Search

Currently, trusted execution environment technologies are widely used to enhance the security of connected devices such as mobile phones and tablets. The trusted operating system is the core component of a trusted execution environment solution, but the trusted operating system itself may face security challenges. The main reason is that the trusted operating system needs to provide different services for different application scenarios, which makes its function more complicated and further increases the code size. In most trusted execution environment solutions, the trusted operating system is based on Monolithic kernel architecture. This will inevitably face security issues such as software defects and lack of isolation between components. In this paper, we propose a scheme for design secure trusted operating system based on a microkernel architecture. In our scheme, we take the modified take-grant model as the system security model and design a discretionary access control mechanism based on the capability system. We implemented our secure trusted operating system on the i.MX6Q platform. The test results show that it works properly and meets the requirements of the GP TEE specifications.

Solid is a moderate re-decentralization architecture for the Web. In Solid, applications fetch data from storage providers called “pods” which implement discretionary access control, permitting users to grant and revoke access rights and thus keeping control over their data. In this paper, we propose to apply an additional de-verticalization by introducing IPFS as a common backend for Solid pods, the goal being to prevent pod provider lock-in and permitting users to consider “self-poding” where the heavy persistency task is out-sourced to IPFS. We have implemented this Solid-over-IPFS architecture using the open-source “Community Solid Server” and successfully ran several Solid applications over IPFS.

Role-based access control (RBAC) model has gained significant attention in cybersecurity in recent years. RBAC restricts system access only to authorized users based on the roles and regulations within an organization. The flexibility and usability of this model have encouraged organizations to migrate from traditional discretionary access control (DAC) models to RBAC. However, this transition requires accomplishing a very challenging task called role mining in which users' roles are generated from the existing access control lists. Although various approaches have been proposed to address this NP-complete problem in the literature, they suffer either from low scalability such that their execution time increases exponentially with the input size, or they rely on fast heuristics with low optimality that generate too many roles. In this paper, we introduce a highly scalable yet optimal approach to tackle the role mining problem. To this end, we utilize a non-negative rank reduced matrix decomposition method to decompose a large-scale user-permission assignment into two constitutive components, i.e. the user-role and role-permission assignments. Then, we apply a thresholding technique to convert real-valued components into binary-valued factors. We employ various access control configurations and demonstrate that our proposed model is able to effectively discover the latent relationship behind the user-permission data even with large datasets.

Recent regulations for security and privacy of personal data request new approaches in data access and retrieval processes. In the context of healthcare, the regulations point two types of consent to access sensitive personal medical data: explicit and implicit consent. This paper focus on explicit consent cases and presents an architecture where the patient grants on-demand access to private health records. The architecture is supported by a Discretionary Access Control model suited for cross-domain and cloud environments. Each resource belongs to a patient that has the power to grant or deny any access rights to users or groups of users. All the process is designed to be secure, from the authentication of the physician in the terminal until the communications between entities, passing by the physician’s terminal check by the patient. Furthermore, the security methods are discussed and evaluated. Finally, it is presented a summary of the developed work and the plans to apply in the future work.

The Internet of Things paradigm is growing rapidly. In fact, controlling this massive growth of IoT globally raises new security and privacy issues. The traditional access control mechanisms provide security to IoT systems such as DAC (discretionary access control) and mandatory access control (MAC). However, these mechanisms are based on central authority management, which raises some issues such as absence of scalability, single point of failure, and lack of privacy. Recently, the decentralized and immutable nature of blockchain technology integrated with access control can help to overcome privacy and security issues in the IoT. This paper presents a review of different access control mechanisms in IoT systems. We present a comparison table of reviewed access control mechanisms. The mechanisms’ scalability, distribution, security, user-centric, privacy and policy enforcing are compared. In addition, we provide access control classifications. Finally, we highlight challenges and future research directions in developing decentralized access control mechanisms for IoT systems.

In this paper, the issue of modeling the transformations of information links in the architecture of cybersecurity of systems with discretionary access control on graphs using the formal "take-grant" model for the task of synthesizing the cybersecurity architecture is considered. For various initial conditions of the problem, reflecting the requirements for the final state of the structure of information links, modeling algorithms based on the Ford-Fulkerson theorem and methods for finding the smallest edge section of a graph are proposed. A software module has been created that implements the proposed algorithms in Python using the NetworkX library. Examples of the results of the created software module are given.

Patient consent is currently a missing piece on Electronic Health Records System (EHR-S) access permission. The control is needed to ensure personal data as the property of the individual, not data controllers or health-care service providers. To cope with this need, in this article, an adaptation of existent Role-Based Access Control (RBAC), including patient-centric control, is described. The revisited feature of existing administrative and supporting RBAC functions allows exclusive control orchestrated by the patient as sole information owner, including the ability to encrypt their data for confidentiality purposes. The additions mimic a Discretionary Access Control (DAC) capability using existing user group membership to vet access over symmetric keys bind to patient's data via the associated PERMS matrix.

The protection of sensitive information in computer systems and networks from malicious manipulation is critical. As a key component in cybersecurity, access control is used to mitigate malicious access to sensitive information. To help students master the access control concepts, we developed a 2D educational game titled "Temple of Treasures" that aims to teach Discretionary Access Control (DAC), Access Control List (ACL) and Mandatory Access Control (MAC) in Unix/Linux Systems via a fun and interactive environment. The Unity3D game engine is used for game development and the game can be deployed to multiple platforms such as Windows, macOS, and web. Player information and in-game assessment data are saved on the cloud through GameSparks for analysis. The game story is centered around a group of adventurers in search of gold. The player is stuck in a temple and has to explore the temple for escape routes. The game has three levels, where level one focuses on DAC, level two focuses on ACL and the last level is for MAC. The player has to explore the temple and gain knowledge on targeted concepts to unlock the gate to the next level. Three in-game assessments have been implemented to provide immediate feedback for students. The UI Accessibility Plugin (UAP) is used to make the game accessible to visually impaired players. To scientifically measure the effectiveness of the game, we developed pre-test, post-test, survey, and focus group protocols. The game has been used in the Operating Systems class as a homework assignment at North Carolina A&T State University in spring 2020. This poster will present the game design and development process, the detailed evaluation plan, and our initial classroom experience. This portable and self-contained game will make it easy to share with other faculty engaged in cyber security teaching and research.

Ensuring security and privacy of IOT devices and the associated/ dependent complex and critical systems is certainly a major concern, especially after proliferation of IoT devices in variety of domains in current era. A considerable level of security can be achieved in these systems using the techniques of Role Based Access Control (RBAC). In contrast to Discretionary Access Control (DAC) where personal identity of the owner/ user matters, RBAC grants access permissions on the basis of roles of the user. Due to the inherent complexity associated with ensuring security in IoT devices and related systems/ services, a level of abstraction is required in the development process, in order to better understand and develop the system accordingly by integrating all the security aspects. This level of abstraction can be achieved by developing the system as per the concepts of Model Driven Development (MDD). In this paper, techniques of Model Driven Architecture (MDA)/ MDD has been used to propose such a Framework/ Meta-Model, which ensures RBAC in order to access the services associated with IoT devices. The proposed Meta-Model can be further extended for the model-based development and automation of such a system that ensure RBAC for IoT devices. Validity of proposed Meta-Model has been proved by creating an M1 level Instance Model of a real-world case study. Results prove, that the proposed Meta-Model is capable to be transformed into a reliable system that ensures RBAC in IoT devices.

The author considers the Internet of Things security problems, namely, the organization of secure access control when using the MQTT protocol. Security mechanisms and methods that are employed or supported by the MQTT protocol have been analyzed. Thus, the protocol employs authentication by the login and password. In addition, it supports cryptographic processing over transferring data via the TLS protocol. Third-party services on OAuth protocol can be used for authentication. The authorization takes place by configuring the ACL-files or via third-party services and databases. The author suggests a device discretionary access control model of machine-to-machine interaction under the MQTT protocol, which is based on the HRU-model. The model entails six operators: the addition and deletion of a subject, the addition and deletion of an object, the addition and deletion of access privileges. The access control model is presented in a form of an access matrix and has three types of privileges: read, write, ownership. The model is composed in a way that makes it compatible with the protocol of a widespread version v3.1.1. The available types of messages in the MQTT protocol allow for the adjustment of access privileges. The author considered an algorithm with such a service data unit build that the unit could easily be distinguished in the message body. The implementation of the suggested model will lead to the minimization of administrator’s involvement due to the possibility for devices to determine access privileges to the information resource without human involvement. The author suggests recommendations for security policies, when organizing an informational exchange in accordance with the MQTT protocol.

The usage of the web based social networks is growing day by day. Our daily life has become dependent on the usage of these social networking applications (apps). These apps allow the people of different ages to share their ideas and remain connected to the people they like to connect with through the medium of internet. There are several web based social networking apps such as Instagram, Twitter, LinkedIn, and Facebook. Facebook has experienced the rapid growth in the number of users in last few years. The access control paradigm of Facebook is different from the way it is generally being provided. The access control is mainly defined through: Role based access control, Trust Management System, Discretionary Access Control. Web based social networks offer attractive means for interaction and communication; on the other hand they also raise privacy and security concerns. There are risks related to the privacy of the users attached to the usage of web based social networks as most of the users accept the privacy and access control policies of such apps without understanding the threat associated with the same. We try to explore some of the threats related to the privacy and access control of web based social network that helps the users to keep their profile safe and avoid any type of data breach.

Traditional discretionary access control (DAC) or mandatory access control (MAC) is not quite effective for remote environment. General role-based access control (RBAC) also has its limitations to control access for applications like remote healthcare due to its static nature. Design of effective access control model is indeed a big challenge for such applications. Fine-grained access control logic capable of adapting changes based on run-time information needs to be considered to meet the requirements of remote healthcare scenarios. In this work, an adaptive access control model is proposed keeping in compliance with state–of-the-art scenario towards ensuring quality of context and trust relationship between owners and users. It focuses on inter-component relationship, where phases are executed either in online or in offline mode to avoid performance bottleneck. Adaptive binding is integrated with application specific workflows. Workflow net models for different scenarios of medical kiosk-based rural healthcare are analyzed to validate proposed access control logic at design time that can reduce the possibility of major faults at run time. Our proposed work supports formal analysis and verification using Workflow Petri Net Designer (WoPeD) tool. Comparative analysis shows how proposed access control model advances the state of art.

A system and related methods for providing greater security and control over access to classified files and documents and other forms of sensitive information based upon a multi-user, multi-modality permission strategy centering on organizational structure, thereby making authentication strategy unpredictable so to significantly reduce the risk of exploitation. Based on the sensitivity or classification of the information being requested by a user, approvers are selected dynamically based on the work environment, e.g., mobility, use of the computing device seeking access, authentication factors under applicable environmental settings, access policy, and the like.

In software-defined networks (SDN), most controllers do not have an established control function for endpoint users and access terminals to access network, which may lead to many attacks. In order to address the problem of security check on access terminals, a secure trusted access method in SDN is designed and implemented in this paper. The method includes an access architecture design and a security access authentication protocol. The access architecture combines the characteristics of the trusted access technology and SDN architecture, and enhances the access security of SDN. The security access authentication protocol specifies the specific structure and implementation of data exchange in the access process. The architecture and protocol implemented in this paper can complete the credibility judgment of the access device and user's identification. Furthermore, it provides different trusted users with different network access permissions. Experiments show that the proposed access method is more secure than the access method that is based on IP address, MAC address and user identity authentication only, thus can effectively guarantee the access security of SDN.

Attribute-based access control (ABAC) is a promising alternative to traditional models of access control (i.e., discretionary access control (DAC), mandatory access control (MAC), and role-based access control (RBAC)) that is drawing attention in both recent academic literature and industry application. However, formalization of a foundational model of ABAC and large scale adoption is still in its infancy. The relatively recent emergence of ABAC still leaves a number of problems unexplored. Issues like delegation, administration, auditability, scalability, hierarchical representations, and the like, have been largely ignored or left to future work. This article provides a basic introduction to ABAC and a comprehensive review of recent research efforts toward developing formal models of ABAC. A taxonomy of ABAC research is presented and used to categorize and evaluate surveyed articles. Open problems are identified based on the shortcomings of the reviewed works and potential solutions discussed.

How should applications legitimately requiring access to sensitive resources to carry out their functionality be granted access to those resources? The answer to this question depends on users. This article introduces user-driven access control, an alternate permission model that adheres to the principle of least privilege while reducing the burden on users to make explicit permission decisions.

As the technology of attribute-based access control (ABAC) matures and begins to supplant earlier models such as role-based or discretionary access control, it becomes necessary to convert from already deployed access control systems to ABAC. Several variations of this general problem can be defined, some of which have been studied by researchers. In particular the ABAC policy mining problem assumes that attribute values for various entities such as users and objects in the system are given, in addition to the authorization state, from which the ABAC policy needs to be discovered. In this paper, we formalize the ABAC RuleSet Existence problem in this context and develop an algorithm and complexity analysis for its solution. We further introduce the notion of ABAC RuleSet Infeasibility Correction along with an algorithm for its solution.

Access control is a security technique that specifies which users can access particular resources in a computing environment. Over the years, numerous access control models have been developed to address various aspects of computer security. In this paper, we focus on a modern approach, attribute-based access control (ABAC), which has been proposed in order to overcome limitations of traditional models: discretionary access control (DAC), mandatory access control (MAC) and role-based access control (RBAC). The work on integrating access control mechanisms in semantic web technologies is developing into two directions: (1) to use semantic web technologies for modeling and analyzing access control policies and (2) to protect knowledge encoded in an ontology. In this paper we focus on the first issue and investigate how ABAC can be integrated into ontology languages.

Access control (AC) is a computer security requirement used to control, in a computing environment, what the user can access, when and how. Policy administration is an essential feature of an AC system. As the number of computers are in hundreds of millions, and due to the different organization requirements, applications and needs, various AC models are presented in literature, such as: Discretionary Access Control (DAC), Mandatory Access Control (MAC), Role Based Access Control (RBAC), etc. These models are used to implement organizational policies that prevent the unauthorized disclosure of sensitive data, protecting the data integrity, and enabling secure access and sharing of information. Each AC model has its own methods for making AC decisions and policy enforcement. However, due to the diversity of AC models and the various concerns and restrictions, its essential to find AC metamodels with higher level of abstraction. Access control metamodels serve as a unifying framework for specifying any AC policy and should ease the migration from an AC model to another. This study reviews existing works on metamodels descriptions and representations. But, are the presented metamodels sufficient to handle the needed target of controlling access especially in the presence of the current information technologies? Do they encompass all features of other AC models? In this paper we are presenting a survey on AC metamodels.

Privilege separation systems that are implemented in applications such as Chromium and OpenSSH Dae- mon(SSHD) are complex, cumbersome because they have to be built on top of traditional Access Control List(ACL) systems. Properties such as least privilege operations along with effective solutions to problems that plague ACL based implementations, such as the Confused Deputy problem makes Capabilities much more capable when compared with the current Mandatory Access Control (MAC)/ Discretionary Access Control(DAC) systems in use within the POSIX systems for implementing privilege separated applications. While some work has been done on integrating a capability system into Linux, the final implementation provided solution for a specific subset of problems that a typical Capability based systems addresses. We provide a kernel module that enhances the Linux File Descriptors (FD) with revocation property, that while providing as a starting point for future refinements and improvements for creating a Capability system, also provides sufficient advantages to existing work flows that involves privilege separation.

In many organizations, it is vital to protect sensitive and confidential data in today’s digital world. For this case such information is made as an open database system; businesses can face legal or financial ramifications. According to the various nature and structures of the organizations, they may not have the same defense and interrelated communities which consist of military services, bank, and other intelligence organizations. All kinds of organizations must set policies to systematically and consistently categorize their data security from theft and threats. There are many types of access control mechanisms depending on the nature of organization such as mandatory access control (MAC), role-based access control (RBAC), and discretionary access control (DAC). This proposed framework focuses on the common threats that can face in the multilevel organizations, the security mechanisms to be considered, and how to secure a database. Multilevel security system allows users with different clearance levels, authorization, and need to know ability to process information in the same system. Moreover, the technical security controls such as user authentication, file access authorization, data encryption, and privacy controls for each user are applied for this framework. The proposed system will present the implementation of effective security framework for multilevel organizations using Strict Integrity Policy by labeling clearances levels to system’s users and classification levels to system’s stored data.

Blockchain technology has been widely concerned by scholars and industry since it was put forward, and Banks, Internet of Things, Supply Chain, Government and Medical Industry have proposed using blockchain technology to solve their problems, respectively. However, there are some difficulties in the deployment of blockchain products. One important reason is privacy protection. In order to protect blockchain privacy, discretionary access control method is proposed, and the corresponding model and algorithm are given. Encryption algorithm is used to encrypt the blockchain transaction transactions to privacy transactions. The encryption key and access rights are encapsulated by Lagrange polynomial to form secret information sent to authorized users. Extracting enough secret information, authorized user groups work together to calculate the decryption key, and then obtain the transaction transactions plaintext and finally implement consensus mechanism to verify the transaction. Secret information safely self-destruct immediately if exceed effective time. Authorized users and effective time are entirely determined by the owner of the transaction. This paper realizes key distributed securely, achieves discretionary access control and fine-grained access control and provides strong privacy protection.

A modification of the KDP scheme for the distribution of encryption keys is considered as applied to a distributed computer system with a discretionary security model. Limited access is specified as forbidden channels of data transmission. The scheme of preliminary key distribution is designed in such a way that it is impossible for forbidden channels to create a key-pair for the data exchange. An example of the construction of the proposed scheme is presented.

The dynamic authorization and continuous monitoring of resource usage in cloud environments is a challenge. Moreover, the extant access control techniques are not well-suited for all types of the cloud-hosted applications predominantly for two reasons. Firstly, these techniques lack in providing features such as generality, extensibility, and flexibility. Secondly, they are static in nature, such that once the user is authorized, they do not evaluate the access request during and after the resource usage. Every application hosted in the cloud has its own requirement of evaluating access request; some applications require request evaluation before assigning resources, while some require continuous monitoring of resource usage along with a dynamic update of attribute values. To address these diverse requirements, we present an Extensible Access Control Framework (EACF) for cloud-based applications, which provides high-level extensibility by incorporating different access control models about the needs of the Cloud service consumers (organizations). A number of access control models are combined in the EACF, which provides reliable authorization service for managing and controlling access to the software as a service-hosted cloud applications.It also helps cloud consumers to provide authorized access to resources (data), as well as contributes to eliminate the need to write customized security code for individual applications. As a case study, three access control models are incorporated into the framework and tested on SaaS-hosted application DSpace to ascertain that the proposed features are functional and working fine.

In general, access control mechanisms in DBMSs ensure that users access only those portions of data for which they have authorizations, according to a predefined set of access control policies. However, it has been shown that access control mechanisms might be not enough. A clear example is the inference problem due to functional dependencies, which might allow a user to discover unauthorized data by exploiting authorized data. In this paper, we wish to investigate data dependencies (e.g., functional dependencies, foreign key constraints, and knowledge-based implications) from a different perspective. In particular, the aim was to investigate data dependencies as a mean for increasing the DBMS utility, that is, the number of queries that can be safely answered, rather than as channels for releasing sensitive data. We believe that, under given circumstances, this unauthorized release may give more benefits than issues. As such, we present a query rewriting technique capable of extending defined access control policies by exploiting data dependencies, in order to authorize unauthorized but inferable data.

In cloud computing applications, users' data and applications are hosted by cloud providers. This paper proposed an access control scheme that uses a combination of discretionary access control and cryptographic techniques to secure users' data and applications hosted by cloud providers. Many cloud applications require users to share their data and applications hosted by cloud providers. To facilitate resource sharing, the proposed scheme allows cloud users to delegate their access permissions to other users easily. Using the access control policies that guard the access to resources and the credentials submitted by users, a third party can infer information about the cloud users. The proposed scheme uses cryptographic techniques to obscure the access control policies and users' credentials to ensure the privacy of the cloud users. Data encryption is used to guarantee the confidentiality of data. Compared with existing schemes, the proposed scheme is more flexible and easy to use. Experiments showed that the proposed scheme is also efficient.

To design a discretionary access control policy, a technique is proposed that uses the principle of analogies and is based on both the properties of objects and the properties of subjects. As attributes characterizing these properties, the values of the security attributes of subjects and objects are chosen. The concept of precedent is defined as an access rule explicitly specified by the security administrator. The problem of interpolation of the access matrix is formulated: the security administrator defines a sequence of precedents, it is required to automate the process of filling the remaining cells of the access matrix. On the family of sets of security attributes, a linear order is introduced. The principles of filling the access matrix on the basis of analogy with the dominant precedent in accordance with a given order relation are developed. The analysis of the proposed methodology is performed and its main advantages are revealed.

The analysis of modern database management systems and their security allows highlighting the main problem-poor protection against loss of user authentication data and the use of discretionary access control mechanism to the management function. Multilayer approach to the user's authorization in the database management systems as the main stage of protection is proposed. The modular system of authorization system divides in 3 layers. First layer is getting access to the user rights which can give user simple access to read database information. Second layer is getting access to the redactor rights. Third layer is getting personal administrator access to the all rights in database. Access to each subsequent layer is possible only after the getting the previous one. Every layer uses security mechanisms, which can help creator of database to protect his database from nonauthorized access.

Nowadays, controlling access to resources is a challenge and the security policies are also needed to be flexible. For providing access control, many access control models can be implemented like Discretionary Access control (DAC), Mandatory Access Control (MAC) and Role-Based Access Control (RBAC) but there are certain limitations in them. Attribute-Based Access Control (ABAC) is the general model which could comprehend the benefits of these models while surpassing their demerits. In this work, we have explained how ABAC can be implemented on Web Application. For implementing ABAC, we have developed a sample web application for an organization to provide users and members access to different resources like course materials and project files. We have defined subject’s attributes, object’s attributes, and policies for it. In conclusion, ABAC can provide dynamic access permissions and flexibility to the access control mechanism in comparison to RBAC and is more secure than Trust-Based Access Control (TrustBAC).

Mobile applications are quickly replacing traditional desktop computing for gaming, social media, email, web browsing, health and fitness, business usage, etc. Many of these mobile apps require that sensitive information (protected health information (PHI) and personally identifiable information (PII)) be displayed, accessed, modified, and stored. In the healthcare domain, there is a need for health information exchange (HIE) among patients and medical providers across a wide range of health information technology (HIT) systems such as electronic health records, e-prescribing, etc., all of which involve highly-sensitive data (PII and PHI) that is exchanged back and forth between the mobile application and its server-side repository/database. In the U.S. in 2015, the Office of the National Coordinator issued a report on certification rules for EHRs that has required that HIT vendors develop RESTful APIs for EHRs and other systems so that patients and medical providers using mobile health (mHealth) applications via the cloud can easily access their healthcare data from multiple sources. This necessitates the consideration that access control mechanisms are candidates to protect highly-sensitive data of such applications via the control of who can call which service. The paper presents the attainment of role-based (RBAC), mandatory (MAC), and discretionary (DAC) access control for RESTful API and cloud services via an Intercepting API Calls approach that is able to define and enforce users of mobile apps to limit the API/cloud services that can be invoked depending on a user’s permissions. The presented Intercepting API Calls approach is demonstrated via an existing mHealth application.

Currently, cloud computing has widely been implemented in several organizations. This is due to the fact that this new model delivers cost-efficient, flexibility and scalability computing resources to the clients. This has led to a growing demand of cloud implementations in different sectors. Although cloud computing facilitates data management, it still faces various security problems. So, it is important to examine cloud security issues before moving to this model. In particular, we focus on existing access control mechanisms in cloud computing. Actually, there exist multiple schemes that ensure data protection, such as DAC (Discretionary Access Control), MAC (Mandatory Access Control), RBAC (Role Base Access Control), ORBAC (Organizational Role Based Access Control) and ABAC (Attributes Based Access Control). The main contribution of this paper is to select the appropriate access control model that meets cloud constraints. Based on these considerations, ABAC model is more suitable to cloud environments compared to other models. In this regard, we provide a comprehensive taxonomy of different ABAC schemes.

The main objective of this work is to analyze and extend security model of mobile devices running on Android OS. Provided security extension is a Linux kernel security module that allows the system administrator to restrict program's capabilities with per-program profiles. Profiles can allow capabilities like network access, raw socket access, and the permission to read, write, or execute files on matching paths. Module supplements the traditional Android capability access control model by providing mandatory access control (MAC) based on path. This extension increases security of access to system objects in a device and allows creating security sandboxes per application.

Android has become a dominant computing platform, and its popularity has coincided with a surge of malware. The incorporation of Security-Enhanced Linux in Android (SEAndroid) is an important security enhancement to the platform. While SEAndroid adds the benefits of mandatory protection that SELinux brought to desktops and servers, the protection is only as good as the policy. Existing Android devices contain a wide variety of SEAndroid policies, depending on both the version of Android as well as the device manufacturer. In this paper, we present an approach to analyze SEAndroid policies in conjunction with the underlying Linux/Unix Discretionary Access Control policies. We apply our approach to four different versions of Android Open Source Project (AOSP) as well as devices from seven different manufacturers, and find several forms of unintentional privilege assignments.

Software components have a wide variety of access control requirements. A one-size-fits-all access control framework will not meet the needs of all of these components.We propose an expressive framework for implementing access control monitors for components. The basis of the framework is a novel concept: the authority environment. An authority environment associates rights with an execution context. The building blocks of access control monitors in our framework are authorization contracts: software contracts that manage authority environments.We've used the framework to implement diverse access control mechanisms (including discretionary access control, stack inspection, history-based access control, and object capabilities), and to write custom access control monitors for three case studies.

In Attribute-Based Access Control (ABAC), attributes are defined as characteristics of subjects, objects as well as environment, and access is granted or denied based on the values of these attributes. With increasing number of organizations showing interest in migrating to ABAC, it is imperative that algorithmic techniques be developed to facilitate the process. While the traditional ABAC policy mining approaches support the development of an ABAC policy from existing Discretionary Access Control (DAC) or Role-Based Access Control (RBAC) systems, they do not handle adaptation to the policy of a similar organization. As the policy itself need not be developed ab initio in this process, it provides agility and a faster migration path, especially for organizations participating in collaborative sharing of data. With the set of objects and their attributes given, along with an access control policy to be adapted to, the problem is to determine an optimal assignment of attributes to subjects so that a set of desired accesses can be granted. Here, optimality is in the number of ABAC rules the subjects would require to use to gain access to various objects. Such an approach not only helps in assisting collaboration between organizations, but also ensures efficient evaluation of rules during policy enforcement. We show that the optimal policy adaptation problem is NP-Complete and present a heuristic solution.

IT companies are largely adopting the emerging technology of cloud computing. Cloud computing technology provides cost-efficient computing resources with increased flexibility, and scalability. The primary concerns in cloud computing implementation are security and privacy. Access control models are used to address security threats and vulnerabilities. There are a variety of access control models, including DAC (Discretionary Access Control), MAC (Mandatory Access Control), RBAC (Role Base Access Control), ORBAC (Organizational Role Based Access Control) and ABAC (Attributes Based Access Control). As such it is important to analyze and compare the different existing access control models. To achieve this goal, we determine well defined criteria necessary within the context of current cloud computing requirements. Accordingly, we choose the appropriate model for the cloud environment.

Role-based access control (RBAC) is a widely-used protocol to design and build an access control for providing the system security regarding authorization. Even though in the context of internet resources access, the authentication and access control are providing critical functionalities. In practice, the RBAC model has three perspectives such as Access Control, End User, and Administrator. An access control model must be built while giving highest priority to Access Control dimension. It means that the system must be secure regarding authorization. Thus, the system may be less useful for end-users and administrators. In this paper, we categorize that the basic motivation behind RBAC model is the easiest administration compared to tight authorization that becomes the reason for the evolution of RBAC model. Tight authorization creates many problems to make a system secure regarding authorization. Therefore, the true dimensions of RBAC model are identified in this study to change the mindset of researchers that RBAC is evolved for easier administration instead of tight access control. We propose a solution to incorporate the concept of roles for relaxed administration along with the permission-based access control. Moreover, we conclude that the dynamic separation of duty (DSD) should be implemented by permissions instead of roles in RBAC model.

Access control is a means to implement within an information system to ensure its security. The development of two distinct themes which are: Access control and networking, to improve one by using the other. It is a vision that motivated us to look for existing methods to combine the two for the benefit of computer security [5, 23, 28, 31]. In fact, our work focuses on the paradigm of access control and its application. First, we studied the best-known access control models existing in the literature. Moreover, we defined the security concept network and protocol, by choosing a cloud system as a case study in order to apply a policy Access control at the level of a firewall to secure our system. Finally, the most appropriate model is presented for implementation based on the security policies and requirements of organizations and the specifications of each access control model.

With the proliferation of locating devices, more and more raw spatial trajectories are formed, and many works enrich these raw trajectories with semantics, and mine patterns from both raw and semantic trajectories, but access control of spatial trajectories is not considered yet. We present a multi-policy secure model for semantic spatial trajectories. In our model, Mandatory Access Control, Role Based Access Control and Discretionary Access control are all enforced, separately and combined, and we represent the model semi-formally in Web Ontology Language.

Over the last decades, we have seen several policy models, including role-based access control and more recently, certificate-base control. These models are based on the important notion "flow relation". In this work, we present a logical language of certificate-based access control. Our model presents the formal method of reasoning for discretionary access and defines logic to express a discretionary policy. We introduce, instead, material implication widely used in mathematics, and we show in a case study its ease in every sense. We find it allows the policy specifications to be interpreted more conveniently by practitioners and implemented in a simple way. Our evaluation shows that policies defined with material implication can be used for creation of the specification of a trust relationships policy and for checking safety of any computer system.

This chapter focuses on the application of access control models such as mandatory access control (MAC), discretionary access control (DAC), and role-based access control (RBAC) represent a significant amount of this domain’s material. Understanding the key categories of access control defenses, as well as preventive, detective, corrective, recovery, deterrent, and compensating controls, is necessary for this and numerous other domains. The final major content area in this chapter is dealing with authentication by introducing methods, protocols, and concepts related to ensuring that an identity claim can be validated appropriately.

Multidata sources and formats and multiuser types introduce new security and privacy challenges to big data applications. The authors propose a multilabels-based scalable access control framework for use in a Hadoop-based big data healthcare application. This framework combines active bundle, role-based access control (RBAC), attribute-based access control (ABAC), discretionary access control (DAC), and mandatory access control (MAC). The multilabels include data type, security degree, lifetime, number of replications, access policy, and hash value. In the framework, data type can be related to security degree. If the user has new access control requirements, the big data administrator can add, delete, or revise the labels to achieve a different access control granularity.

Some specific information or resources only can be accessed by authorized users. Discretionary access control DAC, mandatory access control MAC, and role-based access control RBAC are three main classes of access control policies. MAC and RBAC are more secure than discretionary access control because a system instead of an object's owner determines the policy. MAC is appropriate for multilevel applications with high security requirements such as military ones, while RBAC provides security and business benefits. Most institutions, companies, and governments are multilevel, so relationships between roles or security levels tend to be hierarchical. In this work, an access control mechanism, providing explicit transitive exception and antisymmetric arrangement, is proposed to provide flexible and appropriate solutions to hierarchical relationships. For practicability, no access control policy is strictly constrained in the proposed mechanism such that security classes can be determined according to specific requirements. The proposed mechanism employs an elliptic curve cryptosystem and a two-layer hash approach to ensure security and computation efficiency. Copyright © 2014 John Wiley & Sons, Ltd.

An access control system is needed to ensure only authorized users can access a sensitive resource. We propose a secure access control based on a fully secure and fine grained ciphertext-policy attribute-based encryption scheme. The access control for a sensitive resource is ensured by encrypting it with encryption algorithm from the CP-ABE scheme parameterized by an access control policy. Furthermore, the proposed access control supports non-monotone type access control policy. The ciphertext only can be recovered by users whose attributes satisfy the access control policy. We also implement and measure the performance of our proposed access control. The results of experiments show that our proposed secure access control is feasible.

Currently, local area network (LAN) is commonplace in the Nigerian tertiary institutions and can be a good platform for distributing and disseminating instructional materials. Thus, this paper proposes to improve the quality of academics through online provision of learning resources based on Free and Open Source Software (FOSS); wired and wireless access to contents; and availability of the system 24/7. The system is based on third party software or FOSS called phpBB and Windows 2003 Server Active Directory Services. Both are installed and configured on an intranet. It has a discussion forum which is accessed through Hypertext Transfer Protocol using a web browser; and directory services for files/folders upload and download based on a set of privilege levels in Discretionary Access Control List (DACL) as a way of improving security. The system leads to the development of a virtual campus in Covenant University. Also, it has helpedimprove the quality of teaching by making lecture notes availably on the intranet, lecturer/studentinteraction, accessibility to teaching materials and reduce student’s idle time. The system helps in no small measure to correct the problems plaguing the educational sector such as examination malpractice, decline standards of education and cultism, as students are gainfully engaged in academic and social activities. The creation of a virtual campus would enhance the level of e-participation, and e-readiness of the graduate for the employment market. In particular, it bridges the divide between the developed and the developing nations.

The authors introduce a group-based discretionary access control with decentralized permission and group management for scientific repositories. Currently, access control approaches for repositories have inflexible centralized administrations, which do not scale well to large numbers of users. Moreover, discretionary access control is a legal standard for health-related resources. The proposed access control model, which is formalized using Barker's Unifying Meta-model, differentiates permissions for data and meta-data, enabling the sharing of meta-data while protecting sensitive data. The authors describe how the model was implemented, and what challenges were tackled, in the Epidemic Marketplace, an open software information platform for epidemic studies, designed to foster cooperative behavior and data sharing.

An important new technology has recently been developed that will revolutionize trust and security for online transactions. Conventionally, most of the security-relevant functions are concentrated within the operating system. Often, these functions, especially those dealing with access control, are commingled with object management functions. This article, abstracted from a new book on the subject, explains the key concepts and the exciting potential of Trusted Computing Platforms (often abbreviated to Trusted Platforms). We discuss access control in multilevel database management systems applies and illustrate the main applies of access control based on Trusted Computing in the LogicSQL database system.

TCSEC standard is defined by the U.S. Department of Defense as the operating system security evaluation criteria. Under this standard, Linux system has a higher security level, but there are still some dangers, such as the coarseness of file access granularity. In this paper, we have studied the file access mechanism of Linux, analyzed the security module of LinuxLSM, and then designed the file access mechanism ACL, achieved fine-grained access to files, thus improving the system security level of Linux.

In traditional role-based access control (Role Based Access Control, RBAC), proposed the role and user-groups based on access control with context-aware (Role and Group Based Access Control with Context, RGBACC) model. RGBACC can do unified functional management to users, and can dynamically change the user's permission by the information from application environment in the context of access and security-related .This article RGBACC model applied to the actual document access control system, and the system design and implementation of a detailed description.

In this paper we have taken one of the most amazing network concepts which makes network simpler. By considering the aspect of both side as of good and its related issues like most important and unavoidable is i.e. "Security". Hence, enhancing the security in wireless networks has become of vital importance. In this perspective of concept, we mainly study two security aspects of wireless networks. One is service confidentiality and access control that is to ensure only legitimate users can access service data according to their privileges and in other perspective is of service attack. Wireless broadcast is a convenient and effective approach for disseminating data to a number of users. User training in computer and network security is crucial to the survival of modern networks, yet the methods employed to train users often seem ineffective. The secrecy issues in the context of mandatory and discretionary access control in a multilevel networked environment. Hence of, we stressed on two aspects key management scheme is proposed to address secrecy and efficiency in broadcast services, where keys are used for service confidentiality and access control.