An Access Control Model to Facilitate Healthcare Information Access in Context of Team Collaboration

The delivery of healthcare relies on the sharing of patients information among a group of healthcare professionals (so-called multidisciplinary teams (MDTs)). At present, electronic health records (EHRs) are widely utilized system to create, manage and share patient healthcare information among MDTs. While it is necessary to provide healthcare professionals with privileges to access patient health information, providing too many privileges may backfire when healthcare professionals accidentally or intentionally abuse their privileges. Hence, finding a middle ground, where the necessary privileges are provided and malicious usage are avoided, is necessary. This thesis highlights the access control matters in collaborative healthcare domain. Focus is mainly on the collaborative activities that are best accomplished by organized MDTs within or among healthcare organizations with an objective of accomplishing a specific task (patient treatment). Initially, we investigate the importance and challenges of effective MDTs treatment, the sharing of patient healthcare records in healthcare delivery, patient data confidentiality and the need for flexible access of the MDTs corresponding to the requirements to fulfill their duties. Also, we discuss access control requirements in the collaborative environment with respect to EHRs and usage scenario of MDTs collaboration. Additionally, we provide summary of existing access control models along with their pros and cons pertaining to collaborative health systems. Second, we present a detailed description of the proposed access control model. In this model, the MDTs is classified based on Belbin’s team role theory to ensure that privileges are provided to the actual needs of healthcare professionals and to guarantee confidentiality as well as protect the privacy of sensitive patient information. Finally, evaluation indicates that our access control model has a number of advantages including flexibility in terms of permission management, since roles and team roles can be updated without updating privilege for every user. Moreover, the level of fine-grained control of access to patient EHRs that can be authorized to healthcare providers is managed and controlled based on the job required to meet the minimum necessary standard and need-to-know principle. Additionally, the model does not add significant administrative and performance overhead.publishedVersio

Toward Effective Access Control Using Attributes and Pseudoroles

Sharing of information is fundamental to modern computing environments across many application domains. Such information sharing, however, raises security and privacy concerns that require effective access control to prevent unauthorized access and ensure compliance with various laws and regulations. Current approaches such as Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC) and their variants are inadequate. Although it provides simple administration of access control and user revocation and permission review, RBAC demands complex initial role engineering and makes access control static. ABAC, on the other hand, simplifies initial security setup and enables flexible access control, but increases the complexity of managing privileges, user revocation and user permissions review. These limitations of RBAC and ABAC have thus motivated research into the development of newer models that use attributes and policies while preserving RBAC\u27s advantages. This dissertation explores the role of attributes---characteristics of entities in the system---in achieving effective access control. The first contribution of this dissertation is the design and development of a secure access system using Ciphertext-Policy Attribute-Based Encryption (CP-ABE). The second contribution is the design and validation of a two-step access control approach, the BiLayer Access Control (BLAC) model. The first layer in BLAC checks whether subjects making access requests have the right BLAC pseudoroles---a pseudorole is a predefined subset of a subject\u27s static attributes. If requesting subjects hold the right pseudoroles, the second layer checks rule(s) within associated BLAC policies for further constraints on access. BLAC thus makes use of attributes effectively while preserving RBAC\u27s advantages. The dissertation\u27s third contribution is the design and definition of an evaluation framework for time complexity analysis, and uses this framework to compare BLAC model with RBAC and ABAC. The fourth contribution is the design and construction of a generic access control threat model, and applying it to assess the effectiveness of BLAC, RBAC and ABAC in mitigating insider threats

Comparison and Alignment of Access Control Models

Turvasüsteemipoliitikat rakendatakse arvutis juurdepääsu kontrollimehhanismi kaudu. Juurdepääsu kontrollmehhanismi peamised kontrollid on konfidentsiaalsus, terviklikkus ja turvalisus. Juurdepääsu kontrollmehhanismi saab rakendada mistahes juurdepääsu kontrollmudelite kaudu. See on viis, kuidas volitamata kasutaja eest teavet või ressursse kaitsta, tagades juurdepääsu ainult volitatud kasutajale. On olemas erinevad juurdepääsu kontrollimudelid, kus kõik mudelid pole tänapäeva digitaalkeskkonnale piisavad. Seega tekib probleem ülesande lahendamisel, milline juurdepääsukontrolli mudel sobib teatud tüüpi mitme kasutaja infrastruktuuriga, millel on erinevad juurdepääsuvajadused. Juurdepääsu kontrollmudel erineb vastavalt keskkonnale. On olemas keskkond, mis annab juurdepääsu oma kasutajatele konkreetses võrgustikus ja keskkonnas, kus on kasutajaid, kes vahetavad võrke, et kasutada dünaamiliselt erinevaid ressursse. Seega on ressursside ja võrgu tõhusa kasutamise õige mudeli määramine keeruline, välja arvatud juhul, kui on võimalik olemasolevas mudelis kasutada vajalikke kontseptsioone, et muuta meie uus mudel paindlikumaks.Juurdepääsu kontrollimise standardid erinevate juurdepääsupõhiste õiguste haldamiseks on keerukad. Tekkivate tehnoloogiatega muutuvad süsteemi komponendid ajakohastatuks, seega on väljakutse leida sobiv ja paindlik juhtimismudel, mis vastab süsteemile. Isegi kui saadaval on erinevad juurdepääsukontrolli mudelid, on tõeline probleem leidmaks vajalikku juurdepääsu kontrollimehhanismi, mida saab kasutada meie uue juurdepääsukontrolli mudeli täiustamiseks, et turvaliselt juurde pääsedes ressursse tõhusalt kasutada.Lahenduseks on mõista juurdepääsu kontrollimudeli nõrku ja tugevaid omadusi, võrrelda erinevaid mudeleid ja viia nende parimad omadused kokku paindliku juurdepääsu kontrollimudeli koostamiseks. See saavutatakse süstemaatilise küsitluse abil, kus osalejad kinnitavad, et juurdepääsu kontrollimudelit saab mõista ja võrrelda kolme põhikomponendi: subjekti, poliitika ja objektiga, mille aluseks olevad põhimõtted, metamudelid ja kolme erineva juurdepääsu kontrollimudeli näitel.Erinevate juurdepääsukontrolli mudelite analüütiline võrdlus põhineb aruandel selle kohta, kuidas kasutajad sellega erinevatel juhtudel tegelevad. See uuring aitas saada erinevate inimeste arvamust reaalselt nii, et see empiiriline katsete läbiviimise viis suudaks leida tugevaid ja nõrgemaid tegureid. Lõpuks viiakse kõik tugevad tegureid kooskõlla uue paindliku juurdepääsukontrolli mudeli loomisega.Tulemus aitab võrrelda, uurida ja rakendada sobivat ja vajalikku juurdepääsu kontrollisüsteemile. See paneb meid mõtlema ka sellele, kuidas saab uut juurdepääsu kontrollisüsteemi analüüsida ja võrrelda olemasolevatega. Reaalajas vaatajaskonna abil saab selle väljund olla realistlik. Seda uurimustöö tulemust saab kasutada juurdepääsu kontrolli mudelite edasiseks täiustamiseks.Security system policies are implemented in the computer through access control mechanism. The primary controls that the access control mechanism possesses are confidentiality, integrity, and security. Access control mechanism can be applied through any of the access control models. It is is a way of protecting information or resources from the unauthorized user to provide access to authorized user. There exist different access control models in which all models are not adequate for today's digital environment. So, the problem arises in difficulty faced to choose which access control model suits well for a particular type of multi-user infrastructure with various access needs. Access control model differs according to the environment. There is an environment which grants access to its users within a particular network and for an environment which has users, who switch dynamically between different networks to access resources. Hence, determining the right model for the efficient use of resources and network is difficult, unless, there is a way to implement the needed concepts in our existing model as to make our new flexible model. Access control standards for managing different access privileges are complex to understand. With the emerging technologies, components of a system are getting updated, so, it will be a challenge to find out the suitable and flexible access control model that matches the system. Even though there are different access control model available, there is the real problem in finding out the needed access control mechanism which can be employed for the improvement of our new access control model for the efficient use of the resources to be accessed securely.The solution is to understand the weak and strong features of access control model by comparing different models and aligning their best features to compose into a flexible access control model. It is achieved with the help of systematic survey, where a group of audience validated that access control model can be understood and compared with three main components, subject, policy and object with underlying principles, meta-models and examples of three different access control model. Analytical comparison of different access control model is drawn from a report of how the audience deals with it at various cases that were analyzed. This survey helped to receive the opinion of different people realistically, such that this empirical way of conducting experiments concludes with the way for finding strong and weak factors. Finally, all the strong factors are aligned to form a new flexible access control model. The result helps to compare, study and implement a suitable and necessary access control system. It also makes us think in a way how a new access control system can be analyzed and compared with the existing ones. This research work result can be used for further research in future for the potential enhancement of newer access control models

Managing Access to Electronic Health Records in a Cloud Computing Environment

Access control methods are relevant in securing EHR from unauthorised users and access. It is therefore important that proper access control mechanisms are put in place in order to safeguard the privacy and confidentiality of health records. This paper provides a review of the benefits and limitations of individual access control mechanisms. It also indicate the challenges and advantages associated with the use of the individual access control methods vis-a-vis combined access control methods for accessing electronic health records (EHR) in a cloud computing environment. This review concludes that the use of one access control is not sufficient to fully secure EHR in a cloud computing environment. A combined access control methods has the potential to offer strong security to EHR in the cloud setting. Maximising the benefits of the various access controls is essential for enhancing the security of EHR in a cloud computing environment

From Conventional to State-of-the-Art IoT Access Control Models

open access articleThe advent in Online Social Networks (OSN) and Internet of Things (IoT) has created a new world of collaboration and communication between people and devices. The domain of internet of things uses billions of devices (ranging from tiny sensors to macro scale devices) that continuously produce and exchange huge amounts of data with people and applications. Similarly, more than a billion people are connected through social networking sites to collaborate and share their knowledge. The applications of IoT such as smart health, smart city, social networking, video surveillance and vehicular communication are quickly evolving people’s daily lives. These applications provide accurate, information-rich and personalized services to the users. However, providing personalized information comes at the cost of accessing private information of users such as their location, social relationship details, health information and daily activities. When the information is accessible online, there is always a chance that it can be used maliciously by unauthorized entities. Therefore, an effective access control mechanism must be employed to ensure the security and privacy of entities using OSN and IoT services. Access control refers to a process which can restrict user’s access to data and resources. It enforces access rules to grant authorized users an access to resources and prevent others. This survey examines the increasing literature on access control for traditional models in general, and for OSN and IoT in specific. Challenges and problems related to access control mechanisms are explored to facilitate the adoption of access control solutions in OSN and IoT scenarios. The survey provides a review of the requirements for access control enforcement, discusses several security issues in access control, and elaborates underlying principles and limitations of famous access control models. We evaluate the feasibility of current access control models for OSN and IoT and provide the future development direction of access control for the sam

The Complete MLSK Model—incorporation of lattice operations and XML implementation

Many multilevel security relational models have been proposed and different models offer different advantages. In this paper, we adapt and refine some of the best ideas from these models and add new ones of own to extend our Multilevel Security with Key-polyinstantiation (MLSK) relational model. MLSK now supports relational algebra and user lattice manipulations while ensuring that the soundness, completeness and security that it originally guaranteed are not compromised. We also implement MLSK in a non-relational scenario, thereby demonstrating the extensibility of the model to other environments

An Access Control Model for NoSQL Databases

Current development platforms are web scale, unlike recent platforms which were just network scale. There has been a rapid evolution in computing paradigm that has created the need for data storage as agile and scalable as the applications they support. Relational databases with their joins and locks influence performance in web scale systems negatively. Thus, various types of non-relational databases have emerged in recent years, commonly referred to as NoSQL databases. To fulfill the gaps created by their relational counter-part, they trade consistency and security for performance and scalability. With NoSQL databases being adopted by an increasing number of organizations, the provision of security for them has become a growing concern. This research presents a context based abstract model by extending traditional role based access control for access control in NoSQL databases. The said model evaluates and executes security policies which contain versatile access conditions against the dynamic nature of data. The goal is to devise a mechanism for a forward looking, assertive yet flexible security feature to regulate access to data in the database system that is devoid of rigid structures and consistency, namely a document based database such as MongoDB