Comprehensive Life Cycle Support for Access Rules in Information Systems: The CEOSIS Project

The definition and management of access rules (e.g., to control access to business documents and business functions) is a fundamental task in any enterprise information system (EIS). While there exists considerable work on how to specify and represent access rules, only little research has been spent on access rule changes. Examples include the evolution of organizational models with need for subsequent adaptation of related access rules as well as direct access rule modifications (e.g., to state a previously defined rule more precisely). This paper presents a comprehensive change framework for the controlled evolution of role-based access rules in EIS. First, we consider changes of organizational models and elaborate how they affect existing access rules. Second, we define change operations which enable direct adaptations of access rules. In the latter context, we define the formal semantics of access rule changes based on operator trees. Particularly, this enables their unambiguous application; i.e., we can precisely determine which effects are caused by respective rule changes. This is important, for example, to be able to efficiently and correctly adapt user worklists in process-aware information systems. Altogether this paper contributes to comprehensive life cycle support for access rules in (adaptive) EIS

Managing the Life Cycle of Access Rules in CEOSIS

The definition and management of access rules (e.g., to control the access to business documents and business functions) is an important task within any enterprise information systems (EIS). Many EIS apply role-based access control (RBAC) mechanisms to specify access rules based on organizational models. However, only little research has been spent on organizational changes even though they often become necessary in practice. Examples comprise the evolution of organizational models with subsequent adaptation of access rules or direct access rule modifications. In this paper, we present a change framework for the controlled evolution of access rules in EIS. Specifically, we define change operations which ensure correct modification of access rules. Finally, we define the formal semantics of access rule changes based on operator trees which enables their unambiguous application; i.e., we can precisely determine which effects are caused by respective adaptations. This is important, for example, to be able to efficiently adapt user worklists in process-aware information systems. Altogether this paper contributes to comprehensive life cycle support for access rules in (adaptive) EIS

Object-specific Role-based Access Control

The proper management of privacy and security constraints in information systems in general and access control in particular constitute a tremendous, but still prevalent challenge. Role-based access control (RBAC) and its variations can be considered as the widely adopted approach to realize authorization in information systems. However, RBAC lacks a proper object-specific support, which disallows establishing the fine-grained access control required in many domains. By comparison, attribute-based access control (ABAC) enables a fine-grained access control based on policies and rules evaluating attributes. As a drawback, ABAC lacks the abstraction of roles. Moreover, it is challenging to engineer and to audit the granted privileges encoded in rule-based policies. This paper presents the generic approach of object-specific role-based access control (ORAC). On one hand, ORAC enables information system engineers, administrators and users to utilize the well-known principle of roles. On the other, ORAC allows realizing the access to objects in a fine-grained way where required. The approach was systematically established according to well-elicited key requirements for fine-grained access control in information systems. For the purpose of evaluation, the approach was applied to real-world scenarios and implemented in a proof-of-concept prototype demonstrating its feasibility and applicability

Internet of Thing Based Confidential Healthcare Data Storage, Access Control and Monitoring Using Blockchain Technique

Internet of Things plays a significant role in multiple sectors like agriculture, manufacturing and healthcare for collecting information to automation. The collected information is in different diversity and consists of confidential and non-confidential information. Secure handling of confidential data is a crucial task in cloud computing like storage, access control and monitoring. The blockchain based storage technique provides immutable data storage, efficient access control and dynamic monitoring to confidential data. Thus, the secure internet of things data storage, access control and monitoring using blockchain technique is proposed in this work. The patients health information that are in different formats are pruned by a decision tree algorithm and it classifies the confidential data and non-confidential data by the fuzzy rule classification technique. Depending on data owner's willing, the fuzzy rule is framed and the confidential and non-confidential data collected by internet of things sensors are classified. To provide confidentiality to confidential data, Attribute Based Encryption is applied to confidential data and stored in an off-chain mode of blockchain instead of entire data encryption and storage. The non-confidential data is stored in a plaintext form in cloud storage. When compared to support vector machine, K-nearest neighbor and Naive Bayes classification techniques, the proposed fuzzy rule based confidential data identification produces greater than 96 % of accuracy based on data owner willing and confidential data storage takes lesser than 20 % of storage space and processing time in an entire data storage. Additionally, the blockchain performances like throughput, network scalability and latency is optimized through minimal block size and transactions. Thus, our experimental results show that the proposed blockchain based internet of things data storage, access control and monitoring technique provides better confidentiality and access control to confidential data than the conventional cloud storage technique with lesser processing time

Towards Model-Driven Development of Access Control Policies for Web Applications

We introduce a UML-based notation for graphically modeling systems’ security aspects in a simple and intuitive way and a model-driven process that transforms graphical specifications of access control policies in XACML. These XACML policies are then translated in FACPL, a policy language with a formal semantics, and the resulting policies are evaluated by means of a Java-based software tool

Self-Adaptive Role-Based Access Control for Business Processes

© 2017 IEEE. We present an approach for dynamically reconfiguring the role-based access control (RBAC) of information systems running business processes, to protect them against insider threats. The new approach uses business process execution traces and stochastic model checking to establish confidence intervals for key measurable attributes of user behaviour, and thus to identify and adaptively demote users who misuse their access permissions maliciously or accidentally. We implemented and evaluated the approach and its policy specification formalism for a real IT support business process, showing their ability to express and apply a broad range of self-adaptive RBAC policies