Analysis of Decentralized

Access control refers to securing access to the resources and allowing access up to some defined level. This paper presents various approaches implementing access control in an open domain and carries an analysis of decentralized and diverse access control (DDAC) architecture. The DDAC architecture eliminates the role of centralized authority for managing and issuing users2019; credentials. It allows the users to keep the right of disclosure of their attributes under the sole control of them and also ensures that the users are not able to modify the confidential credentials which have been registered and verified by various trusted attribute providers. This paper explains the metrics for carrying the analysis and then presents a theoretical and experimental analysis of the DDAC architecture

eCH-0219 Glossaire IAM

Der vorliegende Standard definiert die wichtigsten Begriffe für IAM-Lösungen im föderalen E-Government Schweiz und bildet damit die Grundlage aller eCH Standards im Bereich IAM. Die aufgenommenen Begriffe umfassen Stakeholder, Prozesse, Services bis zu Implementationsdetails in föderierten und nicht föderierten IAM-Lösungen. Begriffe aus aktuellen internationalen Standards werden zu den definierten Begriffen in Beziehung gesetzt und damit verständlicher gemachtLa présente norme définit les termes les plus importants pour les solutions IAM dans la cyberadministration fédérale suisse. L’ensemble des normes eCH relatives aux domaines IAM s’appuient sur cette norme. Les termes intégrés incluent les Stakeholders, les processus, les services jusqu’aux détails d’implémentation dans les solutions IAM fédérées et non fédérées. Les termes tirés de normes internationales actuelles sont mis en relation avec la terminologie définie dans un souci d’intelligibilité

PLEDGE: An IoT-oriented Proof-of-Honesty based Blockchain Consensus Protocol

The existing lottery-based consensus algorithms, such as Proof-of-Work, and Proof-of-Stake, are mostly used for blockchain-based financial technology applications. Similarly, the Byzantine Fault Tolerance algorithms do provide consensus finality, yet they are either communications intensive, vulnerable to Denial-of-Service attacks, poorly scalable, or have a low faulty node tolerance level. Moreover, these algorithms are not designed for the Internet of Things systems that require near-real-time transaction confirmation, maximum fault tolerance, and appropriate transaction validation rules. Hence, we propose "Pledge, "a unique Proof-of-Honesty based consensus protocol to reduce the possibility of malicious behavior during blockchain consensus. Pledge also introduces the Internet of Things centric transaction validation rules. Initial experimentation shows that Pledge is economical and secure with low communications complexity and low latency in transaction confirmation

Social Anchor: Privacy-Friendly Attribute Aggregation From Social Networks

In the last decade or so, we have experienced a tremendous proliferation and popularity of different Social Networks (SNs), resulting more and more user attributes being stored in such SNs. These attributes represent a valuable asset and many innovative online services are offered in exchange of such attributes. This particular phenomenon has allured these social networks to act as Identity Providers (IdPs). However, the current setting unnecessarily imposes a restriction: a user can only release attributes from one single IdP in a single session, thereby, limiting the user to aggregate attributes from multiple IdPs within the same session. In addition, our analysis suggests that the manner by which attributes are released from these SNs is extremely privacy-invasive and a user has very limited control to exercise her privacy during this process. In this article, we present Social Anchor, a system for attribute aggregation from social networks in a privacy-friendly fashion. Our proposed Social Anchor system effectively addresses both of these serious issues. Apart from the proposal, we have implemented Social Anchor following a set of security and privacy requirements. We have also examined the associated trust issues using a formal trust analysis model. Besides, we have presented a formal analysis of its protocols using a state-of-the-art formal analysis tool called AVISPA to ensure the security of Social Anchor. Finally, we have provided a performance analysis of Social Anchor

CAFS: A Framework for Context-Aware Federated Services

In this paper we explore two issues: Federated Identity Management and Context-Aware Services. In the last decade or so we have seen these two technologies gaining considerable popularities as they offer a number of benefits to the user and other stakeholders. However, there are a few outstanding security and privacy issues that need to be resolved to harness the full potential of such services. We believe that these problems can be reduced significantly by integrating the federated identity architecture into the context-aware services. With this aim, we have developed a framework for Context-Aware Federated Services based on the Security Assertion Markup Language (SAML) and extensible Access Control Markup Language (XACML) standards. We have illustrated the applicability of our approach by showcasing some use-cases, analysed the security, privacy and trust issues involved in the framework and the advantages it offers

Authentication and Identity Management for the EPOS Project

The increase in the number of online services emphasizes the value of authentication and identity management that we, even without realizing, depend on. In EPOS this authentication and identity management are also crucial, by dealing and being responsible for large amounts of heterogeneous data in multiple formats and from various providers, that can be public or private. Controlling and identify the access to this data is the key. For this purpose, it is necessary to create a system capable of authenticating, authorizing, and account the usage of these services. While services in a development phase can have authentication and authorization modules directly implemented in them, this is not an option for legacy services that cannot be modified. This thesis regards the issue of providing secure and interoperable authentication and authorization framework, associated with correct identity management and an accounting module, stating the difficulties faced and how to be addressed. These issues are approached by implementing the proposed methods in one of the GNSS Data and Products TCS services, that will serve as a study case. While authentication mechanisms have improved constantly over the years, with the addition of multiple authentication factors, there is still not a clear and defined way of how authentication should be done. New security threats are always showing up, and authentication systems need to adapt and improve while maintaining a balance between security and usability. Our goal is, therefore, to propose a system that can provide a good user experience allied to security, which can be used in the TCS services or other web services facing similar problems.A importância da autenticação e gestão de identidades, de que dependemos inconscientemente, aumenta com o crescimento do número de serviços online ao nosso dispor. No EPOS, devido à disponibilização e gestão de dados heterogéneos de várias entidades, que podem ser públicas ou privadas, a existência de um sistema de autenticação e gestão de identidades é também crucial, em que o controlo e identificação do acesso a estes dados é a chave. Numa fase de desenvolvimento dos serviços, estes módulos de autenticação e autorização podem ser diretamente implementados e é possível existir uma adaptação do software aos mesmos. No entanto, há serviços já existentes, cujas alterações implicam mudanças de grande escala e uma reformulação de todo o sistema, e como tal não é exequível fazer alterações diretas aos mesmos. Esta dissertação aborda o desenvolvimento de um sistema de autenticação e autorização seguro e interoperável, associado a uma correta gestão de identidades e um módulo de controlo, identificando os problemas encontrados e propondo soluções para os mesmos. Este desenvolvimento é aplicado num dos serviços do TCS GNSS Data and Products e servirá como caso de estudo. Embora os mecanismos de autenticação tenham melhorado continuamente ao longo dos anos, com a adição de vários fatores de autenticação, ainda não existe um método único e claro de como a autenticação deve ser feita. Novas ameaças estão sempre a surgir e os sistemas atuais precisam de se adaptar e melhorar, mantendo um equilíbrio entre segurança e usabilidade. O nosso objetivo é propor um sistema que possa aliar a segurança a uma boa experiência para o utilizador, e que possa ser utilizado não só nos serviços do TCS, mas também em outros serviços web que enfrentem problemas semelhantes

Federated Access Management for Collaborative Environments

abstract: Access control has been historically recognized as an effective technique for ensuring that computer systems preserve important security properties. Recently, attribute-based access control (ABAC) has emerged as a new paradigm to provide access mediation by leveraging the concept of attributes: observable properties that become relevant under a certain security context and are exhibited by the entities normally involved in the mediation process, namely, end-users and protected resources. Also recently, independently-run organizations from the private and public sectors have recognized the benefits of engaging in multi-disciplinary research collaborations that involve sharing sensitive proprietary resources such as scientific data, networking capabilities and computation time and have recognized ABAC as the paradigm that suits their needs for restricting the way such resources are to be shared with each other. In such a setting, a robust yet flexible access mediation scheme is crucial to guarantee participants are granted access to such resources in a safe and secure manner. However, no consensus exists either in the literature with respect to a formal model that clearly defines the way the components depicted in ABAC should interact with each other, so that the rigorous study of security properties to be effectively pursued. This dissertation proposes an approach tailored to provide a well-defined and formal definition of ABAC, including a description on how attributes exhibited by different independent organizations are to be leveraged for mediating access to shared resources, by allowing for collaborating parties to engage in federations for the specification, discovery, evaluation and communication of attributes, policies, and access mediation decisions. In addition, a software assurance framework is introduced to support the correct construction of enforcement mechanisms implementing our approach by leveraging validation and verification techniques based on software assertions, namely, design by contract (DBC) and behavioral interface specification languages (BISL). Finally, this dissertation also proposes a distributed trust framework that allows for exchanging recommendations on the perceived reputations of members of our proposed federations, in such a way that the level of trust of previously-unknown participants can be properly assessed for the purposes of access mediation.Dissertation/ThesisDoctoral Dissertation Computer Science 201

Attribute-based Single Sign-On: Secure, Private, and Efficient

A Single Sign-On (SSO) system allows users to access different remote services while authenticating only once. SSO can greatly improve the usability and security of online activities by dispensing with the need to securely remember or store tens or hundreds of authentication secrets. On the downside, today\u27s SSO providers can track users\u27 online behavior, and collect personal data that service providers want to see asserted before letting a user access their resources. In this work, we propose a new policy-based Single Sign-On service, i.e., a system that produces access tokens that are conditioned on the user\u27s attributes fulfilling a specified policy. Our solution is based on multi-party computation and threshold cryptography, and generates access tokens of standardized format. The central idea is to distribute the role of the SSO provider among several entities, in order to shield user attributes and access patterns from each individual entity. We provide a formal security model and analysis in the Universal Composability framework, against proactive adversaries. Our implementation and benchmarking show the practicality of our system for many real-world use cases

La gestion de l'identité fédérée et hiérarchique pour le paradigme IaaS

Au fur et à mesure que les nuages informatiques gagnent en popularité, de plus en plus de services tendent à être hébergés sur de telles plateformes. Il est même possible d’héberger une infrastructure informatique complète sur une plateforme de nuages informatiques. Ceci constitue le paradigme IaaS (Infrastructure as a Service). Or, à force d’être utilisées dans différents contextes, des failles dans le modèle d’opération des plateformes de nuages informatiques actuelles commencent à ressortir. L’une d’entre elles concerne le fait qu’ils ne s’intéressent qu’à un seul fournisseur et conséquemment, ne prennent pas en compte l’interopérabilité entre ces fournisseurs de ressources. Cette fonctionnalité peut être spécialement utile pour des petits fournisseurs voulant unir leurs ressources limitées afin de réaliser un objectif commun par exemple. L’interopérabilité interfournisseur permet aussi aux clients de faire affaire avec plusieurs fournisseurs, sans jamais être indéfiniment liés à un seul d’entre eux. Dans l’état actuel des choses, il est généralement très difficile pour un client de migrer ses ressources d’un nuage à un autre. Afin de résoudre ces lacunes, les fournisseurs de nuages informatiques devraient adopter le modèle des nuages informatiques fédérés. Ce modèle leur permettrait de bâtir des nuages complètement distribués, de collaborer et de partager des ressources entre eux de manière transparente. Dans ce mémoire, une architecture de gestion de l’identité et de contrôle d’accès flexible destinée à de tels environnements est décrite. L’approche utilise des technologies de gestion de l’identité fédérée afin de faciliter la création de nuages informatiques fédérées et d’organisations virtuelles dynamiques. Elle s’appuie aussi sur le modèle de contrôle d’accès basé sur les attributs ABAC qui dispose d’une grande flexibilité et fournit un haut degré de flexibilité aux fournisseurs en ce qui concerne leurs actifs. Des fournisseurs membres d’une collaboration sont ainsi en mesure de partager des ressources en fonction des politiques de sécurité établies