and networks from malicious manipulation is critical. As a key component in cybersecurity, access control is used to mitigate malicious access to sensitive information. To help students master the access control concepts, we developed a 2D educational game titled "Temple of Treasures" that aims to teach Discretionary Access Control (DAC), Access Control List (ACL) and Mandatory Access Control (MAC) in Unix/Linux Systems via a fun and interactive environment. The Unity3D game engine is used for game development and the game can be deployed to multiple platforms such as Windows, macOS, and web. Player information and in-game assessment data are saved on the cloud through GameSparks for analysis. The game story is centered around a group of adventurers in search of gold. The player is stuck in a temple and has to explore the temple for escape routes. The game has three levels, where level one focuses on DAC, level two focuses on ACL and the last level is for MAC. The player has to explore the temple and gain knowledge on targeted concepts to unlock the gate to the next level. Three in-game assessments have been implemented to provide immediate feedback for students. The UI Accessibility Plugin (UAP) is used to make the game accessible to visually impaired players. To scientifically measure the effectiveness of the game, we developed pre-test, post-test, survey, and focus group protocols. The game has been used in the Operating Systems class as a homework assignment at North Carolina A&T State University in spring 2020. This poster will present the game design and development process, the detailed evaluation plan, and our initial classroom experience. This portable and self-contained game will make it easy to share with other faculty engaged in cyber security teaching and research.

The article is dedicated to covert channels of data communication in the protected operating system based on the Linux kernel with mandatory access control. The channel which is not intended by developers violates security policy and can lead to disclosure of confidential information. In this paper the covert storage channels are considered. Authors show opportunities to violate the secrecy policy in the protected operating system based on the Linux kernel experimentally. The first scenario uses time stamps of the last access to the files (“atime” stamp), the second scenario uses unreliable mechanism of the automatic login to the user session with another level of secrecy. Then, there are some recommendations to prevent these violations. The goal of this work is to analyze the methods of using covert channels, both previously known and new. The result of the article is recommendations allowing to eliminate security threats which can be embodied through covert channels.

This paper reflects on the paper titled Building Hybrid Access Control by Configuring RBAC and MAC Features which was published in Information and System Technology, 2014. The publication presents an approach for building a hybrid access control model of Role-Based Access Control and Mandatory Access Control by defining and configuring them in terms of features. The publication has been cited three times, which shows limited impact. We review the citing papers as to how the publication is cited and discuss possible reasons for the limited impact. We also discuss its position in the current state of the arts since the publication. Then, we describe an ongoing effort for a new approach to address the weaknesses of the publication with expected impact.

We present Privaros, a framework to enforce privacy policies on drones. Privaros is designed for commercial delivery drones, such as the ones that will likely be used by Amazon Prime Air. Such drones visit a number of host airspaces, each of which may have different privacy requirements. Privaros provides an information flow control framework to enforce the policies of these hosts on the guest delivery drones. The mechanisms in Privaros are built on top of ROS, a middleware popular in many drone platforms. This paper presents the design and implementation of these mechanisms, describes how policies are specified, and shows that Privaros's policy specification can be integrated with India's Digital Sky portal. Our evaluation shows that a drone running Privaros can robustly enforce various privacy policies specified by hosts, and that its core mechanisms only marginally increase communication latency and power consumption.

Traditional discretionary access control (DAC) or mandatory access control (MAC) is not quite effective for remote environment. General role-based access control (RBAC) also has its limitations to control access for applications like remote healthcare due to its static nature. Design of effective access control model is indeed a big challenge for such applications. Fine-grained access control logic capable of adapting changes based on run-time information needs to be considered to meet the requirements of remote healthcare scenarios. In this work, an adaptive access control model is proposed keeping in compliance with state–of-the-art scenario towards ensuring quality of context and trust relationship between owners and users. It focuses on inter-component relationship, where phases are executed either in online or in offline mode to avoid performance bottleneck. Adaptive binding is integrated with application specific workflows. Workflow net models for different scenarios of medical kiosk-based rural healthcare are analyzed to validate proposed access control logic at design time that can reduce the possibility of major faults at run time. Our proposed work supports formal analysis and verification using Workflow Petri Net Designer (WoPeD) tool. Comparative analysis shows how proposed access control model advances the state of art.

Internet of Things has found a lot of applications in power systems. However, with the increased the sensing, networking, and control capabilities, the security issues have become even more urgent at the same time. In this paper, a TMAC model based on trusted mandatory access control is proposed by studying the security situation of a power monitoring system. The model has self-learning characteristic and can realize the automatic escalation of the global security strategy based on intelligent agent, so as to build the safe immune ability and active defense system for the power monitoring. This paper introduces the key technology of the TMAC security model, formalizes some of the work, and finally tests its credibility and effectiveness for the typical application scenario of the power monitoring system. Through the study of this technology, the power monitoring system is further equipped with an immune ability against virus Trojan and hacker attacks, especially for application scenarios, such as substation, power plant, and master station.

Provenance is an increasingly important tool for understanding and even actively preventing system intrusion, but the excessive storage burden imposed by automatic provenance collection threatens to undermine its value in practice. This situation is made worse by the fact that the majority of this metadata is unlikely to be of interest to an administrator, instead describing system noise or other background activities that are not germane to the forensic investigation. To date, storing data provenance in perpetuity was a necessary concession in even the most advanced provenance tracking systems in order to ensure the completeness of the provenance record for future analyses. In this work, we overcome this obstacle by proposing a policy-based approach to provenance filtering , leveraging the confinement properties provided by Mandatory Access Control (MAC) systems in order to identify and isolate subdomains of system activity for which to collect provenance. We introduce the notion of minimal completeness for provenance graphs, and design and implement a system that provides this property by exclusively collecting provenance for the trusted computing base of a target application. In evaluation, we discover that, while the efficacy of our approach is domain dependent, storage costs can be reduced by as much as 89% in critical scenarios such as provenance tracking in cloud computing data centers. To the best of our knowledge, this is the first policy-based provenance monitor to appear in the literature.

Many modern web-platforms are no longer written by a single entity, such as a company or individual, but consist of a trusted core that can be extended by untrusted third-party authors. Examples of this approach include Facebook, Yammer, and Salesforce. Unfortunately, users running third-party "apps" have little control over what the apps can do with their private data. Today's platforms offer only ad hoc constraints on app behavior, leaving users an unfortunate trade-off between convenience and privacy. A principled approach to code confinement could allow the integration of untrusted code while enforcing flexible, end-to-end policies on data access. This paper presents a new framework, Hails, for building web platforms, that adds mandatory access control and a declarative policy language to the familiar MVC architecture. We demonstrate the flexibility of Hails by building several platforms, including GitStar, a code-hosting website that enforces robust privacy policies on user data even while allowing untrusted apps to deliver extended features to users.

Centralized management is typically applied in modern operating system (OS) architecture; however, such systems are prone to crash when any certain component of the OS is explicitly damaged. The basic reason is that these OSes can rarely support a thoroughly secure or isolated environment either between OS kernel-mode components or between user-mode softwares. To mitigate this issue, we propose vmOS, an operating system that aims at improving the security of desktop computing environment. vmOS applies isolation technique to reduce attack surface, virtualization and mandatory access control to provide isolated environment among system components, application software and user privacy. We implement vmOS by adopting hardware-supported virtualization technology and modifying several well-known open source softwares, which aim to provide run-time efficiency of integrated system. Finally, we evaluate the security and performance by some vulnerability exploits and benchmark tools, showing that vmOS is capable of assuring the overall security of users' desktop computing with less overhead.

Users employ smartphones and tablets to manage and store personal information as well as corporate information. However, storing different types of information in the same device may lead to information leakage. Users need tools to define different confidentiality requirements over their data, and to enforce different access policies according to those requirements. Android is the most used mobile operating system, and although it implements various mechanisms to protect user information, it does not have any tool to meet the mentioned needs. This paper presents AndroidBLP, a tool based on the Bell-LaPadula confidentiality model that implements a predefined mandatory access control policy, enables users to define confidentiality requirements, and enforces a confidentiality policy based on those requirements.

Attribute-based access control (ABAC) is a promising alternative to traditional models of access control (i.e., discretionary access control (DAC), mandatory access control (MAC), and role-based access control (RBAC)) that is drawing attention in both recent academic literature and industry application. However, formalization of a foundational model of ABAC and large scale adoption is still in its infancy. The relatively recent emergence of ABAC still leaves a number of problems unexplored. Issues like delegation, administration, auditability, scalability, hierarchical representations, and the like, have been largely ignored or left to future work. This article provides a basic introduction to ABAC and a comprehensive review of recent research efforts toward developing formal models of ABAC. A taxonomy of ABAC research is presented and used to categorize and evaluate surveyed articles. Open problems are identified based on the shortcomings of the reviewed works and potential solutions discussed.

The implementation of mandatory distribution of access in distributed systems taking into account a user hierarchy is considered. The access control is based on the scheme of preliminary key distribution similar to KDP-scheme. The algorithm of building a family of subsets taking into account a user hierarchy was developed.

In order to solve the problem of resource security access control in SDN (Software Define Network), the idea of mandatory access control is introduced, and E-ABAC (Extended Attributes Based Access Control) model based on security level is designed to realize confidentiality and integrity in the access process. SDN switch security level is regarded as the attribute of access control environment, and a secure path planning method based on PSO (Particle Swarm Optimization) algorithm is designed to ensure the security of access data flow. The experimental results show that the proposed method can implement fine-grained mandatory access control in SDN, and has little effect on the response time of concurrent requests.

Access control is a security technique that specifies which users can access particular resources in a computing environment. Over the years, numerous access control models have been developed to address various aspects of computer security. In this paper, we focus on a modern approach, attribute-based access control (ABAC), which has been proposed in order to overcome limitations of traditional models: discretionary access control (DAC), mandatory access control (MAC) and role-based access control (RBAC). The work on integrating access control mechanisms in semantic web technologies is developing into two directions: (1) to use semantic web technologies for modeling and analyzing access control policies and (2) to protect knowledge encoded in an ontology. In this paper we focus on the first issue and investigate how ABAC can be integrated into ontology languages.

With the rapid development of mobile communication technology and mobile Internet technology, mobile terminals are becoming more and more irreplaceable in people's life and work. In the present power industry, Android-based smart mobile terminals are widely used to carry out various kinds of operations. Compared with traditional desktop computers, smart mobile terminals provide users with convenience and are more vulnerable to attack and control. Considering the security protection of the core layer of smart mobile terminal, this paper designs an Android lightweight kernel layer mandatory access control framework, deeply analyses and discusses the necessity of terminal kernel layer security protection, proposes a verifiable lightweight kernel layer access control model, and formalizes the model. This paper describes and uses FVT method to discuss security policy conflict detection technology. Finally, the availability and shortcomings of the model on three typical smart mobile terminals are verified by experiments.

The dispatching and control cloud (referred to as dCloud) with virtualization technology, which has the characteristics of resource sharing and dynamic deployment, leads to serious challenges for the security protection system of the current power monitoring system. The mandatory access control model selected by the security protection system is not suitable for the situation that user data hosted in the cloud. This paper studies the attribute-based encryption technology, and proposes an optimization method that uses the characteristics of the dCloud itself, to improve encryption efficiency and attribute revocation, and then implements an access control system based on attribute encryption model which suitable for dCloud. The experimental results show that the access control system designed in this paper solves the security problems introduced by super-privilege and resource sharing in the dCloud, which can effectively protect the user data and enhance the security to dCloud.

Access control (AC) is a computer security requirement used to control, in a computing environment, what the user can access, when and how. Policy administration is an essential feature of an AC system. As the number of computers are in hundreds of millions, and due to the different organization requirements, applications and needs, various AC models are presented in literature, such as: Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role Based Access Control (RBAC), etc. These models are used to implement organizational policies that prevent the unauthorized disclosure of sensitive data, protecting the data integrity, and enabling secure access and sharing of information. Each AC model has its own methods for making AC decisions and policy enforcement. However, due to the diversity of AC models and the various concerns and restrictions, its essential to find AC metamodels with higher level of abstraction. Access control metamodels serve as a unifying framework for specifying any AC policy and should ease the migration from an AC model to another. This study reviews existing works on metamodels descriptions and representations. But, are the presented metamodels sufficient to handle the needed target of controlling access especially in the presence of the current information technologies? Do they encompass all features of other AC models? In this paper we are presenting a survey on AC metamodels.

The demand for Cloud computing has been increasing for the past few years due to its significance in the IT industry, cost effectiveness and on demand services. To benefit from this technology, access control mechanism need to be applied to restrict the access to legitimate users and prevent the system from unauthorized access whether coming from people or malicious programs. The increase in the number of unauthorized access recently required more work to reduce it. The main problem is that most of the cloud access control is already built based on weak access control mechanism comparing to other mechanisms. In addition to this weakness, the process of changing it to trust mechanism is complex, expensive and takes a great deal of decision-making. This paper investigates the status of existing access control mechanism in the cloud and provides lightweight, secured, and a new approach based on Mandatory Access Control (MAC) mechanism called Arbiter. The proposed architecture aims to reduce the cost and effort of change the entire operating system to meet the requirement of a trusted system. This paper uses design science methodology to design a technical tool for those who are involved in planning, designing and managing access control in the cloud.

We develop a type system for identifying the information flow between variables in a program in the Guarded Commands language. First we characterise the types of information flow that may arise between variables in a non-deterministic program: explicit, implicit, bypassing, correlated or sanitised. Next we allow to specify security policies in a number of traditional ways based on mandatory access control: defining a security lattice, working with components or decentralised labels, both as pertains to confidentiality and integrity. Offending information flows are those identified by the type system and that violate the security policy; a program is sufficiently secure if it contains only acceptable information flows.

In many organizations, it is vital to protect sensitive and confidential data in today’s digital world. For this case such information is made as an open database system; businesses can face legal or financial ramifications. According to the various nature and structures of the organizations, they may not have the same defense and interrelated communities which consist of military services, bank, and other intelligence organizations. All kinds of organizations must set policies to systematically and consistently categorize their data security from theft and threats. There are many types of access control mechanisms depending on the nature of organization such as mandatory access control (MAC), role-based access control (RBAC), and discretionary access control (DAC). This proposed framework focuses on the common threats that can face in the multilevel organizations, the security mechanisms to be considered, and how to secure a database. Multilevel security system allows users with different clearance levels, authorization, and need to know ability to process information in the same system. Moreover, the technical security controls such as user authentication, file access authorization, data encryption, and privacy controls for each user are applied for this framework. The proposed system will present the implementation of effective security framework for multilevel organizations using Strict Integrity Policy by labeling clearances levels to system’s users and classification levels to system’s stored data.

A client-server architecture mapped to a multi-level security (MLS) system maintain independent access restrictions for various system resources. Traditional access control mechanisms e.g., discretionary access matrix often lead to indirect access, therefore are incapable to enforce confidentiality and integrity at process-level. The confused deputy problem is well known in this regard where an unauthorized process may influence an authorized process to manipulate a protected object. In this paper, we propose a solution to confused deputy problem using a recently proposed novel mandatory access control (MAC) based security model RWFM. We demonstrate our approach through a reference monitor that adapts the proposed solution while performing process-level security check, and prevents indirect access to isolated sensitive objects. Further, we compare our solution with the existing literature towards the end of this paper.

IoT devices such as an IoT smart home Server require the real-time processing and SELinux to ensure periodicity through fast response and protect private information using fine-grained access control. However, these two technologies have a conflict of interest regarding time management. SELinux has a latency due to the fine-grained access control, and the real-time process must reduce latency to ensure a periodicity. The alternative is real-time mandatory access control. Proposed Real-time Mandatory Access Control in this paper reduces the overhead of SELinux and secure the periodicity of the real-time process.

This Research discusses the compliance of the Electronic Records Management System (ERMS) on the Principles and Functional Requirements for Records in Electronic office environments (ICA-REQ) Module Two related to access control functions in one of the main categories is maintain. One of the ERMS management records, namely Arsip Elektronik Terintegrasi (Arteri ) is based on open-source. Arteri is the ERMS for managing web-based electronic records to facilitate records management. Therefore, this research aims to determine whether the arteries meet the ERMS standard on the ICA-REQ regarding access control. So, the results of the analysis can be used as input for developers and users to conduct further evaluation and improvement. This research used a qualitative approach with literature study and made observations on Arteri as the object. On analysis it was found that Arteri only fulfilled 12 of the 17 mandatory access control function requirements .

Intraditional framework, mandatory access control (MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system (OS) is comprised since malwares are running in ring0 level. In this paper, we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management (PM), security server (SS) and policy enforcement (PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache (AVC) between SS and PE in the guest OS, in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implement the system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.

As smartphones have become an indispensable part of daily life, mobile users are increasingly relying on them to process personal information with feature-rich applications. This situation requires robust security mechanisms for protecting sensitive applications and data on mobile devices. Android, as one the most popular smartphone operating systems, provides two core security mechanisms, application sandboxing and a permission system. However, recent studies show that these mech- anisms are vulnerable to be passed by a variety of attacks. In this paper, we argue for the need of designing and implementing more comprehensive security mechanisms for Android. We realize that mediating Inter-Process Communication (IPC) channels used by Android applications can mitigate prominent attacks effectively and efficiently. Based on this observation, we propose a practical multi-layer security framework called TRIPLEMON to support policy-based mediation on Android IPC. We also dis- cuss and evaluate a proof-of-concept prototype of TRIPLEMON along with the experimental results derived from real malware samples and synthetic attacks.

Welcome to this special issue of Wireless Personal Communications. This issue contains a collection of the best papers out of various authors who have been submitted to this issue. The main goal for this issue is to be a timely vehicle for publishing selected research papers from practitioners and academia in convergence industries on this emerging topic. This issue covers some of the hottest topics in Convergence Interaction for Communication, including: convergence; interactive applications; cloud service; P2P architectures and wireless protocols; data and index structures; motion recognition; future communication system; hybrid networking system; spectrum resource allocation; personal networking and architectures; multiple access techniques; multicasting and computer communications. The paper by Mun et al. [1] proposes the injecting of a subject policy into access control to strengthen the protection of personal information. This study provides two confidential access control models that apply individually established policies to the role-based access control model (RBAC) and the mandatory access control model (MAC) technologies. In the SpRBAC model, a user’s right to access would follow organizational policy, and accessing personal information would be restricted by the subject policy. In the SpMAC model, users would have to satisfy the subject policy established by the provider of the information, in addition to the requirements of the normal MAC policy. The paper by Lee et al. [2] presents variability change management using orthogonal variability model-based traceability. The proposed method is an approach to tracing variability based on explicit

In this paper, we investigate the security issues of the Android platform which dominates the global market of smart mobile devices. The current permission model for Android security is not powerful and has two problems. One is the coarse-grained relationship between permissions and methods which require them. The other is that mobile users do not have rights to control the permissions of the application. To solve these problems, we propose MacDroid which can control the platform's resources for accessing installed applications. Users can control the application's behavior via MacDroid's policy. We have divided the permission set into method units. The results of the performance test using a pure Android platform show that our proposed scheme can improve security within a short time.

Cloud computing technology offers function that share each other computer resource, software and infra structure based on network. Virtualization is a very useful technology for operation efficiency of enterprise`s server and reducing cost, but it can be target of new security threat when it is used without considering security. This paper proposes access control mechanism based on MAC(Mandatory Access Control) for cloud convergence that solve various problem that can occur in cloud environment. This mechanism is composed of set of state rules, security characteristics and algorithm. Also, we prove that the machine system with access control mechanism and an initial secure state is a secure system. This policy module of mechanism is expected to not only provide the maintenance but also provide secure resource sharing between virtual machines.

Cloud computing has deeply affected the structure of modern ICT infrastructures. It represents an enabling technology for novel paradigms such as Network Function Virtualisation (NFV), which proposes the virtualisation of network functions to enhance the flexibility of networks and to reduce the costs of infrastructure management. Besides potential benefits, NFV inherits the limitations of traditional virtualisation where the isolation of resources comes at the cost of a performance overhead. Lightweight forms of virtualisation, like containers, aim to mitigate this limitation. Furthermore, they allow the agile composition of complex services. These characteristics make containers a suitable technology for NFV environment. A major concern towards the exploitation of containers is security. Since containers provide less isolation than virtual machines, they can expose the whole host to vulnerabilities. In this work, we investigate container-related threats and propose a secure design for a Virtual Network Function deployed in a lightweight NFV environment.

Nowadays, controlling access to resources is a challenge and the security policies are also needed to be flexible. For providing access control, many access control models can be implemented like Discretionary Access control (DAC), Mandatory Access Control (MAC) and Role-Based Access Control (RBAC) but there are certain limitations in them. Attribute-Based Access Control (ABAC) is the general model which could comprehend the benefits of these models while surpassing their demerits. In this work, we have explained how ABAC can be implemented on Web Application. For implementing ABAC, we have developed a sample web application for an organization to provide users and members access to different resources like course materials and project files. We have defined subject’s attributes, object’s attributes, and policies for it. In conclusion, ABAC can provide dynamic access permissions and flexibility to the access control mechanism in comparison to RBAC and is more secure than Trust-Based Access Control (TrustBAC).

Smartphones are a critical device in modern society. With the amount of personal data present on many smartphones, protecting their integrity is crucial. The Android operating system employs multiple layers of security to ensure that the system is resistant to local and remote threats. To achieve this it uses a combination of discretionary and mandatory access control policies. Attackers when attempting to escalate to a higher privilege level must operate within these policies and potentially exploit their flaws. The flow an attacker (and conversely a defender) follows can be modeled as attack graph. In this paper, we explore how attack graphs could be automatically generated from SEAndroid policy files to aid defenders and attackers with auditing system security posture.

Domain isolation enforcement is one of the challenging issues in software environments. To address this problem, NSA, in conjunction with the Secure Computing Corporation and the University of Utah, developed the open-source Flux Advanced Security Kernel (Flask), the mandatory access control (MAC) security architecture underlying major Operating Systems/Hypervisors widely deployed in cloud/desktop environments. In this work, we extend this security architecture to FPGA-based heterogeneous systems. Specifically, we explore the design and implementation of a security framework for controlled sharing of FPGA hardware modules in MAC-based OS/Hypervisor environments. The proposed design guarantees that hardware modules execute in the same security context as of the processes calling them by propagating the latter security policies expressed at the software level, down to the hardware. We prototype the proposed framework with SELinux and demonstrate its utility by evaluating trade-offs between security performance and execution overhead incurred by example applications. The preliminary results show our proposed framework provides isolation with an average of 0.6% worst case performance overhead.

Currently, cloud computing has widely been implemented in several organizations. This is due to the fact that this new model delivers cost-efficient, flexibility and scalability computing resources to the clients. This has led to a growing demand of cloud implementations in different sectors. Although cloud computing facilitates data management, it still faces various security problems. So, it is important to examine cloud security issues before moving to this model. In particular, we focus on existing access control mechanisms in cloud computing. Actually, there exist multiple schemes that ensure data protection, such as DAC (Discretionary Access Control), MAC (Mandatory Access Control), RBAC (Role Base Access Control), ORBAC (Organizational Role Based Access Control) and ABAC (Attributes Based Access Control). The main contribution of this paper is to select the appropriate access control model that meets cloud constraints. Based on these considerations, ABAC model is more suitable to cloud environments compared to other models. In this regard, we provide a comprehensive taxonomy of different ABAC schemes.

Android adopted SELinux's mandatory access control (MAC) mechanisms in 2013. Since then, billions of Android devices have benefited from mandatory access control security policies. These policies are expressed in a variety of rules, maintained by Google and extended by Android OEMs. Over the years, the rules have grown to be quite complex, making it challenging to properly understand or configure these policies. In this paper, we perform a measurement study on the SEAndroid repository to understand the evolution of these policies. We propose a new metric to measure the complexity of the policy by expanding policy rules, with their abstraction features such as macros and groups, into primitive "boxes", which we then use to show that the complexity of the SEAndroid policies has been growing exponentially over time. By analyzing the Git commits, snapshot by snapshot, we are also able to analyze the "age" of policy rules, the trend of changes, and the contributor composition. We also look at hallmark events in Android's history, such as the "Stagefright" vulnerability in Android's media facilities, pointing out how these events led to changes in the MAC policies. The growing complexity of Android's mandatory policies suggests that we will eventually hit the limits of our ability to understand these policies, requiring new tools and techniques., Comment: 16 pages, 11 figures, published in ACSAC '18

e-Government services require intensive information exchange and interconnection among governmental agencies to provide specialized online services and allow informed decision-making. This could compromise the integrity, confidentiality, and/or availability of the information being exchanged. Government agencies are accountable and liable for the protection of information they possess and use on a least privilege security principle basis even after dissemination. However, traditional access control models are short of achieving this as they do not allow dynamic access to unknown users to the system, they do not provide security controls at a fine-grained level, and they do not provide persistent control over this information. This paper proposes a novel secure access control model for cross-governmental agencies. The secure model deploys a Role-centric Mandatory Access Control MAC (R-MAC) model, suggests a classification scheme for e-Government information, and enforces its application using XML security technologies. By using the proposed model, privacy could be preserved by having dynamic, persistent, and fine-grained control over their shared information.