The low-cost secure sessions of access control model for distributed applications by public personal smart cards

Kuo Yi Chen, Chin Yang Lin, Ting-Wei Hou

Research output: Chapter in Book/Report/Conference proceedingConference contribution

5 Citations (Scopus)

Abstract

the secure requirement of modern information systems is increasing significantly nowadays, especially in cloud computing with distributed applications. Among secure mechanisms of an organization, the access control (AC) is a foundation for modern information systems. In order to reach an effective and flexible approach of access control, the Rolebased Access Control (RBAC) models are widely deployed in organizations. Comparing with traditional discretionary access control (DAC) and mandatory access control (MAC), the userrole- subject mapping of a RBAC model provides effective permissions assignments for access control of an organization. However, the RBAC sessions could be stretched over multiple distributed servers in cloud computing. The traversed sessions between servers could be modified, monitored and attacked by modern hacker techniques, and become secure leaks in RBAC models. In order to ensure secure sessions in cloud computing, various encryption approaches are used. Among these encryption approaches, the use of digital certificates by asymmetric encryption methods could be an appropriate solution to ensure the security of RBAC sessions. However, the cost of public/private keys management and issuing an appropriate certificate tokens for each member in organizations could be very expensive. The high cost might block the deployment of secure RBAC sessions, and then reduce the secure level of organizations. In order to improve this issue, a low-cost approach of secure sessions for RBAC models is proposed in this paper. The personal smart cards can be used as a certificate tokens in RBAC models to reach effective user authentications. Moreover, each session of RBAC models, including user-role-subject assignments and contentbased accesses, can be protected by digital certificates which is generated by user own smart cards. Thus the security of RBAC sessions can be improved significantly. It is worth noting that personal smart cards are issued by public departments, thus the expense of tokens issuing and key management could be minimized. Therefore, the session security of a RBAC model could be ensured with user own smart cards without additional cost.

Original languageEnglish
Title of host publicationProceedings - 2011 17th IEEE International Conference on Parallel and Distributed Systems, ICPADS 2011
Pages894-899
Number of pages6
DOIs
Publication statusPublished - 2011 Dec 1
Event2011 17th IEEE International Conference on Parallel and Distributed Systems, ICPADS 2011 - Tainan, Taiwan
Duration: 2011 Dec 72011 Dec 9

Publication series

NameProceedings of the International Conference on Parallel and Distributed Systems - ICPADS
ISSN (Print)1521-9097

Other

Other2011 17th IEEE International Conference on Parallel and Distributed Systems, ICPADS 2011
CountryTaiwan
CityTainan
Period11-12-0711-12-09

All Science Journal Classification (ASJC) codes

  • Hardware and Architecture

Fingerprint Dive into the research topics of 'The low-cost secure sessions of access control model for distributed applications by public personal smart cards'. Together they form a unique fingerprint.

Cite this