Location aware self-adapting firewall policies

Private access to corporate servers from Internet can be achieved using various security mechanisms. This article presents a network access control mechanism that employs a policy management architecture empowered with dynamic firewalls. With the existence of such an architecture, system and/or network administrators do not need to reconfigure firewalls when there is a location change in user settings, reconfiguration will be automatic and seamless. The proposed architecture utilizes dynamic firewalls, which adapt their policies according to user locations through the guidance of a policy server. This architecture is composed of a VPN client at user site, a domain firewall with VPN capabilities, a policy server containing a policy decision engine, and policy agents residing in dynamic firewalls, which map policy server decisions to firewall policy rules, at server site

On XACML\u27s adequacy to specify and to enforce HIPAA

In the medical sphere, personal and medical informa-tion is collected, stored, and transmitted for various pur-poses, such as, continuity of care, rapid formulationof diagnoses, and billing. Many of these operationsmust comply with federal regulations like the HealthInsurance Portability and Accountability Act (HIPAA).To this end, we need a specification language that canprecisely capture the requirements of HIPAA. We alsoneed an enforcement engine that can enforce the pri-vacy policies specified in the language. In the currentwork, we evaluate eXtensible Access Control MarkupLanguage (XACML) as a candidate specification lan-guage for HIPAA privacy rules. We evaluate XACMLbased on the set of features required to sufficiently ex-press HIPAA, proposed by a prior work. We also discusswhich of the features necessary for expressing HIPAAare missing in XACML. We then present high level de-signs of how to enhance XACM

A Prototype to Analyze Role- and Attribute-Based Access Control Models

Käesoleva lõputöö eesmärgiks on luua juurdepääsu kontrolli võrdlemise platvorm või tööriist, mille abil kasutajad saavad eksperimenteerida ning luua turvaanalüüse ja -mudeleid. Lõputöö jaguneb kahte ossa: teoreetiline ja praktiline. Teoreetilises osas uuritakse, kuidas turvalisusmudelid, nagu näiteks kasutajapõhine juurdepääs ja atribuudipõhine juurdepääs töötavad, defineeritakse metamudeleid ja selgitatakse turvalisuse voogu. Seejärel võrreldakse kahte mudelit, fikseerides võrdluskriteeriumid, mida hiljem kasutatakse platvormil. Praktilises osas kasutatakse teoreetilise osa põhipunkte ning defineeritakse vajadused ja kasutuslahendid, et anda kasutajatele maksimaalne arusaam rakenduse sees toimuvast kasutajaliidesega suheldes.The goal of this thesis is to create an access control comparison prototype, where people will do experiments with security models and analyse reports based on their actions. The thesis is split into two parts: theoretical and practical. In the theoretical part, we studied how security models like, Role-Based Access and Attribute-Based Access work, defined the meta models and explained the security flows. After that, we did the theoretical comparison between these models and defined the comparison criteria, which later was used in the prototype. Meanwhile, in practical part, we put main points of the theoretical part and defined requirements and use cases in order to give maximum experience to the users about what is going underneath the application during the interaction through graphical user interface

CRiBAC: Community-centric role interaction based access control model

As one of the most efficient solutions to complex and large-scale problems, multi-agent cooperation has been in the limelight for the past few decades. Recently, many research projects have focused on context-aware cooperation to dynamically provide complex services. As cooperation in the multi-agent systems (MASs) becomes more common, guaranteeing the security of such cooperation takes on even greater importance. However, existing security models do not reflect the agents' unique features, including cooperation and context-awareness. In this paper, we propose a Community-based Role interaction-based Access Control model (CRiBAC) to allow secure cooperation in MASs. To do this, we refine and extend our preliminary RiBAC model, which was proposed earlier to support secure interactions among agents, by introducing a new concept of interaction permission, and then extend it to CRiBAC to support community-based cooperation among agents. We analyze potential problems related to interaction permissions and propose two approaches to address them. We also propose an administration model to facilitate administration of CRiBAC policies. Finally, we present the implementation of a prototype system based on a sample scenario to assess the proposed work and show its feasibility. © 2012 Elsevier Ltd. All rights reserved