Secure administration of cryptographic role-based access control for large-scale cloud storage systems

Cloud data storage is revolutionary because it eliminates the need for additional hardware, which is often costly, inconvenient, and requires additional space. Cloud data storage allows data owners to store large amounts of data in a flexible way and at low cost. The number of online cloud storage services and their consumers has therefore increased dramatically. However, ensuring the privacy and security of data on a digital platform is often a challenge. A cryptographic task-role-based access control (T-RBAC) approach can be used to protect data privacy. This approach ensures the accessibility of data for authorized consumers and keeps it safe from unauthorized consumers. However, this type of cryptographic approach does not address the issue of trust. In this paper, we propose a comprehensive trust model integrated with a cryptographic T-RBAC to enhance the privacy and security of data stored in cloud storage systems, and suggests that trust models involve inheritance and hierarchy in the roles and tasks of trustworthiness evaluation, where this study aims to identify the most feasible solution for the trust issue in T-RBAC approaches. Risk evaluations regarding other possible flaws of the design are also performed. The proposed design can decrease risk by providing high security for cloud storage systems and improve the quality of decisions of cloud operators and data owners.

Download Full-text

An Audit-Integrated ARBAC Model

Applied Mechanics and Materials ◽

10.4028/www.scientific.net/amm.263-266.1600 ◽

2012 ◽

Vol 263-266 ◽

pp. 1600-1604

Author(s):

Qiang Liu ◽

Jian Hua Zhang

Keyword(s):

Access Control ◽

Decision Process ◽

Large Scale ◽

Control Model ◽

Main Stream ◽

Role Based Access Control ◽

Access Control Model ◽

Distributed Application ◽

Role Based ◽

Set Up

Role-Based Access Control (RBAC) model is the main-stream access control model. When addressing large-scale and distributed application, the highest Security Administrator(SA) of RBAC model always try to transfer his management authority to his inferior SAs to decrease his workload. However, How to ensure that these inferior SAs perform their management authorities legally is a big problem. Although there are a technology framework of administrative RBAC model, named ARBAC97, the supervise mechanism and audit mechanism on the utilization of transferred authorities is incomplete in RBAC model. In this research, an audit-integrated ARBAC (au-ARBAC) model is presented. In the au-ARBAC model, a right and liability mechanism has been set up, an audit role is defined and auditing permission is assigned to this role. At the same time, we put forwards two types basic audit business: routine audit and accident audit. As to accident audit, a decision process for division of responsibility is designed to clarify the responsibility of wrongdoer SAs. The Au-ARBAC model can help to improve the Consciousness of authorization responsibility and to perform their management authorities responsibly and legally.

Download Full-text

Access Control Role Evolution Mechanism for Open Computing Environment

Electronics ◽

10.3390/electronics9030517 ◽

2020 ◽

Vol 9 (3) ◽

pp. 517

Author(s):

Aodi Liu ◽

Xuehui Du ◽

Na Wang

Keyword(s):

Access Control ◽

Large Scale ◽

Current System ◽

Data Sets ◽

Role Based Access Control ◽

Real World Data ◽

Evolution Mechanism ◽

Role Relationship ◽

Computing Environments ◽

Role Based

Data resources in open computing environments (including big data, internet of things and cloud computing) are characterized by large scale, wide source, and strong dynamics. Therefore, the user-permission relationship of open computing environments has a huge scale and will be dynamically adjusted over time, which enables effective permission management in the role based access control (RBAC) model to become a challenging problem. In this paper, we design an evolution mechanism of access control roles for open computing environments. The mechanism utilizes the existing user-permission relationship in the current system to mine the access control role and generate the user-role and role-permission relationship. When the user-permission relationship changes, the roles are constantly tuned and evolved to provide role support for access control of open computing environments. We propose a novel genetic-based role evolution algorithm that can effectively mine and optimize roles while preserving the core permissions of the system. In addition, a role relationship aggregation algorithm is proposed to realize the clustering of roles, which provides a supplementary reference for the security administrator to give the role real semantic information. Experimental evaluations in real-world data sets show that the proposed mechanism is effective and reliable.

Download Full-text

Secure Outsourced Medical Data against Unexpected Leakage with Flexible Access Control in a Cloud Storage System

Security and Communication Networks ◽

10.1155/2020/8347213 ◽

2020 ◽

Vol 2020 ◽

pp. 1-20

Author(s):

Xingguang Zhou ◽

Jianwei Liu ◽

Zongyang Zhang ◽

Qianhong Wu

Keyword(s):

Access Control ◽

Medical Records ◽

Cloud Storage ◽

Storage System ◽

Role Based Access Control ◽

Security Model ◽

Access Policy ◽

Fine Grained ◽

Privacy Leakage ◽

Role Based

The application of cloud storage system has been deployed widely in recent years. A lot of electronic medical records (EMRs) are collected and uploaded to the cloud for scalable sharing among the authority users. It is necessary to guarantee the confidentiality of EMRs and the privacy of EMR owners. To achieve this target, we summarize a series of attack behaviors in the cloud storage system and present the security model against many types of unexpected privacy leakage. Privacy of unassailed EMRs is guaranteed in this model, and the influence of privacy leakage is controlled in a certain scope. We also propose a role-based access control scheme to achieve flexible access control on these private EMRs. One can access medical records only if his/her role satisfies the defined access policy, which implies a fine-grained access control. Theoretical and experimental analyses show the efficiency of our scheme in terms of computation and communication.

Download Full-text