Blacklisting and forgiving coarse-grained access control for cloud computing

Abstract

Cloud security is a shared responsibility between cloud providers and users. Reaching to an agreement about the dynamic policies considered for the access control decision-making process is not an easy task in cloud computing. Such dynamic policies can be built in a coarse-grained sharing manner between cloud providers and data owners. The trust notation can provide these dynamic policies, based on multiple factors that can accurately compute the user's trust level for the granting access entity. In this paper, we have introduced the formal trust definition, which imports a novel method to provide the basis for granting access. It is based on two factors and their semantic relations which investigate important measures for the cloud environment. Also, a new Blacklisting and Forgiving Coarse-grained Access Control (BF-CAC) model has been proposed. The proposed model supports changing the user's assigned permissions dynamically based on its trust level. In addition, BF-CAC ensures secure resource sharing between potential untrusted tenants. The proposed model has been implemented on our private cloud environment based on OpenStack. Finally, the experimental results have indicated that the trust level is decaying over time, thus no user can be trusted forever. Also, the number of assigned permissions for the same user is dynamically changing with the user's final trust level.