A Policy Model and Framework for Context-Aware Access Control to Information Resources
TLDR
In this paper, the authors propose a new context-aware access control (CAAC) approach with both dynamic associations of user-role and role-permission capabilities, which supports context sensitive access control to information resources and dynamically re-evaluates the access control decisions when there are dynamic changes to the context.Abstract:
In today’s dynamic ICT environments, the ability to control users’ access to information resources and services has become ever important. On the one hand, it should provide flexibility to adapt to the users’ changing needs, while on the other hand, it should not be compromised. The user is often faced with different contexts and environments that may change the user’s information needs. To allow for this, it is essential to incorporate the dynamically changing context information into the access control policies to reflect different contexts and environments through the use of a new context-aware access control (CAAC) approach with both dynamic associations of user-role and role-permission capabilities. Our proposed CAAC framework differs from the existing access control frameworks in that it supports context-sensitive access control to information resources and dynamically re-evaluates the access control decisions when there are dynamic changes to the context. It uses the dynamic context information to specify the user-role and role-permission assignment policies. We first present a formal policy model for our framework, specifying CAAC policies. Using this model, we then introduce a policy ontology for modeling CAAC policies and a policy enforcement architecture which supports access to resources according to the dynamically changing context information. In addition, we demonstrate the feasibility of our framework by considering (i) the completeness, correctness and consistency of the ontology concepts through application to healthcare scenarios and (ii) the performance and usability testing of the framework when using desktop and mobile-based prototypes.read more
Citations
More filters
Journal ArticleDOI
A Visualized Botnet Detection System Based Deep Learning for the Internet of Things Networks of Smart Cities
R. Vinayakumar,Mamoun Alazab,Sriram Srinivasan,Quoc-Viet Pham,Soman Kotti Padannayil,K. Simran +5 more
TL;DR: A botnet detection system based on a two-level deep learning framework for semantically discriminating botnets and legitimate behaviors at the application layer of the domain name system (DNS) services is proposed.
Journal ArticleDOI
Effectiveness analysis of machine learning classification models for predicting personalized context-aware smartphone usage
TL;DR: This study aims to analyze the effectiveness of various machine learning classification models for predicting personalized usage utilizing individual’s phone log data and presents the empirical evaluations of Artificial Neural Network based classification model, which is frequently used in deep learning and makes comparative analysis in this context-aware study.
Journal ArticleDOI
Intelligent mobile malware detection using permission requests and API calls
TL;DR: The results demonstrate that compared with benign apps, malicious applications invoke a different set of API calls and that mobile malware often requests dangerous permissions to access sensitive data more often than benign apps.
Journal ArticleDOI
A Survey of Context-Aware Access Control Mechanisms for Cloud and Fog Networks: Taxonomy and Open Research Issues.
A. S. M. Kayes,Rudri Kalaria,Iqbal H. Sarker,Md. Saiful Islam,Paul A. Watters,Alex Hay-Man Ng,Mohammad Hammoudeh,Shahriar Badsha,Indika Kumara +8 more
TL;DR: A new generation of Fog-Based Context-Aware Access Control (FB-CAAC) framework is proposed, combining the benefits of the cloud, IoT and context-aware computing; and ensuring proper access control and security at the edge of the end-devices.
Journal ArticleDOI
TrustE-VC: Trustworthy Evaluation Framework for Industrial Connected Vehicles in the Cloud
Mohammad N. Aladwan,Feras M. Awaysheh,Sadi Alawadi,Mamoun Alazab,Tomás F. Pena,José C. Cabaleiro +5 more
TL;DR: This article proposes three-level security features in order to develop effectiveness and trustworthiness in VCs and paves the way for a secure VC using an evaluation of effective security features and underscores directions and challenges facing the VC community.
References
More filters
Journal ArticleDOI
Role-based access control models
TL;DR: Why RBAC is receiving renewed attention as a method of security administration and review is explained, a framework of four reference models developed to better understandRBAC is described, and the use of RBAC to manage itself is discussed.
Journal ArticleDOI
Understanding and Using Context
TL;DR: An operational definition of context is provided and the different ways in which context can be used by context-aware applications are discussed, including the features and abstractions in the toolkit that make the task of building applications easier.
Journal ArticleDOI
A conceptual framework and a toolkit for supporting the rapid prototyping of context-aware applications
TL;DR: A conceptual framework is presented that separates the acquisition and representation of context from the delivery and reaction to context by a context-aware application, and a toolkit is built that instantiates this conceptual framework and supports the rapid development of a rich space of context- aware applications.
Journal ArticleDOI
Proposed NIST standard for role-based access control
TL;DR: Although RBAC continues to evolve as users, researchers, and vendors gain experience with its application, the features and components proposed in this standard represent a fundamental and stable set of mechanisms that may be enhanced by developers in further meeting the needs of their customers.
Journal ArticleDOI
Access control: principle and practice
Ravi Sandhu,Pierangela Samarati +1 more
TL;DR: The access matrix model is reviewed and different approaches to implementing the access matrix in practical systems are described, followed with a discussion of access control policies commonly found in current systems, and a brief consideration ofAccess control administration.