Enhancing Usage Control for Performance: A Proposal for Systems of Systems (Research Poster)

The enforcement of fine-grained access control policies in constrained dynamic networks can become a challenging task. The inherit constraints present in those networks, which result from the limitations of the edge devices in terms of power, computational capacity and storage, require an effective and efficient access control mechanism to be in place to provide suitable monitoring and control of actions and regulate the access over the resources. In this article, we present RESPOnSE, a framework for the specification and enforcement of security policies within such environments, where the computational burden is transferred to high-tier nodes, while low-tier nodes apply risk-aware policy enforcement. RESPOnSE builds on a combination of two widely used access control models, Attribute-Based Access Control and Role-Based Access Control, exploiting the benefits each one provides. Moreover, the proposed mechanism is founded on a compensatory multicriteria decision-making algorithm, based on the calculation of the Euclidean distance between the run-time values of the attributes present in the security policy and their ideal values, as those are specified within the established policy rules.

show abstract

“…Preliminary studies and evaluation towards such an enforcement architecture have been presented in earlier work [67,68].…”

Section: Ranking Of the Alternatives And Final Decisionmentioning

confidence: 99%

RESPOnSE—A Framework for Enforcing Risk-Aware Security Policies in Constrained Dynamic Environments

Michailidou

Gkioulos

Shalaginov

et al. 2020

Sensors

Self Cite

View full text Add to dashboard Cite

show abstract

“…As presented in detail in our earlier study [3], a limitation of access control is that the access request is only checked once, at the initiation, which highlights the lack of capabilities related to checking alterations on the values of attributes during a session so as to re-evaluate the conformance to the policy. This type of continuous control is a feature that Usage Control (UCON) [6] can provide.…”

Section: Introductionmentioning

confidence: 99%

“…In this article, we build on the results of the aforementioned articles in order to mitigate the limitations of the original UCON which have been presented earlier [3]. Namely, the current UCON architecture, requires the complete re-evaluation of access permissions per user-asset-session triplet, both at the initiation and at runtime.…”

Section: Introductionmentioning

confidence: 99%

Enhancing Usage Control for Performance: An Architecture for Systems of Systems

et al. 2019

Self Cite

View full text Add to dashboard Cite

The distributiveness and heterogeneity of today's systems of systems, such as the Internet of Things (IoT), on-line banking systems, and contemporary emergency information systems, require the integration of access and usage control mechanisms, for managing the right of access both to the corresponding services, and the plethora of information that is generated in a daily basis. Usage Control (UCON) is such a mechanism, allowing the fine-grained policy based management of system resources, based on dynamic monitoring and evaluation of object, subject, and environmental attributes. Yet, as we presented in an earlier article, a number of improvements can be introduced to the standard model regarding its resilience on active attacks, the simplification of the policy writing, but also in terms of run-time efficiency and scalability. In this article, we present an enhanced usage control architecture, that was developed for tackling the aforementioned issues. In order to achieve that, a dynamic role allocation system will be added to the existing architecture, alongside with a service grouping functionality which will be based on attribute aggregation. This is structured in accordance to a risk-based framework, which has been developed in order to aggregate the risk values that the individual attributes encapsulate into a unified risk value. These architectural enhancements are utilized in order to improve the resilience, scalability, and run-time efficiency of the existing model.

show abstract