Evaluation of Access Control Techniques in Cloud Computing

Cloud Computing is an advanced evolving technology. It is a technology in which authorised user can store, retrieve and delete data from cloud computing environment. Mostly it is used for storage of data because now a day’s storage of data in safe space is a critical problem. Data kept in cloud can be retrieved any time and at any place, if you are legitimate user and having internet access. Main benefit of use of this technology is you don’t worry about the data storage capacity, equipment purchasing and access speed. Even with of this technology data sharing is very easy. According to use of this technology cloud computing is categorised into service models as SaaS, PassS and IaaS. As data security is depends on user authentication it is also depends on access control.


INTRODUCTION
Cloud Computing is on growing technology in IT sector. This technology is mostly used for data storage, data updating and retrieving of data. Storing and use of data is very easy in this technique you just have to login with your authenticate account and then you will be in cloud environment. [1] [5] According to use of cloud computing this technology is categorised into its service level models as shown in As mentioned in above figure a SaaS is an end user application software service users are using only applications in this type. This is Pay-as -you -go model Applications used by end user are running on a particular cloud service provider.
Many users can use these applications on multiple devices at same time by using their accounts. [2] PaaS is next category in which user is using cloud platform. This category works as middle man between SaaS and IaaS. CEnd User cannot manage anything in this category as network, server or OS etc. PaaS providers offer predefined combinations of OS as WAMP, LAMP etc. This is done for security purpose.
IaaS is a platform virtualization. Ability of this category is providing storage, networks and other fundamental computing resources where the end user is capable to install and run software. Instead of purchasing servers, software, data centre and network equipment's this resource is fully outsourced and controlled by service provider. One important part of hardware is also covered in this category. This includes all type of hardware related to the whole cloud service infrastructure. [4] As user is using whole infrastructure managed by third party then a big question of security is arises here. User authentication and access control are an important terms in cloud computing. Through this paper we will discuss some access control methods which are available nowadays.

[3][5]
Access control is generally a policy or procedure that allows, denies or restricts access to a system. It may, as well, monitor and record all attempts made to access a system It may, as well, monitor and record all attempts made to access a system. Access Control may also identify users attempting to access a system unauthorized. It is a mechanism which is very much important for protection in computer security. Some of these methods are: Mandatory Access Control (MAC), Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), Discretionary Access Control (DAC), Fine-Grained Access Control (FGAC), Hierarchical Attribute-Based Access Control (HABE) and Attribute-Based Encryption Fine Grained Access Control (ABE FGAC).
Mandatory Access Control (MAC) raised when DAC is not efficient in terms of security. The fullness and confidentiality of the system are the most important features. Thus, it is high in security and low in flexibility. Because of high security and complete privacy it is used in government and military system [10]. While MAC performs operations, it does not consider the relationship it has with the users into consideration, user has to strictly follow all the permissions and roles assigned to him. MAC allows system administrative to perform operations according to the introduced policies [11]. Thus, it is much better in terms of logical comparisons when compared with DAC explained in Fig

ROLE-BASED ACCESS CONTROL (RBAC)
In this method users are allocated with different roles and the necessary permissions, limitations and authorizations are performed because of these roles [6]. Working structure of RBAC is as: one user is assigned with one or more than one roles. Two roles of different users can give permission to access one resource. Also at one time user can give permission to two different roles and to two different resources

ATTRIBUTE BASED ACCESS CONTROL
In the usage of Attribute-Based Access Control (ABAC), the user attributes play an important role. Attributes are like Name Age, Designation and Personal Information. These attributes can update according to change. These attributes can be categorise into many groups as Subject Attributes, Environment Attributes and Resource Attributes Aim of this grouping is to avoid complexity. Same as RBAC, ABAC demands the permissions and limitations to action when they are needed. Additionally, logical comparisons, and controls are important features. The set of user attributes will be conserved distinctly as shown in Figure d.

Fig. d: Attribute Based Access Control (ABAC)
For working of ABAC two models are developed: One is Policy model that defines the policies and Second model is the Architecture model that provides the web service access control. Attributes of these models are determined by the experts and they are dynamically altered constantly. Because of this change in access control become easier. [8] But this flexibility increases the occurrences of policy conflicts and makes the maintenance and administration of the policies difficult. After some time period because of this reason developers decided that ABA is not efficient. The reason behind this is access permissions given according to the attributes of the users became insufficient and unproductive. So ABAC is newly introduced as ARBAC with combination of ABAC and RBAC. Time period of this conversion was very less so no more experiments are available on ABAC. [9]

DISCRETIONARY ACCESS CONTROL
DAC is mostly used in area where computer security is very important. Access permission given to a particular user is called as Authenticate User or Owner. These users gives the necessary authorization to individuals in the system and limits their access to the system according to his own requirements. The most important feature of this method is the fact that it has a high level of security, it cannot distinguish between the subjects and object domains and has security leaks [13]. This access control is based on the user or group control so there are many chances of security leaks. Even in this type one owner can share his access with another user and if the another user is not trustworthy then a data security problem will arises. To avoid this you can create a group and assign permissions to only one parson so if anybody is misusing shared access that will be controlled by that one person only. You can call him access admin [14]. This type of access control is highly flexible. Detailed description of this method in diagram format is shown in Fig. e

HIERARCHICAL ATTRIBUTE BASED ACCESS CONTROL
Hierarchical Attribute Based Access Control (HABE) is operated in a hierarchical structure, and according to this structure, the system is made up of a root master (RM) and multi-layer domain masters that consist of the set of users, and users have the set of attributes as shown in Fig. f. This growing authenticates by allowing the admin to assign their function keys to other admins. HABE is the best control mechanism that provides the best scalability and flexibility. The most important feature of this access control is that it gives the information user, in a secure way, belongs to which class [15].

FINE GRAINED ACCESS CONTROL
The advantage of this mechanism is it has the flexibility to determine the access rights and in which mode they can work for each user. In this type of access control user have the right to decide their policies as per their own requirements. In FGAC different hybrid models are used to reach the mechanism. Most important disadvantage of this system is it does not create problems in the systems that work on their own. FGAC has problems in identifying and distinguishing between the operations produced when cooperating with complex structures . Fig f shows