Search

As systems evolve, security administrators need to review and update access control policies. Such updates must be carefully controlled due to the risks associated with erroneous or malicious policy changes. We propose a category-based access control (CBAC) model, called Admin-CBAC, to control administrative actions. Since most of the access control models in use nowadays (including the popular RBAC and ABAC models) are instances of CBAC, from Admin-CBAC, we derive administrative models for RBAC and ABAC, too. We present a graph-based representation of Admin-CBAC policies and a formal operational semantics for administrative actions via graph rewriting. We also discuss implementations of Admin-CBAC exploiting the graph-based representation. Using the formal semantics, we show how properties (such as safety, liveness, and effectiveness of policies) and constraints (such as separation of duties) can be checked, and discuss the impact of policy changes. Although the most interesting properties of policies are generally undecidable in dynamic access control models, we identify particular cases where reachability properties are decidable and can be checked using our operational semantics, generalising previous results for RBAC and ABACα. [ABSTRACT FROM AUTHOR]

Large language models (LLMs) have transformed Natural Language Processing (NLP) by enabling robust text generation and understanding. However, their deployment in sensitive domains like healthcare, finance, and legal services raises critical concerns about privacy and data security. This paper proposes a comprehensive framework for embedding trust mechanisms into LLMs to dynamically control the disclosure of sensitive information. The framework integrates three core components: User Trust Profiling, Information Sensitivity Detection, and Adaptive Output Control. By leveraging techniques such as Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), Named Entity Recognition (NER), contextual analysis, and privacy-preserving methods like differential privacy, the system ensures that sensitive information is disclosed appropriately based on the user's trust level. By focusing on balancing data utility and privacy, the proposed solution offers a novel approach to securely deploying LLMs in high-risk environments. Future work will focus on testing this framework across various domains to evaluate its effectiveness in managing sensitive data while maintaining system efficiency. [ABSTRACT FROM AUTHOR]

In traditional power grids, the unidirectional flow of energy and information has led to a decrease in efficiency. To address this issue, the concept of microgrids with bidirectional flow and independent power sources has been introduced. The components of a microgrid utilize various IoT protocols such as OPC-UA, MQTT, and DDS to implement bidirectional communication, enabling seamless network communication among different elements within the microgrid. Technological innovation, however, has simultaneously given rise to security issues in the communication system of microgrids. The use of IoT protocols creates vulnerabilities that malicious hackers may exploit to eavesdrop on data or attempt unauthorized control of microgrid devices. Therefore, monitoring and controlling security vulnerabilities is essential to prevent intrusion threats and enhance cyber resilience in the stable and efficient operation of microgrid systems. In this study, we propose an RBAC-based security approach on top of DDS protocols in microgrid systems. The proposed approach allocates roles to users or devices and grants various permissions for access control. DDS subscribers request access to topics and publishers request access to evaluations from the role repository using XACML. The overall implementation model is designed for the publisher to receive XACML transmitted from the repository and perform policy decision making and enforcement. By applying these methods, security vulnerabilities in communication between IoT devices can be reduced, and cyber resilience can be enhanced. [ABSTRACT FROM AUTHOR]

Several blockchain-based models have surfaced in recent years to offer a safe method of storing and accessing delicate electronic medical records (EMRs) and role-based access control mechanisms across the healthcare industry. However, single points of failure, Security, privacy and unauthorized access of data are measure concerns for health records access management. Blockchain technology is a decentralized digital ledger that records transactions across multiple computers to ensure security, transparency, and immutability. Solid is a decentralized platform that provides patient centric access control of Electronic Medical Records (EMRs). In this study, a blockchain and solid-pod enabled secure framework has been proposed for EMR transactions and healthcare clouds. This has a significant impact on how quickly and easily emergency EMRs may be shared in a smart healthcare system. Solid and Blockchain prioritize privacy and security by enabling users to set immutable, transparent, and fine-grained access controls for their data using solidity-based smart contracts. For the performance evaluation of our proposed system, solid-pod computing and storage results are analyzed. [ABSTRACT FROM AUTHOR]

Conversational AI systems have emerged as key enablers of human-like interactions across diverse sectors. Nevertheless, the balance between linguistic nuance and factual accuracy has proven elusive. In this paper, we first introduce LLMXplorer, a comprehensive tool that provides an in-depth review of over 205 large language models (LLMs), elucidating their practical implications, ranging from social and ethical to regulatory, as well as their applicability across industries. Building on this foundation, we propose a novel functional architecture that seamlessly integrates the structured dynamics of knowledge graphs with the linguistic capabilities of LLMs. Validated using real-world AI news data, our architecture adeptly blends linguistic sophistication with factual rigor and further strengthens data security through role-based access control. This research provides insights into the evolving landscape of conversational AI, emphasizing the imperative for systems that are efficient, transparent, and trustworthy. [ABSTRACT FROM AUTHOR]

Named Data Networking (NDN) is an emerging network architecture. An important characteristic of NDN is its in-network cache, which enables Data packets to be available from multiple locations on the Internet. Hence the enforcement of access control mechanisms becomes even more critical in the NDN. This paper proposes a novel access control scheme referred to as Role-Based Encryption for NDN (NDN-RBE), which uses a broadcast encryption mechanism to achieve secure data access control. Our scheme uses the role inheritance property of the traditional Role-Based Access Control (RBAC) model to achieve efficient data access control over hierarchical content. This makes our scheme particularly suitable for large-scale real-world content-centric services like Netflix. Our scheme also supports additional design features such as anonymous signature-based authentication, batch signature verification and two types of privilege revocations. In addition, our formal security analysis demonstrates that our scheme is provably secure against Chosen Plaintext Attacks. Our performance and functionality comparison show that our scheme outperforms other notable existing works in terms of security, functionality, computation, communication and storage overhead. Furthermore, our experimental results show an improvement in content delivery time of the order of 15 percent compared with the other closely related works. [ABSTRACT FROM AUTHOR]

Background This research delves into the critical aspects of identity management, access control, and authorization practices within the domains of public and private universities. Identity management involves the meticulous management and control of user identities, encompassing the establishment and maintenance of user profiles, role assignments, and access privileges. Access control is the practice of defining and enforcing policies that govern who can access an IT system or application and which resources they can interact with. Authorization, meanwhile, determines the specific actions and privileges granted to users based on their roles and permissions. Methods To understand the variances in identity management and access control approaches, we conducted a comparative analysis between public and private universities. Our investigation scrutinized the user populations with access to university systems, the enforcement of access limitations, authentication methods, and password policies. Additionally, we examined the nuances of authorization processes, levels of authorization, access approval authorities, user status and role changes, unique user account management, account deletion procedures, user authentication methods, password complexity and expiration policies, password storage methods, and session termination policies. Results This study revealed that both public and private universities prioritize these security measures, with a common categorization of these processes. Nevertheless, there exist disparities, such as the inclusion of contractors and vendors in the user population at private universities, the manual deletion of user accounts in private institutions, and variations in password policies and storage methods. Private universities tend to enforce stricter password policies, employ more secure password storage methods, and implement automatic session termination features. Conclusions This research provides valuable insights into the practices and approaches adopted by public and private universities to safeguard their digital environments. The findings serve as a valuable resource for enhancing identity management, access control, and authorization protocols, enabling institutions to fortify their cybersecurity defenses in an ever-evolving threat landscape.

Role-based Access Control (RBAC) promises an efficient authorization management system in accessing resources including electric vehicle (EV) data stored in the cloud server. In this EV data security implementation, access control has to be strong and efficient with respect to EV user authentication information, thus access control mechanism mandatorily relies on authentication as the system access prerequisite. In this work, identity-based cryptography (IBC) is incorporated with RBAC to invent an EV user role-based access control immersed in his/her identity as an internal EV user’s authentication and key exchange. Contribution to our work is in a simple way involving only the EV user’s signature to verify simultaneously both important aspects of authentication and authorization. In this case, authentication is carried out based on identity while authorization is activated based on EV user’s role. We formally prove that the proposed protocol satisfies the security requirements of both authentication and authorization outright by verifying EV user’s signature. The evaluation results show that the total computational cost for authentication and key exchange process between EV user and the server is practical enough and it only consumes approximately 800 ms.

In a smart home environment, multiple users can access a single smart device simultaneously. Moreover, these multiple users may have conflicting demands at a time; that is, one user’s demands differ from another for the same device based on the role of users and environmental factors. Therefore, existing single-user access control systems cannot handle such conflicting and dynamically changing demands, considering both roles and environmental factors in the multi-user smart home environment. Considering this issue, we proposed a Smart Access Control and Authorization framework (SAAC). It is a multi-user access control solution that has four modules, namely, a user interaction module, a backend server module, a policy manager module, and a policy execution module. The user interaction module collects user data and resource policies, which are processed by the backend server and forwarded to the policy manager. The policy manager resolves conflicts and generates final policies, which are stored in the backend server for enforcement by the policy execution module. The finalized policies are shared with the backend server module and saved there till needed for execution by the policy execution module to enforce the access control decision. We have implemented a proof of concept of the proposed framework on VS Code using the Casbin library. The performance evaluation results show our framework’s effectiveness and efficiency with lower computational complexity requirements than existing methods. Finally, we performed a security analysis of the proposed model based on the STRIDE model that confirms its robustness against access control attacks.

Cloud computing platforms have been one of the best sources for resource computation and service recommendations in the recent years. Users' reliance on the cloud has increased dramatically during the pandemic period, particularly for data storage and pay-per-use services. Restricted and reliable access control is essential for protecting the data stored in the cloud. The traditional role-based access control techniques are ineffective in multi-tenant computing systems like the cloud. To provide security in cloud computing systems and offer a trusted environment for service providers and service users, we present a trust-oriented role-based access control paradigm in this work. The Trust Management System's reputation is something that TRBAC wants to uphold by ensuring that various cloud threats do not compromise the service requests made and used by individual users. Validation and analysis of the membership credentials of users and roles mapped in the access control list ensure restricted access control in TRBAC. The proposed model intends to assist the data owners in identifying reliable service users and service providers by reviewing the interaction history and assessing direct, indirect, and weighted trust. This paper demonstrates how calculated trust values detect nefarious nodes and recommend defense mechanisms against various security concerns, including the Sybil attack, the On–off attack, the Collusion attack, and the DoS attack. To illustrate the impact of the suggested mitigation techniques and to handle various security concerns, a comparative analysis of the TRBAC model is done with its peers. [ABSTRACT FROM AUTHOR]

Conversational AI systems have emerged as key enablers of human-like interactions across diverse sectors. Nevertheless, the balance between linguistic nuance and factual accuracy has proven elusive. In this paper, we first introduce LLMXplorer, a comprehensive tool that provides an in-depth review of over 205 large language models (LLMs), elucidating their practical implications, ranging from social and ethical to regulatory, as well as their applicability across industries. Building on this foundation, we propose a novel functional architecture that seamlessly integrates the structured dynamics of knowledge graphs with the linguistic capabilities of LLMs. Validated using real-world AI news data, our architecture adeptly blends linguistic sophistication with factual rigor and further strengthens data security through role-based access control. This research provides insights into the evolving landscape of conversational AI, emphasizing the imperative for systems that are efficient, transparent, and trustworthy.

Cyberthreat proliferation parallels the rapid surge in smart home usage. While having everything in one place is convenient, it also increases your home's vulnerability to cyber threats. Such an attack could result in bodily harm, the theft of sensitive information, or both. To mitigate the effects of these threats, owners of smart homes can make efforts to prevent cybercriminals from breaking into their premises starting by updating their firmware to the most recent version, creating secure passwords, and enabling two-factor authentication. Second, people should safeguard their gadgets by creating unique user IDs, disabling unneeded functions, and always keeping a tight eye on them. Finally, they must safeguard the facility where they conduct business by installing surveillance equipment, employing electronic locks, and restricting network access. Individuals must take these safeguards, but they must also stay informed about the most recent threats to home cybersecurity and the best strategies to combat them. Smart home device owners should become acquainted with the risks to which their devices are prone and ensure that their devices are updated to the most recent versions of all available software and security upgrades. Collaboration between homeowners, connected device manufacturers, and internet service providers is required to ensure the security of a smart home. Homeowners should research the security features available in smart home devices and only buy from reputable businesses that value consumer privacy and security. As the Internet of Things (IoT) expands and develops, a data privacy standard that meets the criteria of Data protection is in great demand. Safeguarding smart family apps necessitates a community agreement and specific permission from users to store their personal information in the product's database. [ABSTRACT FROM AUTHOR]

In today’s world, services are improved and advanced in every field of life. Especially in the health sector, information technology (IT) plays a vigorous role in electronic health (e-health). To achieve benefits from e-health, its cloud-based implementation is necessary. With this environment’s multiple benefits, privacy and security loopholes exist. As the number of users grows, the Electronic Healthcare System’s (EHS) response time becomes slower. This study presented a trust mechanism for access control (AC) known as role-based access control (RBAC) to address this issue. This method observes the user’s behavior and assigns roles based on it. The AC module has been implemented using SQL Server, and an administrator develops controls for users with roles and access to multiple EHS modules. To validate the user’s trust value, A.net-based framework has been introduced. The framework of e-health proposed in this research ensures that users can protect their data from intruders and other security threats.

During the COVID-19 pandemic, online electronic educational systems have been used in most schools and universities as they were forced to move their operations from classrooms to online settings. However, these systems face a serious security issue. Access control considers the core of data security for any implemented system. This paper presents the well-known role-based access control (RBAC) approach to enhance system security and improve user role and system privilege. This study also addresses the issues faced by extant schemes, such as security risk tolerance, by proposing a privacy-preserving educational system that utilizes RBAC and smart multifactor authentication. This approach uses an asymmetric cryptosystem based on the Elgamal digital signature operation to provide multi-factor authentication while relying on low-complexity cryptographic hash functions. RBAC manages system security via the "user classification, role authorization, and unified management" approach. By limiting the amount of data that users can access, RBAC is particularly suited for multi-level applications. This approach also uses informal analysis and the Scyther tool to conduct extensive formal security proofs. RBAC offers many benefits, including mutual authentication, identity anonymity, forward secrecy, key management, and high resistance to well-known attacks, such as phishing, replay, Man-In-The-Middle (MITM), and insider attacks. Compared with other schemes, RBAC offers more security features and boasts higher cost effectiveness in processing and communication. Furthermore, our work achieves a good balance between performance and security complexity when compared to the state-of-the-art. So, we get good results at a cost of 0.253 ms for computing and 1326 bits for communication. [ABSTRACT FROM AUTHOR]

By following the encrypted communication proposed by IEC 62351-3 and the identity authentication technology by IEC 62351-4， the paper carries out research on role-based access control technology on the theoretical basis of IEC 62351-8. This technology preassigns a role to each client communication device in the communication link according to actual applications. It takes the digital certificate for its secure communication as a carrier to expand the access token that forms the role. The server device recognizes and extracts the role of the client from the digital certificate used by the client in secure communication and grants the client corresponding access permissions according to the preset mapping of roles and permissions to realize the role-based access control function. The purpose of hierarchical and sub-authorized access to IEC 61850 communication has been achieved. This technology improves the controllability of remote operation of power system equipment and has been applied in substations.

As the functionality and services provided by cloud computing increase, control access to these services becomes more complex, and more security breaches are generated. This is mainly based on the emergence of new requirements and constraints in the open, dynamic, heterogeneous, and distributed cloud environment. Despite the importance of identifying these requirements for designing and evaluating access control models, the available studies do not provide a rigorous review of these requirements and the mechanisms that fulfill them. The purpose of this study was to conduct a literature review of the published articles that have dealt with cloud access control requirements and techniques. This paper allowed us to answer the following two research questions: What cloud access control security requirements have been presented in the published literature? What access control mechanisms are proposed to fulfill them? This review yielded 21 requirements and nine mechanisms, reported by 20 manuscripts. The identified requirements in this review will help researchers, academics and practitioners assess the effectiveness of cloud access control models and identify gaps that are not addressed in the proposed solutions. In addition, this review showed the current cloud access control mechanisms used to meet these requirements such as access control based on trust, risk, multi-tenant, and attribute encryption.

A medical record is an important part of a patient's follow-up. It comprises healthcare professionals' views, prescriptions, analyses, and all information about the patient. Several players, including the patient, the doctor, and the pharmacist, are involved in the process of sharing, and managing this file. Any authorized individual can access the electronic medical record (EMR) from anywhere, and the data are shared among various health service providers. Sharing the EMR requires various conditions, such as security and confidentiality. However, existing medical systems may be exposed to system failure and malicious intrusions, making it difficult to deliver dependable services. Additionally, the features of these systems represent a challenge for centralized access control methods. This paper presents SEMRAchain a system based on Access control (Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC)) and a smart contract approach. This fusion enables decentralized, fine-grained, and dynamic access control management for EMR management. Together, blockchain technology as a secure distributed ledger and access control provides such a solution, providing system stakeholders with not just visibility but also trustworthiness, credibility, and immutability. [ABSTRACT FROM AUTHOR]

Summary: The rise of social media‐related crimes has led to the rise of mobile forensics. Since mobile forensics and privacy preservation are conflicting fields, it is important to find a middle ground where forensics can be performed on any device without compromising the confidentiality of an individual. This paper presents a framework called "role‐based mobile forensics framework with cryptography (RBMF2C)" that can be easily implemented and protects users' privacy and does not interfere with the forensic process. A mobile forensic platform called Sher‐locked phones developed using C# is also presented in this paper that is developed following the aforementioned RBMF2C framework. This platform consists of five layers: access control, evidence gathering, data analysis, privacy, and reporting layer. The developed platform implements the RBMF2C framework on the evidence gathering, analysis, and reporting layer to protect the evidential image, evidential findings, and final report from being accessed by unauthorized users. The implementation of privacy preservation techniques as proposed by the proposed framework such as role‐based access control, keyword search, and encryption/ decryption did not hinder the performance of the developed toolkit, and suspects data privacy is also preserved to a substantial extent. [ABSTRACT FROM AUTHOR]

A global transition to power grids with high penetrations of renewable energy generation is being driven in part by rapid installations of distributed energy resources (DER). New DER equipment includes standardized IEEE 1547-2018 communication interfaces and proprietary communications capabilities. Interoperable DER provides new monitoring and control capabilities. The existence of multiple entities with different roles and responsibilities within the DER ecosystem makes the Access Control (AC) mechanism necessary. In this paper, we introduce and compare two novel architectures, which provide a Role-Based Access Control (RBAC) service to the DER ecosystem's entities. Selecting an appropriate RBAC technology is important for the RBAC administrator and users who request DER access authorization. The first architecture is centralized, based on the OpenLDAP, an open source implementation of the Lightweight Directory Access Protocol (LDAP). The second approach is decentralized, based on a private Ethereum blockchain test network, where the RBAC model is stored and efficiently retrieved via the utilization of a single Smart Contract. We have implemented two end-to-end Proofs-of-Concept (PoC), respectively, to offer the RBAC service to the DER entities as web applications. Finally, an evaluation of the two approaches is presented, highlighting the key speed, cost, usability, and security features. [ABSTRACT FROM AUTHOR]

The ever-increasing use of cloud computing and services has raised questions of securely accessing data. Security concernsare a significant hurdle to storing large-scale data in the cloud while controlling and preventing illegal access to data saved in the cloud remains a challenge. Cloud data is managed and owned by a method known as role-based access control (RBAC). Security in role and privileges of users on data objects in RBAC is a cause for concern. In this paper, Double Diagonal Puzzle Encryption Standard - 512 (DDPES-512) has been proposed using reservoir computing. DDPES-512 works on the principle of Advanced Encryption Standard (AES) in which the encryption keys are generated using a Double Diagonal Puzzle (DDP) scheme. The recommended algorithm, DDPES-512 has been compared with ciphertext-policy attribute-based Encryption (CP-ABE) and CP-ABE with anonymization and signature and it was found that DDPES-512 is the more secure algorithm in terms of time taken to generate a secret key (the interval is decreased by 6.45% and the storage overhead of the cloud server was reduced by 12.90% in the cloud environment). [ABSTRACT FROM AUTHOR]

The collaboration among different organizations is considered one of the main benefits of moving applications and services to a cloud computing environment. Unfortunately, this collaboration raises many challenges such as the access of sensitive resources by unauthorized people. Usually, Role-Based Access-Control (RBAC) model is deployed in large organizations. This paper addresses the scalability problem of the online stored rules. This problem affects the performance of the access control system due to increasing number of shared resources and/or number of collaborating organizations in the same cloud environment. Therefore, this paper proposes replacing the cross-domain RBAC rules with Role-To-Role (RTR) mapping rules among all organizations. The RTR mapping rules are generated using a newly proposed Role-Mapping algorithm. A comparative study is performed to evaluate the proposed algorithm's performance with concerning the Rule-Store size and the authorization response time. According to the results, it is found that the proposed algorithm reduces the number of stored rules which minimizes the Rule-Store size and reduces the authorization response time. Additionally, this paper proposes applying a concurrent approach on the RTR mapping model using the proposed Role-Mapping algorithm to achieve more savings in the authorization response time. Therefore, it will be suitable in highly-collaborative cloud environments. [ABSTRACT FROM AUTHOR]

Purpose – This paper aims to describe an effort to provide for a robust and secure software development paradigm intended to support DevSecOps in a naval aviation enterprise (NAE) software support activity (SSA), with said paradigm supporting strong traceability and provability concerning the SSA’s output product, known as an operational flight program (OFP). Through a secure development environment (SDE), each critical software development function performed on said OFP during its development has a corresponding record represented on a blockchain. Design/methodology/approach – An SDE is implemented as a virtual machine or container incorporating software development tools that are modified to support blockchain transactions. Each critical software development function, e.g. editing, compiling, linking, generates a blockchain transaction message with associated information embedded in the output of a said function that, together, can be used to prove integrity and support traceability. An attestation process is used to provide proof that the toolchain containing SDE is not subject to unauthorized modification at the time said critical function is performed. Findings – Blockchain methods are shown to be a viable approach for supporting exhaustive traceability and strong provability of development system integrity for mission-critical software produced by an NAE SSA for NAE embedded systems software. Practical implications – A blockchain-based authentication approach that could be implemented at the OFP point-of-load would provide for fine-grain authentication of all OFP software components, with each component or module having its own proof-of-integrity (including the integrity of the used development tools) over its entire development history. Originality/value – Many SSAs have established control procedures for development such as check-out/check-in. This does not prove the SSA output software is secure. For one thing, a build system does not necessarily enforce procedures in a way that is determinable from the output. Furthermore, the SSA toolchain itself could be attacked. The approach described in this paper enforces security policy and embeds information into the output of every development function that can be cross-referenced to blockchain transaction records for provability and traceability that only trusted tools, free from unauthorized modifications, are used in software development. A key original concept of this approach is that it treats assigned developer time as a transferable digital currency.

Abstract Background The cloud is a promising resource for data sharing and computing. It can optimize several legacy processes involving different units of a company or more companies. Recently, cloud technology applications are spreading out in the healthcare setting as well, allowing to cut down costs for physical infrastructures and staff movements. In a public environment the main challenge is to guarantee the patients’ data protection. We describe a cloud-based system, named ReportFlow, developed with the aim to improve the process of reporting and delivering electroencephalograms. Methods We illustrate the functioning of this application through a use-case scenario occurring in an Italian hospital, and describe the corresponding key encryption and key management used for data security guarantee. We used the X2 test or the unpaired Student t test to perform pre-post comparisons of some indexes, in order to evaluate significant changes after the application of ReportFlow. Results The results obtained through the use of ReportFlow show a reduction of the time for exam reporting (t = 19.94; p

Cloud operating system (Cloud OS) is the heart of cloud management platform that takes control of various cloud resources. Therefore, it attracts numerous attacks, especially unauthorized access. Many existing works adopt role-based access control (RBAC) model for Cloud OS access control and token-based approaches as user credentials of sessions or transactions between users and cloud, but they fail to resist privilege abuse caused by RBAC policy rules tampering or token hijacking. To addresses this challenging problem, we propose a secure access control framework suitable for resource-centric Cloud OS. For one thing, we propose a new authorization model with cryptographically protected RBAC policy rules. To solve the policy decision problem caused by encrypted policy rules in this model, an approach is developed to transform it into permission searching problem and we further propose a policy decision scheme based on this. For another thing, we achieve user token unlinkability and token-replay-attack resistance by introducing randomization mechanism and leveraging one-show token technique. A proof of concept implementation has been developed and the proposed scheme is proven secure and efficient by security analysis and the performance evaluation. [ABSTRACT FROM AUTHOR]