BC-BLPM:A Multi-Level Security Access Control Model Based on Blockchain Technology

Traditional multi-level security(MLS)systems have the defect of centralizing authorized facilities,which is difficult to meet the security requirements of modern distributed peer-to-peer network architecture.Blockchain is widely used in the field of access control with its decentralization,traceability and non-defective modification.Combining the blockchain technology and the Bell-LaPadula model,we propose a new access control model,named BCBLPM,for MLS environment.The“multi-chain”blockchain architecture is used for dividing resources into isolated access domains,providing a fine-grained data protection mechanism.The access control policies are implemented by smart contracts deployed in each access domain,so that the side chains of different access domains storage access records from outside and maintain the integrity of the records.Finally,we implement the BC-BLPM prototype system using the Hyperledger Fabric.The experimental and analytical results show that the model can adapt well to the needs of multi-level security environment,and it has the feasibility of application in actual scenarios.

A Mandatory Access Control Framework in Virtual Machine System with Respect to Multi-level Security I： Theory

At present,there are few security models which control the communication between virtual machines (VMs).Moreover,these models are not applicable to multi-level security (MLS).In order to implement mandatory access control (MAC) and MLS in virtual machine system,this paper designs Virt-BLP model,which is based on BLP model.For the distinction between virtual machine system and non-virtualized system,we build elements and security axioms of Virt-BLP model by modifying those of BLP.Moreover,comparing with BLP,the number of state transition rules of Virt-BLP is reduced accordingly and some rules can only be enforced by trusted subject.As a result,Virt-BLP model supports MAC and partial discretionary access control (DAC),well satisfying the requirement of MLS in virtual machine system.As space is limited,the implementation of our MAC framework will be shown in a continuation.

A Lightweight ABE Security Protection Scheme in Cloud Environment Based on Attribute Weight

Attribute-based encryption(ABE)is a technique used to encrypt data,it has the flexibility of access control,high security,and resistance to collusion attacks,and especially it is used in cloud security protection.However,a large number of bilinear mappings are used in ABE,and the calculation of bilinear pairing is time-consuming.So there is the problem of low efficiency.On the other hand,the decryption key is not uniquely associated with personal identification information,if the decryption key is maliciously sold,ABE is unable to achieve accountability for the user.In practical applications,shared message requires hierarchical sharing in most cases,in this paper,we present a message security hierarchy ABE scheme for this scenario.Firstly,attributes were grouped and weighted according to the importance of attributes,and then an access structure based on a threshold tree was constructed according to attribute weight.This method saved the computing time for decryption while ensuring security and on-demand access to information for users.In addition,with the help of computing power in the cloud,two-step decryption was used to complete the access,which relieved the computing and storage burden on the client side.Finally,we simulated and tested the scheme based on CP-ABE,and selected different security levels to test its performance.The security proof and the experimental simulation result showthat the proposed scheme has high efficiency and good performance,and the solution implements hierarchical access to the shared message.

Security and Privacy Frameworks for Access Control Big Data Systems

In the security and privacy fields,Access Control(AC)systems are viewed as the fundamental aspects of networking security mechanisms.Enforcing AC becomes even more challenging when researchers and data analysts have to analyze complex and distributed Big Data(BD)processing cluster frameworks,which are adopted to manage yottabyte of unstructured sensitive data.For instance,Big Data systems’privacy and security restrictions are most likely to failure due to the malformed AC policy configurations.Furthermore,BD systems were initially developed toped to take care of some of the DB issues to address BD challenges and many of these dealt with the“three Vs”(Velocity,Volume,and Variety)attributes,without planning security consideration,which are considered to be patch work.Some of the BD“three Vs”characteristics,such as distributed computing,fragment,redundant data and node-to node communication,each with its own security challenges,complicate even more the applicability of AC in BD.This paper gives an overview of the latest security and privacy challenges in BD AC systems.Furthermore,it analyzes and compares some of the latest AC research frameworks to reduce privacy and security issues in distributed BD systems,which very few enforce AC in a cost-effective and in a timely manner.Moreover,this work discusses some of the future research methodologies and improvements for BD AC systems.This study is valuable asset for Artificial Intelligence(AI)researchers,DB developers and DB analysts who need the latest AC security and privacy research perspective before using and/or improving a current BD AC framework.

Research on Physical Layer Security in Cognitive Wireless Networks with Multiple Eavesdroppers Based on Resource Allocation Algorithm

With the rapid development of the Internet of Things (IoT), non-Orthogonal Multiple Access (NOMA) technology and cognitive wireless network are two promising technologies to improve the spectral efficiency of the system, which have been widely concerned in the field of wireless communication. However, due to the importance of ownership and privacy protection, the IoT system must provide corresponding security mechanisms. From the perspective of improving the transmission security of CR-NOMA system based on cognitive wireless network, and considering the shortcomings of traditional relay cooperative NOMA system, this paper mainly analyzes the eavesdropping channel model of multi-user CR-NOMA system and derives the expressions of system security and rate to improve the security performance of CR-NOMA system. The basic idea of DC planning algorithm and the scheme of sub-carrier power allocation to improve the transmission security of the system were introduced. An algorithm for DC-CR-NOMA was proposed to maximize the SSR of the system and minimize the energy loss. The simulation results show that under the same complexity, the security and speed of the system can be greatly improved compared with the traditional scheme.

Remote Access Communications Security: Analysis of User Authentication Roles in Organizations

Remote access is a means of accessing resources outside one’s immediate physical location. This has made employee mobility more effective and productive for most organizations. Remote access can be achieved via various channels of remote communication, the most common being Virtual Private Networks (VPNs). The demand for remote access is on the rise, especially during the Covid-19 pandemic, and will continue to increase as most organizations are re-structuring to make telecommuting a permanent part of their mode of operation. Employee mobility, while presenting organizations with some advantages, comes with the associated risk of exposing corporate cyber assets to attackers. The remote user and the remote connectivity technology present some vulnerabilities which can be exploited by any threat agent to violate the confidentiality, integrity and availability (CIA) dimensions of these cyber assets. So, how are users and remote devices authenticated? To what extent is the established connection secured? With employee mobility on the rise, it is necessary to analyze the user authentication role since the mobile employee is not under the monitoring radar of the organization, and the environment from which the mobile employee connects may be vulnerable. In this study, an experiment was setup to ascertain the user authentication roles. The experiment showed the process of 2FA in user authentication and it proved to be an effective means of improving user authentication during remote access. This was depicted via the use of what the user has (mobile phone/soft-token) as a second factor in addition to what the user knows, i.e. password. This authentication method overcomes the security weaknesses inherent in single-factor user authentication via the use of password only. However, the results also showed that though 2FA user authentication ensures security, the remote devices could exhibit further vulnerabilities and pose serious risks to the organization. Thus, a varied implementation was recommended to further enhance the security of remote access communication with regards to the remote user authentication.

Ensuring Security, Confidentiality and Fine-Grained Data Access Control of Cloud Data Storage Implementation Environment

With the development of cloud computing, the mutual understandability among distributed data access control has become an important issue in the security field of cloud computing. To ensure security, confidentiality and fine-grained data access control of Cloud Data Storage (CDS) environment, we proposed Multi-Agent System (MAS) architecture. This architecture consists of two agents: Cloud Service Provider Agent (CSPA) and Cloud Data Confidentiality Agent (CDConA). CSPA provides a graphical interface to the cloud user that facilitates the access to the services offered by the system. CDConA provides each cloud user by definition and enforcement expressive and flexible access structure as a logic formula over cloud data file attributes. This new access control is named as Formula-Based Cloud Data Access Control (FCDAC). Our proposed FCDAC based on MAS architecture consists of four layers: interface layer, existing access control layer, proposed FCDAC layer and CDS layer as well as four types of entities of Cloud Service Provider (CSP), cloud users, knowledge base and confidentiality policy roles. FCDAC, it’s an access policy determined by our MAS architecture, not by the CSPs. A prototype of our proposed FCDAC scheme is implemented using the Java Agent Development Framework Security (JADE-S). Our results in the practical scenario defined formally in this paper, show the Round Trip Time (RTT) for an agent to travel in our system and measured by the times required for an agent to travel around different number of cloud users before and after implementing FCDAC.

Security analysis of access control model in hybrid cloud based on security entropy

To resolve the problem of quantitative analysis in hybrid cloud,a quantitative analysis method,which is based on the security entropy,is proposed.Firstly,according to the information theory,the security entropy is put forward to calculate the uncertainty of the system' s determinations on the irregular access behaviors.Secondly,based on the security entropy,security theorems of hybrid cloud are defined.Finally,typical access control models are analyzed by the method,the method's practicability is validated,and security and applicability of these models are compared.Simulation results prove that the proposed method is suitable for the security quantitative analysis of the access control model and evaluation to access control capability in hybrid cloud.

Big Data Access Control Mechanism Based on Two-Layer Permission Decision Structure

Big data resources are characterized by large scale, wide sources, and strong dynamics. Existing access controlmechanisms based on manual policy formulation by security experts suffer from drawbacks such as low policymanagement efficiency and difficulty in accurately describing the access control policy. To overcome theseproblems, this paper proposes a big data access control mechanism based on a two-layer permission decisionstructure. This mechanism extends the attribute-based access control (ABAC) model. Business attributes areintroduced in the ABAC model as business constraints between entities. The proposed mechanism implementsa two-layer permission decision structure composed of the inherent attributes of access control entities and thebusiness attributes, which constitute the general permission decision algorithm based on logical calculation andthe business permission decision algorithm based on a bi-directional long short-term memory (BiLSTM) neuralnetwork, respectively. The general permission decision algorithm is used to implement accurate policy decisions,while the business permission decision algorithm implements fuzzy decisions based on the business constraints.The BiLSTM neural network is used to calculate the similarity of the business attributes to realize intelligent,adaptive, and efficient access control permission decisions. Through the two-layer permission decision structure,the complex and diverse big data access control management requirements can be satisfied by considering thesecurity and availability of resources. Experimental results show that the proposed mechanism is effective andreliable. In summary, it can efficiently support the secure sharing of big data resources.

A Method of Auxiliary Planning for Intelligent Substation Access System Based on Security Region

This paper presents an auxiliary planning method for intelligent substation access system based on security region. Firstly, the method of resolving the static voltage security region is proposed. Secondly, the method of constructing the optimal index of substation accession is given, which is used to describe the priority of the node into the substation. Finally, a complete set of intelligent substation access system auxiliary planning strategy is given, which takes into account the constraints of the normal operation of the grid on the voltage amplitude.

Food Access and Experience of Food Insecurity in Nigerian Households during the COVID-19 Lockdown

The food insecurity experiences and related behaviors of Nigerian households during the COVID-19 lockdown have not been fully discussed. This study was conducted to elicit information on the impact of COVID-19 lockdown on economic and behavioral patterns related to food access. An online-based semi-structured questionnaire distributed through messaging platforms was used to collect information on characteristics, food purchasing behaviour before and during COVID-19 lockdown among respondents. Experience of food insecurity was assessed using Food Insecurity Experience Scale (FIES). A total of 883 responses were received and analyzed using SPSS Version 20.0. Most of the respondents (90.5%) were at home or had stopped going to work due to COVID-19 restrictions. Even though smaller households had higher food expenditure claims than larger households (p = 0.012), the larger the household, the more acute the challenge of economic access to food (p = 0.050). Location (p = 0.000), age (p = 0.003), occupation (p = 0.014) and income level (p = 0.000) were associated with experience of food insecurity. In conclusion, lockdown restrictions increased food expenditure and experience of food insecurity among the respondents and thus we recommend the probe of long-term consequences of deviations from usual food access on undernutrition or overnutrition in Nigerian households.

Security of Broadband Access Network

Due to the rapid development of broadband access technologies, the broadband access networks have wider and wider application. However, with the development, the security issue became a public concern. Under the environment of access network, customers, access equipment and networks all face various threats, especially those from the user side. Such technologies and solutions as port positioning, fraud prevention on Medium Access Control (MAC) addresses and monitoring of illegal services might be the solution to the security problem existing in the current networks.

The Design of an Intelligent Security Access Control System Based on Fingerprint Sensor FPC1011C

This paper deals with the design of an intelligent access control system based on the fingerprint sensor FPC- 1011C. The design uses the S3C2410 and TMS320VC5510A as the system processor. A fingerprint acquisition module and a wireless alarm module were designed by using the fingerprint sensor FPC1011C and GPRS module SIM100 respectively. The whole system was implemented wireless alarm through messages and GPRS-Internet in the GSM/GPRS web. In order to achieve the simple and high Real-time system, the μC-Linux system migration was also implemented.

Hadoop Distributed File System Security Challenges and Examination of Unauthorized Access Issue

Hadoop technology is followed by some security issues. At its beginnings, developers paid attention to the development of basic functionalities mostly, and proposal of security components was not of prime interest. Because of that, the technology remained vulnerable to malicious activities of unauthorized users whose purpose is to endanger system functionalities or to compromise private user data. Researchers and developers are continuously trying to solve these issues by upgrading Hadoop’s security mechanisms and preventing undesirable malicious activities. In this paper, the most common HDFS security problems and a review of unauthorized access issues are presented. First, Hadoop mechanism and its main components are described as the introduction part of the leading research problem. Then, HDFS architecture is given, and all including components and functionalities are introduced. Further, all possible types of users are listed with an accent on unauthorized users, which are of great importance for the paper. One part of the research is dedicated to the consideration of Hadoop security levels, environment and user assessments. The review also includes an explanation of Log Monitoring and Audit features, and detail consideration of authorization and authentication issues. Possible consequences of unauthorized access to a system are covered, and a few recommendations for solving problems of unauthorized access are offered. Honeypot nodes, security mechanisms for collecting valuable information about malicious parties, are presented in the last part of the paper. Finally, the idea for developing a new type of Intrusion Detector, which will be based on using an artificial neural network, is presented. The detector will be an integral part of a new kind of virtual honeypot mechanism and represents the initial base for future scientific work of authors.

Intelligent Security Auditing Based on Access Control of Devices in Ad Hoc Network

Security in Ad Hoc network is an important issue under the opening circumstance of application service. Some protocols and models of security auditing have been proposed to ensure rationality of contracting strategy and operating regulation and used to identify abnormal operation. Model of security auditing based on access control of devices will be advanced to register sign of devices and property of event of access control and to audit those actions. In the end, the model is analyzed and simulated.

DNACDS:Cloud IoE big data security and accessing scheme based on DNA cryptography

The Internet of Everything(IoE)based cloud computing is one of the most prominent areas in the digital big data world.This approach allows efficient infrastructure to store and access big real-time data and smart IoE services from the cloud.The IoE-based cloud computing services are located at remote locations without the control of the data owner.The data owners mostly depend on the untrusted Cloud Service Provider(CSP)and do not know the implemented security capabilities.The lack of knowledge about security capabilities and control over data raises several security issues.Deoxyribonucleic Acid(DNA)computing is a biological concept that can improve the security of IoE big data.The IoE big data security scheme consists of the Station-to-Station Key Agreement Protocol(StS KAP)and Feistel cipher algorithms.This paper proposed a DNA-based cryptographic scheme and access control model(DNACDS)to solve IoE big data security and access issues.The experimental results illustrated that DNACDS performs better than other DNA-based security schemes.The theoretical security analysis of the DNACDS shows better resistance capabilities.

ResearchonsecureaccessmechanismininternetofthingsbasedonTePA

以椭圆曲线密码算法和三元对等鉴别架构为基础，通过对物联网的基本概念、体系结构的分析，提出了一种基于椭圆曲线签名、三元鉴别的物联网安全接入机制。该机制强化了对物联网中无线传感器节点的鉴别，要求通信的任何一方在通信前必须通过其它两方的身份验证。从性能和安全等方面分析了该机制的可行性和可靠性，增强了物联网下对接入访问的安全控制，从而对物联网的建设发展起到了一定的建言作用。

基于WS-Security的SOA安全协议框架设计

面向服务的架构(SOA)具有平台无关性,突破企业内部网的限制,实现供应链上下游伙伴业务的紧密结合等优点。文章根据SOA的架构设计理念,设计了面向Web服务的安全协议框架;研究结果较好地解决了系统集成的问题,而且系统间消息安全性也得以保障。

Spring Security的Web资源保护功能研究与扩展

针对开源安全框架Spring Security的Web资源保护功能进行研究,分析框架的认证和授权两个主要过程,指出了框架对于用户和Web资源的授权信息外化存储这一关键企业级安全特性支持上的不足,进而对此进行了扩展。借助于Spring容器的依赖注入特性和安全框架的扩展性,结合数据库存储授权信息,本文设计了一个基于Spring Security的用户与Web资源授权信息动态存储方案,并给出了关键的程序代码。