Search

The use of a simple Windows authentication password is not always enough to ensure protection and confidentiality of the data stored on user's workstations. In this paper we propose and implement an encrypted file system. The proposed solution is based on creating and using encrypted volumes embedded (stored) on a physical partition. The encrypted volumes act as virtual drives which offer the user the impression that he's working with a normal physical partition. Security of the password and the encrypted volumes' portability are ensured by the developed application. [ABSTRACT FROM AUTHOR]

This paper shows the design and development of an access control and interlocking system for the Molecular Immunology Center because the commercial systems installed in this center do not meet all needs. The proposed system consists of two electronic boards: the door controller and the interlock controller, both were developed based on Microchip's PIC microcontroller programmed using CCS PCW compiler. These cards are able to communicate with devices like barcode reading, proximity, biometric or any other that transmit by Wiegand protocol. They must also be configured to operate in a desired manner and therefore a software application was developed using Qt as framework, and implementing effective practices of software engineering. This application communicates with the controllers via RS232 using Modbus protocol. [ABSTRACT FROM AUTHOR]

With the emergence of diverse group-based services, multiple multicast groups are likely to coexist in a single network, and users may subscribe to multiple groups simultaneously. However, the existing group key management (GKM) schemes, aiming to secure communication within a single group, are not suitable in multiple multicast group environments because of inefficient use of keys, and much larger rekeying overheads. In this paper, we propose a new GKM scheme for multiple multicast groups, called the master-key-encryption-based multiple group key management (MKE-MGKM) scheme. The MKE-MGKM scheme exploits asymmetric keys, i.e., a master key and multiple slave keys, which are generated from the proposed master key encryption (MKE) algorithm and is used for efficient distribution of the group key. It alleviates the rekeying overhead by using the asymmetry of the master and slave keys, i.e., even if one of the slave keys is updated, the remaining ones can still be unchanged by modifying only the master key. Through numerical analysis and simulations, it is shown that the MKE-MGKM scheme can reduce the storage overhead of a key distribution center (KDC) by 75 percent and the storage overhead of a user by up to 85 percent, and 60 percent of the communication overhead at most, compared to the existing schemes. [ABSTRACT FROM PUBLISHER]

Access control is a critical feature of many systems, including networks of services, processes within a computer, and objects within a running process. The security consequences of a particular architecture or access control policy are often difficult to determine, especially where some components are not under our control, where components are created dynamically, or where access policies are updated dynamically. The SERSCIS Access Modeller (SAM) takes a model of a system and explores how access can propagate through it. It can both prove defined safety properties and discover unwanted properties. By defining expected behaviours, recording the results as a baseline, and then introducing untrusted actors, SAM can discover a wide variety of design flaws. SAM is designed to handle dynamic systems (i.e., at runtime, new objects are created and access policies modified) and systems where some objects are not trusted. It extends previous approaches such as Scollar and Authodox to provide a programmer-friendly syntax for specifying behaviour, and allows modelling of services with mutually suspicious clients. Taking the Confused Deputy example from Authodox we show that SAM detects the attack automatically; using a web-based backup service, we show how to model RBAC systems, detecting a missing validation check; and using a proxy certificate system, we show how to extend it to model new access mechanisms. On discovering that a library fails to follow an RFC precisely, we re-evaluate our existing models under the new assumption and discover that the proxy certificate design is not safe with this library. [ABSTRACT FROM AUTHOR]

The stringent security requirements of organisations like banks or hospitals frequently adopt role-based access control (RBAC) principles to represent and simplify their internal permission management. While representing a fundamental advanced RBAC concept enabling precise restrictions on access rights, authorisation constraints increase the complexity of the resulting security policies so that tool support for convenient creation and adequate validation is required. A particular contribution of our work is a new approach to developing and analysing RBAC policies using a UML-based domain-specific language (DSL), which allows the hiding of the mathematical structures of the underlying authorisation constraints implemented in OCL. The DSL we present is highly configurable and extensible with respect to new concepts and classes of authorisation constraints, and allows the developer to validate RBAC policies in an effective way. The handling of dynamic (that is, time-dependent) constraints, their visual representation through the RBAC DSL and their analysis all form another part of our contribution. The approach is supported by a UML and OCL validation tool. [ABSTRACT FROM AUTHOR]

In Mobile Ad Hoc Networks (MANETs), the existing literature work does not provide information about the occurrence of Backoff collision. In this paper, we introduce a link-utility-based Improved Backoff Cooperative MAC (LIBC-MAC) protocol. In this MAC protocol, when nodes along the transmitting path lie in different transmission region, then cooperative transmission is invoked by the corresponding node. Cooperative paths are selected by finding link utility value, which is computed in terms of transmission type, rate, power, link lifetime and bandwidth. Further, our technique utilizes an improved backoff algorithm to mitigate the problem of collision. The backoff algorithm is based on number of nodes and degree of mobility. Through simulation results we prove the efficiency of our technique. Our technique effectively eliminates the hidden node problem. [ABSTRACT FROM AUTHOR]

Abstract: Any secured system (such as secure group communication) can be modeled as a capability-based access control system in which each user is given a set of secret keys of the resources he is granted access to. In some large systems with resource-constrained devices, such as sensor networks and RFID systems, the design is sensitive to key storage cost. With a goal to minimize the maximum key storage needed at any user, key compression based on key linking, that is, deriving one key from another without compromising security, is studied. A lower bound on key storage needed for a general access structure with key derivation is derived. This bound demonstrates the theoretic limit of any systems which do not trade off security and can be viewed as a negative result to provide ground for designs with security tradeoff. A provably secure key derivation scheme based on pseudorandom functions is given, along with an algorithm to find the optimal key linking pattern for any given access structure. Using the key linking framework, a number of key pre-distribution schemes in the literature are analyzed. [Copyright &y& Elsevier]

Entities and their relationships for various fields of specialization can be described by ontologies. For example, the classes, relationships, and methods for designing a virus may be put into a Protégé ontology. If that design is to be integrated with a missile design, it will require a standard way of sharing and cross-referencing both classes and objects of the ontologies. This should be done in a secure way which only allows access to specified researchers using specified classes, relations, methods, and documentation. In this paper, we introduce a framework for ontology sharing that enables ontologies to easily be deployed on the web. Kernel0 is the ontology of classes, relations, attributes, and objects. It describes its own typing constraints and meta-data in the same way as data. Objects can have relationships to objects of other ontologies. Kernel-1 authorization definitions in our framework are able to dynamically determine the permissions of each user or group for queried objects. Our authorization has the ability to perform inferences via IS-A inheritance and by evaluating implicit relations and operator definitions. All modifications of values in the knowledge base are checked for both appropriate authorization and satisfaction of all typing constraints. [ABSTRACT FROM AUTHOR]

With the advent of Radio Frequency Identification technologies or RFID for short, different types of products and security-relevant applications have been developed for use in fields and businesses like: inventory management, product tracking, access control, passports or transport fare collection. Even though RFID has been around for quite some time, there are some types of businesses like theme parks, water parks or music festivals that haven't yet tested the benefits that this technology brings. This paper focuses on presenting advantages and disadvantages of using an unified access control and electronic wallet system based on RFID cards like MiFare tags as an alternative to existing ticket/currency access and payment systems employed by the majority of the businesses mentioned above. [ABSTRACT FROM AUTHOR]

The design of wireless local area networks (WLANs) with enhanced throughput performance have attracted significant amounts of attention in recent years. Based on the IEEE 802.11n standard, frame aggregation is considered one of the major factors to improve the system performance of WLANs from the medium access control (MAC) perspective. In order to fulfill the requirements of high throughput performance, feasible design of automatic repeat request (ARQ) mechanisms becomes important for providing reliable data transmission. In this paper, two MAC-defined ARQ protocols are proposed to consider the effect from frame aggregation for the enhancement of network throughput. An aggregated selective repeat ARQ (ASR-ARQ) scheme is proposed which incorporates the selective repeat ARQ scheme with the consideration of frame aggregation. On the other hand, for worse channel quality, the aggregated hybrid ARQ (AH-ARQ) mechanism is proposed to further enhance the throughput performance by adopting the Reed-Solomon (RS) block code as forward error correction (FEC) scheme. Novel analytical models for both the ASR-ARQ and AH-ARQ protocols are established with the consideration of interfering wireless stations. Simulations are conducted to validate and compare the proposed ARQ mechanisms based on the service time distribution and system throughput. Numerical evaluations show that the proposed AH-ARQ protocol can outperform the other schemes under worse channel condition; while the ASR-ARQ scheme is superior to the other mechanisms under better channel condition. [ABSTRACT FROM PUBLISHER]

Copyright of InfoM is the property of Belgrade University, Faculty of Organizational Science and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Five-phase reservation protocol (FPRP) is a contention-based media access control protocol for wireless ad hoc networks. FPRP uses a five-phase reservation process to establish slot assignments based on time division multiple access. It allows a node to reserve only one slot in an information frame. Once a node has reserved a slot, it will cease contending for other slots. As a result, there may be less contending nodes in the remaining slots, so the time slots in an information frame are not fully used by FPRP. To improve time slot utilization, this paper proposes an improved pseudo-Bayesian algorithm, based on which an improved contention access mechanism for FPRP is proposed, in which nodes are allowed to contend for more than one slot in a reservation frame according to a certain probability/priority. Simulation results indicate that the proposed mechanism performs better than FPRP in time slot utilization and hence the network throughput under various scenarios. [ABSTRACT FROM AUTHOR]

Obligations are an essential element of security policies since they enable the specification of many security requirements such as availability, privacy, usage control and data protection. In everyday life, the fulfillment of obligations is often the responsibility of more than one subject, e.g., 'All patients must be checked by one of the doctors'. Obligations may also be fulfilled in different ways, e.g., 'Every customer should pay either in cash or by check'. Current security policy languages do not enable the specification of these intuitive and much needed requirements. In this paper, we show how policy languages can be extended to support the specification of these requirements which we call group obligations. To clarify the semantics of group obligations, we introduce state-based models for both group and individual obligations and show how group obligations can be managed according to change in the state of individual obligations. We formalize the semantics of the model and interactions between individual and group obligations by introducing a policy-enforcement language ℒE. ℒE enables the formal description of the application domain and the policy and provides operational semantics for policy management. Moreover, we discuss termination and determinism of policy enforcement in the proposed framework and show how different sanction/reaction policies may be activated when group obligations are violated. [ABSTRACT FROM AUTHOR]

Abstract: The emergence of Cyber-Physical Systems (CPSs) heralds the ubiquitous and autonomous globally interconnected networks of embedded devices with their own means of interaction with the physical environment. The complex interactions with the physical environment significantly increase security risks. Especially, for mission-critical CPSs, sensitive data are closely related to security issues and are accessed only by authorized users. Role based access control is an essential component for protecting CPSs from unauthorized access. However, existing mechanisms are inadequate. We argue that role assignment should not depend on the remaining energy of a node but its reputation. This paper proposes a role-based access control model, R2BAC, for CPSs using reputation. The definitions and evaluation metrics of trust and reputation are given in order to evaluate the behavior of the nodes. Then reputation evaluation scheme and role assignment scheme are presented, respectively. In addition, we give the proofs of correctness and complexity analysis for R2BAC. Eventually, a wide set of simulations are provided to evaluate its performance. [Copyright &y& Elsevier]

Secure communication over a network which is insecure, Virtual Private Network (VPN) plays an important role for providing security. Ensuring security in VPN is a major task since it is subject to several attacks along with the security criteria such as authentication, access control, confidentiality and integrity. In this paper, we propose a frame work to improve the VPN architecture by using concurrent multipath transfer with path assignment and multi-homing technique for secure data transmission. In this work, the data from the source is encrypted before transmission through the public network. Encrypted data is then divided into several segments. Subsequently the symmetric key required for encryption and the data segments are all assigned to separate ISPs (Internet Service Providers) and VPN tunnels. They are transferred concurrently using multi-homing to the target VPN gateway in the public networks. The target VPN gateway first retrieves the symmetric key from the corresponding tunnel and then reassembles the data segments to get the resultant decrypted data. This enhances the integrity of the network as it maintains the confidentiality also. This technique is efficient as the original data cannot be determined by the attacker since the data is transmitted in fragments and the key required for decrypting is also not easily available. By simulation results, we proved that the proposed technique achieves good packet delivery ratio, compared with the existing technique. [ABSTRACT FROM AUTHOR]

Recently, XML (eXtensible Markup Language) has obtained popularity for representing and exchanging data over the Internet. With the growing popularity of XML, a large number of the XML documents with private data appeared on the web. Thus, the need of an access control mechanism for the XML document over the World Wide Web arises. There have been a number of researches to specify and enforce access control for the XML data but a unified overview of the XML access control seems still necessary. In this paper, we first investigate the basic concepts of designing and developing an XML access control system and then classify current XML access control models and mechanisms to assist researchers in identifying current practices and trends and to give new directions in improving previous researches and discovering new challenges. [ABSTRACT FROM AUTHOR]

Abstract: Due to realization of the grid environment as commercial grid where diverse and unknown users can access the grid resources for job execution, resource access control becomes a major issue. Traditional methods of providing access control to grid resources fail because of lack of flexibility and scalability in them. Considering grid environment as cooperative model of the society, it is envisioned that as people like to give their valuable belongings to only trustworthy people to safeguard themselves from loss similarly if, somehow, the resource providers are able to classify the requesting users as trustworthy or not before giving them access of resources, then they will be able to protect their resources from malicious users. In this paper classification of the user requesting grid resources as trustworthy or not is done using Radial Basis Function Neural Network (RBFNN). They are good at approximation and are able to generalize well even for that data whose training is not given to the network. [Copyright &y& Elsevier]

Abstract: The end-to-end packet delay in mobile ad hoc network depends on many influential variables such as path length from source to destination, average neighbours of intermediate hops, interference from other transmissions and medium access control protocol etc. Hence, accurate prediction of end-to-end packet delay is very difficult but necessary for Quality of Service (QoS) routing in Mobile Ad Hoc Network (MANET) environment. In this article, we have tried to evaluate the applicability and capability of artificial neural network for prediction of end-to-end packet delay in mobile ad hoc network environment. We have used path length and average number of neighbors between source destination pair as input parameters to calculate the delay. In the present study, we developed two models based on Radial Basis Function (RBF) network and Generalized Regression Neural Network (GRNN). Three different data sets consisting of delay, path length and average neighbors are obtained using network simulator for three different routing protocols namely (i) Ad-hoc On-demand Distance Vector (AODV) routing, (ii) Destination Sequenced Distance Vector (DSDV) routing and (iii) Dynamic Source Routing (DSR). According to various performance evaluation criterion, we found that GRNN gives better prediction than RBF network [Copyright &y& Elsevier]

To achieve high efficiency and robustness during the node contention process in medium access control (MAC) protocols, a k-round contention resolution (k-CR) scheme is devised. Theoretical analysis of its success probability of selecting only one node ps and throughput is also presented. Numerical results show that the k-CR scheme can achieve higher ps than the k-round elimination contention (k-EC) scheme, and higher throughput than the k-EC and IEEE 802.11 DCF schemes in a wireless local area network environment. [ABSTRACT FROM AUTHOR]

Significance and popularity of Role-Based Access Control (RBAC) is inevitable; however, its application is highly challenging in multi-domain collaborative smart city environments. The reason is its limitations in adapting the dynamically changing information of users, tasks, access policies and resources in such applications. It also does not incorporate semantically meaningful business roles, which could have a diverse impact upon access decisions in such multi-domain collaborative business environments. We propose an Intelligent Role-based Access Control (I-RBAC) model that uses intelligent software agents for achieving intelligent access control in such highly dynamic multi-domain environments. The novelty of this model lies in using a core I-RBAC ontology that is developed using real-world semantic business roles as occupational roles provided by Standard Occupational Classification (SOC), USA. It contains around 1400 business roles, from nearly all domains, along with their detailed task descriptions as well as hierarchical relationships among them. The semantic role mining process is performed through intelligent agents that use word embedding and a bidirectional LSTM deep neural network for automated population of organizational ontology from its unstructured text policy and, subsequently, matching this ontology with core I-RBAC ontology to extract unified business roles. The experimentation was performed on a large number of collaboration case scenarios of five multi-domain organizations and promising results were obtained regarding the accuracy of automatically derived RDF triples (Subject, Predicate, Object) from organizational text policies as well as the accuracy of extracted semantically meaningful roles. [ABSTRACT FROM AUTHOR]

Modern industrial systems are enriched by cyber–physical devices and interconnections with business processes that enable flexible production, remote monitoring, control and maintenance. These systems are typically subject to multiple authorities which must cooperate with each other, as in the case of segmented industrial environments and supply chains. In similar contexts, voluntary or unintentional damages may be caused by cyber attacks or by misbehaving authorized parties. We propose an original architecture that regulates accesses to industrial systems' resources through authorization delegation procedures. It guarantees several benefits that include the possibility of auditing authorizations released by delegated third parties, of detecting misconducts and possible attacks, and of assuring attribution of misconducts. The proposed solution is compatible with constraints characterizing industrial environments and with security and performance requirements of industrial architectures. The performance and latencies of the auditing mechanisms are evaluated through a prototype. [ABSTRACT FROM AUTHOR]

e-lab is a remote laboratory platform that provides access to several remote experiments in basic or advanced physics . Recent upgrades to it's interface and new features introduced make it more accessible and appealing, but experiment's attractiveness for teachers and students has been an issue. A new experiment intended to improve this aspect was introduced: the World Pendulum. Consisting in multiple identical pendulum apparatuses connected to e-lab and scattered throughout different locations across several countries. The World Pendulum is intended at exploring a unique feature allowed by remote experimentation - experimental repetition in different locations. [ABSTRACT FROM AUTHOR]

Cloud computing is a type of computing through which data can be stored, managed and processed remotely rather than locally with essentially the internet. The key characteristics it possesses are numerous like centralized network access, cost, low maintenance, resource-sharing, scalability, etc., are the reasons why the entire world is relayed on cloud computing. In this paper, we propose a secure; privacy enhances multi-owner data sharing for dynamic groups in the cloud. In addition, we propose an auditing service to perform audits for multiple users simultaneously and efficiently, a process called Batch Auditing. As the emerging trend of forming dynamic groups for multi-owner data sharing, finding the odd person in the group is the biggest task. Our implementation performs well relative to the underlying security, privacy enhancing issues for dynamic groups using batch auditing. [ABSTRACT FROM AUTHOR]

Over the last few decades, the proliferation of the Internet of Things (IoT) has produced an overwhelming flow of data and services, which has shifted the access control paradigm from a fixed desktop environment to dynamic cloud environments. Fog computing is associated with a new access control paradigm to reduce the overhead costs by moving the execution of application logic from the centre of the cloud data sources to the periphery of the IoT-oriented sensor networks. Indeed, accessing information and data resources from a variety of IoT sources has been plagued with inherent problems such as data heterogeneity, privacy, security and computational overheads. This paper presents an extensive survey of security, privacy and access control research, while highlighting several specific concerns in a wide range of contextual conditions (e.g., spatial, temporal and environmental contexts) which are gaining a lot of momentum in the area of industrial sensor and cloud networks. We present different taxonomies, such as contextual conditions and authorization models, based on the key issues in this area and discuss the existing context-sensitive access control approaches to tackle the aforementioned issues. With the aim of reducing administrative and computational overheads in the IoT sensor networks, we propose a new generation of Fog-Based Context-Aware Access Control (FB-CAAC) framework, combining the benefits of the cloud, IoT and context-aware computing; and ensuring proper access control and security at the edge of the end-devices. Our goal is not only to control context-sensitive access to data resources in the cloud, but also to move the execution of an application logic from the cloud-level to an intermediary-level where necessary, through adding computational nodes at the edge of the IoT sensor network. A discussion of some open research issues pertaining to context-sensitive access control to data resources is provided, including several real-world case studies. We conclude the paper with an in-depth analysis of the research challenges that have not been adequately addressed in the literature and highlight directions for future work that has not been well aligned with currently available research. [ABSTRACT FROM AUTHOR]