Adaptable and Dynamic Access Control Decision-Enforcement Approach Based on Multilayer Hybrid Deep Learning Techniques in BYOD Environment

Organizations are adopting the Bring Your Own Device(BYOD)concept to enhance productivity and reduce expenses.However,this trend introduces security challenges,such as unauthorized access.Traditional access control systems,such as Attribute-Based Access Control(ABAC)and Role-Based Access Control(RBAC),are limited in their ability to enforce access decisions due to the variability and dynamism of attributes related to users and resources.This paper proposes a method for enforcing access decisions that is adaptable and dynamic,based on multilayer hybrid deep learning techniques,particularly the Tabular Deep Neural Network Tabular DNN method.This technique transforms all input attributes in an access request into a binary classification(allow or deny)using multiple layers,ensuring accurate and efficient access decision-making.The proposed solution was evaluated using the Kaggle Amazon access control policy dataset and demonstrated its effectiveness by achieving a 94%accuracy rate.Additionally,the proposed solution enhances the implementation of access decisions based on a variety of resource and user attributes while ensuring privacy through indirect communication with the Policy Administration Point(PAP).This solution significantly improves the flexibility of access control systems,making themmore dynamic and adaptable to the evolving needs ofmodern organizations.Furthermore,it offers a scalable approach to manage the complexities associated with the BYOD environment,providing a robust framework for secure and efficient access management.

Interference management via access control and mobility prediction in two-tier heterogeneous networks

Abstract： Two-tier heterogeneous networks （HetNets）, where the current cellular networks, i.e., macrocells, are overlapped with a large number of randomly distributed femtocells, can potentially bring significant benefits to spectral utilization and system capacity. The interference management and access control for open and closed femtocells in two-tier HetNets were focused. The contributions consist of two parts. Firstly, in order to reduce the uplink interference caused by MUEs （macrocell user equipments） at closed femtocells, an incentive mechanism to implement interference mitigation was proposed. It encourages femtoeells that work with closed-subscriber-group （CSG） to allow the interfering MUEs access in but only via uplink, which can reduce the interference significantly and also benefit the marco-tier. The interference issue was then studied in open-subscriber-group （OSG） femtocells from the perspective of handover and mobility prediction. Inbound handover provides an alternative solution for open femtocells when interference turns up, while this accompanies with PCI （physical cell identity） confusion during inbound handover. To reduce the PCI confusion, a dynamic PCI allocation scheme was proposed, by which the high handin femtocells have the dedicated PCI while the others share the reuse PCIs. A Markov chain based mobility prediction algorithm was designed to decide whether the femtoeell status is with high handover requests. Numerical analysis reveals that the UL interference is managed well for the CSG femtocell and the PCI confusion issue is mitigated greatly in OSG femtocell compared to the conventional approaches.

Mobility Conscious Medium Access Control Scheme for Wireless Sensor Networks: A Conceptual Approach

Mobility in Wireless Sensor Network (WSN) presents distinctive challenges in Medium Access Control (MAC) scheme. Numerous MAC protocols for sensor networks assume that sensor nodes are static and focus primarily on energy efficiency. This work seeks to develop an improved mobility conscious medium access control scheme for wireless sensor networks with a view to enhance energy conservation on mobile sensor nodes. On this note, mobility patterns of different scenarios are modelled using Gauss Markov Mobility Model (GMMM) to determine the position and distance of the sensor nodes and how they are correlated in time.

A distributed synchronous reservation multiple access control protocol for mobile Ad hoc networks

This study proposes a new multiple access con-trol protocol named distributed synchronous reservation mul-tiple access control protocol,in which the hidden and exposed terminal problems are solved,and the quality of service(QoS)requirements for real-time traffic are guaranteed.The protocol is founded on time division multiplex address and a different type of traffic is assigned to different priority,according to which a node should compete for and reserve the free slots in a different method.Moreover,there is a reservation acknowledgement process before data transmit in each reserved slot,so that the intruded terminal problem is solved.The throughput and average packets drop probability of this protocol are analyzed and simulated in a fully connected network,the results of which indicate that this protocol is efficient enough to support the real-time traffic,and it is more suitable to MANETs.

Security Service Technology for Mobile Networks

As mobile networks become high speed and attain an all-IP structure, more services are possible. This brings about many new security requirements that traditional security programs cannot handle. This paper analyzes security threats and the needs of 3G/4G mobile networks, and then proposes a novel protection scheme for them based on their whole structure. In this scheme, a trusted computing environment is constructed on the mobile terminal side by combining software validity verification with access control. At the security management center, security services such as validity verification and integrity check are provided to mobile terminals. In this way, terminals and the network as a whole are secured to a much greater extent. This paper also highlights problems to be addressed in future research and development.

Asymmetric Dual-Channel MAC Protocol for Multihop Mobile Ad Hoc Networks

In order to resolve the hidden and exposed terminal problems and improve the probability of concurrent packet transmissions for multihop Mobile Ad Hoc Networks （MANETs）, a novel slotted Asyrmaetric Dual-Channel Medium Access Control （ADC-MAC） protocol is proposed. It exploits sirmltaneous reservation with less collisions and conision-flee data packet transmissions, and achieves optimal transmission balance on the Control Channel （CCH） and Data Channel （DCH） by adjusting the relationship between Reservation Slot （RS） on the CCH and the data packet Transmission Slot （TS） on the DCH. Transmission interferences can be avoided by only observing CCH for the transmission time of a data packet. The proposed RS and contention micro-slot backoff mechanisms also greatly improve channel access efficiency. Simulation results show that compared to IFEE 802. 11 DCF and -Mc protocols, the proposed protocol can achieve a throughput gain of 88% in singlehop networks and 151% in nltihop networks at the same total data rate.

A DUAL RESERVATION CDMA-BASED MAC PROTOCOL WITH POWER CONTROL FOR AD HOC NETWORKS

This paper proposes a new multi-channel Medium Access Control (MAC) protocol named as Dual Reservation Code Division Multiple Access (CDMA) based MAC protocol with Power Control (DRCPC). The code channel is divided into common channel,broadcast channel and several data chan-nels. And dynamic power control mechanism is implemented to reduce near-far interference. Compared with IEEE 802.11 Distributed Coordination Function (DCF) protocol,the results show that the pro-posed mechanism improves the average throughput and limits the transmission delay efficiently.

Cooperative MIMO MAC Transmission Using Space Codes in Wireless Sensor Network

Wireless sensor network （WSN） requires robust and efficient communication protocols to minimise delay and save energy. The lifetime of WSN can be maximised by selecting proper medium access control （MAC） scheme depending on the contention level of the network. The throughput of WSN however reduces due to channel fading effects even with the proper design of MAC protocol. Hence this paper proposes a new MAC scheme for enabling packet transmission using cooperative multi-input multi-output （MIMO） utilising space time codes（STC） such as space time block code （STBC）, space time trellis code （STTC） to achieve higher energy savings and lower delay by allowing nodes to transmit and receive information jointly. The performance of the proposed MAC protocol is evaluated in terms of transmission error probability, energy consumption and delay. Simulation results show that the proposed cooperative MIMO MAC protocol provides reliable and efficient transmission by leveraging MIMO diversity gains.

Multilevel security model for ad hoc networks

Modern battlefield doctrine is based on mobility, flexibility, and rapid response to changing situations. As is well known, mobile ad hoc network systems are among the best utilities for battlefield activity. Although much research has been done on secure routing, security issues have largely been ignored in applying mobile ad hoc network theory to computer technology. An ad hoc network is usually assumed to be homogeneous, which is an irrational assumption for armies. It is clear that soldiers, commanders, and commanders-in-chief should have different security levels and computation powers as they have access to asymmetric resources. Imitating basic military rank levels in battlefield situations, how multilevel security can be introduced into ad hoc networks is indicated, thereby controlling restricted classified information flows among nodes that have different security levels.

一种均衡流量的Mobile Ad Hoc网络能量路由选择方法

由于Ad hoc网络是能量受限网络,因此如何提高Ad hoc网络的能量效率问题非常重要.该文提出了一种新的路由选择度量,该度量把节点链路层的拥塞度与节点当前剩余能量综合在一起考虑,使得网络中能量消耗和网络负荷能更加均匀地分布,提高了网络的连通性,增加了网络的吞吐量.仿真结果表明,该度量对于不同规模的网络,其吞吐量均有不同程度的提高.

Authentication masking code against DoS of T-MAC protocol

Security vulnerability of denial of service (DoS) in time out-medium access control (T-MAC) protocol was discussed and analysis of power consumption at each stage of T-MAC protocol was carried out. For power efficient authentication scheme which can provide reliability, efficiency, and security for a general T-MAC communication, a novel synchronization and authentication scheme using authentication masking code was proposed. Authentication data were repeated and masked by PN sequence. The simulation results show that the proposed approach can provide synchronization and authentication simultaneously for nodes in wireless sensor network (WSN). 63 bits AMC code gives above 99.97% synchronization detection and 93.98% authentication data detection probability in BER 0.031 7.

A distributed authentication and authorization scheme for in-network big data sharing

Big data has a strong demand for a network infrastructure with the capability to support data sharing and retrieval efficiently. Information-centric networking （ICN） is an emerging approach to satisfy this demand, where big data is cached ubiquitously in the network and retrieved using data names. However, existing authentication and authorization schemes rely mostly on centralized servers to provide certification and mediation services for data retrieval. This causes considerable traffic overhead for the secure distributed sharing of data. To solve this problem, we employ identity-based cryptography （IBC） to propose a Distributed Authentication and Authorization Scheme （DAAS）, where an identity-based signature （IBS） is used to achieve distributed verifications of the identities of publishers and users. Moreover, Ciphertext-Policy Attribnte-based encryption （CP-ABE） is used to enable the distributed and fine-grained authorization. DAAS consists of three phases： initialization, secure data publication, and secure data retrieval, which seamlessly integrate authentication and authorization with the in- terest/data communication paradigm in ICN. In particular, we propose trustworthy registration and Network Operator and Authority Manifest （NOAM） dissemination to provide initial secure registration and enable efficient authentication for global data retrieval. Meanwhile, Attribute Manifest （AM） distribution coupled with automatic attribute update is proposed to reduce the cost of attribute retrieval. We examine the performance of the proposed DAAS, which shows that it can achieve a lower bandwidth cost than existing schemes.

Correlation Composition Awareness Model with Pair Collaborative Localization for IoT Authentication and Localization

Secure authentication and accurate localization among Internet of Things(IoT)sensors are pivotal for the functionality and integrity of IoT networks.IoT authentication and localization are intricate and symbiotic,impacting both the security and operational functionality of IoT systems.Hence,accurate localization and lightweight authentication on resource-constrained IoT devices pose several challenges.To overcome these challenges,recent approaches have used encryption techniques with well-known key infrastructures.However,these methods are inefficient due to the increasing number of data breaches in their localization approaches.This proposed research efficiently integrates authentication and localization processes in such a way that they complement each other without compromising on security or accuracy.The proposed framework aims to detect active attacks within IoT networks,precisely localize malicious IoT devices participating in these attacks,and establish dynamic implicit authentication mechanisms.This integrated framework proposes a Correlation Composition Awareness(CCA)model,which explores innovative approaches to device correlations,enhancing the accuracy of attack detection and localization.Additionally,this framework introduces the Pair Collaborative Localization(PCL)technique,facilitating precise identification of the exact locations of malicious IoT devices.To address device authentication,a Behavior and Performance Measurement(BPM)scheme is developed,ensuring that only trusted devices gain access to the network.This work has been evaluated across various environments and compared against existing models.The results prove that the proposed methodology attains 96%attack detection accuracy,84%localization accuracy,and 98%device authentication accuracy.

气象部门终端入网控制系统的设计与实现

气象信息网络的快速发展,促进气象内部网络的设备种类和数量不断增加,对传统的入网管理方式提出新的挑战。现阶段,气象内网办公区网络接入设备数量超过7000台,在网设备的种类和数量难以梳理,违规占用网络资源的现象时有发生。由于接入设备的合法性难以确定,在违规接入设备后无法第一时间发现和阻断,对业务系统和气象数据安全带来威胁。在网设备可能存在恶意程序运行,接入气象网络后可能对其它设备的安全产生重大影响。传统控制技术需要维护本地的数据信息,存在数据准确性滞后和泄露风险。该文以解决以上问题为出发点,设计和实现适应气象网络需求的无客户端模式终端入网控制系统,通过与统一信任服务系统和终端安全管理系统数据共享,实现身份认证信息的自动更新和维护,同时促进终端安全管理软件在气象园区的广泛应用,及时发现和阻断违规设备的接入,消除潜在的安全隐患。

MEC-NOMA系统的物理层安全性能评估

面向移动边缘计算(mobile edge computing,MEC)场景,建立了一个存在主动攻击者的非正交多址协议(nonorthogonal multile access,NOMA)网络传输模型,并设计一种卷积神经网络(convolutional neural network,CNN)模型来评估该传输模型的安全中断概率(security outage probability,SOP)。研究结果表明:所提出的MEC-NOMA系统不仅提高了SOP,而且能够对抗主动窃听者的攻击;此外,通过CNN模型评估的SOP与其他方法(蒙特卡洛方法和数学解析表达式)非常接近,且执行时间更短。

无线局域网应用多重USG防火墙的安全策略研究

无线网络是一种方便灵活的网络接入方式,同时也存在一系列的安全威胁。通过对无线网络中可能产生的攻击和入侵方式进行详细的研究,确定基于华为USG5500防火墙的多重综合防御措施,包括身份验证、访问控制、数据加密、监测防御等多个方面,重点放在无线网络的身份验证和访问控制上。基于eNSP平台部署仿真拓扑,规划IP地址和防火墙区域,在无线网络中采用WPA2-PSK加密技术和VLAN技术,在多重防火墙中设置访问控制策略和流量过滤规则。仿真结果表明,在正确设置策略规则的情况下,多重USG5500防火墙能够及时监控和识别网络中的异常行为,有效检测和阻止网络攻击,提升无线网络的安全性和可靠性。

面向水下移动汇聚节点的媒体接入控制协议研究

针对水下移动传感网络(underwater mobile sensor network,UWMSN)中使用自主移动节点进行数据收集存在的拓扑结构不断变化、传输不可靠的问题,提出一种动态退避发送数据帧的自适应媒体接入控制(media access control,MAC)协议,通过将协议划分为控制阶段与数据阶段周期性地更新可建立通信的节点信息,根据当前周期获得的节点距离信息调度各节点数据传输顺序,利用水下环境的大传播时延计算各节点的回退发送数据帧的时间,使用数据重传机制提高传输的可靠性。采用OPNET网络仿真模拟器对提出的协议进行仿真和对比分析。仿真结果显示,协议在密度较低的小范围水下传感网络中可保证较高的投递成功率和较低的端到端时延,增大了网络吞吐量,提高了网络性能。

城市轨道交通云平台网络安全访问控制技术研究

通过分析城市轨道交通云平台网络安全常见风险及应用实施需求,首先论述访问控制技术的适用性,提出以资源隔离为主,结合安全策略实施的解决方案;其次采取业务系统分区分域的策略对城轨云平台进行边界划分,形成保障系统安全的基础架构,并遵循风险检测与控制的安全标准体系,实现基于主动防御技术的城轨云安全态势感控平台;最后按照等级保护规范的要求,提出一套基于安全标记的强制访问控制技术模型,从安全级别和安全范畴2个维度进行安全标记设计,按照数据敏感度和完整性设定安全级别,按照业务类型和业务区域进行安全范畴的抽象和定义,从而有效支持城轨云平台达到所设计的网络安全标记等级。

TA-BAC:基于有向无环图的访问控制模型

为解决传统访问控制模型存在有效期内策略获取困难、传输过程安全性低等问题,研究更细粒度、更具适用性的基于属性权能的访问控制模型(token attribute based access control, TA-BAC)。构建一种基于DAG区块链的TA-BAC访问控制模型;实现轻量化区块链存储,设计灵活的策略获取流程;引入基于属性的加密算法实现访问控制流程中凭证token的安全性增强机制。对优化后的访问控制模型进行分析验证,其结果表明,该模型具有较好的安全性和更高的性能,面对不同规模的访问控制场景具备良好的适用性。