Content uploaded by Alan H. Karp
Author content
All content in this area was uploaded by Alan H. Karp on May 07, 2020
Content may be subject to copyright.
A preview of the PDF is not available
From ABAC to ZBAC: The evolution of access control models
... ZBAC (authoriZation Based Access Control) was proposed as a distributed authorization model, but it was designed for "enterprise architecture" and not for general computing systems [4]. Roesner et al. proposed a usage based access control to limit program access to user data through user's interactions with applications. ...
... Later access control papers like Roesner et al. [6] have this concept. In addition, it presents a model that can be used to limit damage caused by application compromise, but it does not provide a measurable implementation for standard programs like word processing programs [4]. However, its assumptions present a problem when it looked at what data applications were accessing. ...
... AuthoriZation-Based Access Control (ZBAC) has been presented in 2009 [17]. It is similar to capability-based models. ...
... ZBAC uses authorizations that are presented with the access request [17]. An authorization represents every permission that is exercised. ...
Access control is a part of the security of information technologies. Access control regulates the access requests to system resources. The access control logic is formalized in models. Many access control models exist. They vary in their design, components, policies and areas of application. With the developing of information technologies, more complex access control models have been created. This paper is concerned with overview and analysis for a number of access control models. First, an overview of access control models is presented. Second, they are analyzed and compared by a number of parameters: storing the identity of the user, delegation of trust, fine-grained policies, flexibility, object-versioning, scalability, using time in policies, structure, trustworthiness, workflow control, areas of application etc. Some of these parameters describe the access control models, while other parameters are important characteristics and components of these models. The results of the comparative analysis are presented in tables. Prospects of development of new models are specified.
... Commercial solutions [21] that cater to organizations employ one or more of these classical access control functionalities. While tremendous progress has been made in the realm of classical access control approaches [41], one fundamental issue has remained the same for over forty years. Skilled security administrators needed to engineer and manage accesses as only humans could develop detailed policy insights about individuals' needs within the broader organization. ...
A common trait of current access control approaches is the challenging need to engineer abstract and intuitive access control models. This entails designing access control information in the form of roles (RBAC), attributes (ABAC), or relationships (ReBAC) as the case may be, and subsequently, designing access control rules. This framework has its benefits but has significant limitations in the context of modern systems that are dynamic, complex, and large-scale, due to which it is difficult to maintain an accurate access control state in the system for a human administrator. This paper proposes Deep Learning Based Access Control (DLBAC) by leveraging significant advances in deep learning technology as a potential solution to this problem. We envision that DLBAC could complement and, in the long-term, has the potential to even replace, classical access control models with a neural network that reduces the burden of access control model engineering and updates. Without loss of generality, we conduct a thorough investigation of a candidate DLBAC model, called DLBAC_alpha, using both real-world and synthetic datasets. We demonstrate the feasibility of the proposed approach by addressing issues related to accuracy, generalization, and explainability. We also discuss challenges and future research directions.
... As it has been shown in Section 2.1.1, the security policy can be formally represented according to different access control models, as well as their extensions and variants [25,129,139,114,1]. This formalization allows the proof of properties on the security provided by the access control system being designed. ...
In certain sensitive environments, such as the healthcare domain, where users are generally trusted and where particular events may occur, such as emergencies, the implemented security controls in the corresponding information systems should not block certain decisions and actions of users. This could have serious consequences. Indeed, it is important to be able to identify and trace these actions and decisions in order to detect possible violations of the security policy put in place and fix responsibilities. These functions are ensured by the a posteriori access control that lies on a monitoring mechanism based on logs. In the literature, this type of access control hasbeen divided into three stages: log processing, log analysis, and accountability. In this thesis, we cover these three areas of the a posteriori access control by providing new solutions, and we introduce new aspects that have not been addressed before.
... Over the last decades, several models have been proposed to cover the problem of Access Control. These models propose to take into account various notions, including roles (RBAC) (Sandhu, 1996), attributes (ABAC) (Hu, 2013), context (Corrad, 2004), history (Banerjee and Naumann, 2004), risk (Kandala et al., 2011), authorization (Karp et al., 2010) or trust (Kagal et al., 2001). ...
Data leakage can lead to severe issues for a company, including financial loss, damage of goodwill, reputation, lawsuits and loss of future sales. To prevent these problems, a company can use other mechanisms on top of traditional Access Control. These mechanisms include for instance Data Leak Prevention or Information Rights Management and can be referred as Transmission Control. However, such solutions can lack usability and can be intrusive for end-users employees. To have a better understanding of the perception and usage of such mechanisms within business infrastructures, we have conducted in this article an online survey on 150 employees. These employees come from different companies of different sizes and sectors of activity. The results show that whatever the size of the company or its sector of activity, security mechanisms such as access control and transmission control can be considered as quite intrusive and blocking for employees. Moreover, our survey also shows interesting results regarding more acceptable and user-friendly anti-data leakage mechanisms that could be used within companies.
This is an Open Access Journal / article distributed under the terms of the Creative Commons Attribution License (CC BY-NC-ND 3.0) which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. All rights reserved. E-health monitoring system is increased in its popularity by providing flexible environment for the hospitals for storing their patient's health status information without keeping individual servers on hospitals. Information stored in the servers is sensitive information of patients which cannot be provided with public access. Usually the doctors are only allowed with access permission to operate the information whenever it is required. Thus it is vital important to doctor's presence to have approach to the patient's health information. However in emergency situations, in case of absence of doctors it is more difficult to retrieve the patient's information which would affect the treatment provided to the patients. And also in the previous work, BTG policy rules are defined already, in which emergency acts cannot be taken if none of them defined in the rules are not present. These problematic remains focused in our previous investigation method by leading technique called Resource Constrained Secured Access Control Module (RCSACM). In this work, the hackers might attempt to steal the data by acting as genuine users in the emergency act by performing identity foraging attack. And also transferring entire data through multiple data path links would cause increased delay and more bandwidth consumption. These problems are fixed in the proposed investigation method by familiarizing the new method namely Trust built BTG Access Controller Model (TBTGACM). ABSTRACT RESEARCH ARTICLE
Access control has become the most necessary requirement to limit unauthorized and privileged access to information systems in cloud computing. Access control models counter the additional security challenges like rules, domain names, job allocation, multi hosting and separation of tasks. This paper classifies the conventional and modern access control models which has been utilized to restrain these access flaws by employing a variety of practices and methodologies. It examine the frequent security threats to information confidentiality, integrity, data accessibility and their approach used for cloud solutions. This paper proposed a priority based task scheduling access control (PbTAC) model to secure and scheduled access of resources & services rendered to cloud user. PbTAC model will ensure the job allocation, tasks scheduling and security of information through its rule policies during transmission between parties. It also help in reducing system overhead by minimize the computation and less storage cost.
Cloud computing is considered as one of the most dominant paradigms in the Information Technology industry these days. It offers new cost effective services. With the rapid development of cloud computing, cloud security issues are becoming increasingly prominent and urgently need to be dealt with. Access control, as an important measure for traditional information and system protection, can effectively prevent illegal users from accessing protected objects, limit users’ permission, and protect information resources from illegal use and access. This paper mainly discusses the improvement of the existing access control model in the cloud computing environment, the cloud data security protection technology, the introduction of risk perception and trust mechanism to implement access control to dynamically detect user identity and authorization technology for the vulnerabilities in the cloud system. We also point out some future research directions in cloud computing.
Context-awareness is a quintessential feature of ubiquitous computing. Contextual information not only facilitates improved applications, but can also become significant security parameters – which in turn can potentially ensure service delivery not to anyone anytime anywhere, but to the right person at the right time and place. Specially, in determining access control to resources, contextual information can play an important role. Access control models, as studied in traditional computing security, however, have no notion of context-awareness; and the recent works in the nascent field of context-aware access control predominantly focus on spatio-temporal contexts, disregarding a host of other pertinent contexts. In this paper, with a view to exploring the relationship of access control and context-awareness in ubiquitous computing, the authors propose a comprehensive context-aware access control model for ubiquitous healthcare services. They explain the design, implementation and evaluation of the proposed model in detail. They chose healthcare as a representative application domain because healthcare systems pose an array of non-trivial context-sensitive access control requirements, many of which are directly or indirectly applicable to other context-aware ubiquitous computing applications.
We describe the design and implementation of a trust-management system Soutei, a dialect of Binder, for access control in distributed systems. Soutei policies and credentials are written in a declarative logic-based security language and thus constitute distributed logic programs. Soutei policies are mod- ular, concise, and readable. They support policy verification, and, despite the sim- plicity of the language, express role- and attribute-based access control lists, and conditional delegation. We describe the real-world deployment of Soutei into a publish-subscribe web service with distributed and compartmentalized administration, emphasizing the often overlooked aspect of authorizing the creation of resources and the corre- sponding policies. Soutei brings Binder from a research prototype into the real world. Support- ing large, truly distributed policies required non-trivial changes to Binder, in particular mode-restriction and goal-directed top-down evaluation. To improve the robustness of our evaluator, we describe a fair and terminating backtracking algorithm.
This paper appeared in nearly this form in the Oct. 1988 issue of Operating Systems Review, pp 36:38 Bold face stuff should be changed for greater correspondence to Unix. This is a nearly true story (unessential details have been changed). The events happened about 1977 at Tymshare, a company which provided commercial timesharing services. Before this happened I had heard of capabilities and thought that they were neat and tidy, but was not yet convinced that they were necessary. This occasion convinced me that they were necessary. It is an intricate scenario but such is the nature of computers. Our operating system was much like Unix (Ô of AT&T) in its protection structures. A compiler was installed in a directory called SYSX. A user would use the compiler by saying "RUN /SYSX/FORT", and could provide the name of a file to receive some optional debugging output. We had instrumented the compiler to collect statistics about l
Exploring Claims-Based Identity
- K Brown
K. Brown, "Exploring Claims-Based Identity", http://msdn.microsoft.com/enus/magazine/cc163366.aspx
Access Control for the Services Oriented Architecture
- J Li
- A H Karp
J. Li and A. H. Karp, "Access Control for the Services Oriented Architecture", ACM
Workshop on Secure Web Services, Fairfax, VA, November 2007, also
http://www.hpl.hp.com/techreports/2007/HPL-2007-105.html
XPOLA -An Extensible Capability-based Authorization Infrastructure for Grids
- L Fang
- D Gannon
L. Fang and D. Gannon, "XPOLA -An Extensible Capability-based Authorization
Infrastructure for Grids", 4th Annual PKI R&D Workshop: Multiple Paths to Trust,
Gaithersburg, MD, April 2005
Internet X.509 Public Key Infrastructure (PKI) Proxy Certificate Profile
- S Tuecke
- V Welch
- D Engert
- L Pearlman
- M Thompson
S. Tuecke, V. Welch, D. Engert, L. Pearlman, M. Thompson, "Internet X.509 Public Key
Infrastructure (PKI) Proxy Certificate Profile", IETF RFC 3820,
http://www.ietf.org/rfc/rfc3820.txt, June 2004
Liberty ID-WSF Security Mechanisms Core
- F Hirsch
F. Hirsch, ed., "Liberty ID-WSF Security Mechanisms Core, Version 2.0",
http://www.projectliberty.org/liberty/content/download/893/6255/file/liberty-idwsfsecurity-mechanisms-core-v2.0.pdf, 2006