Design and Implementation of Enhanced Discretionary Access Control Mechanism

Yong Luo

2007-01-01

Abstract:Discretionary access control(DAC) is one of the basic security mechanisms of secure operating system.Traditional file permissions can not meet high level secure operating system's requirements to DAC.Design and implementation of DAC mechanism based on ACL is researched.And three important enhancements are proposed and implemented.

What problem does this paper attempt to address?

Design and Implementation of Unified Access Control System Based on LDAP

ZHENG Lan,CHEN Qi

DOI: https://doi.org/10.3969/j.issn.1000-7024.2005.07.058

2005-01-01

Abstract:With the rapid growth of internet and enterprises on a global scale, the use of directories as accessible repositories providesa flexible and various solution for gathering, storage and accessing information. The design and implementation of an unified accesscontrol system supporting single-sign-on areintrodueed, whichis based on LDAPdirectory and combines access controls ofall applicationsystems to realize security access system of unified users management. The system used middleware technology to efficiently resolvethe bottleneck problem when a lot of users accesed LDAP database.
Multi-level Access Control for Collaborative CAD

CH Fang,W Peng,XZ Ye,SY Zhang

DOI: https://doi.org/10.1109/cscwd.2005.194248

2007-01-01

Journal of Software

Abstract:Access control is one of the key steps to ensuring the availability, confidentiality and integrity of system resources. While it has been fully applied in various network systems, it's still relatively new for collaborative CAD. This paper provides a new framework of multi-level access control for collaborative CAD based on hierarchical product modeling. A layered privilege model (LPM) has been developed to provide multi-granularity access permissions in the part level and feature level. An extended hierarchy role-based access control (EHRBAC) is implemented, integrated with LPM and common Hierarchy RBAC, to provide hierarchical access control of collaborative feature modeling in the component/part level and design feature level. Mesh simplification techniques are used to create variable level-of-detail for individual features.
Application-Defined Decentralized Access Control

Yuanzhong Xu,Alan M Dunn,Owen S Hofmann,Michael Z Lee,Syed Akbar Mehdi,Emmett Witchel

Abstract:DCAC is a practical OS-level access control system that supports application-defined principals. It allows normal users to perform administrative operations within their privilege, enabling isolation and privilege separation for applications. It does not require centralized policy specification or management, giving applications freedom to manage their principals while the policies are still enforced by the OS. DCAC uses hierarchically-named attributes as a generic framework for user-defined policies such as groups defined by normal users. For both local and networked file systems, its execution time overhead is between 0%-9% on file system microbenchmarks, and under 1% on applications. This paper shows the design and implementation of DCAC, as well as several real-world use cases, including sandboxing applications, enforcing server applications' security policies, supporting NFS, and authenticating user-defined sub-principals in SSH, all with minimal code changes.
DAC-MACS: Effective Data Access Control for Multi-Authority Cloud Storage Systems

Kan Yang,Xiaohua Jia,Kui Ren,Bo Zhang

DOI: https://doi.org/10.1109/tifs.2013.2279531

IF: 7.231

2013-01-01

IEEE Transactions on Information Forensics and Security

Abstract:Data access control is an effective way to ensure data security in the cloud. However, due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Existing access control schemes are no longer applicable to cloud storage systems, because they either produce multiple encrypted copies of the same data or require a fully trusted cloud server. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising technique for access control of encrypted data. However, due to the inefficiency of decryption and revocation, existing CP-ABE schemes cannot be directly applied to construct a data access control scheme for multiauthority cloud storage systems, where users may hold attributes from multiple authorities. In this paper, we propose data access control for multiauthority cloud storage (DAC-MACS), an effective and secure data access control scheme with efficient decryption and revocation. Specifically, we construct a new multiauthority CP-ABE scheme with efficient decryption, and also design an efficient attribute revocation method that can achieve both forward security and backward security. We further propose an extensive data access control scheme (EDAC-MACS), which is secure under weaker security assumptions.
Design and Implement of Enhanced SNMP Access Control

HE Tian-he,PAN Xue-zeng

DOI: https://doi.org/10.3969/j.issn.1671-7147.2007.03.016

2007-01-01

Abstract:SNMP provides a way to manage and monitor the computer network.By extending its access control model on the 3rd version,the paper offers two methods : view based access control model(vacm) and role based access control model.It enhances RBAC's power and function.In use SNMPv3 based on Time Enhanced RBAC is more efficient and useful.
Design of campus comprehensive access management platform

Cai E. Xu,Feng Xu,Xiaohua Li,Dongming Lu,Yanqi Cheng

DOI: https://doi.org/10.3969/j.issn.1000-436x.2013.z2.027

2013-01-01

Abstract:Considering access control with more card, scattered access flow data and poor scalability in current university building multi-system, the campus integrated access management platform triple frame design with the core of perception layer, transport layer and application layer was proposed. Campus card access control applications based on a unified data processing were realized, by method of Media and unified campus card authorization, implementing hierarchical management and access networking, comprehensively regulate access standards and centralized storage of data water. The design not only facilitates the management of school access control applications, but also carries out data mining based access control and lay the foundation for leadership decision-making support.
Study and Improvement of MAC(Mandatory Access Control) for Windows

CHEN Hui,ZHOU Xue-Hai,CHEN Xiang-Lan

DOI: https://doi.org/10.3969/j.issn.1003-3254.2010.12.003

2010-01-01

Abstract:Security is always a hot topic with the development of computer technologies.Currently,mechanisms like active defense,detection and anti-detection are proposed.They could be implemented on different levels such as application-level and kernel-level in the system.We manage to go to the system-level.Linux owns mature security-enhanced version SELinux.For Windows,we focus on mandatory access control and propose a mechanism with improved efficiency,compatibility and stability.
DACPCC:A Data Access Control Scheme with Access Permission for Cloud Computing

Yu-ding WANG,Jia-hai YANG

DOI: https://doi.org/10.3969/j.issn.0372-2112.2018.01.033

2018-01-01

Abstract:Currently,the most common encryption scheme of cloud computing access control system is CP-ABE,but the conventional CP-ABE encryption did not deal with the issue of user's access permission;data owners only allow the users to read the data but not to write,such kind of coarse access control mechanism is not flexible and low efficiency.To deal with this issue,the paper proposes a Data Access Control scheme with access Permission for Cloud Computing (DACPCC),it sets permission control keys to encrypt the data in cloud based on CP-ABE;the data owner controls the data's access permission by choosing the permission control keys.The paper illustrates the design details of the proposed scheme,then theoretically proves the security and evaluates the performance through simulated experiments;the results show that DACPCC allows the data owners to control the access permission of the data,and it is safe and more efficient.
Reputation and Attribute Based Dynamic Access Control Framework in Cloud Computing Environment for Privacy Protection

Liu Wu,Sun Donghong,Ren Ping,Liu Ke

DOI: https://doi.org/10.1109/fskd.2016.7603356

2016-01-01

Abstract:A Reputation and Attribute Based Dynamic Access Control (RA-DAC) Framework for Privacy Protection in Cloud Computing Environment was presented in this paper. First, RA-DAC is used to encourage honest users for their good actions in cloud environment. Second, RA-DAC is also used to constraint malicious users for their destructive actions in cloud environment. And finally, based on RA-DAC we developed the Reputation and Attribute Based Dynamic Access Control System (RA-DACS) which is used to detect the malicious behaviors of dishonest users and automatically prevent their further action to threaten the security of the cloud computing environment.
Role-Based Access Controls

David F. Ferraiolo,D. Richard Kuhn

DOI: https://doi.org/10.48550/arXiv.0903.2171

2009-06-03

Abstract:While Mandatory Access Controls (MAC) are appropriate for multilevel secure military applications, Discretionary Access Controls (DAC) are often perceived as meeting the security processing needs of industry and civilian government. This paper argues that reliance on DAC as the principal method of access control is unfounded and inappropriate for many commercial and civilian government organizations. The paper describes a type of non-discretionary access control - role-based access control (RBAC) - that is more central to the secure processing needs of non-military systems than DAC.

Cryptography and Security
The Design and Implementation of a Distributed Access Control System Based on Trust-Management

WANG Yuan,XU Feng,CAO Chun

DOI: https://doi.org/10.3969/j.issn.1002-137X.2005.08.069

2005-01-01

Computer Science

Abstract:The security problems of the open coordination software environment make great influence on the develop- ment and application of the software systems. Trust management is a new approach to solve these security problems ef- fectively. By analyzing the security problems of the open coordination software systems and the limitations of the tradi- tional trust management systems, this paper designs and implements a distributed access control system, DACBTM, based on trust management, which is suitable for the application system in the open coordination software environment. The system can evaluate the trust relationship between software entities by the approach of trust-evaluation. We also present an improved, effective algorithm for the collection of the security information, which provides a reasonable mechanism to solve the shortness of the security information in the open coordination software environment.
A Feasible Fuzzy-Extended Attribute-Based Access Control Technique

Yang Xu,Wuqiang Gao,Quanrun Zeng,Guojun Wang,Ju Ren,Yaoxue Zhang

DOI: https://doi.org/10.1155/2018/6476315

IF: 1.968

2018-01-01

Security and Communication Networks

Abstract:Attribute-based access control (ABAC) is a maturing authorization technique with outstanding expressiveness and scalability, which shows its overwhelmingly competitive advantage, especially in complicated dynamic environments. Unfortunately, the absence of a flexible exceptional approval mechanism in ABAC impairs the resource usability and business time efficiency in current practice, which could limit its growth. In this paper, we propose a feasible fuzzy-extended ABAC (FBAC) technique to improve the flexibility in urgent exceptional authorizations and thereby improving the resource usability and business timeliness. We use the fuzzy assessment mechanism to evaluate the policy-matching degrees of the requests that do not comply with policies, so that the system can make special approval decisions accordingly to achieve unattended exceptional authorizations. We also designed an auxiliary credit mechanism accompanied by periodic credit adjustment auditing to regulate expediential authorizations for mitigating risks. Theoretical analyses and experimental evaluations show that the FBAC approach enhances resource immediacy and usability with controllable risk.
EACS: an Efficient Access Control Scheme for Electronic Publishing in Cloud Computing

Wu Deming,Zhang Yu,Wang Lina,Hou Jian,Xiao Lei,Chen Wei,Zhou Qing

DOI: https://doi.org/10.1049/cje.2017.11.009

IF: 1.019

2018-01-01

Chinese Journal of Electronics

Abstract:To guarantee that electronic publications are accessible only to the authorized users via cloud, we propose an Efficient access control scheme（EACS） based on Attribute-based encryption（ABE）, which is suitable for fine-grained access control. Compared with existing stateof-the-art schemes, EACS is more practical by following functions. Considering the factor that the user membership may change frequently, EACS has the capability of coping with dynamic membership efficiently. Arbitrary-State is also supported to facilitate the system management and improve efficiency. Besides, we prove in the standard model that the security of EACS is based on the Decisional Bilinear Diffie-Hellman assumption. To evaluate the practicality of EACS, we provide a detailed theoretical performance analysis and a simulation comparison with existing schemes. Both the theoretical analysis and the experimental results show that our proposal is efficient and practical for electronic publishing under cloud environment.
An Action-Based Fine-Grained Access Control Mechanism for Structured Documents and Its Application

Mang Su,Fenghua Li,Zhi Tang,Yinyan Yu,Bo Zhou

DOI: https://doi.org/10.1155/2014/232708

2014-01-01

Abstract:This paper presents an action-based fine-grained access control mechanism for structured documents. Firstly, we define a describing model for structured documents and analyze the application scenarios. The describing model could support the permission management on chapters, pages, sections, words, and pictures of structured documents. Secondly, based on the action-based access control (ABAC) model, we propose a fine-grained control protocol for structured documents by introducing temporal state and environmental state. The protocol covering different stages from document creation, to permission specification and usage control are given by using the Z-notation. Finally, we give the implementation of our mechanism and make the comparisons between the existing methods and our mechanism. The result shows that our mechanism could provide the better solution of fine-grained access control for structured documents in complicated networks. Moreover, it is more flexible and practical.
An efficient privacy‐enhanced attribute‐based access control mechanism

Yang Xu,Quanrun Zeng,Guojun Wang,Cheng Zhang,Ju Ren,Yaoxue Zhang

DOI: https://doi.org/10.1002/cpe.5556

2020-01-01

Abstract:Owing to the rapid progress of network researching, attribute-based access control (ABAC) has attracted more and more attention due to its appreciable expressiveness, flexibility, and scalability. Unfortunately, collecting user attributes is necessary to complete the standard ABAC decision process, which increases the risk of privacy disclosure. This problem increases public doubts about ABAC and hinders its popularization. In this paper, a privacy-protected and efficient attribute-based access control (EPABAC) scheme is proposed to prevent the privacy leakage of access subject in the decision-making process of ABAC by introducing a novel hash-based binary search tree. The analyses and experimental evaluations show that the EPABAC achieves user privacy protection in the decision-making process with acceptable additional computing overhead.
Comments on “DAC-MACS: Effective Data Access Control for Multiauthority Cloud Storage Systems”/Security Analysis of Attribute Revocation in Multiauthority Data Access Control for Cloud Storage Systems

Jia-An Hong,Kaiping Xue,Li, W.

DOI: https://doi.org/10.1109/TIFS.2015.2407327

2015-01-01

Abstract:In the above paper, Yang et al. have proposed a multi-authority ciphertext-policy attribute-based encryption-based data access control for cloud storage, in which the authors claimed that the mechanism in dealing with attribute revocation could achieve both forward security and backward security. Unfortunately, our further analysis and investigation show that their work adopts a bidirectional re-encryption method in ciphertext updating, so a security vulnerability appears. Our proposed attack method demonstrates that a revoked user can still decrypt new ciphertexts that are claimed to require the new-version secret keys to decrypt.
An Access Control Frame Based on the Privilege of Program and It's Implementation in Linux

王凯,陆骏,茅兵

DOI: https://doi.org/10.3969/j.issn.1001-3695.2004.06.057

2004-01-01

Abstract:The paper analysises the concept of access control based on the privilege of program,and proposes a model of this access control according to the three dimension access model,then introduces it’s prototype implementation in Linux,which is a part of the security enhanced system based on Linux designed by the computer science department of Nanjing university.
Adaptive Dynamic Average Consensus Scheme with Preserving Privacy and against False Data Injection Attacks: Dynamic Event-triggered Mechanism

Yang Yang,Jinwei Li,Xue Wang,Fei Ding,Chunxia Dou,Victor Kuzin

DOI: https://doi.org/10.1109/tvt.2024.3361179

IF: 6.8

2024-01-01

IEEE Transactions on Vehicular Technology

Abstract:It is a critical issue for achieving dynamic average consensus (DAC) in the presence of privacy eavesdroppers and false data injection (FDI) attacks, and this scenario is applicable to intelligent transportation systems. A dynamic event-triggered privacy preserving DAC (DET-PPDAC) control scheme is proposed. Firstly, in a privacy-sensitive scene, different time-varying terms are added to communication states by hiding real information from eavesdroppers. An observer and a compensator are designed to construct a control scheme for compensating for the impact of FDI attacks over a channel between a control signal and an actuator. Adaptive auxiliary variables are introduced for compensating for residual errors owing to asymmetric encryption/decryption functions. Dynamic event-triggered conditions are constructed to reduce the number of data as well as the risk of leakage by eavesdroppers, and continuous monitor from neighbors is removed. Our DET-PPDAC control scheme can also be applied to a directed graph. Stability analysis shows that the control scheme finally achieves DAC with bounded errors and Zeno-free behaviors while satisfying the requirement of privacy preservation. Simulation examples with formation of vehicles are given to demonstrate the effectiveness of the proposed control scheme.

telecommunications,engineering, electrical & electronic,transportation science & technology
Mandatory Access Control Mechanism of Executable Program under LSM

LIU Wei-peng,HU Jun,LV Hui-jun,LIU Yi

DOI: https://doi.org/10.3969/j.issn.1000-3428.2008.07.056

2008-01-01

Abstract:This paper analyses the main design idea of Linux Security Module(LSM) and the problem of the intrinsic access control mechanism of Linux executable program, and discusses the design of Mandatory Access Control(MAC) mechanism of executable program based on LSM. As the demonstration, it implements a MAC system prototype based on Linux kernel 2.6.11. The illumination that how to implement MAC of executable program in operating system is given.
An Extended Access Control Model Based on Roles and Departments

HU Ying-song,CHEN Gang,ZHU A-ke,CHEN Zhong-xin

2006-01-01

Abstract:A new access control model based on roles and departments is proposed,which extends the traditional RBAC model. The new model abstracts the department from the property of roles,and becomes an important factor of permission control. Furthermore,this paper designs a three-layered architecture for this cross-platform security administration and one of the access control policies is described in detail.

Design and Implementation of Enhanced Discretionary Access Control Mechanism

Design and Implementation of Unified Access Control System Based on LDAP

Multi-level Access Control for Collaborative CAD

Application-Defined Decentralized Access Control

DAC-MACS: Effective Data Access Control for Multi-Authority Cloud Storage Systems

Design and Implement of Enhanced SNMP Access Control

Design of campus comprehensive access management platform

Study and Improvement of MAC(Mandatory Access Control) for Windows

DACPCC:A Data Access Control Scheme with Access Permission for Cloud Computing

Reputation and Attribute Based Dynamic Access Control Framework in Cloud Computing Environment for Privacy Protection

Role-Based Access Controls

The Design and Implementation of a Distributed Access Control System Based on Trust-Management

A Feasible Fuzzy-Extended Attribute-Based Access Control Technique

EACS: an Efficient Access Control Scheme for Electronic Publishing in Cloud Computing

An Action-Based Fine-Grained Access Control Mechanism for Structured Documents and Its Application

An efficient privacy‐enhanced attribute‐based access control mechanism

Comments on “DAC-MACS: Effective Data Access Control for Multiauthority Cloud Storage Systems”/Security Analysis of Attribute Revocation in Multiauthority Data Access Control for Cloud Storage Systems

An Access Control Frame Based on the Privilege of Program and It's Implementation in Linux

Adaptive Dynamic Average Consensus Scheme with Preserving Privacy and against False Data Injection Attacks: Dynamic Event-triggered Mechanism

Mandatory Access Control Mechanism of Executable Program under LSM

An Extended Access Control Model Based on Roles and Departments