Characteristics and general requirements for the access control and management system

The article shows the relevance of the widespread use of computer vision technology on the example of face recognition as part of the access control and management system. The main methods that are used in the implementation of classical control systems and access control are considered. The scheme for the implementation of the access control with face recognition technology is described. The use of this technology makes it possible to increase the level of information security of enterprises and, as a result, reduce the possible financial damage from the implementation of attacks on their assets from illegitimate penetration into the protected area through the access control system using the passes of legal users.

To treat technical problems of data acquisition, alarm management, and historical data archiving of radiation protection control system in Thorium Molten Salt Reactor, a network prototype system was designed based on experimental physics and industrial control system. Radiation level of many locations in Jiading campus of Shanghai Institute of Applied Physics is being continuously monitored, and boundaries of accelerator facilities and radiochemical areas are defined by the access control system. In this paper, we introduce the control system design, including human–machine interfaces, alarm system, historical data archiving system, and the software for access control. The software development followed the standard of Capability Maturity Model Integration (CMMI®) Level 3, and the software had passed a third-party test, which indicated that the functionality and the reliability could fulfill the requirements of the radiation protection system.

Nowadays, people around the world completely depend and mostly use the Internet to maintain communication, contact with family, friends and with people around the world, access and exchange information, and enjoy multimedia communication. As the use of internet increase then users those who use internet and Access the information using internet in the organization or outside organization also increase. User Data security is very tedious and important part of IT system and its user lifecycle control system. Because of this the reason user data security is always consider while designing security systems for an organization. Modern approaches are to maintain the track of users and records of user access, Identity management systems and Access Management Systems are used. Identity management system help to provide a super-set of user provisioning systems that provide easy management of user credentials and their identity information to users and others those who need that information. Similarly Access Management Systems provide strong authentication and authorization solution using SSO, WebSEAL, and policy-based approach to identify who can access the resource at what level. The new research and approaches provide such a new functions base on organization policies that help to re-engine the access of user base on security procedures to the resources which are available. This paper provides an overview of the Identity Management Systems Access Management System and Federated Identity Manager that how they are use to manage the user security and also the challenges or risks in implementing a Secure system.

Advanced centralised access control (CAC) systems are widely deployed on campuses as a means to provide security and track movements. There is concern that some campuses are not using such protective systems, hence this paper attempts to resolve this weaknesses in such institutions’ by developing a simpler CAC system using the Radio Frequency (RF) and contactless smart card technologies. The scope of the developed system is not only limited to access control but also to utilise the gathered data to automate and potentially to support other processes of the institution, such as lecture scheduling and attendance tracking.

The increased complexity of modern access control (AC) systems stems partly from the need to support diverse and multiple administrative domains. Systems engineering is a key technology to manage this complexity since it is capable of assuring that an operational system will adhere to the initial conceptual design and defined requirements. Specifically, the verification stage of an AC system should be based on techniques that have a sound and mathematical underpinning. Working on this assumption, model checking techniques are applied for the verification of predefined system properties, and thus, conducting a security analysis of a system. In this paper, we propose the utilization of automated and error-free model checking techniques for the verification of security properties in multi-domain AC systems. Therefore, we propose a formal definition in temporal logic of four AC system properties regarding secure inter-operation with Role-Based Access Control (RBAC) policies in order to be verified by using model checking. For this purpose, we demonstrate the implementation of a tool chain for expressing RBAC security policies, reasoning on role hierarchies and properly feeding the model checking process. The proposed approach can be applied in any RBAC model to efficiently detect non-conformance between an AC system and its security specifications. As a proof of concept, we provide examples illustrating the verification of the defined secure inter-operation properties in multi-domain RBAC policies.

Background. In recent years, the development of an automated identification process using biometric authentication has been observed, which has a high level of protection, since it allows you to evaluate the physical parameters and characteristics of a particular person. Such access control is more reliable since identifiers cannot be transferred to third parties or duplicated to bypass security systems. Over the past decades, a significant number of systems with biometric identification has been developed, but systems with identification according to the characteristics of the photoplethysmogram still receive little attention. The main task of biometric personality identification using photoplethysmogram is the search and implementation of machine learning methods to determine their belonging to a particular patient.Objective. The purpose of the paper is to develop an algorithm for distinguishing pulse wave iterations using the calculation of the temporal characteristics of photoplethysmograms, such as the maximum amplitude value, variance, mean absolute deviation, Wilson amplitude and the total sum of signal amplitude values.Methods. Based on the study of the temporal characteristics of the photoplethysmogram, an algorithm for distinguishing pulse wave iterations is created, which can be used for further biometric identification of a person using machine-learning methods.Results. The results can be used for further development of automated access control and management systems using biometric identification.Conclusions. Known methods of biometric identification are usually based on the static parameters of a person (the structure of the cornea of the eye, palm, fingerprints, geometry of the auricle, etc.), but have a low level of protection, since using special equipment you can create a copy of the biometric key. Therefore, today, the use of methods based on the parameters of dynamic biometric identification (plethysmogram, cardiogram and others) provides the highest degree of protection, but requires a more accurate software device to isolate and determine common symptoms. The proposed approach to calculating individual parameters of the photoplethysmogram with the aim of their subsequent classification by machine learning methods may be an acceptable solution for patient biometric identification systems.

This paper discusses methods for preventing SQL (Structured Query Language) injections in identity and access control (IAM) systems. SQL injections represent one of the most serious threats to web security, allowing attackers to gain unauthorized access to and modify data. The main security methods include filtering input data, using prepared statements and parameterization, implementing stored procedures, restricting access rights, and regularly updating software. Effective privilege management and database activity monitoring also play a key role in preventing attacks. The introduction of these measures helps protect confidential information, ensures reliable authentication and authorization, and maintains data integrity. The paper highlights the importance of an integrated approach to database security in the face of growing cyber threats.

The purpose of this paper is to present a computerized integrated project management system and report results of a survey on the effectiveness of the system. The system consists of a scheduling system, material management system, labor/equipment system, and safety/quality control system. The backbone system is a scheduling system that adopts a production planning system and a project scheduling system. The lowest level in the scheduling system is a daily work management system, which is linked to each functional management system (i.e. material management system, labor/equipment system, and safety/quality control system). The paper focuses on the material management and scheduling systems to implement a material “pull” system to reduce material inventories on site. Details of material management and scheduling systems are discussed, and a sample application is presented to demonstrate the features of the proposed computer application system. The paper presents practitioners and researchers with a practical tool to integrate material management and scheduling systems for site personnel.

In traditional framework, mandatory access control (MAC) system and malicious software are run in kernel mode. Malicious software can stop MAC systems to be started and make it do invalid. This problem cannot be solved under the traditional framework if the operating system (OS) is comprised since malwares are running in ring0 level. In this paper, we propose a novel way to use hypervisors to protect kernel integrity and the access control system in commodity operating systems. We separate the access control system into three parts: policy management (PM), security server (SS) and policy enforcement (PE). Policy management and the security server reside in the security domain to protect them against malware and the isolation feather of the hypervisor can protect them from attacks. We add an access vector cache (AVC) between SS and PE in the guest OS, in order to speed up communication between the guest OS and the security domain. The policy enforcement module is retained in the guest OS for performance. The security of AVC and PE can be ensured by using a memory protection mechanism. The goal of protecting the OS kernel is to ensure the security of the execution path. We implement the system by a modified Xen hypervisor. The result shows that we can secure the security of the access control system in the guest OS with no overhead compared with modules in the latter. Our system offers a centralized security policy for virtual domains in virtual machine environments.

Access control system is an important component to protect patients’ information from abuse in a health care system. It is a major concern in the management, design, and development of healthcare systems. Designing access control policies for healthcare systems is complicated due to the dynamic and inherent complexity of the tasks performed by the healthcare personnel. Permissions in access control systems are usually granted on the basis of static policies. However, static policies are not enough to cope with various situations such as emergencies. Most often, the Break-the-glass mechanism is used to bypass static policies to handle emergency situations. Since healthcare systems are critical systems, where errors can be very costly in terms of lives, quality of life, and/or dollars, it is crucial to identify discrepancies between policy specifications and their intended function to implement correctly a flexible access control system. Formal verifications are necessary for exhaustive verification and validation of policy specifications to ensure that the policy specifications truly encapsulate the desires of the policy authors. We present a verifiable framework to enact a dynamic access control model by integrating the ANSI/INCTIS RBAC Reference Model in a workflow and an approach for property verifications of the access control model. Access control policies are expressed by the formal semantics of a model checker and properties are verified by the DiVinE model checker.

Introduction. In order to ensure the sustainable functioning of critical infrastructures (CI), in conditions of the growth of various types of threats, security systems (SB) for various purposes, for example, technical SB, should be created on them. As such systems, first of all, there are security alarm systems, access control and some others. These systems are usually integral parts of the overall physical protection of CI, so they play an important role in ensuring the security of CI. One of the most important SB on the CI is the identification and access control system. In recent years, specialists in these systems have paid closer attention to the issues of ensuring the security of checkpoints for vehicles. It is known that they can be one of the most vulnerable places in the system of physical protection of the CI. Based on this, the task of improving identification and access control systems, including the vehicle, is currently an urgent scientific and practical task, and therefore require further study. Aims and Purposes. The purpose of this study is to develop a simplified conceptual design of the wireless identification and access control system of the vehicle on the CI. Methods. To achieve this goal, the methods of system analysis, elements of the theory of radio engineering, as well as methods of analysis, description, generalization, results of research works on the subject of research were used. Results and discussion. The existing systems of wireless identification and access control on CI are considered on the example of wireless identification and access control systems of the vehicle. Some ways of improving the safety and reliability of the operation of these systems are outlined. The analysis of ways to improve the systems of wireless identification and access control on CI is carried out on the example of wireless identification and access control systems of the vehicle. A simplified conceptual design of the wireless identification and access control system of the vehicle on CI has been developed. The main primary provisions of the system under development related to the circuit engineering stage of conceptual design are formulated. Conclusions. As a result of the conducted research, a simplified conceptual design of the wireless identification and access control system of the vehicle on CI has been developed. According to the authors, the developed simplified conceptual project, with appropriate adaptation, can be applied in practice for the purposes of ensuring the physical protection of CI. Keywords: critical infrastructure; identification systems; access control; wireless data transmission systems; conceptual project.

The article presents issues related to the use of electronic security systems (ESB) on a vast railway area. These systems are operated in very different environmental conditions. Due to the fact that electrical and electronic systems coexist on the extensive railway area for various purposes - e.g. power supply systems for railway traction, rail traffic control systems (SRK), electronic security systems - fire alarm system (SSP), CCTV system (CCTV), access control system (SKD), a significant operational problem in addition to environmental changes in which the above-mentioned technical facilities are used, there is also the issue of electromagnetic compatibility. Depending on the area extent of the railway area, construction, technical configuration, way of alarming, safety classes of these systems may be different. In SSP there is another factor that affects the configuration of these systems, namely the so-called fire scenario and how to notify the State Fire Service (PSP) about an existing fire risk or damage. There are several different ESB structures - focused, distributed and mixed. The type of ESB used in a given railway facility - construction or open area is conditioned by its cubic capacity [m3], terrain extent [m2 or km2] and the number of supervised facilities. The use of a given type of ESB to ensure safety and fire protection in a given railway area also depends on the requirements of legal provisions for the object(s), the fire scenario that must be implemented by the system, legal requirements for the given protected area, the accepted scope of protection and the reliability and operational requirements to be met by these installations. The article presents basic issues related to ESB operation that are used in the selected railway area. The review of technical solutions of selected ESBs and the methodology of conducting the analysis for the purposes of developing, e.g. fire scenario or hazard analysis, presented in the article, will enable railway facility designers to properly develop design assumptions.

This paper discusses the issues of training machine learning models for people authentication by the face image in longwave infrared radiation. The analysis of public available and freely distributed datasets of other researchers in the field, which contain images of people’s faces in infrared range, are discussed. It was concluded, that it is necessary to form a dataset for training and testing machine learning models on one’s own. To obtain the highest results using trained methods in practical purposes a list of requirements for the collected dataset was developed. In conclusion, an experiment was conducted, where the machine learning method (logistic regression) was trained on each dataset and tested on a sample of 15 images combining each dataset (75 images totally). During the experiment it was discovered, that the algorithm trained on the collected dataset successfully copes with both: the task of authenticating user by his thermal imaging on theoretical datasets and in the practical one. The results obtained can be used in access control and management systems to increase the fault tolerance characteristics for person authentication. The use of this dataset allows the model training aimed at theoretical and practical use in the tasks of processing thermograms, for the person authentication by the pattern of veins and vascular networks on the face in cases of changes in appearance and environmental conditions.

Regarding high precision and automatic control requirements for management and control system of oil depot, this paper applied RF technology in in-out oil management and automatic control theory in automatic control system of oil depot. Thus, a novel oil depot automatic in-out control system based on three level structure and RF technology was designed. In the system, the three level structures are composed of on-site control level, site management level and remote management level. A mode of combining control instruments with PLC controller was adopted in on-site control level and VB .Net was used as software for upper computer. The designed non-contact IC card management software for oil access and in-out oil control system will simplify the operation process of employees; approve levels of safe management and data accuracy for oil access in oil depot. Field tests show that this system has advantage of high control accuracy achieved 0.2 magnitude, high precision of data acquisition and easy operation for control management. The system provides an efficient technology approach for raising the level of automation and management in the oil industry.

The fire detection system combines the simultaneous measurements of smoke, carbon monoxide, and carbon dioxide. The security of campus against intruders moving in laboratories, class rooms, staffrooms or washrooms. The fire alarm system consists of Fire detectors (with can be smoke detector, heat, or Infra-Red detectors), control unit and alarm system. A fire detection system is developed based on the simultaneous measurements of temperature and smoke. The fire detection system with the alarm algorithm detected fires that were not alarmed by smoke sensors, and alarmed in shorter times than smoke sensors operating alone. Previous fire detection algorithms used data from sensors for temperature, smoke, and combustion products. The smoke sensor alarms when the analog output signal exceeds or equal the threshold value. The node includes analog sensors to measure smoke, carbon monoxide (CO) and temperature. A fire alarm system should reliably and in a timely way notify building occupants about the presence of fire indicators, such as smoke or high temperatures.