Adaptive Context Aware Access Control Model for Ubiquitous Learning Environment
In a ubiquitous environment the users access to any services at anytime, anywhere through any device is the new dictum. Thus, ubiquity and mobility of devices made the access control, adaptive in nature by using the contextual information. However, dynamically changing context does not leverage on access control for the resources requested. We propose an access control mechanism that adapted through means of gathering the dynamically changing contextual information that has an impact on access decisions. As a result, a finegrained access control decisions is assessed through well tuned analysis about a user behavior and need before granting or denying. Results and performance analysis is presented for the proposed contextaware access control mechanism. Index Terms Access Control, Authentication, ContextAware, Security, Ubiquitous Environment. NOMENCLATURE ASCIIAmerican Standard Code for Information Interchange, RBAC Role Based Access Control, CAACContext Aware Access Control, CS Checksum, IP Internet Protocol. 1.0 INTRODUCTION Context is defined as, the information that is utilized to characterize the situation of an entity. Intuitively, it is reasonable to accept location, identity, activity and time [1, 2] as essential attributes of the context. In a ubiquitous environment, the context awareness term was introduced by Schilit in 1994[3] The Context aware devices [4, 8] intellectually capture the circumstances under which they operate, based on rules, situations, requirements and react accordingly to their environment. Thus, ubiquitous computing personalizes services to the end users based on context. Manipulative access to resources is usually done by listing access control rules or policies. Adaptability in access control consistently requires evolving change and requirements in a ubiquitous environment. However, the security related challenges, like authentication, authorization, access control, integrity, confidentiality, and availability needs to meet in any context aware system. In our proposed system, we concentrate on authentication and authorization by considering the required data for access control. Authentication verifies the identity of an entity, i.e. what you know, what you are or what you have. 1,2 Dept. of Comp. Science and Eng. 1,2 Siddaganga Institute of Technology, Tumakuru, Karnataka, India. 1 jagadambasu@gmail.com, 2 bsbsit@gmail.com. Passwords, passphrases, secret codes, certificate based [5]and personal identification numbers (PINs) found as what you know; keys to lock and unlock for what you have and biometric authentication methods like iris, image, fingerprints, and keystroke [6] presents what you are. Once the identity of the user gets declared in the authentication stage, the users were assigned a set of authorizations considered to be the rights, privileges, or permissions associated to do with the resources. The system administrator assigns the authorization by considering the system security policies. The policies define the right varying from the boundaries of not allowing anything (permit nothing) to allowing everything (permit everything) or to allowing in between [7] In our proposed system, the user types are found accordingly to the change in context. The change in context and behavior is analyzed while fulfilling the need if the request comes from the genuine user. 1.1 Ubiquitous learning Learning about the right thing at the right place and time in the right way is needed in ubiquitous computing environment [9] Context aware Ubiquitous environments adapt the user's real situation to provide adequate information for learning. Ubiquitous learning [10] creates a situation or surroundings to acquire the context information all around the user, where he/she may not be conscious of the learning developments. Developments in ubiquitous learning environment adds the advantages of adaptive learning with the benefits of ubiquitous to provide users, freedom to access to their individual needs with allowable flexibility. 1.2 Proposed Adaptive Context aware Access Control Learning based on user requirement, becomes necessary for access control based on the role the user is playing in a ubiquitous learning environment. Where a user can play a single or multiple roles at a time, but computing system in this needs a generous level of understanding of the situation they are and the complex relations between the various essentials. Thus, the ability becomes perception and malleable to the situation accordingly termed as "adaptability" Adaptive context aware access control knowledge includes: monitoring users activity, understanding user's requirements and preferences, and using these newly gained information to facilitate access control. The proposed Context Aware Access Control (CAAC) adapts itself to the varying environment by developing a proactive centralized monitoring system that acts as a context server through acquiring and managing the context information for analyzing user requirements. The analyzed output will bring in the corresponding decisions. BIJIT BVICAM's International Journal of Information Technology Copy Right (c) BIJIT 2016; January June, 2016; Vol. 8 No. 1; ISSN 0973 5658 923 This paper is organized as follows: Section 2, discuss related works in the area of context aware models, section 3 describes the proposed CAAC system, section 4 discusses the performance analysis, section 5 presents the results and section 6 concludes with future work. 2.0 RELATED WORKS Access control models were categorized to [11] mandatory access control models, discretionary access control model, and role based access control model. A role based access control models allow users, computers, and applications to follow static policy for accessing computers, files, applications, servers, communication ports and devices. The Role based Access Control (RBAC) [12] started with multi user and multi application on line systems pioneered in the 1970s. The RBAC grants the access permissions based on the roles and various job functions the user is playing in an organization. All RBAC models restrict the access control through static policies. But, the model [13] allows for the definition of context aware security policies for requested tasks and makes it easy to define, and understand complex security systems. An effective access control model that is aware of context modifications and change authorizations when location, date, time of access, and resources settings changed in ContextAware Access Control Model (CAACM) [14] Cerberus [15] included context aware identification, authentication and access control and reasoning about context, but the process was complicated to implement. Generic context based software architecture (Gaia) [16] was aware of physical spaces based on geographic region with limited and well defined borders, containing physical objects, assorted networked devices, and users performing a varied of activities. This model uses the context of first order logic and Boolean algebra, which allowed them to describe straight forwarded rules. The Kerberos authentication [17] proposed the process to enable activation or deactivation of roles assigned to a user depending on his/her context. If we consider a user, in an un secure place like a canteen, the access to sensitive data is not allowed, but when the user is in a research lab, private chambers or hostel building rooms is permitted to access the confidential data. The system [17] is context aware in nature to block the accessing if the user is in unsecured context or allow access if the user is in a secure context. Context aware access control based on ontology [18] was aware of developing the policies based on the user, device, and place for software services that are static in nature. In [19] the context aware access control policy T consists of two parts: the context attributes set TS {teacher/student, teaching time/spare time, Pad/mobile phone/personal comp. and the operation attributes set TO {Read/Write/Read write} namely T {TS AND TO} The context attributes set TS consists of four subattributes, which denotes user uses the device at a particular time in a place, namely TS {Who AND When AND Where AND Which} For example, for the resource R, following policy is established to control access: Tro {Teacher OR Student} AND {School Teaching OR Spare Time} AND {At School OR Outside School} AND Only}{Personal Comp. OR Pad OR Mobile Phone} AND Read Trw {Teacher AND Spare Time AND At School AND Personal Comp. AND Read Write} The policy Tro represents the context condition under which the resource R is allowed to read only mode. The policy Trw defines the context condition under which the resource R is operated in the read/write mode. This is almost acceptable with the [14] Another system [21] adopts access control based on a need to know principle, where the requests for access are allowed when relevance to the requester's project is identified. For example, if we consider a data analyst's present the project development of a mechanical project, it would be illegitimate for the analyst to have access to documents on other aspects, e.g. feminist activities. Above examples contributed to move towards adapting to the situation and need. Adopting the user contexts [14, 19] to his need motivated to implement an adaptive access control according to the changing context. 3.0 PROPOSED SYSTEM This section describes the architecture and a working model of the proposed system. 3.1 Architecture Centralized approach or decentralized (distributed) method can follow while building context aware access control system. However, selection of access control method is based on ubiquitous environmental requirements and associated risks. We adopt a centralized approach for access control model for the users in small ubiquitous environments like a college campus, centralized offices, restaurants, and malls. The architecture of t