Towards a Fine-Grained Access Control for Cloud

Abstract

The centerpiece of an efficient Cloud security architecture is a well-defined access control policy. In literature we can find several access control models such as the Mandatory Access Control (MAC), Discretionary Access Control (DAC), Role-Based Access Control (RBAC) and the latest one Usage Control Authorization, oBligation and Condition (UCON ABC ).The UCON ABC is very suitable for the context of distributed systems like cloud computing but it doesn't give any implementation method. In this paper we define the profile centric model using graph formalism and its implementation using matrix. We define the profile as the combination of all possible authorization, obligation, condition, role, etc... and other access parameters like attributes that we can found in Cloud system.We discuss its application using three matrixes (profile definition, profile inheritance and user assignment). Profile centric modeling is an optimum paradigm to define access control policy in complex distributed and elastic system like cloud computing.The proposed solution is validated and implemented over Hadoop distributed file system in the context of Safe Box as a service.

Evaluation of Access Control Techniques in Cloud Computing

“…Because of this change in access control become easier. [8] But this flexibility increases the occurrences of policy conflicts and makes the maintenance and administration of the policies difficult. After some time period because of this reason developers decided that ABA is not efficient.…”

Survey on Access Control Mechanisms in Cloud Computing

“…The decisions in MAC are not made by an owner but a central system [11,12]. In this way, more powerful processes are performed in security models [57,64,65].…”

“…Langaliya and Aluvalu [108] discussed traditional access control models and their advantages-disadvantages. Msahli, Chen and Serhrouchni [12] define the profile as the combination of all possible authorization, role, and other access parameters in Cloud system. Yang, Liu, Jia, and Shen [109] focus on how to securely share video contents to a certain group of people in cloud-based multimedia systems, and propose a cryptographic approach, a provably secure time domain attribute-based access control (TAAC) scheme, to secure the cloud-based video content sharing for that they analyzed ABAC and ABE.…”

“…The unit that assigns the authorities is the person who is the owner of the objects called Owner; thus, he also determines the security principles. The owner gives the necessary authorization to individuals in the system, introduces limitations, and limits their access to the system according to his own will [12,51]. Although the most important feature of this system is the fact that it has a high level of security, it cannot distinguish between the subjects and object domains and has security leaks [57][58][59][60].…”

“…According to RBAC, the users are assigned to different roles, and the necessary permissions, limitations and authorizations are performed because of these roles [11][12][13][14]. The general structure of the RBAC is the following: with role searches permission assignment (PA), the privileges in the system of every role are determined and the administration permissions are assigned to these roles based on the user assignment (UA), permissions and limitations of the user from the role the user [15][16][17][18][19].…”