A Distributed Access Control System for Cloud Federations

Abstract

Abstract-Cloud federations are a new collaboration paradigm where organizations share data across their private cloud infrastructures. However, the adoption of cloud federations is hindered by federated organizations' concerns on potential risks of data leakage and data misuse. For cloud federations to be viable, federated organizations' privacy concerns should be alleviated by providing mechanisms that allow organizations to control which users from other federated organizations can access which data. We propose a novel identity and access management system for cloud federations. The system allows federated organizations to enforce attribute-based access control policies on their data in a privacy-preserving fashion. Users are granted access to federated data when their identity attributes match the policies, but without revealing their attributes to the federated organization owning data. The system also guarantees the integrity of the policy evaluation process by using blockchain technology and Intel SGX trusted hardware. It uses blockchain to ensure that users identity attributes and access control policies cannot be modified by a malicious user, while Intel SGX protects the integrity and confidentiality of the policy enforcement process. We present the access control protocol, the system architecture and discuss future extensions.

A Mechanism to Resolve the Unauthorized Access Vulnerability Caused by Permission Delegation in Blockchain-Based Access Control

“…For the single point of failure, Jemel et al used the blockchain for user legitimacy checks in CP-ABE access control [10]; Outchakoucht et al used the blockchain for operations such as granting, using, and circulating access permissions in SmartOrBAC [11]. To address security and trust issues among multiple organizations, Cruz et al used blockchain as a trusted third party to solve the cross-organizational access control problem in Role-Based Access Control(RBAC) [12]; Alansari et al used blockchain to prevent user identity attributes and access control policies in Attributes Based Access Control(ABAC) from being modified by malicious users [13]; Maesa et al publicly store policies and permission exchanges on the blockchain to prevent one party from fraudulently rejecting the rights granted by the policies [14].…”

Blockchain based access control systems: State of the art and challenges

“…In cloud federation also sharing data between multiple organization is a concern from users privacy perspective [2]. Keeping the arXiv:1908.08503v1 [cs.CR] 22 Aug 2019 personal data related to the users' identities private, while giving them access to the shared data, is the main concern.…”

“…[60] Mobile applications. Alansari et al [1,2] Cloud federation Ouaddah et al [39], Pinno et al [41], Dukkipati [21], Ma et al [34] Personal data generated by IoT devices Dagher et al [14], Azaria et al [5], Xia et al [52] Healthcare patients data Le and Mutka [30] Pervasive environment…”

“…The Bystander is the one who is willing to pay a small fee in order to get access to the shared knowledge. Similarly, Alansari et al [2] present an identity and access control management framework for cloud federation while keeps the attributes related to the users' identity private by using the OCBE protocol [31]. Although the federation party, which owns the data, do not have access to the users' attributes, the user can access the requested data if the user has access to the data based on the system policy.…”

“…[23,36] systems have focused on auditability characteristic and trusted logging provided by blockchain to design a reliable access control system. From the transactional perspective, [28,35,59] use only transactions to store access control attributes on blockchain, while [2,13,17,22,23,26,36,39,42,51,52] applied smart contracts to exploit its advantages such as flexibility and automatically enforcing access control policies. Also, the challenges and future directions have been discussed in this paper.…”