Access control, Data security and privacy

1. SOME NEW RESEARCH DEVELOPMENTS IN ACCESS
CONTROL
Rajab Ssemwogerere &
Wamwoyo Faruk
2019/HD03/29911U & 2019/HD05/25248U
College of Computing and Information Sciences
srajab@cis.mak.ac.ug,faroukissa85@gmail.com
1. Introduction
Internet of things (IoT) bridges communication between
different things or devices such as wireless sensors, smart
devices like mobile phones among others to the internet.
According to Cisco predictive analytics, more than 50
billion devices will be connected to the internet, because
every node can be a provider on that specific network
domain[1, 2]. Due to this factor, there will be an increase on
the number of network nodes hence increasing the volume
of data created by the large number of connected devices.
Secondly, a group of economists Gantz, J et al. [3] by 2005
humans had created 130 Exabyte’s of data, 2010 data
increased to 1,200, by 2015 it increased to 7,900 Exabyte’s
and he predicted that, by 2020 there will be approximately
40,900 Exabyte’s of Data. Considering to some of these
factors, Cloud computing technology was implemented to
handle these circumstances. But unfortunately, the demands
exceeded the level of achievement of cloud services. Cisco
introduced fog computing technology that ensures all
possible network devices interlinked to fog devices, fog
devices which are then linked to the cloud. These devices
collect all the users’ data, preprocess it, and then link it to
the cloud. All data is collected at one central location, threats
like man-in-middle attacks are probable, and there is need
for proper security and access control mechanisms for the
smoothness of this technology.
Security vulnerabilities pave as a result of poorly
constructed system or software cybercriminals finding it
easy to exploit the organization or companies Data. Access
control is critically important for any organization to ensure
security of Data or any piece of information [1, 2, 4, 5].
Access control is a fundamental component of security
through which users are granted physical or logical access
rights to systems, places, shared resources, data or
information[5]. Policies clarify the major objectives of the
system or organization, rules ideally interpret these policies
into a more clearly manageable state of a Boolean decision
(ALLOW or DENY) upon an access request.
In this paper, layout of our work follows; the two recent
studies in access control identifying what they address, their
findings and also what could be investigated as a
consequence of their work and then lastly, the conclusion.
2. Recent studies in Access Control
Zhang, Peng et al. [1] made a comprehensive survey of
Access control of users’ data in the environment of fog
computing highlighting the security vulnerabilities,
problems and challenges.
Younis, Kifayat et al. [4] illustrated a novel cloud based
access control criteria presenting a list of factors and
properties affecting proposing and evaluating of cloud
based access control models reviewing significant
challenge and obstacle to cloud computing security.
Beckerle, Matthias et al. [5] introduced a security and
metrics approach that quantify how usable access control
rule sets are, providing an approach that offers a uniform
and scientific method for comparing different rule sets that
can be used as an optimization criteria to generate usable
access control rule sets and to improve their manageability.
2.1 Formal definitions for Usable Access Control Rule
sets from goals to Metrics.
2.1.1 Authors’ contribution
From the results that correlate with the objectives;
From the pilot study, the authors derived six goals for
building usable access control rule sets, which are currently
used by experts to evaluate rule sets
The authors’ introduced security and usability metrics that
quantify how usable access control rule sets are, obtained a
set of six formal definitions for security and usability
properties of access control rule sets; allow no more than
the owner wants to be allowed, allow everything the owner
wants to be allowed, a rule must not be fully covered by
another rule of the same rule set, two rules belonging to the
same rule set must not conflict, minimize the number of rule
set elements and minimize maintenance effort in a changing
system. Hence providing means for obtaining usable access
control rule sets that, reflect to the access control policies
and secondly, access control rule sets that are easy to
understand and manage.

2. The authors’ also provided an approach that offers a
uniform and scientific method for computing different rule
sets that can be used as optimization criteria to generate
usable access control rule sets to improve their manageability
through formalizing and implementing tools to measure and
compare different rule sets automatically, hence authors’
achieving their objectives.
2.1.2 Authors’ motivation to carry out specific work
This section summaries the research gap of [6-8],
The authors’ realized that access control rule sets that
formulate access control policies, the task of generating and
managing them is not trivial or meaningful. They presented
a novel approach to support generating sound and
manageable usable access control rule sets that could
compare analyze access control rule sets automatically.
2.1.3 Extra studies the Contribution of the authors’
could have brought.
This section summaries the authors’ recommendation and
further study.
The set of six goals is not comprehensive as other metrics
where not included in that set for instance, the design of the
User interface which wasn’t mentioned during the
interviews of the pilot study but considered an important
aspect for the less experienced users, additionally, indirect
interdependency of rules, which may impact the usability
of rule sets. Including these metrics could lead to better rule
sets, but to determine their relevance would require their
further testing and evaluation.
Also the metrics that where presented were independent
of the attribution of costs and extract extension of this work
would introduce cost functions for the some specific metric
sets. Optimizing a criterion could affect other criteria,
therefore it is important to evaluate dependencies between
criteria in future work and also design a tool that can be
integrated in the daily working environment to actively help
users to produce usable access control rule sets.
2.2 A Survey on Access control in Fog Computing.
2.2.1 Authors’ contribution
From the results that correlate with the objectives;
The authors’ discussed the developing definitions of fog
computing, made comparisons among these definitions as
defined by different scholars, spotting out some of the key
terms used; heterogeneous, ubiquity, distribution and cloud
interaction. Basing on the authors’ comparisons the authors
with these key terms, they justified them as advantages of
fog computing and cloud computing and the two coexist.
Analyzed the security challenges in fog computing and
verified that access control is a fundamental requirement to
ensure security, then provided a comprehensive survey of
access control on users’ data in the environment of fog
computing with the aim of highlighting security problems
and challenges.
The authors’ provided requirements and taxonomies in
order to build a secure and efficient access control in the
environment of fog computing, the following requirements
have to be taken into consideration namely,
 Latency, access control systems in fog computing
must grant access decisions to end users in a
reasonable time.
 Efficiency of access control is still a challenge for
any access control system which may lead to the
decision process being delayed causing latency to
other parts of the network.
 Generality; services of fog computing are based on
various techniques having differences in hardware
and software. They require generic APIs to deal with
the existing APIs and protocols.
 Aggregation needs to be done since data is collected
by user devices that are located in different
geographical locations in order to reduce latency and
get meaningful data.
 Privacy protection is unavoidable due to the
decentralized architecture, protecting the privacy of
data is a critical requirement in fog access control.
 Resource restriction; is the main requirement of fog
access control because the computation resources at
the client side and the edge of the network are
limited.
 Policy management; the access control model in fog
computing must have the ability to support releasing,
invoking, and deleting or creating a policy.
2.2.2 Authors’ motivation to carry out specific work
Sharing resources among potential untrusted tenants on fog
devices increases the risk of side-channel attacks like the
man-in-the-middle attacks on the fog devices, the authors’
to rethink possible problems of access control and security
caused by virtualization and multi-tenancy. Additionally,
the interference of multi-tenancy computation may lead to
unauthorized information flow, and the same problems
which also exist in cloud computing.
2.1.3 Extra studies the Contribution of the authors’
could have brought.
Attribute based encryption access control (ABE), data
owner who formulates access policies through attributes
that indicate what kind of users can or cannot access the
data. All data is encrypted and stored in the fog devices and
cloud servers; thus, side-channel attacks because of sharing
of physical resources are in vain. However, due to the
unique requirements of fog computing, access control
schemes of cloud computing perhaps not suitable for fog
computing directly. Constructing the ABE-based access
control that works best for fog computing deserves further
research, to realize fine-grained, cryptographically
enforced access control mechanisms in fog computing.

3. 3. Conclusion
In our work, we have comprehensively explored
security and access control. We reviewed some of the
existing work about access control and highlighted the
authors’ contributions, authors’ motivation to carry
out that specific work and some extra studies the
contribution of the author could have brought,
providing potential future research directions, explore
and achieve better and more resourceful objectives for
each of the new work in the future.
References
1 Zhang, P., Liu, J.K., Yu, F.R., Sookhak, M., Au,
M.H., and Luo, X.: ‘A survey on access control in fog
computing’, IEEE Communications Magazine, 2018, 56,
(2), pp. 144-149
2 Tourani, R., Misra, S., Mick, T., and Panwar, G.:
‘Security, privacy, and access control in information-
centric networking: A survey’, IEEE communications
surveys & tutorials, 2017, 20, (1), pp. 566-600
3 Gantz, J., and Reinsel, D.: ‘The digital universe in
2020: Big data, bigger digital shadows, and biggest growth
in the far east’, IDC iView: IDC Analyze the future, 2012,
2007, (2012), pp. 1-16
4 Younis, Y.A., Kifayat, K., and Merabti, M.: ‘A
novel evaluation criteria to cloud based access control
models’, in Editor (Ed.)^(Eds.): ‘Book A novel evaluation
criteria to cloud based access control models’ (IEEE, 2015,
edn.), pp. 68-73
5 Beckerle, M., and Martucci, L.A.: ‘Formal
definitions for usable access control rule sets from goals to
metrics’, in Editor (Ed.)^(Eds.): ‘Book Formal definitions
for usable access control rule sets from goals to metrics’
(ACM, 2013, edn.), pp. 2
6 Bauer, L., Cranor, L.F., Reeder, R.W., Reiter,
M.K., and Vaniea, K.: ‘Real life challenges in access-
control management’, in Editor (Ed.)^(Eds.): ‘Book Real
life challenges in access-control management’ (ACM,
2009, edn.), pp. 899-908
7 Latham, D.C.: ‘Department of defense trusted
computer system evaluation criteria’, Department of
Defense, 1986
8 Smetters, D.K., and Good, N.: ‘How users use
access control’, in Editor (Ed.)^(Eds.): ‘Book How users
use access control’ (ACM, 2009, edn.), pp. 15