An Access Control Model Based on System Security Risk for Dynamic Sensitive Data Storage in the Cloud
Source abstract
Abstract
In cloud computing, dynamic storage of data generated by users, applications, tasks, workflows, etc. requires frequent access operations, so traditional encryption cannot be applied in this case. Considering the vulnerability of dynamic data, its protection needs to consider an efficient and dynamic security protection scheme. In data-oriented access control, the traditional approach is generally static policy matching, which cannot deal with emergencies and has the problem of privileged users. To solve this problem, this paper proposes a data-oriented risk-based access control model, which adds risk assessment to the traditional attribute-based access control and aims at the source of risk from three aspects: subject attribute, resource attribute, and environment attribute. A set of risk assessment indexes is proposed, and the calculation method of risk assessment is quantitatively analyzed by combining fuzzy consistency AHP analysis method, and finally, the realization of XACML is given. The validity of the proposed model is analyzed, and the carried out experimental analysis verifies its effectiveness. The proposed model benefits cloud data storage applications that require dynamic data storage, for example, medical/patient data storage.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Cloud Data Security Solutions · Access Control and Trust · Privacy-Preserving Technologies in Data
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Applied College, Taibah University, Medina 42353, Saudi Arabia
College of Computer Science and Engineering, Taibah University, Medina 42353, Saudi Arabia
Ecole Supérieure des Sciences Economiques et Commerciales de Tunis, University of Tunis, Montfleury 1089, Tunisia
Business Analytics and Decision Making Lab (BADEM) at Tunis Business School, University of Tunis, Bir El Kassaa 2059, Tunisia
Department of Information Systems and Technology, College of Computer Science and Engineering, University of Jeddah, Jeddah 23445, Saudi Arabia
References (31)
Show source-provided references
1. Atlam, H.F., Alenezi, A., Walters, R.J., and Wills, G.B. (2017, January 24–26). An overview of risk estimation techniques in risk-based access control for the internet of things. Proceedings of the 2nd International Conference on Internet of Things, Big Data and Security, Porto, Portugal.10.5220/0006292602540260 ↗
2. Risk assessment methodology for information systems, based on the user behavior and it-security incidents analysis
3. Santos, D.R.D., Westphall, C.M., and Westphall, C.B. (2014, January 5–9). A dynamic risk-based access control architecture for cloud computing. Proceedings of the IEEE/IFIP NOMS 2014—IEEE/IFIP Network Operations and Management Symposium: Management in a Software Defined World, Krakow, Poland.10.1109/NOMS.2014.6838319 ↗
4. Chen, A., Xing, H., She, K., and Duan, G. (2016, January 8–10). A Dynamic Risk-Based Access Control Model for Cloud Computing. Proceedings of the 2016 IEEE International Conferences on Big Data and Cloud Computing (BDCloud), Social Computing and Networking (SocialCom), Sustainable Computing and Communications (SustainCom) (BDCloud-SocialCom-SustainCom), Atlanta, GA, USA.10.1109/BDCloud-SocialCom-SustainCom.2016.90 ↗
5. Bijon, K.Z., Krishnan, R., and Sandhu, R. (2013, January 14–16). A framework for risk-aware role based access control. Proceedings of the 2013 IEEE Conference on Communications and Network Security, CNS, National Harbor, MD, USA.10.1109/CNS.2013.6682761 ↗
6. Dynamic risk-based decision methods for access control systems10.1016/j.cose.2012.02.006 ↗
7. An access control model for cloud computing
8. PpBAC: Popularity based access control model for cloud computing10.4018/JOEUC.2018100102 ↗
9. Sabzmakan, A., and Mirtaheri, S.L. (2021, January 3–4). An Improved Distributed Access Control Model in Cloud Computing by Blockchain. Proceedings of the 26th International Computer Conference, Computer Society of Iran, CSICC, Tehran, Iran.10.1109/CSICC52343.2021.9420586 ↗
10. AuthPrivacyChain: A Blockchain-Based Access Control Framework with Privacy Protection in Cloud10.1109/ACCESS.2020.2985762 ↗
11. MTBAC: A mutual trust based access control model in Cloud computing10.1109/CC.2014.6827577 ↗
12. Chunge, L., Mingji, M., Bingxu, L., and Shuxin, C. (2021, January 12–14). Design and Implementation of Trust-based Access Control Model for Cloud Computing. Proceedings of the IEEE Advanced Information Technology, Electronic and Automation Control Conference (IAEAC), Chongqing, China.10.1109/IAEAC50856.2021.9391012 ↗
13. Research on Trust-Role Access Control Model in Cloud Computing10.21307/ijanmc-2019-050 ↗
14. Context-aware access control model for services provided from cloud computing10.1007/978-3-319-66379-1_25 ↗
15. Ni, Q., Bertino, E., and Lobo, J. (2010, January 13). Risk-based access control systems built on fuzzy inferences. Proceedings of the 5th International Symposium on Information, Computer and Communications Security, ASIACCS 2010, New York, NY, USA.10.1145/1755688.1755719 ↗
16. Cheng, P.C., Rohatgi, P., Keser, C., Karger, P.A., Wagner, G.M., and Reninger, A.S. (2007, January 20–23). Fuzzy Multi-Level Security: An experiment on quantified risk-adaptive access control. Proceedings of the IEEE Symposium on Security and Privacy, Berkeley, CA, USA.10.1109/SP.2007.21 ↗
17. Li, J., Bai, Y., and Zaman, N. (2013, January 16–18). A fuzzy modeling approach for risk-based access control in eHealth cloud. Proceedings of the 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications, Melbourne, VIC, Australia.10.1109/TrustCom.2013.66 ↗
18. Al-Shaer, E., Ou, X., and Xie, G. (2013). Automated Security Management, Springer International Publishing.10.1007/978-3-319-01433-3 ↗
19. Atlam, H.F., Azad, M.A., and Fadhel, N.F. (2022). Efficient NFS Model for Risk Estimation in a Risk-Based Access Control Model. Sensors, 22.10.3390/s22052005 ↗
20. Atlam, H.F., Azad, M.A., Alassafi, M.O., Alshdadi, A.A., and Alenezi, A. (2020). Risk-based access control model: A systematic literature review. Future Internet, 12.10.3390/fi12060103 ↗
21. Secure access control model for cloud computing environment with fuzzy max interval trust values
22. Development of trust based access control models using fuzzy logic in cloud computing
23. Critical comparison of access control models for cloud computing
24. Survey of Centralized and Decentralized Access Control Models in Cloud Computing
25. Shan, T.L., Ismail, S.A., and Azizan, A. (2018, January 24–26). Access Control Models for Cloud Computing: A Review. Proceedings of the 2018 2nd International Conference on Telematics and Future Generation Networks, TAFGEN, Kuching, Malaysia.10.1109/TAFGEN.2018.8580489 ↗
26. Survey of access control models and technologies for cloud computing10.1007/s10586-018-1850-7 ↗
27. Aftab, M.U., Hamza, A., Oluwasanmi, A., Nie, X., Sarfraz, M.S., Shehzad, D., Qin, Z., and Rafiq, A. (2022). Traditional and Hybrid Access Control Models: A Detailed Survey. Secur. Commun. Netw., 2022.10.1155/2022/1560885 ↗
28. A survey on access control models in cloud computing10.1007/978-3-319-13728-5_73 ↗
29. Review of access control model
30. The analytic hierarchy and analytic network measurement processes: Applications to decisions under Risk10.29020/nybg.ejpam.v1i1.6 ↗
31. Saaty, T.L. (1988). Mathematical Models for Decision Support, Springer.