A Context Authentication Service for Role Based Access Control in Distributed Systems - CARDS

Abstract

Information misuse is one of the major risks for information systems in organisations. Traditional approaches for authorisation and access control are insufficient because information misuse is primarily done by authorised people. These people have opportunity to access information even for unintended purposes. Role based access controls address this problem because access rights can be related to context descriptions (roles) and therefore, need-to-know access controls can be established. Need-to-know access controls define roles according to tasks in an organisation which represent intended purposes for information usage. Nonetheless, existing approaches for role based access controls do not ensure context authenticity during system operation, i.e. correspondence between activated roles and tasks within an organisation's actual business. Context authenticity must be ensured when a user activates a role or requests context related access to a particular object. Therefore, a context authentication service must be integrated with role based access controls. In this paper we describe the functionality and service components of a context authentication service called CARDS (Context Authentication Service for Role Based Access Control in Distributed Systems).

Putting Things in Context: Securing Industrial Authentication with Context Information

“…A privacy-enhanced access control scheme that optionally integrates context in pervasive environments is developed by Ren and Lou (2007). Hohlbein and Teufel address the issue of authorised persons misusing the system by introducing a role-based access control scheme that uses a need-to-know basis (Holbein and Teufel 1995). In addition to that, context information can be used to determine the security level of a network, as proposed by Duque , or to perform attribution of attacker types, as presented by Fraunholz et al (Fraunholz et al 2017a;Fraunholz et al 2017c).…”

“…The challenges faced by authentication and authorisation, as well as solutions proposed by works presented above are listed in Table 3. (Bhatti et al 2004;Lima et al 2011; Govindan and Mohapatra 2012) Authentication for critical services (Aloul et al 2009) Multi-factor authentication for MANETs (Glynos et al 2005;Govindan and Mohapatra 2012) Privacy-preserving multifactor authentication (Bhargav-Spantzel et al 2017) Multi-factor authentication for pervasive environments (Ren and Lou 2007;Mayrhofer 2006;Mayrhofer and Gellersen 2007;Banyal et al 2013) Multi-factor authentication for fragile communication (Holbein and Teufel 1995;Bardram et al 2003;Kindberg et al 2002;Hulsebosch et al 2005;Mayrhofer and Gellersen 2007;Ren and Lou 2007;Lenzini 2009;Hayashi et al 2013;Primo et al 2014) Authorisation over constrained channels (Kindberg and Zhang 2001;Kindberg et al 2002) Survey (Dasgupta et al 2017) Context-aided intrusion detection (Fraunholz et al 2017a;Fraunholz et al 2017b;Fraunholz et al 2017c; Duque Anton et al…”

Pres

“…Security and flexibility are the two most important aspects in electronic business system [10,11,19]. Role-Base Access Control (RBAC) model [20] is a promising alternative to traditional discretionary and mandatory access control (DAC and MAC) model, which is regarded as a neutral policy and has been used in a variety of forms for computer system security.…”