An evaluation of break-the-glass access control model for medical data in wireless sensor networks

Abstract

Wireless Sensor Networks (WSNs) have recently attracted a lot of attention in the research community because it is easy to deploy them in the physical environment and collect and disseminate environmental data from them. The collected data from sensor nodes can vary based on what kind of application is used for WSNs. Data confidentiality and access control to that collected data are the most challenging issues in WSNs because the users are able to access data from the different location via ad-hoc manner. Access control is one of the critical requirements to prevent unauthorised access from users. The current access control models in information systems cannot be applied straightforwardly because of some limitations namely limited energy, resource and memory, and low computation capability. Based on the requirements of WSNs, we proposed the Break-The-Glass Access Control (BTG-AC) model which is the modified and redesigned version of Break-The-Glass Role-Based Access Control (BTG-RBAC) model. The several changes within the access control engine are made in BTG-RBAC to apply and fit in WSNs. We developed the BTG-AC model in Ponder2 package. Also a medical scenario was developed to evaluate the BTG-AC model for medical data in WSNs. In this paper, detail design, implementation phase, evaluation result and policies evaluation for the BTG-AC model are presented. Based on the evaluation result, the BTG-AC model can be used in WSNs after several modifications have been made under Ponder2 Package

Achieve Privacy-Preserving Priority Classification on Patient Health Data in Remote eHealthcare System

“…The access control policies are proper techniques used for privacy-preserving. Most of time, hybrid access control policies are adopted to propose a privacy-preserving access control mechanisms [28]- [33]. It is common to use the combination of the access control and the pseudonymization in one privacy-preserving scheme, which stores the users' data in an anonymized manner, and shared the anonymized data according to the access control policies.…”

Health Information System Role-Based Access Control Current Security Trends and Challenges

“…Also, focused on emergency access to protected EHR information over wireless sensor networks (WSN) that implement RBAC, Maw et al [ 18 ] proposed a “breaking the glass” feature allowing access to a previously blocked object under certain user circumstances and obligations.…”

“…Although some articles focused only at describing the need of an additional security layer or different access control model combination [ 26 , 29 , 31 ], we can summarize RBAC current adaptation needs as follows: Conditional or emergency access and authorization are delegated. Context- and situation access-based solutions are advocated to be adapted over original RBAC features [ 14 , 16 – 18 , 32 ] requiring additional user's obligation. Access segmentation and interdomain/federation scenarios are needed.…”

“…Context- and situation access-based solutions are advocated to be adapted over original RBAC features [ 14 , 16 – 18 , 32 ] requiring additional user's obligation.…”

Comparing and Integrating Break-the-Glass and Delegation in Role-based Access Control for Healthcare

“…Allowing roles to take advantage of a broken glass without obligations seems to invite for abuses, which we intend to avoid, but even if we assume an implementation that mimics less faithfully what happens to a real glass (see § 4) Ferreira et al's proposal of the break-the-glass diverges from auto-delegation. There are still other works that define ways to extend BTG-RBAC, but their applicability is limited to specific domains such as Wireless Sensor Networks (Maw et al, 2014) and Cloud Computing (Rajesh and Nayak, 2012). There is no understanding about how break-the-glass and delegation relate in general and in the medical domain in particular.…”