Authorization and Access Control

Foundations, Frameworks, and Applications

Parikshit N. Mahalle,Shashikant S. Bhong,Gitanjali R. Shinde

• Editorial: CRC Press
• Año: 2022
• ISBN:
  9781000592511
• Edición: 1
• Categoría: Computer Science
• Categoría: Data Mining

This book focuses on various authorization and access control techniques, threats and attack modeling, including an overview of the Open Authorization 2.0 (OAuth 2.0) framework along with user-managed access (UMA) and security analysis. Important key concepts are discussed regarding login credentials with restricted access to third parties with a primary account as a resource server. A detailed protocol overview and authorization process, along with security analysis of OAuth 2.0, are also discussed in the book. Case studies of websites with vulnerability issues are included.

FEATURES

• 
  
  

• Provides an overview of the security challenges of IoT and mitigation techniques with a focus on authorization and access control mechanisms

• 
  
  

• Discusses a behavioral analysis of threats and attacks using UML base modeling

• 
  
  

• Covers the use of the OAuth 2.0 Protocol and UMA for connecting web applications

• 
  
  

• Includes role-based access control (RBAC), discretionary access control (DAC), mandatory access control (MAC) and permission-based access control (PBAC)

• 
  
  

• Explores how to provide access to third-party web applications through a resource server by use of a secured and reliable OAuth 2.0 framework

This book is for researchers and professionals who are engaged in IT security, auditing and computer engineering.

Authors

Parikshit N. Mahalle, PhD, earned a BE degree in computer science and engineering at Sant Gadge Baba Amravati University, Amravati, India, and an ME degree in computer engineering at Savitribai Phule Pune University, Pune, India. He earned a PhD in computer science and engineering with a specialization in wireless communication at Aalborg University, Aalborg, Denmark. He was a post-doc researcher at CMI, Aalborg University, Copenhagen, Denmark. He was a professor and the head of the Department of Computer Engineering at STES’s Smt. Kashibai Navale College of Engineering, Pune, India. Currently, he is a professor and head of the Department of Artificial intelligence and Data Science at Vishwakarma Institute of Information Technology, Pune, India. He has more than 20 years of teaching and research experience. He is a senior member of IEEE, ACM member, life member of CSI, and a life member of ISTE. Also, he is a member of IEEE Transactions on Information Forensics and Security and IEEE Internet of Things Journal. He is a reviewer for IGI Global – International Journal of Rough Sets and Data Analysis (IJRSDA), and Associate Editor for IGI Global – International Journal of Synthetic Emotions (IJSE) and Interscience International Journal of Grid and Utility Computing (IJGUC). He is a member of the editorial review board for IGI Global – International Journal of Ambient Computing and Intelligence (IJACI). He has published more than 150 research publications, with 1711 citations and an H index of 18. He has published five edited books by Springer and CRC Press. He has seven patents to his credit. He has worked as chairman of various boards of studies.

Shashikant S. Bhong has more than 7 years of experience and is presently an SPPU-approved assistant professor in the Department of Computer Engineering, Smt. Kashibai Navale College of Engineering, Pune. He earned an ME in computer engineering at Savitribai Phule Pune University, Pune, India, and a BE in computer engineering at Savitribai Phule Pune University, Pune, India. He has published four papers at national and international conferences and journals. He has worked as an assistant professor in STES, Rwanda Kigali, Rwanda (East Africa) in 2016 and as an instructor/trainer in Combat Training Centre (CTC) Gabiro, for the Rwandan army.

Gitanjali R. Shinde, PhD, has over 13 years of experience and is presently an assistant professor in the Department of Computer Engineering at Vishwakarma Institute of Information Technology, Pune, India. She earned a PhD in wireless communication from CMI, Aalborg University, Copenhagen, Denmark, on the research problem statement “Cluster Framework for Internet of People, Things and Services”. She earned an ME in computer engineering at the University of Pune, Pune, India, in 2012 and a BE in computer engineering at the University of Pune, Pune, India, in 2006. She has received research funding for the project Lightweight Group Authentication for IoT by SPPU, Pune. She has presented a research article at the World Wireless Research Forum (WWRF) meeting, Beijing, China. She has published 50+ papers at national and international conferences and journals. She is the author of five books with Springer and CRC Press/Taylor & Francis Group. She is also the editor of books with De Gruyter and Springer. She is a reviewer of prominent IGI journal publications and IEEE Transactions.

1 Introduction

DOI: 10.1201/9781003268482-1

1.1 Internet to Internet of Things

Science fiction (sci-fi) movies are rapidly turning into a pragmatist or reality. These sci-fi movies are becoming reality due to the Internet. The Internet, also known as “network of network”, is one of the most important and transformative powers of technology, which forms the backbone of virtual communication today. It is like a digital gum that is attached to humanity in one way or another, from video calling someone to searching information, from finding location to watching movies at Over The Top (OTT) platform, and there is no area left untouched. Internet is a more straightforward term, a technology that sets up a link between your PC/computer and someone else’s PC/computer worldwide through some server, router and switches. The significant type of current Internet communication is among people/human (i.e. human to human). We can call it the Internet of People. The Internet of People changes the world. Well, there’s a new Internet emerging and it’s poised to change the world you see; this new Internet is not just about connecting people but about connecting things and so it’s named the Internet of Things (IoT).

It is a big challenge to connect things to the Internet. Here’s why: because things can start to communicate/share their knowledge/experience with other things. Here, the question that bugs our mind is: how is it possible that two different things can communicate or share their experience with each other? This is how it goes: you take things and add some features to the things like ability to sense, communicate, control and touch. By adding this feature, there you create opportunities for the things to communicate, interact and collaborate/team up with other things. This is the same as how humans communicate, interact and collaborate with each other in their own environment with the help of five sense organs by which humans can sense, see/watch, smell, hear and taste. If humans don’t have these five sensory organs, then they could also be normal objects or things. Due to this ability to connect or communicate, the IoT and Internet of People intersect. For example, the smartphone used by us is also a thing that has the capability to sense more than we can imagine. It can sense your location, your movement and position of your phone (auto rotation and switch off screen while calling and phone is near to your ear), adjust the brightness of the display screen based on the surrounding light, etc. One can even say that it has the eyes to see in the form of a camera, has the ability to speak using speakers and capability to listen and record via microphone and, most importantly, has the ability to communicate with different devices or phones wirelessly. This is all due to adding some features and sensors/devices to phones like motion sensor, GPS, speaker, mic, ambient light sensor, environmental sensor, proximity sensor, accelerometer sensor, barometer sensor, gyroscope sensor, etc. How about this example, a bracelet which can track steps, all the activity you do, how well you have taken your nap, track heartbeat and pulse rate, and also can communicate. We named this type of thing as a smart band. By just adding some features to this bracelet, we can make the bracelet (thing) to communicate. How about the dog collar? Before the emergence of Internet and IoT, it was just a dog collar, but after that, the collar has become smart: it can track the dog’s activity, location, etc. There are hundreds of thousands of such things which become smarter after IoT, just by adding some IoT sensors and devices. The good thing is that we have systems and some tools by which we can add this feature to the already existing things by which they can communicate with each other, and this is all due to the IoT.

The future Internet will be having the ability to connect and communicate with all the physical and virtual things which are surrounding us in the existing Internet. The IoT is a dream that involves connection among various physical and virtual things to see how life would change when things, homes, villages and cities become intelligent like humans. In this context, IoT is the fundamental piece of “Future Internet” that directs people, private and public associations, and educational and research institutes to become smart. By using smart things, they can participate or improve their business, data and social cycles by interfacing with themselves and with the surrounding. Thus, smart things are made to sense the data and react accordingly or autonomously to the occurred events without or with any human interaction, and they should self-configure themselves.

IoT is the next upcoming form of Internet communication where devices will communicate with other devices, which is called machine-to-machine (M2M) communication. IoT can be said to establish the ability of communication among everybody and everything. IoT empowers us to implant a type of intelligence in the objects/things that are or can be connected with the Internet to share data, make communication, give response based on inputs, take decisions independently, and provide all the useful services [1].

1.2 ICT Standardization

Information and Communication Technology (ICT) is a more extensive term of Information Technology (IT) which uses Communication Technology. Internet, mobile/cell phones, wireless networks, computers, middleware, software, social networks, and other media applications and services associated with this technology allow to store, retrieve, transfer and manipulate information or data in the digital form. ICT is aimed to work on the seriousness of industry and to satisfy the needs of the general public and economy. India has played an important role for the globalization, development and research of ICT. The reason behind this is, India is developing day by day and there is a massive growth in the field of ICT industrial development and research. Besides India, large-scale research is going on in countries of North America, Asia and Europe in the field of ICT along with research in the advanced wireless IT industry and all the markets associated with it. Parallel to this, the national and international organizations such as the European Telecommunications Standardization Institute (ETSI) [2], the International Telecommunication Union (ITU-R) [3], the Association of Radio Industries and Businesses (ARIB) [4] and the Telecommunications Industry Association (TIA) [5]) are effectively organizing the rapidly growing ICT industry by forming and following specific guidelines and standards.

The Global ICT Standardization Forum for India (GISFI) [6] is an Indian standardization forum which is effectively working in the area of ICT sector and its associated application fields such as telemedicine, energy, biotechnology and wireless robots. With ICT and its products, applications and services, services and applications are growing quickly in the present worldwide economy turning into a vital piece of our regular daily existence, and it is of basic significance to establish an environment that addresses both the overall industrial business and society’s expectation. To increase the intensity of the industrial business while guaranteeing all the citizens or human society that can benefit from the opportunity created by the advancement of research in the field of ICT. Like other standardization forums, GISFI focuses on balancing between India and worldwide industrial requirements with India and other countries’ society expectations.

ICT is a significant driver of seriousness and representation, and right now, it is one of the key modern industrial sectors. Standardization of ICT is very important for today’s world to provide a strong framework for growing the economy and development in the society. Standardization is the voluntary help shared among industries, public organizations, private organizations, consumers and all the other interested parties for development of technical specifications to compete in the global market. In today’s competitive world, industries use standardization for growing, which ultimately leads to market growth.

The significance of ICT standardization for advanced digital inclusion has been featured in various events and discussion forums. GISFI [6] characterized standardization as one of the fundamental structure blocks of the Information Society. In fact, standardization is not only essential for ICT field, but it is also necessary to maintain a stable economy [7]. The standards and rules to manufacture or develop a new product/technology and services are accounted for in the economy of distribution and production, by keeping the cost of product low and facilitating access to worldwide markets, which can improve the economy of an organization or an industry. Standardization of ICT provides a platform for organizations of ICT to distribute their standard products and services, and compete in global markets. Due to standardization of ICT, competition in the world market increases, which leads to a lot of research and development in ICT.

There is one more fact that there are many developing countries which are l...

Índice

• Cover
• Half Title Page
• Title Page
• Copyright Page
• Table of Contents
• Preface
• Authors
• Index