Abstract An information system is composed of two types of entities, subjects like users and objects like databases from the security viewpoint. A subject issues an operation to an object to manipulate data in the object. An object is protected from malicious accesses of unauthorized subjects in the AC (Access Control) models. Nevertheless, if data in an object $$o_j$$ o j is stored in another object $$o_k$$ o k , a subject $$s_i$$ s i which is allowed to read $$o_k$$ o k can read the data of $$o_j$$ o j in $$o_k$$ o k even if $$s_i$$ s i is not granted an access right of $$o_j$$ o j , i.e. illegal information flow from $$o_j$$ o j to $$s_i$$ s i occurs. In our previous studies, the O-IFC (Object-based Information Flow Control) is proposed where operations occurring illegal information flow are prohibited. Here, a unit of data exchanged among entities is an object. Even if some operations do not occur illegal information flow, the operations are prohibited in the O-IFC. In order to reduce the operations unnecessarily prohibited, a novel C-IFC (Content-based IFC) is proposed where a finer unit of data than an object is considered to be exchanged among entities. In this article, an object is composed of natural language sentences. It is critical to decide whether or not a sentence $$st_j$$ s t j in $$o_j$$ o j is the same as another sentence $$st_k$$ s t k in $$o_k$$ o k . In this article, the sentence classifier is used which is generated by using the large language model based on the neural networks. If $$st_j$$ s t j and

Abstract In the Internet of Things, the CBAC (capability‐based access control) model is proposed to make devices securely accessed. Here, an owner of a device issues a capability token, that is, a set of access rights, to a subject. The subject is allowed to manipulate ROs (resource objects) in the device according to access rights in the capability token. In the CBAC model, there is a problem a subject sbi can obtain data of an RO by accessing the data in an RO after the data are brought to the RO even if the subject sbi is not allowed to obtain the data from the RO . Here, the data in the RO illegally flow to the subject sbi. In our previous studies, the OI (operation interruption) protocol where illegal operations are interrupted is proposed and evaluated in the simulation. In this article, we implement the OI protocol and evaluate the authorization process of the OI protocol in terms of the execution time. In the evaluation, we make clear the features of the execution time of authorization processes for GET, PUT, POST, and DELETE operations in the OI protocol.

Summary The Internet of Things is composed of sensor and actuator devices. Devices have to be securely accessed by subjects. In this article, we take the capability‐based access control (CBAC) model where a subject is issued a capability token to manipulate a device by a device owner. In the CBAC model, information which a subject is not allowed to get may illegally flow to the subject. Hence, the operation interruption (OI) protocol to prevent illegal information flow is proposed in our previous studies. However, although a subject is not allowed to get data at time , the subject can get the data later than the time . Here, the data come to the subject later than expected by the subject to get the data, that is, the information flows late to the subject. In this article, we newly propose a time‐based OI (TBOI) protocol to prevent not only illegal information flow but also late information flow. Here, operations implying illegal or late information flow are interrupted, that is, not performed at devices. In the evaluation, we show not only illegal information flow but also late information flow are prevented in the TBOI protocol differently from the OI protocol.

Summary In the fog computing (FC) models, a fog node supports not only routing functions but also application processes. By the application processes, output data are calculated on input data from sensors and other nodes and sent to target fog nodes which can calculate on the output data. In this article, we consider the mobile topic‐based publish/subscribe fog computing (MPSFC) model where mobile fog nodes communicate with one another by publishing and subscribing messages in wireless networks. Subscription topics of a fog node denote input data on which the node can calculate output data. Publication topics of a message show data carried by the message. In the topic‐based data transmission (TBDT) protocol proposed in our previous studies, while a fewer number of messages are transmitted, the delivery ratio of messages is smaller than the epidemic routing protocol. In this article, we newly propose a pair of time‐to‐live‐based data transmission (TTLBDT) and probability and topic‐based data transmission (PTBDT) protocols in order to increase the delivery ratio. If another node is found in the communication range, a fog node forwards messages to the node. Even if the node is not a target node, the node receives the message with some probability in the PTBDT protocol. In the evaluation, we show the delivery ratios in the TTLBDT and PTBDT protocols are larger than the TBDT protocol. In addition, we show the number of messages exchanged in the PTBDT protocol is smaller than the epidemic routing protocol.

Summary In this paper, we propose a P2PPSO (P2P [peer‐to‐peer] type of topic‐based Publish/Subscribe with Object concept) model, where each peer process (peer) exchanges objects by publishing and receiving event messages with no centralized coordinator. In addition, objects are characterized by topics. Suppose an event message ej published by a peer pj carries an object on some topics into a target peer pi. Here, information in the peer pj illegally flows to the peer pi if the target peer pi is not allowed to subscribe the topics. An illegal object is an object whose topics a target peer is not allowed to subscribe. Even if an event message is received by a target peer by checking topics, objects carried by the event message may be illegal at the target peer. In this paper, we propose a TOBS (topics‐of‐objects–based synchronization) protocol to prevent target peers from receiving illegal objects in the P2PPSO model. Here, even if an event message is received by a target peer, illegal objects in the event message are not delivered to the target peer. In the evaluation, we show how many event messages carry illegal objects in the TOBS protocol.

In the peer-to-peer (P2P) type of topic-based publish/subscribe (P2PPS) model, each peer process (peer) can publish and subscribe event messages which are characterized by topics with no centralized coordinator. A peer pj publishes an event message ej after receiving an event message ei, i.e. ei causally precedes ej. Here, the event message ej may carry information of the event message ei. If a peer pk receiving ej is not allowed to subscribe the topics of ei, the peer pk illegally obtains the information by receiving ej. In our previous studies, the SBS, TBS, and FS-H protocols are proposed to prevent illegal information flow. In addition, if a source peer pi publishes an event message e without giving related topics or with giving unrelated topics, a destination peer pj may misunderstand the meaning of the event message e. Here, malicious information flow occurs. In this paper, we newly propose a TBSM (topic-based synchronization to prevent malicious information flow) protocol. Here, event messages which may cause malicious information flow are banned. In the evaluation, we show the number of event messages banned in the TBSM protocol is larger than the TBS protocol since the number of event messages which are just malicious is larger than just illegal.

In the peer-to-peer type of topic-based publish/subscribe (P2PPS) model, each peer (process) can publish and receive event messages with no centralized coordinator. A peer is allowed to publish and subscribe an event message with topics which are in the publication and subscription topics of the peer. Some information may flow from a peer to another peer if the peer publishes an event message to the other peer. We have to prevent illegal information flow to occur by publications and notifications of event messages. In our previous studies, the subscription-based synchronization (SBS), subscription initialization SBS (SI-SBS), topic-based synchronization (TBS), and SI-TBS protocols are proposed. In the SBS and SI-SBS protocols, it is checked whether or not illegal information flow to occur in terms of subscription and publication rights granted to each peer. However, even some legal notifications are banned while no illegal event message is notified. In the TBS and SI-TBS protocols, only topics which each peer manipulates are considered. In this paper, we evaluate the protocols in terms of the number of notifications banned.

Wireless ad-hoc networks which do not use network infrastructure are getting more important in various types of applications like vehicle-to-vehicle (V2V) networks. Here, neighbor nodes with which each node can directly communicate may be changed, e.g. due to movement of nodes and faults of networks and nodes. Messages are forwarded to destination nodes by wireless node-to-node communication in ad-hoc routing protocols. In this paper, we newly propose a reliable one-to-one communication protocol named TBAH (Trustworthiness-Based Ad-Hoc communication) protocol where a route to the destination node is dynamically found by selecting trustworthiness nodes. In this paper, the trustworthiness of a node is defined in terms of electric energy consumption of the node. We show the total electric energy consumption can be reduced in the TBAH protocol compared with the AODV protocol in the evaluation.

We have to reduce the electric energy consumed by servers in a cluster. In our previous studies, types of algorithms to select an energy-efficient server for a request process are proposed. Furthermore, schemes for energy-efficiently migrating a process and replicas of a process are discussed where a process and a replica migrate on a host server to a more energy-efficient guest server in our previous studies. However, it is not easy to realize the migration of processes on types of servers. Virtual machine (VM) technologies are now widely used to support applications with virtual resource service in could computing systems. Here, a virtual machine with application processes can migrate from a host server to another guest server. In this paper, we newly propose an energy-aware migration scheme of virtual machines (EAMV). Here, processes on a virtual machine can migrate to a server which consumes smaller electric energy and can be energy-efficiently performed in a cluster. We implement the EAMV scheme and evaluate the migration scheme in terms of energy consumption of servers and execution time of each process.

Data in an object may flow into another object if transactions read and write data in the objects. A transaction illegally reads data in an object if the object includes data in other objects which are not allowed to be read. In our previous studies, the flexible read-write-abortion with role sensitivity (FRWA-R), object sensitivity (FRWA-O), and role safety (FRWA-RS) protocols are proposed to prevent illegal information flow. Here, a transaction aborts with some probability once illegally reading data in an object. The abortionprobability of a transaction depends on the sensitivities of roles which the transaction holds and objects in which the transaction illegally reads data. The safety of a role and object shows how many transactions which hold the role and illegally read data in the object commit or abort after illegally reading data in the object, respectively. Here, safety of a role which increases and decreases by constant values as a transaction holding the role aborts and commits, respectively. Based on the safety concept, we newly propose an influential abortion probability of a transaction where the abortion probability depends on not only roles held by the transaction but also the previous abortion probability. In this paper, we newly propose an FRWA with the influential abortion probability (FRWA-IAP) protocol. In the evaluation, we show a fewer number of transactions abort in the FRWA-IAP protocol than the RWA and FRWA-RS protocols while transactions are more efficiently performed than the WA protocol.

A publish/subscribe (PS) model is an event-driven model of a distributed system. In this paper, we consider a peer-to-peer (P2P) type of PS model where each peer (process) can publish and subscribe events. Here, a peer publishes an event message and then the event message is notified to a target peer which is interested in the event. Publications and subscriptions are specified in terms of topics as discussed in topic-based PS systems. In this paper, we newly discuss a topic-based access control (TBAC) model to prevent illegal information flow among peers in PS systems. Here, an access right is a pair "t, op" of a topic t and an operation op which is publish or subscribe. A peer is allowed to publish an event message with topics and subscribe topics only if the topics are granted to the peer. An event message e is notified to a peer pi if the publication of e and subscription of pi include some common topic. If a peer pi publishes an event message e2 after receiving an event message e1, the event message e2 may bring the event of e1, which the peer pi is not allowed to publish. Here, information in the peer pi illegally flow to another peer. We define the legal flow relation among the peers. Then, we newly propose a subscription-based synchronization (SBS) protocol to prevent illegal information flow. Here, a notification is banned if the notification may cause illegal information flow. We evaluate the SBS protocol in terms of number of notifications banned.

A distributed system is considered in an event-driven model composed of processes which are sequences of events. In this paper, we discuss a peer-to-peer (P2P) model of a topic-based publish/subscribe system (P2PPS model) where each peer process (peer) can both subscribe interesting topics and publish event messages. Since each peer can both publish and receive event messages, a peer may publish an event message e1 after receiving an event message e2. In the P2PPS system, event messages have to be notified to every common target peer in the causal order. In the TBC (topicbased causally delivery) protocol, event messages are causally delivered by taking advantage of physical time in addition to linear time and topic vector. Physical time is used to reduce pairs of event messages unnecessarily ordered. In this paper, we discuss the relation among the clock offset and delay time in the evaluation.

Information systems have to be secure in presence of illegal access. A transaction illegally reads an object if the transaction reads the object which includes data in other objects which is not allowed to be read. A transaction illegally writes an object after illegally reading some object. In addition, we consider suspicious object whose data is not allowed to flow to another object. A transaction suspiciously reads a suspicious object. A transaction impossibly writes an object after reading a suspicious object. Write-abortion (WA) and read-write abortion (RWA) protocols to prevent illegal information flow are already discussed. In the WA protocol, a transaction is aborted once issuing an illegal or impossible write. Reads are meaninglessly performed since the reads are undone due to the abortion of the transaction. In the RWA protocol, a transaction is aborted once issuing an illegal read or impossible write. Here, read operations to be performed after an illegal read are lost since a transaction is aborted just on issuing an illegal read. In this paper, we newly propose a flexible read-write abortion (FRWA) protocol to reduce the number of meaningless and lost reads. Here, a transaction is aborted with some probability if the transaction illegally reads an object. We evaluate the FRWA protocols compared with the WA and RWA protocols. We show the execution time of each transaction in the FRWA protocols is shorter than the WA and more number of reads can be performed in the RWA protocols.

Application processes have to be efficiently performed in presence of server faults in a cluster. Multiple replicas of a process are performed on multiple servers. However, the more number of replicas of a process are performed, the more reliable and available the process can be performed but the more amount of electric energy is consumed. In this paper, we take a process migration (MG) approach to energy efficiently and reliably performing multiple replicas of an application process on servers. A replica of a process performed on a current server st migrates to another server su if the server su is expected to consume a smaller amount of electric energy to perform the replica than the current server st while the deadline constraint of the process is satisfied. We consider synchronous and asynchronous ways for process replicas to migrate to servers. In the synchronous migration, every replica migrates to another server on a same computation state. In the asynchronous migration, each replica makes a decision on when the replica migrates to which server.

In information systems, objects have to be not only legally accessed in presence of illegal accesses but also data in a suspicious object is not allowed to flow to another object. A transaction illegally and suspiciously reads an object if the transaction reads the object which includes data in other objects which are not allowed to be read and the object which is suspicious, respectively. A transaction illegally and impossibly writes an object after illegally and suspiciously reading an object, respectively. The write-abortion (WA), read-write-abortion (RWA), and flexible RWA (FRWA) protocols to prevent illegal information flow are proposed in our previous papers. In the WA and RWA protocols, a transaction is aborted once issuing an illegal or impossible write and issuing an illegal read or impossible write, respectively. Reads are meaninglessly performed since the reads are later undone due to the abortion of the transaction in the WA protocol. Reads which can be performed after an illegal read are not performed, i.e. Lost since a transaction is aborted just once issuing an illegal read in the RWA protocol. In the FRWA protocol, a transaction is aborted with some probability once illegally reading an object in order to reduce the number of meaningless and lost reads. We newly introduce the sensitivity concept of an object in order to decide on the abortion probability. The more number of transactions are aborted after illegally reading an object, the more highly sensitive the object is. A transaction which illegally reads a more sensitive object is aborted with higher probability. In the evaluation, we show the execution time of each transaction in the FRWA protocol is shorter than WA and more number of reads can be performed than RWA.

In information systems, data in an object may illegally flow into another object if a subject manipulates the objects. In this paper, we discuss information flow control models to prevent illegal information to occur in the role-based access control (RBAC) model. First, we define a legal information flow relation ri-> rj among roles ri and rj. It means, if a subject granted the role ri manipulates objects before another subject granted the role rj, no illegal information flow occur. We discuss safe systems where no illegal information flow occur even if operations from different subjects are performed in any order. Then, we discuss a role-based synchronization (RBS) protocol and an object-based synchronization (OBS) protocol to prevent illegal information flow in unsafe systems. Here, a transaction is aborted if the transaction reads an object and illegal information flow might occur. In the RBS protocol, the illegal information flow condition is specified in terms of roles while objects in the OBS protocol. We evaluate the RBS and OBS protocols in terms of number of transactions aborted.

In information systems, data in an object may illegally flow into another object if transactions manipulate the objects. In our previous studies, the role-based synchronization (RBS) and object-based synchronization (OBS) protocols are discussed to present illegal information flow in the role-based access control (RBAC) model. Illegal read operations mean read operations which might imply illegal information flow. Transactions which issue illegal read operations are aborted. In this paper, we consider a unique object whose data is not allowed to flow to another object. An illegal write is defined to be a write operation which is issued after reading a unique object or illegally reading an object in a transaction. Each transaction reads any object but is aborted if the transaction illegally writes an object. Synchronization protocol WA-RBS and WA-OBS are discussed based on abortion of transaction issuing illegal write operations.