Abstract: A method for crypto-currency transaction authentication includes receiving, by a computing device, from a data storage device associated with a first entity, an authentication information demonstrating possession of a private key, retrieving, by the computing device, from an audit chain, at least one crypto-currency transaction to an address associated with a public key corresponding to the private key, and authenticating, by the computing device, based on the retrieved crypto-currency transaction, the first entity.

Abstract: Mobile Android applications often have access to sensitive data and resources on the user device. Misuse of this data by malicious applications may result in privacy breaches and sensitive data leakage. An example would be a malicious application surreptitiously recording a confidential business conversation. The problem arises from the fact that Android users do not have control over the application capabilities once the applications have been granted the requested privileges upon installation. In many cases, however, whether an application may get a privilege depends on the specific user context and thus we need a context-based access control mechanism by which privileges can be dynamically granted or revoked to applications based on the specific context of the user. In this paper we propose such an access control mechanism. Our implementation of context differentiates between closely located sub-areas within the same location. We have modified the Android operating system so that context-based access control restrictions can be specified and enforced. We have performed several experiments to assess the efficiency of our access control mechanism and the accuracy of context detection.

Abstract: The disclosure relates to using a control service to control external access to APIs of IoT devices on a private network. An external application can request access to an API, and in response, the control service can monitor broadcasts from the IoT devices indicating what APIs they have available. If a match exists, the control service can request user authorization to allow the requested access. The user can grant or deny the requested access, and place limitations on the authorized access. The control service uses this information to open a connection between the requesting application and the IoT device having the requested API, and via this connection, the requesting application can access and control the device running the requested API.

Abstract: For critical applications, real-time data access is essential from the nodes inside a wireless sensor network WSN. Only the authorized users with unique access privilege should access the specific, but not all, sensing information gathered by the cluster heads in a hierarchical WSNs. Access rights for the correct information and resources for different services from the cluster heads to the genuine users can be provided with the help of efficient user access control mechanisms. In this paper, we propose a new user access control scheme with attribute-based encryption using elliptic curve cryptography in hierarchical WSNs. In attribute-based encryption, the ciphertexts are labeled with sets of attributes and secret keys of the users that are associated with their own access structures. The authorized users with the relevant set of attributes can able to decrypt the encrypted message coming from the cluster heads. Our scheme provides high security. Moreover, our scheme is efficient as compared with those for other existing user access control schemes. Through both the formal and informal security analysis, we show that our scheme has the ability to tolerate different known attacks required for a user access control designed for WSNs. Furthermore, we simulate our scheme for the formal security verification using the widely-accepted automated validation of Internet security protocols and applications tool. The simulation results demonstrate that our scheme is secure. Copyright © 2014 John Wiley & Sons, Ltd.

Abstract: This paper proposes a comprehensive encryption-based access control framework for content centric networking (CCN), called CCN-AC. This framework is both flexible and extensible, enabling the specification, implementation, and enforcement of a variety of access control policies for sensitive content in the network. The design of CCN-AC heavily relies on the concept of secure content object manifests and leverages them to decouple encrypted content from access policy and specifications for minimum communication overhead and maximum utilization of in-network caches. To demonstrate the flexibility of framework, we also describe how to implement two sample access control schemes, group-based access control and broadcast access control, within CCN-AC framework.

Abstract: Techniques are disclosed for providing and/or implementing utilizing declarative techniques for transaction-specific authentication. Certain techniques are disclosed herein that enable transaction signing using modular authentication via declarative requests from applications. An application can declaratively specify one or more transaction factor values to be used in an authentication, and the authentication, using a transaction-signed one-time password, can be directed by an access manager module without further involvement of the application. Upon a successful or non-successful authentication, the access manager module can provide the result back to the application. Accordingly, an authentication process specific to (and valid only for) a particular transaction can be performed without direct involvement of the application and without application-centric knowledge required by the access manager module.

Abstract: A method and system for authenticating user access to a resource is disclosed having the steps of receiving an access request from a user to access a resource, sending an authentication request to an authenticator, receiving an authentication response from the authenticator, providing access to the resource if the authentication response is validated by each authenticator; and denying access to the resource if the authentication response is not validated by the authenticator.

Abstract: The large scale adoption of mobile medicine, supported by an increasing number of medical devices and remote access to health services, correlated with the continuous involvement of the patients in their own healthcare, led to the emergence of tremendous amounts of clinical data They need to be securely transferred, archived and accessed This paper refers to a new approach for protecting the privacy and security of clinical data through the use of a state of the art encryption scheme and attribute-based access control authorization framework As personal medical records are often used by different entities (eg Doctors, pharmacists, nurses, etc), there is a need for different degrees of authorization access for specific parts of the personal dossier Appropriate cryptographic tools are presented for allowing partial visibility and valid protection on authorized parts for hierarchical privacy protection of eHealth data The encryption process relies on ARCANA, a security platform developed at ERISCS research laboratory from University Aix-Marseille It provides the appropriate cryptographic tools for secure hierarchical access to healthcare data This ensures that the access of various entities to the healthcare data is accurately and hierarchically controlled The access control framework used in this research is based on XACML, a standard access control decision model specified by OASIS The applicability and feasibility of XACML-based policies to regulate the access to patient data are demonstrated through SAFAX SAFAX is a new public authorization framework developed by the Eindhoven University of Technology tested among others on eHealth case studies, in cooperation with Munich University of Applied Sciences It is envisioned that the usage of data encryption and public authorization solutions to regulate access control on patients clinical data will have a big impact on the patient's trust in electronic healthcare systems and will speed up their large scale adoption

Abstract: Attribute-based access control (ABAC) and role-based access control (RBAC) are currently the two most popular access control models. Yet, they both have known limitations and offer features complimentary to each other. Due to this fact, integration of RBAC and ABAC has recently emerged as an important area of research. In this paper, we propose an access control model that combines the two models in a novel way in order to unify their benefits. Our approach provides a fine-grained access control mechanism that not only takes contextual information into account while making the access control decisions but is also suitable for applications where access to resources is controlled by exploiting contents of the resources in the policy.

Abstract: A system for automatic authentication of service requests includes authentication of a remote access device. This authentication may be accomplished automatically prior to text or audio communication between a customer and a service agent. In some embodiments, authentication is accomplished automatically by authentication of the remote access device or accomplished by asking the customer questions. A single authentication of the remote access device may be used to authenticate a service request transferred between service agents. The authentication of the remote device may include, for example, use of a personal identification number, a fingerprint, a photograph, and/or a hardware identifier. Some embodiments include an intelligent pipeline configured for managing queues of customer service requests.

Abstract: Methods and systems are provided for decentralizing user data access rights control activities in networked organizations having diverse access control models and file server protocols. A folder management application enables end users of the file system to make requests for access to storage elements, either individually, or by becoming members of a user group having group access privileges. Responsibility for dealing with such requests is distributed to respective group owners and data owners, who may delegate responsibility to authorizers. The application may also consider automatically generated proposals for changes to access privileges. An automatic system continually monitors and analyzes access behavior by users who have been pre-classified into groups having common data access privileges. As the organizational structure changes, these groups are adaptively changed both in composition and in data access rights.

Abstract: A method is disclosed for providing physical access credentials to a client device. The method may include receiving a request for a physical access credential, where the first request includes at least one user access credential and at least one physical access point identifier. The method may also include determining whether the request should be granted based at least in part on the at least one user access credential. The method may further include, in response to determining that the request should be granted, sending the physical access credential associated with the physical access point.

Abstract: This paper proposes an access control scheme called Collaborative Cipher text-Policy Attribute Role Based Encryption (C-CP-ARBE) Our C-CP-ARBE integrates Role-based Access Control (RBAC) into a Cipher text-Policy Attribute-based Encryption (CP-ABE) The proposed model provides high expressiveness of access control policy, scalable user management, and less user revocation cost compared to the existing approach In addition, our model supports both read and write access control in a more complex data sharing in collaborative cloud storage where there are multi-owner, multi-user, and multi-authority For the evaluation, we develop the access control tool and set up test cases to validate the functionality of our proposed scheme We also conduct the performance evaluation and compare the revocation cost of our C-CP-ARBE and CP-ABE scheme to demonstrate that our revocation method incurs less computation cost and efficient in practice for supporting a larger scale of users

Abstract: Many traditional authentication and access control mechanisms do not use context-aware approach, i.e., those mechanisms do not incorporate context parameters while mak- ing authentication and authorisation decisions. The context unaware mechanisms can be inadequate for the Internet of Things due to its dynamic and heterogeneous environment. The context information can be used to reconfigure security mechanisms and adjust security parameters. The contextual information can be integrated into various security mecha- nisms such as authentication, access control, encryption, etc. The context-aware security is the dynamic adjustment of secu- rity policy based on the context. In this paper, we discuss the context-awareness techniques for authentication and access control mechanisms. We present the concepts of context, con- text- awareness, and context based security and highlight con- textual attributes that can be used to support and enhance authentication and access control mechanisms for the Internet of Things.

Abstract: A communications network places in data communication an access point controlling access to a controlled access area; a server; and a medium-long range wireless communications transceiver. The transceiver detects presence of a portable electronic device outside the access point. The server obtains an indication that a user of the portable electronic device has been authenticated to the portable electronic device and initiates a payment approval process which is completed before the user seeks to pass through the access point. Based at least in part on the authentication and success of the payment approval process, the server provides to the access point an electronic token indicating that the user, bearing the portable electronic device, is to be allowed to pass through the access point into the controlled access area.

Abstract: Software-Defined Networking (SDN) is a new paradigm for building computer networks through the decoupling of the control and forwarding functions of network devices This has provided not only an exciting opportunity for the industry and researchers to solve some of the most persistent networking problems, but also an environment where creative network applications and services are more easily developed and deployed to solve specific business needs In this paper, we present FlowIdentity — a virtualized network access control function using OpenFlow protocol FlowIdentity implements 8021X framework in SDN architecture, combined with a novel authorization method through a stateful role-based firewall Policy definition is based on high-level endpoints' role which can be dynamically updated and enforced directly on the centralized 8021X authenticator Our solution solves some outlined persistent challenges facing the traditional port-based access control method to provide an effective enterprise network access control solution, and also provides a platform that encourages network operators, equipment vendors and researchers to develop innovative alternatives to the current solutions

Abstract: Radio Frequency Identification (RFID) technology utilizes the electromagnetic fields for data transfer in order to perform automatic detection and tracking of tags or tags of objects. It can provide ways to design and implement relatively inexpensive systems particularly for security aspects. In this paper, we have proposed a digital access control system that can be employed to a protected area where none but people with authenticated credentials can enter. In fact, we have implemented the system in the server room of an educational Institute to test its efficiency as well as expenditure. The implemented system comprises of digital door lock which is unlock able in real time to ensure secured access specifying activation, authentication and validation of users prior to bringing the RFID card close to the reader. The entire system is associated with a central client-server sub-system to ensure and maintain the overall system integrity. Associated sub-system also generates a log report to maintain check-in and check-out status of visitors in accordance with the primary credentials of each. This system will certainly provide an idea about the design and installation of a relatively inexpensive security system which is suitable in the perspective of a developing country like Bangladesh.

Abstract: Since the access control environment has changed and the threat of insider information leakage has come to the fore, studies on risk-based access control models that decide access permissions dynamically have been conducted vigorously. Medical information systems should protect sensitive data such as medical information from insider threat and enable dynamic access control depending on the context such as life-threatening emergencies. In this paper, we suggest an approach and framework for context sensitive risk-based access control suitable for medical information systems. This approach categorizes context information, estimating and applying risk through context- and treatment-based permission profiling and specifications by expanding the eXtensible Access Control Markup Language (XACML) to apply risk. The proposed framework supports quick responses to medical situations and prevents unnecessary insider data access through dynamic access authorization decisions in accordance with the severity of the context and treatment.

Abstract: A computer implemented method of a resource provider for access control in a network connected computer system, wherein a blockchain data structure accessible via the network stores digitally signed records validated by network connected miner software components. A provider record is associated with the resource provider 202, the method allowing for identifying an access control role 450 definition for access to the resource, the role including a specification of access permissions. A request is received 462 from a resource consumer for access to the resource and the resource consumer is given an indication of a quantity of a cryptocurrency 464 required for access to the resource. In response to a determination that the required quantity of cryptocurrency is transferred 466 to the provider record in the blockchain, the transfer being caused by a blockchain transaction including an identification of the role and the transaction being validated 468 by a miner component, granting the consumer access to the resource 476 in accordance with the role definition.

Abstract: Adopting IT as an integral part of business and operation is certainly making the healthcare industry more efficient and cost-effective. With the widespread digitalization of personal health information, coupled with big data revolution and advanced analytics, security and privacy related to medical data — especially ensuring authorized access thereto — is facing a huge challenge. In this paper, we argue that a fine-grained approach is needed for developing access control mechanisms contingent upon various environmental and application-dependent contexts along with provision for secure delegation of access-control rights. In particular, we propose a context-sensitive approach to access control, building on conventional discretionary access control (DAC) and role-based access control (RBAC) models. Taking a holistic view to access control, we effectively address the precursory authentication part as well. The eTRON architecture — which advocates use of tamper-resistant chips equipped with functions for mutual authentication and encrypted communication — is used for authentication and implementing the DAC-based delegation of access-control rights. For realizing the authorization and access decision, we used the RBAC model and implemented context verification on top of it. Our approach closely follows regulatory and technical standards of the healthcare domain. Evaluation of the proposed system in terms of various security and performance showed promising results.

Abstract: Due to the proliferation of advanced analytic applications built on a massive scale of data from several data sources, big data technology has emerged to shift the paradigm of data management. Big data management is usually taken into data outsourcing environment such as cloud computing. According to the outsourcing environment, security and privacy management becomes one of the critical issues for business decision. Typically, cryptographic-based access control is employed to support privacy-preserving authentication and authorization for data outsourcing scenario. In this paper, we propose a novel access control model combining Role-based Access Control (RBAC) model, symmetric encryption, and ciphertext attribute-based encryption (CP-ABE) to support finegrained access control for big data outsourced in cloud storage systems. We also demonstrate the efficiency and performance of our proposed scheme through the implementation.

Abstract: Clouds are becoming prevalent service providers because of their low upfront costs, rapid application deployment, and high scalability. Many users outsource their sensitive data and services to cloud providers. Users frequently access these sensitive services through devices and connections that are vulnerable to thieving and eavesdropping. Therefore, users are desperate of robust security measures to protect their data and services privacy in clouds. In particular, robust authentication techniques are demanded by users for safe access to cloud services. One technique is to utilize multiple authentication factors (a.k. A multi-factor authentication) to access cloud services. However, the challenge is that the multi-factor authentication technique is not effective as it causes user frustration and fatigue. To address this challenge, in this study, we propose a multi-factor authentication architecture that aims at minimizing the perceived authentication hardship for cloud users while improving the security of the authentication. To achieve the goal, our authentication architecture suggests a progressive manner to leverage access to different levels of cloud services. At each level, the architecture asks for authentication factors by considering the perceived hardship for users. To increase the security and user convenience, the architecture also considers implicit authentication factors in addition to the explicit factors. Our evaluation results indicate that authentication using the proposed architecture decreases the users' perceived hardship up to 29% in compare with other methods. The results also reveal that our proposed architecture adapts the authentication difficulty based on the user condition.

Abstract: A method for controlling access of a user to a physical device which is provided with an access control unit that can block and release access to functions of the physical device includes the provision of a central control platform and a mobile access device An identification check of the user is carried out, the user being identified by the mobile access device Following a successful identification check, a wireless communication link is established between the mobile access device and the access control unit of the physical device Identification information and unique access data are transmitted from the mobile access device to the access control unit The access control unit ascertains the access rights of the user to the physical device using the received information and additional information from the central control platform

Abstract: Disclosed herein are a variety of systems and methods for authentication physical access to a distributed site of an electric power generation and delivery system. According to various embodiments, a mobile device may be utilized as an input device for a physical access control system associated with a distributed site. Authentication credentials entered by a user using the mobile device may be communicated to the physical access control system for use in connection with authentication and/or access control decisions. Using the mobile device may, among other things, allow for users to provide certain authentication credentials to the physical access control system without the need to utilize certain input devices that may be prone to damage and/or failure due to exposure to environmental conditions.

Abstract: This paper describes mechanisms for achieving strong, multi-factor authentication in Ambient Assisted Living environments. These mechanisms rely on biometric-based technologies to provide information security and privacy in the Internet of Things. The importance of user choice and ease of use of authentication methods in achieving universal access to services in assistive environments is described. Cryptographic algorithm and protocol solutions that depend on a Public Key Infrastructure for the protection of sensitive information are discussed. Lighter weight alternatives are then proposed that use authenticated key exchange to combat phishing and other attacks and provide mutual authentication and data confidentiality.

Abstract: Attribute Based Access Control (ABAC) is a popularapproach to enterprise-wide access control that providesflexibility suitable for today's dynamic distributed systems.ABAC controls access to objects by evaluating policy rulesagainst the attributes of entities (subject and object),operations, and the environment relevant to a request, butgreat care must be taken in setting up and maintaining theaccess control rules that allow such flexible operations.Thisarticle summarizes important considerations in ABACdeployment first introduced in the Guide to Attribute BasedAccess Control [1].

Abstract: Privacy, security, and trust concerns are continuously hindering the growth of cloud computing despite its attractive features. To mitigate these concerns, an emerging approach targets the use of multi-cloud architectures to achieve portability and reduce cost. Multi-cloud architectures however suffer several challenges including inadequate cross-provider APIs, insufficient support from cloud service providers, and especially non-unified access control mechanisms. Consequently, the available multi-cloud proposals are unhandy or insecure. This paper proposes two contributions. At first, we survey existing cloud storage provider interfaces. Following, we propose a novel technique that deals with the challenges of connecting modern authentication standards and multiple cloud authorization methods.

Abstract: Despite the various attractive features that Cloud has to offer, the rate of Cloud migration is rather slow, primarily due to the serious security and privacy issues that exist in the paradigm. One of the main problems in this regard is that of authorization in the Cloud environment, which is the focus of our research. In this paper, we present a systematic analysis of the existing authorization solutions in Cloud and evaluate their effectiveness against well-established industrial standards that conform to the unique access control requirements in the domain. Our analysis can benefit organizations by helping them decide the best authorization technique for deployment in Cloud; a case study along with simulation results is also presented to illustrate the procedure of using our qualitative analysis for the selection of an appropriate technique, as per Cloud consumer requirements. From the results of this evaluation, we derive the general shortcomings of the extant access control techniques that are keeping them from providing successful authorization and, therefore, widely adopted by the Cloud community. To that end, we enumerate the features an ideal access control mechanisms for the Cloud should have, and combine them to suggest the ultimate solution to this major security challenge -- access control as a service (ACaaS) for the software as a service (SaaS) layer. We conclude that a meticulous research is needed to incorporate the identified authorization features into a generic ACaaS framework that should be adequate for providing high level of extensibility and security by integrating multiple access control models.