Search

This paper deals with providing privacy-preserving access control in Internet of Things (IoT) systems. Here, a user/IoT device requests access to services provided by other IoT devices and multiple requests are combined to a request-specific service chain. An anonymous delegated credential based system architecture is proposed, where the requester’s identity is not exposed to the services. The paper presents the proposed architecture’s various components including the security aspects. Various options for implementing the architecture on resource-full and resource-constrained services are presented. A prototype of the proposed architecture is then implemented using Linux-based containers to emulate the services. Two representative systems, namely, a small-scale home automation system using a short service chain and a large-scale industrial automation system using a long service chain are considered. Timing measurements from the implementation are presented to demonstrate that the architecture is feasible and can be adapted for practical use in large-scale IoT systems.

Social media has revolutionized how individuals, including nutrition and dietetics practitioners, communicate and transmit information. Although not everyone uses or has access to social media, the influence of this medium has grown over the years. Benefits include rapid communication, growing ones' practice, increased visibility, shared expertise, ability to connect anytime, reach larger audiences, create original content, self and client/patient education, and building of relationships. With the advantages come potential professional and ethical pitfalls, however, particularly for healthcare professionals held to a higher standard by society due to their credentials and training. With billions of users and the frequent emergence of new social media platforms, it is not surprising that nutrition and dietetics practitioners are increasingly gravitating to these communication channels, both personally and professionally. Of course, nutrition and dietetics practitioners must follow applicable laws and regulations (for instance, Health Insurance Portability and Accountability Act, or HIPAA). By membership or credential, practitioners agree to abide by the Academy of Nutrition and Dietetics (Academy)/the Commission on Dietetic Registration (CDR) Code of Ethics for the Nutrition and Dietetics Profession. Practitioners should adhere to social media best practices by following standards of civility and professionalism.

We estimate labor market returns to terminal associate's degrees and certificates, with a particular focus on how returns for different credential types evolve over a longer period of time (eleven years post entry) than most of the prior literature. We also explore how returns vary depending on labor market conditions and on which labor market outcome metric is used. Using administrative data from Ohio and an individual fixed-effects approach, we find that the value of an associate's degree grows substantially after graduation, and this finding is robust to choice of specification and outcome. The returns to a long-term certificate are flat over time in our main specification, but more sensitive to assumptions about individual-specific earnings trends. Returns to associate's degrees are notably higher in recession years versus prerecession years. Finally, we find that associate's degrees lead to improved outcomes relative to non-completion across a range of metrics, including higher paying jobs, more stability in employment over time, and a greater likelihood of earning a living wage, whereas certificates generally pay off via the employment margin and a reduced likelihood of claiming unemployment insurance.

The Australian and New Zealand Academy for Eating Disorders (ANZAED) launched a Credentialing scheme for Australian Eating Disorder (ED) clinicians in 2022. Credentialing programs establish a minimum standard of skills and expertise for professionals across various disciplines. Supervision is usually offered to support these professionals in meeting the criteria and becoming Credentialed. Although the effects of clinical supervision have been empirically established, supervision of mental health practitioners as part of Credentialing schemes remains relatively understudied.

A key feature of the booming smart home is the integration of a wide assortment of technologies, including various standards, proprietary communication protocols and heterogeneous platforms. Due to customization, unsatisfied assumptions and incompatibility in the integration, critical security vulnerabilities are likely to be introduced by the integration. Hence, this work addresses the security problems in smart home systems from an integration perspective, as a complement to numerous studies that focus on the analysis of individual technologies. We propose HOMESCAN, an approach that examines the security of the implementations of smart home systems. It extracts the abstract specification of application-layer protocols and internal behaviors of entities, so that it is able to conduct an end-to-end security analysis against various attack models. Applying HOMESCAN on three extensively-used smart home systems, we have found twelve non-trivial security vulnerabilities, which may lead to unauthorized remote control and credential leakage.

PurposeThis article outlines the development of the Refugee Job Search Process Framework (RJSPF), which was created to help identify barriers that refugees face when trying to find employment. The framework incorporates an interdisciplinary, multi-level approach to the job search, delving into research from migration studies and Industrial/Organizational psychology to outline factors that exist on both the side of the refugee applicant and the organization at each stage of the RJSPF. The authors also tested the RJSPF with Syrian refugees and service providers in Canada to examine the validity of each component of the model.Design/methodology/approachThe authors used a semi-structured format to interview refugees and service providers on their experiences in either trying to find employment or helping their refugee clients with the job search process. After transcribing the interviews, the data were independently coded, quantified, and analysed using Nvivo software to validate the RJSPF.FindingsThe majority of the RJSPF either had high or moderate support from the interviews. The authors also identified 6 broader themes using thematic analysis, which include language fluency, credential recognition, Canadian experience “catch 22”, cultural incongruencies, employer exploitation, and mental health for successful employment.Originality/valueThe RJSPF is a new integration of disparate theories of job search experiences in a literature that lacks an organizing framework and perspective on the unique challenges refugees face in this area compared to other newcomers. In doing so, the authors use an interdisciplinary, multi-level approach that extends the nomological network of barriers facing refugees, therefore informing future research and practice.

Notary Public is a public official who is authorized to make credential deeds as a means of proof. Besides being given a notary protokol, it is also obliged to save the notary protokol, both its own and other notary protokols. Regulations related to depository of notary protokol in article 65 paragraph (5) of the UUJN only state that the time for submission was issued 25 (twenty-five) years or more sent by the Notary recipient of the Notary Protokol to the Regional Supervisory Council. This can lead to legal considerations of the notary who will accept the protokol responsible for the notary protokol which is of great concern, which causes rejection of other notaries who will accept the protokol. This study uses a normative method with steps of description, systematization, and explanation of the content of positive law related to using laws and regulations, accessing history and obtaining concepts. Based on the results of the assessment and analysis, the notary protokol is not regulated by the exploitation in UUJN so as to make an agreement on the law so that it can keep documents on the notary protokol while he is still working and also open the work agreement by getting permission from the Notary Association Regional Supervisory Board. Indonesia. While it was agreed that there was a refusal to accept the notary protokol, legal considerations would be given to the notary recipient of the protokol. Tackling these responsibilities can be incorporated into codes of ethics, the notary profession, and approved by the government regarding sanctions for reprimands and compensation from membership.

In the United States, attaining the orthopedic certified specialist (OCS) credential or the orthopedic subspecialty credential of Fellow of the American Academy of Orthopedic Manual Physical Therapists (FAAOMPT), may lead to a higher level of orthopedic practice. It is unknown whether attaining these credentials influences physical therapist confidence in and frequency of engagement in prescription opioid medication misuse (POMM) management practices. A national cross-sectional web-based survey of PTs identified whether respondents had an OCS or FAAOMPT credential. Self-report confidence in POMM-related management practices and the frequency of engaging in these practices were assessed. Logistic regression evaluated association between credential status and confidence in, and frequency of, engagement in POMM-related management practices. The analysis included 402 respondents with a mean age of 41.0 (SD = 11.2) and 203 (50.4%) females. There were 91 (22.6%) PTs with a FAAOMPT credential, 143 (35.6%) with an OCS but with no FAAOMPT credential and 168 (41.8%) had neither credential. Compared to those with an OCS credential, FAAOMPTs reported greater confidence in, and greater frequency of engagement in, POMM-related management practices (p

The General Education Development (GED) certificate is recognized as a credible alternative to a high school diploma in the US. In this paper, we use detailed administrative data from the state of Kentucky to measure the efficacy of a GED degree. We examine the association between the GED college readiness and early post-secondary academic performance. Following previous work in this area, we address selection issues by focusing on a sample of students who are identified as at-risk prior to high school entry. Our results suggest the GED credential is not a credible signal of PSE readiness, particularly in the area of mathematics. GED graduates attain a lower first semester GPA and are also less likely to re-enroll in second semester courses. Differences in the highest level of high school math coursework between GED holders and traditional graduates account for a majority of the observed GED related math-readiness disparities. We also test whether the substantial changes made to the GED exam in 2014 improved student readiness in PSE institutions, however we find no meaningful improvements in PSE math readiness.

Understanding the early teacher pipeline, how many and what types of individuals are pursuing a teaching credential, is critically important. Unfortunately, as Dan Goldhaber and Kris Holden explain, the two national data collections that can be used to explore these areas provide incomplete and sometimes contrasting pictures about the number of people preparing for a teaching career. They describe how data collection could be improved to address this problem and provide a clearer national picture of who is preparing to be tomorrow’s teachers.

This design case describes the implementation of the Human-centered Design process, developed by the world leading design firm IDEO and Stanford d. school. The process describes the technology integration onto a teaching credential program course at a university in Central California. It reports the thought process to adopting HCD in the course with a focus on a semester-long assignment called Technology Leap Project (TLP). The preliminary design decisions and the design process in depth. Each phase of the HCD process (i.e. Inspiration, Ideation, Implementation) was defined and its manifestation into the TLP was articulated and assembled with samples of students’ work. The case also discusses various merits and challenges for the design team of applying the HCD process in engaging student learning and responding to their learning needs. Finally, the revision plan was discussed.

Learners are increasingly turning to “alternative” education channels to up- and re-skill over the course of their lifetimes. In turn, the credentialing market is expanding quickly to supplement or replace training available through traditional pathways. Yet, the relationship between emerging credentials and learners' career outcomes is underexplored. To allow credentials to pave more inclusive pathways to professions, organizations that issue credentials need to gather data about career outcomes, leverage those data to enhance their program, and promote the outcomes transparently. This chapter explores three approaches to reporting outcomes and provides actionable recommendations to implement transparent reporting strategies. If implemented, the suggested approaches could ultimately help enhance understanding of, trust in, and economic support for alternative credentials.

In 2019, Southern New Hampshire University (SNHU or University) convened a Digital Credentials Lab (DCL) team to research, design, and pilot micro-credentials. The goal was to determine if there was a demand for this type of “alternative” learning experience in the market to see if it could be sustainable within the current higher education framework at the University. Through rigorous research, including both internal and external interviews, multiple pilots, and testing, the DCL sought to answer these questions and determine if micro-credentials could add more diversity to the SNHU catalog. In this chapter, the authors offer insight and experience, including findings from various pilots and learner feedback, to help inform other institutions that may be considering offering micro-credentials.

Four-year public institutions of higher education (IHEs) face increasing pressure to innovate with noncredit credentials. The chapter aims to develop leaders' mental models for navigating unique complexities associated with offering programs that do not award academic credit. First, a review of noncredit literature and organizational science principles explains that noncredit programming is often unaligned with IHE organizational culture and structure. Then, two metaphors for leaders' roles in overcoming barriers to innovation are introduced and critiqued: Buller's organic leadership concept and Christensen and Eyring's higher education DNA concept. Complexity leadership theory is next presented as a mental model to understand three complementary leader roles for fostering innovation with a complex organizational environment. Finally, the chapter's case features three vignettes from public IHE continuing education leaders that exemplify the complexities related to pursuing noncredit credential innovation. Strategies and discussion questions are included.

The Extensible Authentication Protocol (EAP) is used for authenticating client devices to WiFi networks, and it is designed to be extensible with new authentication methods. We look at ways to extend the protocol to support credential provisioning and configuration of new client devices. As large numbers of IoT devices are deployed, the task will be simplified by combining the network connectivity, identity and certificate provisioning, and application-layer connectivity to one process. The solution will also allow the use of a one-time credential for the initial authentication, so that the long-term device certificate is issued automatically after the first connection to the network. The paper analyzes the requirements and architectural design options that implement such a user experience. We consider solutions that transfer short bootstrapping data inside the EAP session and then implement the provisioning and configuration with web APIs over HTTPS. This allows future flexibility and speed of development inthe provisioning and configuration steps. We designed and implemented several architecturally different solutions and present the comparison results and also compare with previous proposals that have similar goals.

Anonymous credentials (ACs) are a powerful cryptographic tool for the secure use of digital services, when simultaneously aiming for strong privacy guarantees of users combined with strong authentication guarantees for providers of services. They allow users to selectively prove possession of attributes encoded in a credential without revealing any other meaningful information about themselves. While there is a significant body of research on AC systems, modern use-cases of ACs such as mobile applications come with various requirements not sufficiently considered so far. These include preventing the sharing of credentials and coping with resource constraints of the platforms (e.g., smart cards such as SIM cards in smartphones). Such aspects are typically out of scope of AC constructions, and, thus AC systems that can be considered entirely practical have been elusive so far. In this paper we address this problem by introducing and formalizing the notion of core/helper anonymous credentials (CHAC). The model considers a constrained core device (e.g., a SIM card) and a powerful helper device (e.g., a smartphone). The key idea is that the core device performs operations that do not depend on the size of the credential or the number of attributes, but at the same time the helper device is unable to use the credential without its help. We present a provably secure generic construction of CHACs using a combination of signatures with flexible public keys (SFPK) and the novel notion of aggregatable attribute-based equivalence class signatures (AAEQ) along with a concrete instantiation. The key characteristics of our scheme are that the size of showing tokens is independent of the number of attributes in the credential(s) and that the core device only needs to compute a single elliptic curve scalar multiplication, regardless of the number of attributes. We confirm the practical efficiency of our CHACs with an implementation of our scheme on a Multos smart card as the core and an Android smartphone as the helper device. A credential showing requires less than 500 ms on the smart card and around 200 ms on the smartphone (even for a credential with 1000 attributes).

In this paper, we perform the first multifaceted measurement study to investigate the widespread insecure practices employed by tertiary education institutes (TEIs) around the globe when offering WPA2-Enterprise Wi-Fi services. The security of such services critically hinges on two aspects: (1) the connection configuration on the client-side; and (2) the TLS setup on the authentication servers. Weaknesses in either can leave users susceptible to credential theft. Typically, TEIs prescribe to their users either manual instructions or pre-configured profiles (e.g., eduroam CAT). For studying the security of configurations, we present a framework in which each configuration is mapped to an abstract security label drawn from a strict partially ordered set. We first used this framework to evaluate the configurations supported by the user interfaces (UIs) of mainstream operating systems (OSs), and discovered many design weaknesses. We then considered 7045 TEIs in 54 countries/regions, and collected 7275 configuration instructions from 2061 TEIs. Our analysis showed that majority of these instructions lead to insecure configurations, and nearly 86% of those TEIs can suffer from credential thefts on at least one OS. We also analyzed a large corpus of pre-configured eduroam CAT profiles and discovered several misconfiguration issues that can negatively impact security. Finally, we evaluated the TLS parameters used by authentication servers of thousands of TEIs and discovered perilous practices, such as the use of expired certificates, deprecated versions of TLS, weak signature algorithms, and suspected cases of private key reuse among TEIs. Our long list of findings have been responsibly disclosed to the relevant stakeholders, many of which have already been positively acknowledged.

Background Patient portals allow communication with clinicians, access to test results, appointments, etc, and generally requires another set of log-ins and passwords, which can become cumbersome, as patients often have records at multiple institutions. Social credentials (eg, Google and Facebook) are increasingly used as a federated identity to allow access and reduce the password burden. Single Federated Identity Log-in for Electronic health records (Single-FILE) is a real-world test of the feasibility and acceptability of federated social credentials for patients to access their electronic health records (EHRs) at multiple organizations with a single sign-on (SSO). Objective This study aims to deploy a federated identity system for health care in a real-world environment so patients can safely use a social identity to access their EHR data at multiple organizations. This will help identify barriers and inform guidance for the deployment of such systems. Methods Single-FILE allowed patients to pick a social identity (such as Google or Facebook) as a federated identity for multisite EHR patient portal access with an SSO. Binding the identity to the patient’s EHR records was performed by confirming that the patient had a valid portal log-in and sending a one-time passcode to a telephone (SMS text message or voice) number retrieved from the EHR. This reduced the risk of stolen EHR portal credentials. For a real-world test, we recruited 8 patients and (or) their caregivers who had EHR data at 2 independent health care facilities, enrolled them into Single-FILE, and allowed them to use their social identity credentials to access their patient records. We used a short qualitative interview to assess their interest and use of a federated identity for SSO. Single-FILE was implemented as a web-based patient portal, although the concept can be readily implemented on a variety of mobile platforms. Results We interviewed the patients and their caregivers to assess their comfort levels with using a social identity for access. Patients noted that they appreciated only having to remember 1 log-in as part of Single-FILE and being able to sign up through Facebook. Conclusions Our results indicate that from a technical perspective, a social identity can be used as a federated identity that is bound to a patient’s EHR data. The one-time passcode sent to the patient’s EHR phone number provided assurance that the binding is valid. The patients indicated that they were comfortable with using their social credentials instead of having to remember the log-in credentials for their EHR portal. Our experience will help inform the implementation of federated identity systems in health care in the United States.

All the citizens of a country avail e-Governance services through the Internet, where it inherently does not offer security services. Accessing these services securely and transparently is a significant concern for both the citizen and the government. The multi-server authentication scheme with user biometric and personal mobile devices is an efficient way to reduce security issues related to unauthorized access. It is difficult for a user to remember multiple credentials. If a user performs a login attempt with an incorrect credential, then she is denied access to the service. Therefore, one credential to access every server is a convenient option. Nowadays, most mobile devices are compatible with the biometric scanner; accordingly, it can quickly record the biometric features during the authentication process. This paper devises an elliptic curve-based secure multi-server authentication scheme with the user biometric, password, and mobile device. A user can access various e-Governance services from any location through a dedicated mobile app in our scheme. We perform some formal security analysis of our scheme in the random oracle model, BAN logic, and AVISPA tool. The performance evaluation shows that our scheme accomplishes the known security and functionality features concerning other comparable schemes. Thus, our scheme will be suitable for providing secure access to e-Governance services to every citizen through their mobile devices.

The impact of coronavirus disease 2019 challenged schools and credential programs to adjust pedagogy, but rapid changes impeded equitable practices to K-12 grade English Learners (ELs). The framework stems from critical multicultural education. Data represented 81 credential candidates across three universities. Study confirmed that ELs lacked access to online learning, active engagement with peers/teachers, and differentiated instruction due to rapid changes and uncertainties to their programs.

Despite the latest efforts to foster the adoption of privacy-enhancing Attribute-Based Credential (p-ABC) systems in electronic services, those systems are not yet broadly adopted. The main reasons behind this are performance efficiency issues, lack of interoperability with standards, and the centralized architectural scheme that relies on a unique Identity Provider (IdP) for credential issuance. To cope with these limitations, this paper describes the first implementation of the Pointcheval–Sanders Multi-Signatures (PS-MS) crypto scheme proposed by Camenisch et al. and its integration in a distributed and privacy-preserving identity management system proposed in OLYMPUS H2020 European research project. Our efficient implementation provides remarkable privacy-preservation features for identity management in online transactions leveraging p-ABC systems, including unforgeability, minimal disclosure of personal data through zero-knowledge proofs, unlinkability in online transactions and fully distributed credential issuance across different IdPs, thereby removing the IdP as a unique point of failure. The performance of the implementation has been exhaustively analyzed and evaluated with different curves, signers and number of attributes, and compared against Identity Mixer, the best known p-ABC system, outperforming significantly the credential issuance and zero-knowledge proving and verification processes (2–4 times less execution time).