Authentication and Access Control in RFID Based Logistics-customs Clearance Service Platform

The content security requirements of a radio frequency identification （RFID） based logistics-customs clearance service platform （LCCSP） are analysed in this paper. Then, both the unified identity authentication and the access control modules are designed according to those analyses. Finally, the unified identity authentication and the access control on the business level are implemented separately. In the unified identity authentication module, based on an improved Kerberos-based authentication approach, a new control transfer method is proposed to solve the sharing problem of tickets among different servers of different departments. In the access control module, the functions of access controls are divided into different granularities to make the access control management more flexible. Moreover, the access control module has significant reference value for user management in similar systems.

Service Security Architecture and Access Control Model for Cloud Computing

Security is a key problem for the development of Cloud Computing. A common service security architecture is a basic abstract to support security research work. The authorization ability in the service security faces more complex and variable users and environment. Based on the multidimensional views, the service security architecture is described on three dimensions of service security requirement integrating security attributes and service layers. An attribute-based dynamic access control model is presented to detail the relationships among subjects, objects, roles, attributes, context and extra factors further. The model uses dynamic control policies to support the multiple roles and flexible authority. At last, access control and policies execution mechanism were studied as the implementation suggestion.

Privacy Protection Based Access Control Scheme in Cloud-Based Services

With the rapid development of computer technology, cloud-based services have become a hot topic. They not only provide users with convenience, but also bring many security issues, such as data sharing and privacy issue. In this paper, we present an access control system with privilege separation based on privacy protection(PS-ACS). In the PS-ACS scheme, we divide users into private domain(PRD) and public domain(PUD) logically. In PRD, to achieve read access permission and write access permission, we adopt the Key-Aggregate Encryption(KAE) and the Improved Attribute-based Signature(IABS) respectively. In PUD, we construct a new multi-authority ciphertext policy attribute-based encryption(CP-ABE) scheme with efficient decryption to avoid the issues of single point of failure and complicated key distribution, and design an efficient attribute revocation method for it. The analysis and simulation result show that our scheme is feasible and superior to protect users' privacy in cloud-based services.

Access Control Policy Analysis and Access Denial Method for Cloud Services

Personal cloud computing is an emerging trend in the computer industry. For a sustainable service, cloud computing services must control user access. The essential business characteristics of cloud computing are payment status and service level agreement. This work proposes a novel access control method for personal cloud service business. The proposed method sets metadata, policy analysis rules, and access denying rules. Metadata define the structure of access control policies and user requirements for cloud services. The policy analysis rules are used to compare conflicts and redundancies between access control policies. The access denying rules apply policies for inhibiting inappropriate access. The ontology is a theoretical foundation of this method. In this work, ontologies for payment status, access permission, service level, and the cloud provide semantic information needed to execute rules. A scenario of personal data backup cloud service is also provided in this work. This work potentially provides cloud service providers with a convenient method of controlling user access according to changeable business and marketing strategies.

Service-Aware Access Control Procedure for Blockchain Assisted Real-Time Applications

The design of distributed ledger,Asymmetric Key Algorithm(AKA)blockchain systems,is prominent in administering security and access control in various real-time services and applications.The assimilation of blockchain systems leverages the reliable access and secure service provisioning of the services.However,the distributed ledger technology’s access control and chained decisions are defaced by pervasive and service unawareness.It results in degrading security through unattended access control for limited-service users.In this article,a service-aware access control procedure(SACP)is introduced to address the afore-mentioned issue.The proposed SACP denes attended access control for all the service session by identifying the users and service provider availability.The distributed nature of the ledger systems and classication tree learning are combined to determine unattended access.The sole access is determined by summarizing the closed and open access requests and the service provider’s availability and integrity checks.In this process,the learning process classies the secured access request and completed the integrity checks of the current and previous service dissemination.This classication-based access administration reduces the service disconnections and false access rate of the applications.

Trust-Compensation-Based Access Control Model for Web Services

For most current Web Service access control methods, Web Service providers create a series of access control roles based on specified attributes. Only by meeting all the roles can a subject obtain the access to necessary operations and resources. However, because of the dynamic and open traits of Web Services, it is difficult for Web Service providers to work out an access control policy with moderate intensity and to realize a satisfactory balance between protecting the security of resources and maintaining the service reachable rate. To provide a solution to the above problem, this paper proposed a trust compensation access control method based on the Attribute-Based Access Control model. Our main contributions include a formal description of the access control method, a method to calculate the attribute trust degree based on time decay, and the trust compensation value of the attribute trust degree, as well as a new Service Oriented Architecture （SOA） architecture and its procedures based on a detailed trust compensation access control method.

Joint power control based on service factor for code division multiple access system

An important feature of the traffic in mobile networks is burstiness. Drawbacks of conventional power control algorithms for time division duplex （TDD）-code division multiple access （CDMA） systems are analyzed. A joint power control algorithm based on service factor is presented to address the TDD-CDMA mobile services in the burst mode according to the Markov modulated Bernoulli process. The joint power control equation is derived. A function model is developed to verify the new algorithm and evaluate its performance. Simulation results show that the new power control algorithm can estimate interference strength more precisely, speed up convergence of power control, and enhance power efficiency and system capacity. It is shown that the proposed algorithm is more robust against link gain changes, and outperforms the reference algorithms.

基于ABAC的Web Services访问控制研究

为解决Web Services访问控制问题,分析了传统访问控制模型在Web Services应用中的不足,给出了面向Web Services的基于属性的访问控制模型ABAC(Attribute Based Access Control)的定义,设计了ABAC访问控制架构,并利用可扩展的访问控制标记语言XACMLe(Xtensible Access Control Markup Language)实现了细粒度的Web Services访问控制系统。系统的应用有效保护了Web Services资源。

Enhanced Trust Based Access Control for Multi-Cloud Environment

Security is an essential part of the cloud environment.For ensuring the security of the data being communicated to and from the cloud server,a significant parameter called trust was introduced.Trust-based security played a vital role in ensuring that the communication between cloud users and service providers remained unadulterated and authentic.In most cloud-based data distribution environments,emphasis is placed on accepting trusted client users’requests,but the cloud servers’integrity is seldom verified.This paper designs a trust-based access control model based on user and server characteristics in a multi-cloud environment to address this issue.The proposed methodology consists of data encryption using Cyclic Shift Transposition Algorithm and trust-based access control method.In this trust-based access control mechanism framework,trust values are assigned to cloud users using direct trust degrees.The direct trust degree is estimated based on the following metrics:success and failure rate of interactions,service satisfaction index,and dishonesty level.In addition to this,trust values are assigned to cloud servers based on the metrics:server load,service rejection rate,and service access delay.The role-Based Access control policy of each user is modified based on his trust level.If the server fails to meet the minimum trust level,then another suitable server will be selected.The proposed system is found to outperform other existing systems in a multi-cloud environment.

Ensuring Security, Confidentiality and Fine-Grained Data Access Control of Cloud Data Storage Implementation Environment

With the development of cloud computing, the mutual understandability among distributed data access control has become an important issue in the security field of cloud computing. To ensure security, confidentiality and fine-grained data access control of Cloud Data Storage (CDS) environment, we proposed Multi-Agent System (MAS) architecture. This architecture consists of two agents: Cloud Service Provider Agent (CSPA) and Cloud Data Confidentiality Agent (CDConA). CSPA provides a graphical interface to the cloud user that facilitates the access to the services offered by the system. CDConA provides each cloud user by definition and enforcement expressive and flexible access structure as a logic formula over cloud data file attributes. This new access control is named as Formula-Based Cloud Data Access Control (FCDAC). Our proposed FCDAC based on MAS architecture consists of four layers: interface layer, existing access control layer, proposed FCDAC layer and CDS layer as well as four types of entities of Cloud Service Provider (CSP), cloud users, knowledge base and confidentiality policy roles. FCDAC, it’s an access policy determined by our MAS architecture, not by the CSPs. A prototype of our proposed FCDAC scheme is implemented using the Java Agent Development Framework Security (JADE-S). Our results in the practical scenario defined formally in this paper, show the Round Trip Time (RTT) for an agent to travel in our system and measured by the times required for an agent to travel around different number of cloud users before and after implementing FCDAC.

OBLIVIOUS TRANSFER WITH ACCESS CONTROL AND IDENTITY-BASED ENCRYPTION WITH ANONYMOUS KEY ISSUING

In ACM'CCS 2009,Camenisch,et al.proposed the Oblivious Transfer with Access Control(AC-OT) in which each item is associated with an attribute set and can only be available,on request,to the users who have all the attributes in the associated set.Namely,AC-OT achieves access control policy for conjunction of attributes.Essentially,the functionality of AC-OT is equivalent to the sim-plified version that we call AC-OT-SV:for each item,one attribute is associated with it,and it is requested that only the users who possess the associated attribute can obtain the item by queries.On one hand,AC-OT-SV is a special case of AC-OT when there is just one associated attribute with each item.On the other hand,any AC-OT can be realized by an AC-OT-SV.In this paper,we first present a concrete AC-OT-SV protocol which is proved to be secure in the model defined by Camenisch,et al..Then from the protocol,interestingly,a concrete Identity-Based Encryption(IBE) with Anonymous Key Issuing(AKI) is given which is just a direct application to AC-OT-SV.By comparison,we show that the AKI protocol we present is more efficient in communications than that proposed by Chow.

Geospacial information utilized under the access control strategy

This paper introduces a solution to the secure requirement for digital rights management （DRM） by the way of geospacial access control named geospacial access control （GeoAC） in geospacial field. The issues of authorization for geospacial DRM are concentrated on. To geospacial DRM, one aspect is the declaration and enforcement of access rights, based on geographic aspects. To the approbation of digital geographic content, it is important to adopt online access to geodata through a special data infrastructure （SDI）. This results in the interoperability requirements on three different levels： data model level, service level and access control level. The interaction between the data model and service level can be obtained by criterions of the open geospacial consortium （OGC）, and the interaction of the access control level may be reached by declaring and enforcing access restrictions in GeoAC. Then an archetype enforcement based on GeoAC is elucidated. As one aspect of performing usage rights, the execution of access restrictions as an extension to a regular SDI is illuminated.

Web Services的访问控制研究综述

随着Web Services的发展,它本身的安全问题已经成为制约其发展的关键因素。本文主要论述了Web Ser-vices的访问控制技术的研究现状及其问题。首先,从协议层次出发讨论了Web Services的访问控制技术的研究方法。然后分别介绍了XML文档和SOAP协议的访问控制技术,以及Web Services的相关访问控制规范。最后总结全文并提出了需要进一步研究的问题。

基于Web Service的授权访问控制方法

授权访问控制是管理信息系统中不可缺少的重要模块,而传统的权限控制模块耦合性和复用性都有待改善。设计了一种基于Web服务的独立授权访问控制方法。该方法抽象出授权访问控制中的基本功能,通过把授权信息以五元组的形式封装到数据库表字段中,从而能够独立出授权访问控制功能,在这样的基础之上再将授权访问控制方法Web服务化,从而形成耦合性低、可复用性强、能被异构环境下各种平台上的各种应用方便地调用的授权访问控制模块。

Web Service认证体系的分析与实现

通过对传统安全认证体系的不足之处进行分析 ,提出了基于WebService的安全认证、访问控制体系基本结构 ,在此基础上给出了有关具体实现中问题的解决方案。并进一步提出了基于面向对象方法和针对多Web站点实现单点登录的扩展结构。

基于ACS的SSL VPN系统的设计与实现

随着企业信息化进程的推进,业务信息化程度的不断提高,企业对信息系统的依赖也越来越大。突破时间和空间的限制,随时使用企业内部资源已经成为工作人员迫切的需求。部署基于ACS的SSL VPN认证系统,通过VPN智能隧道和扩展RADIUS属性字段的应用,解决认证系统用户访问权限控制和C/S业务系统访问局域网服务器的问题,达到无客户端VPN接入方式访问企业内局域网资源的效果。

Web Services中基于信任的动态访问控制

在Web Services系统中,用户行为的动态不确定性,使得现有的访问控制模型难以控制用户的恶意行为。针对这一问题,提出一种基于信任的动态访问控制模型。该模型将安全断言标记语言和可扩展的访问控制标志语言相结合,并采用了一种基于忠诚度的信任度计算方法。仿真结果显示,该访问控制方式能有效地遏制恶意行为,实现访问控制的动态性,具有较好的通用性、灵活性和可扩展性。

基于PMI的Web Service访问控制方案

随着WebService的广泛应用,访问控制在其中的作用越来越得到体现。PMI作为权限管理设施为WebService提供了统一的授权管理方法,实现对服务资源的有效保护。介绍了WebService和PMI访问控制模型的基本功能和框架,详细论述了一种基于PMI的WebService访问控制系统的设计方案,并对其中的消息传输、策略描述以及具体过程作了进一步的分析。

基于角色授权的Web service访问控制模型

访问控制是一种实现信息安全的有效措施,可防止对资源的未授权访问．针对目前Web服务本身的安全控制不能很好地适应企业级用户的安全需求这一问题,构造了一种基于角色授权的Web服务访问控制模型．该模型将权限同角色联系起来,根据服务特征及访问状态给用户赋予不同的角色,用户通过得到的相应角色获得访问权限,从而实现对服务本身的保护,防止未授权用户获取服务信息．另外文中还讨论了该模型实现中的几个关键问题．