Hardware Based Function Level Mandatory Access Control for Memory Structures

The Pi-calculus has been developed to reason about behavioural equivalence. Different notions of equivalence are defined in terms of process interactions, as well as the context of processes. There are various extensions of the Pi-calculus, such as the SPI calculus, which has primitives to facilitate security protocol design.<br /> <br />Another area of computer security is access control research, which includes problems of access control models, policies and access control mechanism. The design of a unified framework for access control requires that all policies are supported and different access control models are instantiated correctly.<br /> <br />In this paper we will utilise the Pi calculus to reason about access control policies and mechanism. An equivalence of different policy implementations, as well as access control mechanism will be shown. Finally some experiences regarding the use of Pi-calculus are presented.

With the development of computing and communication technologies, an extremely large amount of data has been collected, stored, utilized, and shared, while new security and privacy challenges arise. Existing access control mechanisms provided by big data platforms have limitations in granularity and expressiveness. In this article, we present SparkAC, a novel access control mechanism for secure data sharing and analysis in Spark. In particular, we first propose a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">purpose-aware access control</i> (PAAC) model, which introduces new concepts of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">data processing purpose</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">data operation purpose</i> and an automatic purpose analysis algorithm that identifies purposes from data analytics operations and queries. Moreover, we develop a unified access control mechanism that implements PAAC model in two modules. GuardSpark++ supports structured data access control in Spark Catalyst and GuardDAG supports unstructured data access control in Spark core. Finally, we evaluate GuardSpark++ and GuardDAG with multiple data sources, applications, and data analytics engines. Experimental results show that SparkAC provides effective access control functionalities with very small (GuardSpark++) or medium (GuardDAG) performance overhead.

For any file, the modification, access and creation date and time stamp (MAC DTS) is a major parameter, which if preserved properly can be used to gain crucial evidence about activities on the file. Activities on a file system is generally protected by access control mechanism specific to the operating system; discretionary or mandatory access control mechanism being the most common ones. Generally, access control mechanisms deal with allow or deny a based rule (for access to a file) which even extends to role based access control in some cases. This directly implies that access protection mechanism is generally tightly coupled with almost all operating systems. Still, intrusion is a common phenomenon. This paper analyzes and measures the performance of our previously defined approach for efficient file system intrusion detection system. This paper also establishes how this approach can be complementary to existing access control mechanism for Linux kernel 2.6.x.

ABSTRACTSome specific information or resources only can be accessed by authorized users. Discretionary access control (DAC), mandatory access control (MAC), and role‐based access control (RBAC) are three main classes of access control policies. MAC and RBAC are more secure than discretionary access control because a system instead of an object's owner determines the policy. MAC is appropriate for multilevel applications with high security requirements such as military ones, while RBAC provides security and business benefits. Most institutions, companies, and governments are multilevel, so relationships between roles or security levels tend to be hierarchical. In this work, an access control mechanism, providing explicit transitive exception and antisymmetric arrangement, is proposed to provide flexible and appropriate solutions to hierarchical relationships. For practicability, no access control policy is strictly constrained in the proposed mechanism such that security classes can be determined according to specific requirements. The proposed mechanism employs an elliptic curve cryptosystem and a two‐layer hash approach to ensure security and computation efficiency. Copyright © 2014 John Wiley &amp; Sons, Ltd.

Chapter 23 - Policies, Access Control, and Formal Methods

With the development of Internet-of-Things (IoT) technology, various types of information, such as social resources and physical resources, are deeply integrated for different comprehensive applications. Social networking, car networking, medical services, video surveillance, and other forms of the IoT information service model gradually change people’s daily lives. Facing the vast amounts of IoT information data, the IoT search technology is used to quickly find accurate information to meet the real-time search needs of users. However, IoT search requires using a large amount of user private information, such as personal health information, location information, and social relations information, to provide personalized services. Employing private information from users will encounter security problems if an effective access control mechanism is missing during the IoT search process. An access control mechanism can effectively monitor the access activities of resources and ensure that authorized users access information resources under legitimate conditions. This survey examines the growing literature on access control for an IoT search. Problems and challenges of access control mechanisms are analyzed to facilitate the adoption of access control solutions in real-life settings. This article aims to provide theoretical, methodological, and technical guidance for IoT search access control mechanisms in large-scale dynamic heterogeneous environments. Based on a literature review, we also analyzed the future development direction of access control in the age of IoT.

The design of a mandatory access control (MAC) mechanism for the Unix file system is described. The design is simple, compatible with AT&T's Systems V and Berkeley's BSD Unix with Sun Microsystem's Network File System support, and it avoids some of the deficiencies present in approaches done to date. The MAC design introduces the concept of file name hiding. The design eliminates the need for partitioned directories and the need to log out and then log in again to use upgraded directories. The author briefly describes the traditional Unix file system. Approaches to adding a mandatory access control mechanism to the Unix file system are detailed, and problems with the approaches are examined. Finally, the proposed approach is described, including an explanation of how it solves the deficiencies of the previous approaches. >

Abstract: We use a state-transition approach to analyze and compare the core access control mechanisms that are characteristic of a variety of trust management, access control list, and capability-based systems. The framework, which characterizes the set of rights a subject has over an object after any sequence of actions, is based on abstract system states, state transitions, and logical deduction of access control judgments. We present abstract models representing the access control portion of trust management, access control lists, and two versions of capabilities, proving various correspondence and simulation relations between these models. The main results include an equivalence between access control lists (ACLs) and capabilities viewed as rows of the Lampson access matrix and the (proper) subsumption of a form of ACLs by an unforgeable reference form of capabilities. The access control mechanism at the heart of distributed trust management systems is formally shown to provide a tractable compromise between unrestricted capability passing from the capability models and easy revocation provided by access control lists. The underlying simulations show how trust management compares with more established access control mechanisms, independent of features such as local name spaces and certificate authorization hierarchies.

With the use of virtualization, threats appears gradually in domains constituted by host and virtual machines (VMs). Access control between VMs becomes a necessary method of the security management of virtualized platform. The traditional Mandatory Access Control (MAC) based on fixed security policy is greatly restricted on flexibility. In this paper, we proposed a quantitatively trust evaluation method based on VM's historical behavior, which combined with existing MAC mechanism, to build a flexible, fine-grained access control mechanism.

This paper presents the design and implementation features of Centralized Pervasive Computing Environment/Multilevel Security (CPCE/MLS), a multilevel security (MLS) system in pervasive computing environment deployed in Local area network (LAN) with a Mandatory Access Control (MAC) mechanism. By introducing the server-storage terminals and implementing the multilevel security access control mechanism based on the Bell---LaPadula model, process creation supervision, and an auditing mechanism, the CPCE/MLS system is able to provide the security guarantee of the whole computing environment. As such, each terminal is controlled under an integrated security policy. The performance test results show that the CPCE/MLS system, without optimization, generates great overhead but achieves significantly better performance after the cache mechanism is added in the monitor agent and in the hook driver. The system with the hook driver cache mechanism is able to achieve the 95.9% throughput of the native system with 8 K and 16 K requested data blocksize.

Project "Code Safe" is designed to increase the dependability and security of software through strong security measures, as well as sticking to coding guidelines. In today's digital world that is characterized by data breaches and cyber threats, the safety of sensitive data and protection against unauthorized entry have become very necessary. The project aims to provide a secure environment for software applications by including encryption, access control, and secure authentication mechanisms. The project ensures that any confidential information is kept safe from unauthorized tampering or access through the use of robust encryption algorithms. Access control mechanisms are also in place to regulate user permissions and restrict access to specific functionalities and data, thus ensuring that only authorized persons can interact with the application. To this extent, multi-factor authentication secure access mechanisms would be integrated into authenticate user identity; hence preventing illegal entries to the system. To this extent also, it marks the significance that the software project places on high-quality maintainability of software codes. As indicated, this increases the general quality of a base of the developed software codes towards industry coding and best standards of practice. In addition, this involves modular designing principles, routine code reviews, and automated testing frameworks for identification and handling of software defects thereby improving the reliability and stability of an application. "Code Safe" is an iteration-based development process that includes continuous security assessments as well as updates throughout the software development lifecycle. By keeping on the latest trends and technologies that evolve in terms of security, this project could be able to integrate cutting edge security features within its application; hence, resiliency toward current threats could be ensured. Finally, "Code Safe" aims at ensuring secure platforms for different types of software such as web services, mobile applications or desktop software. The project tries to inspire confidence in end-users that their data and interactions are safeguarded through a robust security framework and adherence to coding best practices. Keywords— Security Measures, Encryption, Secure Authentication, Multi-Factor Authentication, Cyber Threats

With rapid advancements in the technology, almost all the devices around are becoming smart and contribute to the Internet of Things (IoT) network. When a new IoT device is added to the network, it is important to verify the authenticity of the device before allowing it to communicate with the network. Hence, access control is a crucial security mechanism that allows only the authenticated node to become the part of the network. An access control mechanism also supports confidentiality, by establishing a session key that accomplishes secure communications in open public channels. Recently, blockchain has been implemented in access control protocols to provide a better security mechanism. The foundation of this survey article is laid on IoT, where a detailed description on IoT, its architecture and applications is provided. Further, various security challenges and issues, security attacks possible in IoT and their countermeasures are also provided. We emphasize on the blockchain technology and its evolution in IoT. A detailed description on existing consensus mechanisms and how blockchain can be used to overpower IoT vulnerabilities is highlighted. Moreover, we provide a comprehensive description on access control protocols. The protocols are classified into certificate-based, certificate-less and blockchain-based access control mechanisms for better understanding. We then elaborate on each use case like smart home, smart grid, health care and smart agriculture while describing access control mechanisms. The detailed description not only explains the implementation of the access mechanism, but also gives a wider vision on IoT applications. Next, a rigorous comparative analysis is performed to showcase the efficiency of all protocols in terms of computation and communication costs. Finally, we discuss open research issues and challenges in a blockchain-envisioned IoT network.

In wireless communication, an access control mechanism is especially important to realize a stable connection. Typical access control mechanisms assume a single wireless channel, where every terminal can communicate with each other on the same frequency channel. On the contrary, the industrial, scientific and medical (ISM) radio band using 2.4 GHz has a different assumption for them because the IEEE 802.11 standard assigned each channel for 5 MHz, but conventional devices transmit a 20 MHz band signal. As a result, an overlapped band may be interference to a signal over a neighbor channel. This paper proposes a new type of access control mechanism supporting multichannel. The proposed scheme employs a different bandwidth signal for access control and data transmission. As a result, terminals over neighbor channels can recognize a data transmission even if they cannot demodulate a data transmission signal. The benefit of the proposed scheme is multiple transmission of the access control message over different channels. Since the receiver should receive multiple channels for access control and data transmission, this paper designs an extended system model of Orthogonal Frequency Division Multiplexing (OFDM). The evaluation results show that the proposed scheme can avoid packet conflicts between neighbor channels.

Background: Cloud computing provides access to a large scale of resources. Access control is the indispensable requirement for protecting cloud resource. A cloud service provider is responsible for enforcing access control and they normally rely upon conventional access control mechanisms. Methods: These access control policies, consider the access control primitives in separation which may lead to abuse of access control. These aforesaid problems motivated our research to center around the provision of access control by considering the association among the three access control primitives namely the user making access request, resource upon which access is requested and operation performed by the user on the resource. Hence Ontology Centric Access Control (OCAC) is being proposed in this paper. Findings: This OCAC circulates authorization rules among the primitives of access control say subject, object and action by reducing the various associations among the associations among the access control elements; it is observed that there is less chance for security violation. Ontology is used since it reduces the times of agreement while exchanging the authorization policies across the security domains. For reducing the number of statements and rules in policy base, subsumption property is used. This reduces the space and time complexity. Applications/Improvements: We are applying our work to protect bank data as banks are embracing clouds to store huge data by cutting their IT costs.Keywords: Access Control, Ontology, Cloud Computing, User Ontology, Resource Ontology, Activity Ontology Introduction

PurposeThis paper aims to manage access control tasks to satisfy the user privacy needs of online information resources according to social relations and tags.Design/methodology/approachThe study proposes a method for access control management in the online social context. The proposed method includes the access control policy management process, metadata of access control policies, the data of ontologies, tags, and social relations, and conflict detection rules.FindingsOnline information sharing and hiding, which needs to consider social relations and mentioned topics, is a unique context and needs a novel access control mechanism. Ontologies are powerful and expressive enough to identify conflicts in access control policies. The paper provides a method using ontologies to control the access control activities based on social relations and tags on web content. The effectiveness of the method's conflict detection rules is validated through several scenarios.Research limitations/implicationsTo make the proposed method suitable for widespread usage, further work is required to develop an access control policy specification and conflict detection tool. The proposed method introduces relatively novel usage scenarios, which consider social relationships, and tags compared with existing access control methods for online information sharing.Practical implicationsThe proposed access control mechanism can be integrated into existing web sites. Online users can use this method to share information more easily than at present.Originality/valueThe method enables flexible access control in social contexts and handles unavoidable conflicts. It also opens the way to new access control scenarios in online social activities. The method can be used to keep secrets hidden from selected people.