Privacy-Friendly Access Control Based on Personal Attributes

There have been several attempts made in literature to develop access control techniques to stem data security problems. Many of these techniques had been found to have one deficiency or other. Hence, this study developed a Symbolic Attribute-Based Access Control (SABAC) system for data security in the cloud service environment. SABAC system was implemented by developing Hash-tag Symbol Authentication (HSA) algorithm using the Message Digest-5 encryption. SABAC utilizes a 3-Tier continuous authentication method by combining the use of username and password, HSA code, and real-time image monitoring and verification. HSA code is generated by combining 5-tuple user attributes and the string generated from the user’s image using Obfuscation Technique. The concatenated string is converted to hexadecimal which serves as input to MD5 to produces a unique HSA code. SABAC was evaluated using three major security metrics of confidentiality, integrity, and avail-ability. The result of security metrics tests showed a confidence level of 99.993%, integrity threshold of 99.998%, and availability throughput of 150 users/second. This implies that SABAC is highly efficient for cloud data security. It shows that hackers would find it impossible to match any fake identity with valid HSA in the database. The study concluded that SABAC could be used for access control in a cloud environment for assuring data security. It was recommended that the SABAC system should be adopted by Cloud Solution Providers and Security Specialists.

Modern financial institutions face unprecedented challenges in maintaining regulatory compliance, preserving operational efficiency, and competitive advantage. The development for compliance-by-design as compliance as compliance represents a fundamental paradigm change in financial system architecture. This technical article explores comprehensive frameworks for implementing regulatory-centric system design across financial operations platforms. The discussion encompasses foundational principles of audit traceability through event sourcing patterns and immutable audit trails that capture complete transaction contexts with precise temporal information. Version control strategies extend beyond traditional source code management to include sophisticated bi-temporal data models tracking valid time and transaction time dimensions. Metadata lineage tracking leverages graph-based architectures, enabling forward and backward traceability across distributed financial data environments. Transaction trail design integrates event-driven architectures with streaming platforms to support real-time compliance validation while maintaining guaranteed delivery and ordering properties essential for regulatory accuracy. Exception handling workflows employ adaptive techniques, including reinforcement learning for dynamic policy optimization and automated remediation capabilities. The compliance-by-design implementation framework introduces architectural patterns such as Command Query Responsibility Segregation and attribute-based access control systems that embed regulatory requirements into fundamental system structures. Continuous compliance monitoring provides real-time assessment capabilities with rule-based detection engines and automated alert generation supporting regulatory submissions across jurisdictional frameworks.

Side-channel attacks are a prominent threat to the security of cryptographic implementations. Differently from the traditional black-box attacks, which exploit the inputs and outputs of cryptographic schemes, side-channel attacks partially access the inner working of the scheme as well, by observing the physical leakage emitted by the device executing cryptographic algorithms. A notable example is the class of power-analysis attacks, which exploits the power consumption of the underlying device to recover the secret keys of the implemented cryptosystem. Since their first presentation in the late 1990s, the problem of securing cryptographic systems in the presence of side-channel leakages received significant attention by the cryptographic community. In particular, the theory community has concentrated its research efforts on formally modeling the side-channel leakages and on designing cryptographic schemes \textit{provably} secure in such leakage models. However, conceiving a formal model that realistically captures possible physical leakages and constructing primitives sufficiently efficient to be deployed in practice are still challenging research objectives. This research area is usually referred to as leakage-resilient cryptography. In this dissertation, we examine three main research directions. The first one focuses on the technique of masking, which is the most popular approach to counteract power-analysis attacks. In this context, our work analyzes possible methods to improve the efficiency of masked implementations, with the goal of overcoming the decrease in performance, which is a common drawback of masking. In particular, we provide new and more efficient algorithms for the computation of basic operations in two kinds of masking schemes: the Boolean masking and the Inner Product masking. The second research direction of this work addresses the problem of formalizing security requirements for hardware implementations. While provable security of software-oriented masking has been studied since the origin of leakage resilient cryptography, the more complex task of formally proving the security of hardware-oriented masking is receiving attention by the community only recently. We discuss the different challenges of this field, and we introduce a new theoretical model, the robust probing model, capturing the conditions required for securely implementing complex algorithms in practice, providing a guide to practical implementers. Finally, the last part of this work is concerned with the protection of algorithms employed in lattice-based constructions, which are studied in the field of post-quantum cryptography. While several works investigate the application of masking schemes to standard cryptosystems, for most post-quantum schemes this is still an ongoing research. We contribute to this research area, by applying the masking countermeasure to a binomial sampler which is at the base of many lattice-based cryptosystems.

Secure administration of cryptographic role-based access control for large-scale cloud storage systems

Due to human influence and its negative impacts on the world’s environment, the world is changing into a cleaner and more sustainable energy system. In both private and public buildings, there is a desire to reduce electricity usage, automate appliances, and optimize the electricity usage of a building. This paper presents the design and implementation of a secured smart home switching system based on wireless communications and self-energy harvesting. The proposed secured smart home switching system integrates access control of the building’s electricity, energy harvesting, and storage for the active electronic components and circuitries, and wireless communication for smart switches and sockets. The paper gives two contributions to the design of smart home systems: 1) A practical design and implementation of security (access control system) for a building’s power supply which adds a locking feature such that only authorized personnel are capable of altering the power state of the smart sockets and switches in a building, and; 2) A model of energy harvesting and storage system for the active electronic components of the circuitries and wireless communication for smart switches and sockets. The access control involves four stages (a control unit, a comparator unit, a memory unit, and the switching unit). The access control system provides means of access control by having a security keypad that switches ON or OFF the building’s electricity, provided the user knows the security pin code (8 coded pins). The proposed system also harvests and stores energy for all the active electronic devices using a photovoltaic system with ultracapacitor energy buffer. The designed secured smart home utilized smart power and switches, and message queuing telemetry transport for ease of controlling energy usage. The experimental results obtained from extensive testing of the prototype shows an improvement in security and energy management in a building.

The growth of quantum computing reveals a series of significant threats to cryptographic systems known today, such as RSA, ECC, and Diffie-Hellman, which are extremely important for Internet security, but are threatened by the increase in possible quantum attacks. The area of public and private key cryptography is vast. Therefore, this article addresses post-quantum cryptography (PQC) algorithms and the challenges of implementing them in Internet of Things (IoT) devices, given the difficulty of application due to restricted resources, such as RAM and clock speed . To this end, we will discuss the need for standardization of algorithms considering low-resource IoT devices, prioritizing RAM over ROM, meeting the needs of low-memory devices, which are lighter. The National Institute of Standards and Technology (NIST) has validated four cryptographic systems that are secure against quantum attacks. We analyze the implications of these systems on the infrastructure of current networks and will compare in detail these algorithms and their respective strengths, weaknesses, and trade-offs. We evaluate the feasibility of post-quantum encryption (PQC) algorithms in resource-constrained IoT devices using the ESP-WROOM-32 microcontroller. Three cryptographic schemes were implemented and compared.

Nowadays, biometric recognition represents an integral component of identity management and access control systems, replacing PINs or passwords. However, the wide deployment of biometric recognition systems in the past decades has raised numerous privacy concerns regarding the storage and use of biometric data. Due to the fact that the link between individuals and their biometric characteristics, e.g. fingerprints or iris, is strong and permanent, biometric reference data (templates) need to be protected in order to safeguard individuals' privacy and biometric systems' security. In particular, unprotected biometric templates can be abused to crossmatch biometric databases, i.e. tracking individuals without consent, and to launch presentation attacks employing specific inversion techniques. Technologies of biometric template protection offer solutions to privacy preserving biometric authentication, which improves the public confidence and acceptance of biometric systems. While biometric template protection has been an active research topic over the last 20 years, proposed solutions are still far from gaining practical acceptance. The existing gap between theory and practice, which results in a trade-off between privacy protection and recognition accuracy, is caused by numerous factors. To facilitate a standardized design and application of biometric template protection schemes, researchers have to solve several open problems. This chapter provides an overview of state-of-the-art technologies of biometric template protection and discusses main issues and challenges.

Chaos and high-level dynamics in coupled lasers and their applications

Lattice-based cryptographic scheme is constructed based on hard problems on a lattice such as the short integer solution (SIS) problem and the learning with error (LWE). However, the cryptographic scheme based on SIS or LWE is inefficient since the size of the key is too large. Thus, most cryptographic schemes use the variants of LWE and SIS with ring and module structures. Albrecht and Deo showed that there is a reduction from module-LWE (M-LWE) to ring-LWE (R-LWE) in the polynomial ring by handling the error rate and modulus. However, unlike the LWE problem, the SIS problem does not have an error rate, but there is the upper bound β on the norm of the solution of the SIS problem. In this paper, we propose the two novel reductions related to module-SIS (M-SIS) and ring-SIS (R-SIS) on a polynomial ring. We propose (i) the reduction from R-SIS q k ,m k ,β k to R-SIS q , m,β and (ii) the reduction from M-SIS to R-SIS under norm constraint of R-SIS. Combining these two results implies that R-SIS for a specified modulus and number samples is more difficult than M-SIS under norm constraints of R-SIS, which provides the range of possible module ranks for M-SIS. From the reduction we propose, contrary to the widely known belief, our result shows that there is a possibility that the security parameters of M-SIS may be less secure when it reduces to R-SIS for the theoretical reasons presented in this paper. Therefore, when generating parameters on an M-SIS structure, the theoretical security level over R-SIS also should also be checked at the same time.

The emerging complexity of edge-based and autonomous UAV communication networks requires smart, secure, and adaptive architectures to defend against emerging cyber threats. Traditional access control and cryptographic key management systems, inherently static and rule-based, cannot support the demands of both real-time responsiveness and contextual decision-making. This paper presents a modular AI-enabled system that integrates Support Vector Machines (SVMs) for access control and Deep Q-Networks (DQNs) for adaptive encryption key rotation within a simulated quantum-secure communication channel. The proposed system was implemented with Docker and Kubernetes, with testing on NS-3 and SimulaQron platforms to allow scalable deployment and modularity. The SVM classifier achieved 96.8% accuracy and 99.2% recall in anomalous traffic, proving it to be effective in edge-based access control. The DQN agent is trained on the best key rotation policies and achieves 92.5% accuracy in the simulated environments of reinforcement learning, with stable convergence. These findings are in agreement with existing studies that recommend the use of AI to improve security in cloud-edge systems. The proposed framework provides an effective design blueprint of intelligent UAV communications based on low-latency inference and adaptive cryptographic policy control. Future work involves real-world implementation using Quantum Key Distribution (QKD) equipment, along with federated learning extensions to support collaborative intelligence across decentralized UAV swarms and edge devices.

Cloud data storage lets customers store vast amounts of data cheaply on demand. Cryptographic role-based access control (RBAC) systems preserve cloud data privacy by restricting access to users. This study develops a trust model to reason about and improve data security in cryptographic RBAC cloud storage systems. The trust degrees of the user determine the access rights to the data and are performed by User Activity Monitoring Agent (UAMA). Two different misconducts of users such as access policy violation and data leakage affect the trust degree of the user, which in turn upgrades the access policy. In addition, the user has to decrypt the data for gaining information from it, which is a second line of security. The performance of trust based RBAC scheme is evaluated with respect to different parameters such as illegitimate user detection, memory consumption, data storage with retrieval time and the proposed work performs better.

Deployable quantum key distribution (QKD) for free-space link must be both reference frame tolerant and hardware compact, yet existing free-space implementations still rely on bulk optics and active alignment. To address this gap, we develop the first reference frame independent (RFI) QKD transmitter fully integrated on a photonic-integrated circuit (PIC) and packaged in a CFP2 optical-transceiver form factor. The PIC incorporates a six-channel laser diode array, a six-channel variable optical attenuator array, and a polarization beam combiner, providing wavelength indistinguishability and high polarization fidelity. Combined with a micro-optics based polarization decoder and a bidirectional two-stage pointing, acquisition, and tracking (PAT) system, the PIC transmitter forms a complete free-space RFI QKD system. Based on the system, RFI QKD is performed with 10 m free-space channel, providing that QBERs measured in the same basis are below 3.81 % and the security parameter is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$1.77\pm 0.02$</tex-math></inline-formula>. This leads a stable secret key rate of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$77.33\pm 1.65 \text{kbps}$</tex-math></inline-formula> for 100 s. These results verify the feasibility of PIC-based RFI QKD transmitter and establish a clear pathway toward fully deployable PIC-based QKD systems.

Access control is an important security parameter in industrial networks; a mismanaged access control system leads to security breaches. The existing security solutions significantly consider the access control methods in the Industrial Internet of Things (IIoT); however, falsified identity can bypass the secure access control system. Thus, a centralized access control method leads to risks for data security. We are the first to address the risk factors of granted access in an industrial environment and present a risk-adaptive access control framework for IIoTs. Our proposed solution framework uses blockchain to provide secure decentralized access control in the industrial environment with privacy-preserved multi-party data sharing. We name our framework “Adaptive Access controL for Multi-party data cOmputation in iNdustrial Decentralization (AALMOND)”. AALMOND uses lightweight cryptographic operations to reduce the complexity of the execution and loosen up the tight bounds on resource-constrained industrial devices. Further, the risk-adaptive access control in AALMOND provides a better security analysis of the multi-party sharing data. Our framework uses role-based, attribute-based, and organization-based access controls to map the assets for risk calculation. We put all the required policies in a smart contract for the ease of multi-party data sharing to obtain a transparent access control execution more suitably. We also pioneer in the calculation of the risk adaptivity of AALMOND considering the NIST recommendations of operation risk, security risk, and heuristic risk. We measure the performance of AALMOND with state-of-the-art frameworks based on throughput, latency, complexity analysis, and risk adaptivity factors. We find that AALMOND is efficient for IIoTs as it shows 24% reduced latency and 20% better throughput as compared to the other existing models.

Enforcing a practical Mandatory Access Control (MAC) in a commercial operating system to tackle malware problem is a grand challenge but also a promising approach. The firmest barriers to apply MAC to defeat malware programs are the incompatible and unusable problems in existing MAC systems. To address these issues, we start our work by analyzing the technical details of 2,600 malware samples one by one and performing experiments over two types of MAC enforced operating systems. Based on the preliminary studies, we design a novel MAC model incorporating intrusion detection and tracing in a commercial operating system, named Tracer, in order to disable malware on hosts while offering good compatibility to existing software and good usability to common users who are not system experts. The model conceptually consists of three actions: detecting, tracing and restricting suspected intruders. One novelty is that it leverages light-weight intrusion detection and tracing techniques to automate security label configuration that is widely acknowledged as a tough issue when applying a MAC system in practice. The other is that, rather than restricting information flow as a traditional MAC does, it traces intruders and restricts only their critical malware behaviors, where intruders represent processes and executables that are potential agents of a remote attacker. Our prototyping and experiments on Windows show that Tracer can effectively defeat all malware samples tested via blocking malware behaviors while not causing a significant compatibility problem.

Computers' required random numbers initially, for simulations and numerical computations like Monte Carlo calculations. Random number generators offer an important contribution to many cryptographic systems. They are critical components in computational science. However the tradeoff between quality and computational performance is an issue for many numerical simulations. FPGA optimized RNGs are efficient in terms of resources than other types of software-based RNGs which means that they can take advantage of bitwise operations and FPGA based specific features. A class of FPGA based RNG called a LUT-SR RNG is illustrated using an algorithm Shift registers are used to improve mixing rate between numbers. Results will be misleading when correlations exist between the random numbers and hence permutations are used. The LUTs are configured into shift registers. The algorithm is simplified based on the architecture such that it ensures longer periods. A generator with a period of 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">r</sup> − 1 can be implemented and provides r random output bits. This provides a good quality balance compared to previous generators. The critical path between all registers is a single LUT. The program is run in Model Sim 6.4a and implementation is done using Xilinx PlanAhead Virtex5 kit.