Abstract:The ability to enforce robust and dynamic access controls on cloud-hosted data while simultaneously ensuring confidentiality with respect to the cloud itself is a clear goal for many users and organizations. To this end, there has been much cryptographic research proposing the use of (hierarchical) identity-based encryption, attribute-based encryption, predicate encryption, functional encryption, and related technologies to perform robust and private access control on untrusted cloud providers. However, the vast majority of this work studies static models in which the access control policies being enforced do not change over time. This is contrary to the needs of most practical applications, which leverage dynamic data and/or policies. In this paper, we show that the cryptographic enforcement of dynamic access controls on untrusted platforms incurs computational costs that are likely prohibitive in practice. Specifically, we develop lightweight constructions for enforcing role-based access controls (i.e., $\mathsf{RBAC}_0$) over cloud-hosted files using identity-based and traditional public-key cryptography. This is done under a threat model as close as possible to the one assumed in the cryptographic literature. We prove the correctness of these constructions, and leverage real-world $\mathsf{RBAC}$ datasets and recent techniques developed by the access control community to experimentally analyze, via simulation, their associated computational costs. This analysis shows that supporting revocation, file updates, and other state change functionality is likely to incur prohibitive overheads in even minimally-dynamic, realistic scenarios. We identify a number of bottlenecks in such systems, and fruitful areas for future work that will lead to more natural and efficient constructions for the cryptographic enforcement of dynamic access controls.

Reputation and Attribute Based Dynamic Access Control Framework in Cloud Computing Environment for Privacy Protection

Resource-centric Dynamic Access Control in Cloud

A reputation mechanism in peer-to-peer cloud storage systems

DAC-MACS: Effective Data Access Control for Multi-Authority Cloud Storage Systems

A cloud-user behavior assessment based dynamic access control model

RAAC: Robust and Auditable Access Control with Multiple Attribute Authorities for Public Cloud Storage

Achieving Secure, Scalable, and Fine-grained Data Access Control in Cloud Computing

An Efficient Role Based Access Control System for Cloud Computing

Attribute-based Fine-Grained Access Control with Efficient Revocation in Cloud Storage Systems.

A Blockchain and CP-ABE Based Access Control Scheme with Fine-Grained Revocation of Attributes in Cloud Health

FEACS: A Flexible and Efficient Access Control Scheme for Cloud Computing

DACPCC:A Data Access Control Scheme with Access Permission for Cloud Computing

Revocable, dynamic and decentralized data access control in cloud storage

Security Analysis of Attribute Revocation in Multi-Authority Data Access Control for Cloud Storage System

Dynamic Role-based Access Control for Web Services Using Context and Trust

Data access control model based on data's role and attributes for cloud computing

Integrity Audit of Shared Cloud Data with Identity Tracking

A Privacy-Preserving Attribute-Based Access Control Scheme.

Comments on “DAC-MACS: Effective Data Access Control for Multiauthority Cloud Storage Systems”/Security Analysis of Attribute Revocation in Multiauthority Data Access Control for Cloud Storage Systems

DIRA: Enabling decentralized data integrity and reputation audit via blockchain

On the Practicality of Cryptographically Enforcing Dynamic Access Control Policies in the Cloud (Extended Version)