The low-cost secure sessions of access control model for distributed applications by public personal smart cards

the secure requirement of modern information systems is increasing significantly nowadays, especially in cloud computing with distributed applications. Among secure mechanisms of an organization, the access control (AC) is a foundation for modern information systems. In order to reach an effective and flexible approach of access control, the Rolebased Access Control (RBAC) models are widely deployed in organizations. Comparing with traditional discretionary access control (DAC) and mandatory access control (MAC), the userrole- subject mapping of a RBAC model provides effective permissions assignments for access control of an organization. However, the RBAC sessions could be stretched over multiple distributed servers in cloud computing. The traversed sessions between servers could be modified, monitored and attacked by modern hacker techniques, and become secure leaks in RBAC models. In order to ensure secure sessions in cloud computing, various encryption approaches are used. Among these encryption approaches, the use of digital certificates by asymmetric encryption methods could be an appropriate solution to ensure the security of RBAC sessions. However, the cost of public/private keys management and issuing an appropriate certificate tokens for each member in organizations could be very expensive. The high cost might block the deployment of secure RBAC sessions, and then reduce the secure level of organizations. In order to improve this issue, a low-cost approach of secure sessions for RBAC models is proposed in this paper. The personal smart cards can be used as a certificate tokens in RBAC models to reach effective user authentications. Moreover, each session of RBAC models, including user-role-subject assignments and contentbased accesses, can be protected by digital certificates which is generated by user own smart cards. Thus the security of RBAC sessions can be improved significantly. It is worth noting that personal smart cards are issued by public departments, thus the expense of tokens issuing and key management could be minimized. Therefore, the session security of a RBAC model could be ensured with user own smart cards without additional cost.