Search NASASearch

SEARCH · Search NASA

Results for “access control”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records

Access Control of Web and Java Based Applications

Cyber security has gained national and international attention as a result of near continuous headlines from financial institutions, retail stores, government offices and universities reporting compromised systems and stolen data. Concerns continue to rise as threats of service interruption, and spreading of viruses become ever more prevalent and serious. Controlling access to application layer resources is a critical component in a layered security solution that includes encryption, firewalls, virtual private networks, antivirus, and intrusion detection. In this paper we discuss the development of an application-level access control solution, based on an open-source access manager augmented with custom software components, to provide protection to both Web-based and Java-based client and server applications.

cybersecurity

Access Control of Web- and Java-Based Applications

Cybersecurity has become a great concern as threats of service interruption, unauthorized access, stealing and altering of information, and spreading of viruses have become more prevalent and serious. Application layer access control of applications is a critical component in the overall security solution that also includes encryption, firewalls, virtual private networks, antivirus, and intrusion detection. An access control solution, based on an open-source access manager augmented with custom software components, was developed to provide protection to both Web-based and Javabased client and server applications. The DISA Security Service (DISA-SS) provides common access control capabilities for AMMOS software applications through a set of application programming interfaces (APIs) and network- accessible security services for authentication, single sign-on, authorization checking, and authorization policy management. The OpenAM access management technology designed for Web applications can be extended to meet the needs of Java thick clients and stand alone servers that are commonly used in the JPL AMMOS environment. The DISA-SS reusable components have greatly reduced the effort for each AMMOS subsystem to develop its own access control strategy. The novelty of this work is that it leverages an open-source access management product that was designed for Webbased applications to provide access control for Java thick clients and Java standalone servers. Thick clients and standalone servers are still commonly used in businesses and government, especially for applications that require rich graphical user interfaces and high-performance visualization that cannot be met by thin clients running on Web browsers

Tso, Kam S.

Common Badging and Access Control System (CBACS)

This slide presentation presents NASA's Common Badging and Access Control System. NASA began a Smart Card implementation in January 2004. Following site surveys, it was determined that NASA's badging and access control systems required upgrades to common infrastructure in order to provide flexibly, usability, and return on investment prior to a smart card implantation. Common Badging and Access Control System (CBACS) provides the common infrastructure from which FIPS-201 compliant processes, systems, and credentials can be developed and used.

Dischinger, Portia

Programmable Direct-Memory-Access Controller

Proposed programmable direct-memory-access controller (DMAC) operates with computer systems of 32000 series, which have 32-bit data buses and use addresses of 24 (or potentially 32) bits. Controller functions with or without help of central processing unit (CPU) and starts itself. Includes such advanced features as ability to compare two blocks of memory for equality and to search block of memory for specific value. Made as single very-large-scale integrated-circuit chip.

Hendry, David F.

Access control and privacy in large distributed systems

Large scale distributed systems consists of workstations, mainframe computers, supercomputers and other types of servers, all connected by a computer network. These systems are being used in a variety of applications including the support of collaborative scientific research. In such an environment, issues of access control and privacy arise. Access control is required for several reasons, including the protection of sensitive resources and cost control. Privacy is also required for similar reasons, including the protection of a researcher's proprietary results. A possible architecture for integrating available computer and communications security technologies into a system that meet these requirements is described. This architecture is meant as a starting point for discussion, rather that the final answer.

Leiner, B. M.

Access control and privacy in large distributed systems

Large scale distributed systems consists of workstations, mainframe computers, supercomputers and other types of servers, all connected by a computer network. These systems are being used in a variety of applications including the support of collaborative scientific research. In such an environment, issues of access control and privacy arise. Access control is required for several reasons, including the protection of sensitive resources and cost control. Privacy is also required for similar reasons, including the protection of a researcher's proprietary results. A possible architecture for integrating available computer and communications security technologies into a system that meet these requirements is described. This architecture is meant as a starting point for discussion, rather that the final answer.

Leiner, B. M.

A Brief Survey of Media Access Control, Data Link Layer, and Protocol Technologies for Lunar Surface Communications

This paper surveys and describes some of the existing media access control and data link layer technologies for possible application in lunar surface communications and the advanced wideband Direct Sequence Code Division Multiple Access (DSCDMA) conceptual systems utilizing phased-array technology that will evolve in the next decade. Time Domain Multiple Access (TDMA) and Code Division Multiple Access (CDMA) are standard Media Access Control (MAC) techniques that can be incorporated into lunar surface communications architectures. Another novel hybrid technique that is recently being developed for use with smart antenna technology combines the advantages of CDMA with those of TDMA. The relatively new and sundry wireless LAN data link layer protocols that are continually under development offer distinct advantages for lunar surface applications over the legacy protocols which are not wireless. Also several communication transport and routing protocols can be chosen with characteristics commensurate with smart antenna systems to provide spacecraft communications for links exhibiting high capacity on the surface of the Moon. The proper choices depend on the specific communication requirements.

Wallett, Thomas M.

Testing Efficiency Improved by Addition of Remote Access Control Room

The NASA Lewis Research Center's Remote Access Control Room (RACR) uses off-the-shelf video conferencing software integrated with existing facility data systems to provide access to the test data by networking from virtually anywhere in the country. The system allows research engineers in remote locations to participate in tests and monitor data in real time just as if they were present in the control room.

Source record

Common Badging and Access Control System (CBACS)

The goals of the project are: Achieve high business value through a common badging and access control system that integrates with smart cards. Provide physical (versus logical) deployment of smart cards initially. Provides a common consistent and reliable environment into which to release the smart card. Gives opportunity to develop agency-wide consistent processes, practices and policies. Enables enterprise data capture and management. Promotes data validation prior to SC issuance.

Baldridge, Tim

Guaranteeing synchronous message deadlines with the timed token medium access control protocol

We study the problem of guaranteeing synchronous message deadlines in token ring networks where the timed token medium access control protocol is employed. Synchronous capacity, defined as the maximum time for which a node can transmit its synchronous messages every time it receives the token, is a key parameter in the control of synchronous message transmission. To ensure the transmission of synchronous messages before their deadlines, synchronous capacities must be properly allocated to individual nodes. We address the issue of appropriate allocation of the synchronous capacities. Several synchronous capacity allocation schemes are analyzed in terms of their ability to satisfy deadline constraints of synchronous messages. We show that an inappropriate allocation of the synchronous capacities could cause message deadlines to be missed even if the synchronous traffic is extremely low. We propose a scheme called the normalized proportional allocation scheme which can guarantee the synchronous message deadlines for synchronous traffic of up to 33 percent of available utilization. To date, no other synchronous capacity allocation scheme has been reported to achieve such substantial performance. Another major contribution of this paper is an extension to the previous work on the bounded token rotation time. We prove that the time elapsed between any consecutive visits to a particular node is bounded by upsilon TTRT, where TTRT is the target token rotation time set up at system initialization time. The previous result by Johnson and Sevcik is a special case where upsilon = 2. We use this result in the analysis of various synchronous allocation schemes. It can also be applied in other similar studies.

Agrawal, Gopal

Cardea: Dynamic Access Control in Distributed Systems

Modern authorization systems span domains of administration, rely on many different authentication sources, and manage complex attributes as part of the authorization process. This . paper presents Cardea, a distributed system that facilitates dynamic access control, as a valuable piece of an inter-operable authorization framework. First, the authorization model employed in Cardea and its functionality goals are examined. Next, critical features of the system architecture and its handling of the authorization process are then examined. Then the S A M L and XACML standards, as incorporated into the system, are analyzed. Finally, the future directions of this project are outlined and connection points with general components of an authorization system are highlighted.

Lepro, Rebekah

First Experiences Using XACML for Access Control in Distributed Systems

Authorization systems today are increasingly complex. They span domains of administration, rely on many different authentication sources, and manage permissions that can be as complex as the system itself. Worse still, while there are many standards that define authentication mechanisms, the standards that address authorization are less well defined and tend to work only within homogeneous systems. This paper presents XACML, a standard access control language, as one component of a distributed and inter-operable authorization framework. Several emerging systems which incorporate XACML are discussed. These discussions illustrate how authorization can be deployed in distributed, decentralized systems. Finally, some new and future topics are presented to show where this work is heading and how it will help connect the general components of an authorization system.

Lorch, Marcus

Autonomous Information Unit for Fine-Grain Data Access Control and Information Protection in a Net-Centric System

As communication and networking technologies advance, networks will become highly complex and heterogeneous, interconnecting different network domains. There is a need to provide user authentication and data protection in order to further facilitate critical mission operations, especially in the tactical and mission-critical net-centric networking environment. The Autonomous Information Unit (AIU) technology was designed to provide the fine-grain data access and user control in a net-centric system-testing environment to meet these objectives. The AIU is a fundamental capability designed to enable fine-grain data access and user control in the cross-domain networking environments, where an AIU is composed of the mission data, metadata, and policy. An AIU provides a mechanism to establish trust among deployed AIUs based on recombining shared secrets, authentication and verify users with a username, X.509 certificate, enclave information, and classification level. AIU achieves data protection through (1) splitting data into multiple information pieces using the Shamir's secret sharing algorithm, (2) encrypting each individual information piece using military-grade AES-256 encryption, and (3) randomizing the position of the encrypted data based on the unbiased and memory efficient in-place Fisher-Yates shuffle method. Therefore, it becomes virtually impossible for attackers to compromise data since attackers need to obtain all distributed information as well as the encryption key and the random seeds to properly arrange the data. In addition, since policy can be associated with data in the AIU, different user access and data control strategies can be included. The AIU technology can greatly enhance information assurance and security management in the bandwidth-limited and ad hoc net-centric environments. In addition, AIU technology can be applicable to general complex network domains and applications where distributed user authentication and data protection are necessary. AIU achieves fine-grain data access and user control, reducing the security risk significantly, simplifying the complexity of various security operations, and providing the high information assurance across different network domains.

Chow, Edward T.

ACCESS Pointing Control System

ACCESS (Actively-Corrected Coronograph for Exoplanet System Studies) was one of four medium-class exoplanet concepts selected for the NASA Astrophysics Strategic Mission Concept Study (ASMCS) program in 2008/2009. The ACCESS study evaluated four major coronograph concepts under a common space observatory. This paper describes the high precision pointing control system (PCS) baselined for this observatory.

space telescope

Two Mechanisms to Avoid Control Conflicts Resulting from Uncoordinated Intent

This software implements a real-time access control protocol that is intended to make all connected users aware of the presence of other connected users, and which of them is currently in control of the system. Here, "in control" means that a single user is authorized and enabled to issue instructions to the system. The software The software also implements a goal scheduling mechanism that can detect situations where plans for the operation of a target system proposed by different users overlap and interact in conflicting ways. In such situations, the system can either simply report the conflict (rejecting one goal or the entire plan), or reschedule the goals in a way that does not conflict. The access control mechanism (and associated control protocol) is unique. Other access control mechanisms are generally intended to authenticate users, or exclude unauthorized access. This software does neither, and would likely depend on having some other mechanism to support those requirements.

Mishkin, Andrew H.

Data Bus Adapts to Changing Traffic Level

Access becomes timed when collisions threaten. Two-mode scheme used to grant terminals access to data bus. Causes bus to alternate between random accessibility and controlled accessibility to optimize performance and adapt to changing data-traffic conditions. Bus is part of 100-Mb/s optical-fiber packet data system.

Lew, Eugene

Achievable Performance and Effective Interrogator Design for SAW RFID Sensor Tags

For many NASA missions, remote sensing is a critical application that supports activities such as environmental monitoring, planetary science, structural shape and health monitoring, non-destructive evaluation, etc. The utility of the remote sensing devices themselves is greatly increased if they are passive V that is, they do not require any on-board power supply such as batteries V and if they can be identified uniquely during the sensor interrogation process. Additional passive sensor characteristics that enable greater utilization in space applications are small size and weight, long read ranges with low interrogator power, ruggedness, and operability in extreme environments (vacuum, extreme high/low temperature, high radiation, etc.) In this paper, we consider one very promising passive sensor technology, called surface acoustic wave (SAW) radio-frequency identification (RFID), that satisfies all of these criteria. In general, RFID is a method of identifying items using radio waves to interrogate tags encoded with a unique identifier that are affixed to the items of interest. In the case of passive tags, only the interrogator, which transmits power to the tags in the form of radio-frequency electromagnetic radiation, requires access to a power supply. Passive RFID technologies are used today in many applications, including asset tracking and management, security and access control, and remote sensing. To date, most of the development and application in RFID technology has focused on either asset/inventory tracking and control or security and access control because these are the largest commercial application areas. Recently however, there has been growing interest in using passive RFID technology for remote sensing applications, and SAW devices are at the forefront of RFID sensing technology development. Although SAW RFID tags have great potential for use in numerous space-based remote sensing applications, the limited collision resolution capability of current generation tags limits the performance in a cluttered sensing environment. That is, as more SAW-based sensors are added to the environment, numerous tag responses are superimposed at the receiver and decoding all or even a subset of the telemetry becomes increasingly difficult. Background clutter generated by reflectors other than the sensors themselves is also a problem, as is multipath interference and signal distortion, but the limiting factor in many remote sensing applications can be expected to be tag mutual interference. This problem may be greatly mitigated by proper design of the SAW tag waveform, but that remains an open research problem, and in the meantime, several other related questions remain to be answered including: (1) What are the fundamental relationships between tag parameters such as bit-rate, time-bandwidth-product, SNR, and achievable collision resolution? (2) What are the differences in optimal or near-optimal interrogator designs between noise-limited environments and interference-limited environments? (3) What are the performance characteristics of different interrogator designs in term of parameters such as transmitter power level, range, and number of interfering tags? In this paper, we will present the results of a research effort aimed at providing at least partial answers to all of these questions.

Barton Richard J.