A new security policy for distributed resource management and access control

BackgroundClinical information systems frequently use intranet and Internet technologies. However these technologies have emphasized sharing and not security, despite the sensitive and private nature of much health information. Digital certificates (electronic documents which recognize an entity or its attributes) can be used to control access in clinical intranet applications.ObjectivesTo outline the need for access control in distributed clinical database systems, to describe the use of digital certificates and security policies, and to propose the architecture for a system using digital certificates, cryptography and security policy to control access to clinical intranet applications.MethodsWe have previously developed a security policy, DIMEDAC (Distributed Medical Database Access Control), which is compatible with emerging public key and privilege management infrastructure. In our implementation approach we propose the use of digital certificates, to be used in conjunction with DIMEDAC.ResultsOur proposed access control system consists of two phases: the ways users gain their security credentials; and how these credentials are used to access medical data. Three types of digital certificates are used: identity certificates for authentication; attribute certificates for authorization; and access-rule certificates for propagation of access control policy. Once a user is identified and authenticated, subsequent access decisions are based on a combination of identity and attribute certificates, with access-rule certificates providing the policy framework.ConclusionsAccess control in clinical intranet applications can be successfully and securely managed through the use of digital certificates and the DIMEDAC security policy.

A model of resource access control is presented in which the access control to resources can employ user interaction to obtain the necessary permissions. This model is inspired by and improves on the Java security architecture used in Java-enabled mobile telephones. We extend the Java model to incl ude access control permissions with multiplicities in order to allow to use a permission a certain number of times. We define a program model based on control flow graphs together with its operational semantics and provide a formal definition of the basic security policy to enforce viz that an application will always ask for a permission before using it to access a resource. A static analysis which enforces the security policy is defined and proved correct. A constraint solving algorithm implementing the analysis is presented.

Traditional access control mechanisms prevent illegal access by controlling access right before executing an action; they belong to a class of a priori security solutions and, from this point of view, they have some limitations, like inflexibility in unanticipated circumstances. By contrast, a posteriori mechanisms enforce policies not by preventing unauthorized access, but rather by deterring it. Such access control needs evidence to prove violations. Evidence is derived from one or several log records, which trace each user's actions. Efficiency of violation detection mostly depends on the compliance of log records with the access control policy. In order to develop an efficient method for finding these violations, we propose restructuring log records according to a security policy model. We illustrate our methodology by applying it to the healthcare domain, taking care of the IHE (Integrating the healthcare enterprise) framework, particularly its basic security profile, ATNA (Audit Trail and Node Authentication). This profile defines log records established on the analysis of common health practice scenarios. We analyze and establish how ATNA log records can be refined in order to be integrated into an a posteriori access and usage control process, based on an expressive and contextual security policy like the OrBAC policy.

Since Hospital Information Systems (HIS) are designed to support doctors and healthcare professionals in their daily activities, information security plays a vital role in managing access control. Efficiency and effectiveness of information security policy is crucial, especially when dealing with situations that affect the status and life-history of the patient. In addition, the rules and procedures to follow, in order to provide confidentiality of sensitive information, have to focus on management of events on any table of the HIS. On the other hand, control and statement constraints, as well as events and security auditing techniques, play also an important role, due to the heterogeneity of healthcare professionals’ roles, actions and physical locations, as well as to the specific characteristics and needs of the healthcare organizations. This chapter will first explore issues in managing access control and security of healthcare information by reviewing the possible threats and vulnerabilities as well as the basic attributes of the hospital’s security plan. The authors will then present a hierarchical access model that, from a security policy perspective, refers to data ownership and access control issues. The authors conclude the chapter with discussions of upcoming security issues.

Role-based access control (RBAC) is a widely-used protocol to design and build an access control for providing the system security regarding authorization. Even though in the context of internet resources access, the authentication and access control are providing critical functionalities. In practice, the RBAC model has three perspectives such as Access Control, End User, and Administrator. An access control model must be built while giving highest priority to Access Control dimension. It means that the system must be secure regarding authorization. Thus, the system may be less useful for end-users and administrators. In this paper, we categorize that the basic motivation behind RBAC model is the easiest administration compared to tight authorization that becomes the reason for the evolution of RBAC model. Tight authorization creates many problems to make a system secure regarding authorization. Therefore, the true dimensions of RBAC model are identified in this study to change the mindset of researchers that RBAC is evolved for easier administration instead of tight access control. We propose a solution to incorporate the concept of roles for relaxed administration along with the permission-based access control. Moreover, we conclude that the dynamic separation of duty (DSD) should be implemented by permissions instead of roles in RBAC model.

We propose the πD-calculus, a process calculus that can flexibly model fine-grained control of resource access in distributed computation, with a type system that statically prevents access violations. Access control of resources is important in distributed computation, where resources themselves or their contents may be transmitted from one domain to another and thereby vital resources may be exposed to unauthorized processes. In πD, a notion of hierarchical domains is introduced as an abstraction of protection domains, and considered as the unit of access control. Domains are treated as first-class values and can be created dynamically. In addition, the hierarchal structure of domains can be extended dynamically as well. These features are the source of the expressiveness of πD. This paper presents the syntax, the operational semantics, and the type system of πD, with examples to demonstrate its expressiveness.

The enforcement of fine-grained access control policies in constrained dynamic networks can become a challenging task. The inherit constraints present in those networks, which result from the limitations of the edge devices in terms of power, computational capacity and storage, require an effective and efficient access control mechanism to be in place to provide suitable monitoring and control of actions and regulate the access over the resources. In this article, we present RESPOnSE, a framework for the specification and enforcement of security policies within such environments, where the computational burden is transferred to high-tier nodes, while low-tier nodes apply risk-aware policy enforcement. RESPOnSE builds on a combination of two widely used access control models, Attribute-Based Access Control and Role-Based Access Control, exploiting the benefits each one provides. Moreover, the proposed mechanism is founded on a compensatory multicriteria decision-making algorithm, based on the calculation of the Euclidean distance between the run-time values of the attributes present in the security policy and their ideal values, as those are specified within the established policy rules.

The Windows Embedded operating system (OS) adopts a discretionary access control (DAC)-based policy, but underlying vulnerabilities exist because of external hacker attacks and other factors. In this study, we propose a system that improves the security of the Windows Embedded OS by applying a mandatory access control (MAC) policy in which the access rights of objects, such as files and folders, and subjects’ privileges, such as processes, are compared. We conducted access control tests to verify whether the proposed system could avoid the vulnerabilities of DAC-based systems. Our results indicate that the existing DAC-based security systems could be neutralized if a principal’s security policy is removed. However, in the proposed MAC-based Windows Embedded OS, even if the clearance and category values of a subject’s files are given the highest rating, all accesses are automatically denied. Therefore, the execution of all files that were not previously registered on the whitelist was denied, proving that security was improved relative to DAC-based systems.

Hybrid wireless network technologies are well suited to providing broadband access everywhere with enhanced performance in term of coverage, capacity and throughput compared to access networks based on a single technology. Wireless broadband technologies have implicit advantages such as an ability to serve the customer everywhere and mitigate the digital divide, offer right capacity at right cost and remain connected on the move. Wireless is scalable in both capacity and coverage areas, an imperative as requested services evolve towards increasingly bandwidth hungry applications. There is a rapid development that takes place today, with a considerable interest in establishing WiMAX solutions copying the success of WiFi. This may well happen, but many challenges are still to be overcome. Interoperability of hybrid networks is a key design objective to drive solution costs down. Efficient utilisation of the frequency spectrum requires progress in various fields such as interference suppression and smart radios, efficient resource management and access control. The designing and planning of hybrid networks require suitable software tools taking into account user and service characteristics as well as evolving technical and economical factors. This paper is based on work in the project BROADWAN (BROADWAN, 2004; Tjelta et al., 2004), partly funded under the Information Society Technologies (IST) priority of the European Commission Sixth Framework Programme.

Cronus [1-7] is an object oriented distributed system which operates in a heterogeneous computer environment of interconnected local area networks. As a distributed system architecture. Cronus faces a number of resource management issues not present in non-distributed architectures. Strategies for effectively controlling the redundancy and reconfigurability inherent in Cronus are needed to take advantage of the distributed system environment. These strategies for resource management are often conveniently separated into policies and mechanisms. A policy is a goal or guideline set by a system administrator or component designer constraining the decisions made by a resource allocator. A mechanism is an internal system structure designed to implement a class of policies.In the Cronus distributed system model, there are currently two general aspects of resource allocation mechanisms which are particular to the network environment and must be effectively managed. One of these is the binding of a client request to a particular resource manager for those resources which are available redundantly. Redundancy comes in two forms: replicated objects, (e.g., a multi-copy file) and replicated managers (any manager for a type can create a new instance of that object type). For both forms the selection of an object manager to provide the given service is an important resource management policy decision. The other important aspect of resource management mechanism is the ability to reconfigure parts of the system by dynamically migrating objects. Object migration is a powerful tool for matching system resources to tasks in a manner that attempts to maximize some measure of system performance, reliability, or survivability. Both static reconfiguration (e.g., choosing or amending the placement of object managers and their associated objects), and dynamic reconfiguration (e.g., moving an individual object in direct response to demand for its use possible in the Cronus architecture and design.The general approach to resource management in Cronus is to individually control the management of the classes of objects which make up the system. This approach extends Cronus resource management concepts beyond system resources to the abstract resources developed by applications. Resource management for an individual abstract resource (type) and for groups of related resource types (services) in Cronus is based on combining a number of carefully planned mechanisms which are part of the system architecture. In addition to resource management by resource type, a client specific policy which considers collections of object types used in a specific context can be constructed.In Cronus we achieve system wide and easily controllable resource management by requiring the object managers to cooperate in enforcing a resource management policy for their resource type. An object manager can redirect operations to a peer manager on another processor on the basis of current resource status. In the case for creation of a file to an alternate file manager which may have more storage available. Part of the basis for decisions to redirect requests are parameters, settable dynamically by system administrators through monitoring and control functions, which control the resource management strategy. The creation of objects and resource management in general thus becomes a responsibility that is decentralized among object managers on each processor based on a global allocation policy, both in terms of sharing current status and possible redirection of operations between managers.The Cronus resource management model is based on the integration of the following set of primitive mechanisms: the kernel routes requests for a given type to any available manager of that type, using the Locate mechanismCronus managers redirect requests to a more appropriate peer to accomplish resource management objectivesmanagers periodically collect current status of their peers, via a standard mechanism (ReportStatus), to be used as a basis for selecting a site for redirecting an operationusers and applications optionally indicate specific location preferences with requestsan operator can monitor and regulate the functioning of the resource management policyapplications can use the basic system mechanisms (e.g. broadcast or multicast, ReportStatus operations) to build special-purpose resource management strategies tailored to their needThere is a hierarchy of desirable locations for implementing resource management policies: object managers, shared libraries, and finally client programs or users themselves. Managers are the most desirable because they are readily identifiable with a limited set of object types which are likely to have similar policy goals. Also, managers are addressable as a group for administrative control to regulate the policy parameters, and for peer manager cooperation to implement the policy. Many decisions are negotiated between managers based upon information periodically obtained via the ReportStatus operation. The Cronus Monitoring and Control System uses the same ReportStatus operation to present the operator with a global view of how well the resource management policy is proceeding.In this paper we elaborate on these approaches to distributed resource management in Cronus, including appropriate background, detailed system design, and experiences with incorporating these ideas into three different resource managers.

Mobile agent systems provide new perspectives for distributed e-commerce applications. These applications may present specific restrictions, making mobile agent systems a feasible solution. Even so, mobile agents present some security related problems. An important one is resource access control. The ability for mobile agents to provide a simple, scalable, flexible, and secure access control system is a key point for the widespread adoption of mobile agents. In this paper we propose a mechanism to safely assign roles to mobile agents and an access control method based on Role-based Access Control (RBAC). The access control method provides a simple, lightweight and distributed model for mobile agent applications. It is proposed as an extension of the MARISM-A (An Architecture for Mobile Agents with Recursive Itineraries and Secure Migration) project, a secure mobile agent platform.

Current paradigm changes for improving safety, quality and efficiency of care processes under massive deployment of information and communication technologies (ICT) place high requirements on privacy and security. These mainly focus on privilege management and access control harmonized in international standards and their further evolution. NIST and ISO, but especially HL7 play a prominent role in this context. Starting with classic role-based access control (RBAC) foundations to new specifications for security and privacy labeling of segmented health information, HL7 security is presented as a scalable intermediate solution on the way to comprehensive privilege management and access control by explicit, ontology-based, formal and therefore machine-processable policies. The successfully balloted HL7 labeling specification supports context-sensitive communication and cooperation between different stakeholders and processes with different purposes of use, based on meta-data of information, actors and processes involved. Basics of policy management and practical solutions are discussed.

The increasing use of wireless technologies in enterprise networks demands strong security management and policy enforcement mechanisms. The conventional security management frameworks used in wired LAN do not suit in wireless domain due to dynamic topology and mobility of hosts. The enforcement of organizational security policies in wireless LAN requires appropriate access control models as well as correct distribution of access control rules in the network access points. In this paper, we propose a WLAN security management framework supported by a spatio-temporal RBAC (STRBAC) model. The concept of mobile IP has been used to ensure a fixed layer 3 address of a mobile host. Each wireless policy zone consists of a Policy Zone Controller that coordinates with a dedicated Local Role Server to extract the low level access configurations corresponding to the zone access routers. The system can be mapped into a reconfigurable hardware to exploit the parallelism in computing. We also propose a formal STRBAC model to represent the global security policies formally and a SAT based decision procedure to verify the access configurations

Traditionally, the definition and the maintenance of security and access control policies has been the exclusive task of system administrators or security officers. In modern distributed and heterogeneous systems, there exist the need to allow different stakeholders to create and edit their security and access control preferences. In order to solve this problem two main challenges need to be met. First, authoring tools with different user interfaces should be designed and adapted to meet domain background and the degree of expertise of each stakeholder. For example, policy authoring tools for a patient or a doctor should be user friendly and not contain any technical details, while those for a security administrators can be more sophisticated, containing more details. Second, conflicts that can arise among security policies defined by different stakeholders must be considered by these authoring tools on runtime. Furthermore, warnings and assisting messages must be provided to help defining correct policies and to avoid potential security risks. Towards meeting these challenges, we propose an authoring framework for security policies. This framework enables building authoring tools that take into consideration the views of different stakeholders.KeywordsSecurity policyEHRPolicy authoringUsabilityModel-driven engineering

News