Trust-Based Access Control for Secure Cloud Computing

Multi-tenancy, elasticity and dynamicity pose several novel challenges for access control in a cloud environment. Accessing subjects may dynamically change, resources requiring protection may be created or modified, and subject access requirements to resources may change during the course of the application execution. Users may need to acquire different permissions from different administrative domains based on the services in cloud computing environment. Traditional identity-based access control models such as attribute-based access control (ABAC), role-based access control (RBAC), discretionary access control (DAC), or mandatory access control (MAC) cannot be applied directly in clouds. In this chapter, we explore challenges of cloud access control, identify desirable properties of access control models, and introduce the novel graph-theoretic semantics of access control model. We specify how authorization occurs in the proposed model, and present how to incorporate features such as separation of duty (SoD).