Abstract
This position paper presents a method to ease the management of data security from the user point of view. Nowadays, users have many ways to access the same data: direct connection to the host, shared filesystem or web drive-like solutions. This leads to complex data access control policies. At the same time, users have more and more liberty in resource instantiation. They can benefit from various self service storage facilities from many Cloud operators in an on-premise or remote way. Moreover, interfaces with these providers are designed in a way that real locations of data are hidden to give an illusion of infinite resources availability. Obviously, Cloud providers have many ways to fine tune resource allocation but users may not be aware of it. With this growth of resource distribution, access control also evolved. Formerly, a simple access control scheme based on identity was sufficient for data security (IBAC). With the complexity increase of access control, new schemes emerged based on roles (RBAC) or attributes (ABAC). We will investigate the last one because attributes rules access control but it also gives information on a user’s profile that may be used to ease the creation and configuration of data services on distributed resources such as Cloud providers.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7.
References
National Security Agency. Kubernetes hardening guidance v 1.2. Technical report National Security Agency, Cybersecurity and Infrastructure Security Agency (2022). https://media.defense.gov/2022/Aug/29/2003066362/-%201/-%201/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF
Badger, L., et al.: Practical domain and type enforcement for UNIX. In: Proceedings 1995 IEEE Symposium on Security and Privacy, pp. 66–77. IEEE (1995)
Bell, D.E.,: Secure computer systems: mathematical foundations and model. In: Technical Report ESD-TR-73-278-1 (1973)
Biba, K.: Integrity considerations for secure computing systems. In: Mitre Report MTR-3153, Mitre Corporation, Bedford, MA (1975)
Boebert, W.E.: A practical alternative to hierarchical integrity policies. In: Proceedings of the 8th National Computer Security Conference, 1985 (1985)
Bousquet, A., et al.: Enforcing security and assurance properties in cloud environment. In: 2015 IEEE/ACM 8th International Conference on Utility and Cloud Computing (UCC), pp. 271–280. IEEE (2015)
Brand, S.L.: DoD 5200.28-STD department of defense trusted computer system evaluation criteria (orange book). Nat. Comput. Secur. Center, 1–94 (1985)
Briffaut, J., Lalande, J.-F., Toinard, C.: Formalization of security properties: enforcement for mac operating systems and verification of dynamic mac policies. Int. J. Adv. Secur. 2(4), 325–343 (2009)
Briffaut, J., Lalande, J.-F., Toinard, C.: Security and results of a large-scale high-interaction honeypot. J. Comput. 4(5), 395–404 (2009)
Briffaut, J., et al.: Enforcement of security properties for dynamic MAC policies. In: 2009 Third International Conference on Emerging Security Information, Systems and Technologies, pp. 114–120. IEEE (2009)
Chung et al.: Guide to Attribute Based Access Control (ABAC) Definition and Considerations (2019). https://doi.org/10.6028/NIST.SP.800-162
Cuppens, F., Cuppens-Boulahia, N.: Modeling contextual security policies. Int. J. Inf. Secur. 7(4), 285–305 (2008)
Denning, P.J.: Fault tolerant operating systems. ACM Comput. Surv. (CSUR) 8(4), 359–389 (1976)
Downs, D.D., et al.: Issues in discretionary access control. In: 1985 IEEE Symposium on Security and Privacy, pp. 208–208. IEEE (1985)
Ennahbaoui, M., Elhajji, S.: Study of access control models. In: Proceedings of the World Congress on Engineering, Vol. 2, pp. 3–5 (2013)
Ferraiolo, D., Cugini, J., Kuhn, D.R., et al.: Role-based access control (RBAC): features and motivations. In: Proceedings of 11th Annual Computer Security Application Conference, pp. 241–48 (1995)
Ferraiolo, D.F., Barkley, J.F., Kuhn, D.R.: A role-based access control model and reference implementation within a corporate intranet. ACM Trans. Inf. Syst. Secur. (TISSEC) 2(1), 34–64 (1999)
Ferrario, D.: Role-based access control. In: Proceedings of 15th National Computer Security Conference, 1992 (1992)
Gros, D., et al.: PIGA-cluster: a distributed architecture integrating a shared and resilient reference monitor to enforce mandatory access control in the HPC environment. In: 2013 International Conference on High Performance Computing & Simulation (HPCS), pp. 273–280. IEEE (2013)
Gupta, E., et al.: Attribute-based access control for NoSQL databases. In: Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy, pp. 317–319 (2021)
Harrison, M.A., Ruzzo, W.L., Ullman, J.D.: Protection in operating systems. Commun. ACM 19(8), 461–471 (1976)
ITSEC. Information Technology Security Evaluation Criteria (1991)
Jahid, S., et al.: MyABDAC: compiling XACML policies for attribute based database access control. In: Proceedings of the First ACM Conference on Data and Application Security and Privacy, pp. 97–108 (2011)
Kubernetes – see. https://kubernetes.io/.k8s
Lampson, B.W.: Protection. ACM SIGOPS Oper. Syst. Rev. 8(1), 18–24 (1974)
Li, N., Mao, Z.: Administration in role-based access control. In: Proceedings of the 2nd ACM symposium on Information, Computer and Communications Security, pp. 127–138 (2007)
Loscocco, P.A., et al.: The inevitability of failure: the flawed assumption of security in modern computing environments. In: Proceedings of the 21st National Information Systems Security Conference (1998)
Mahmoud, A.A., et al.: A new graph-based reinforcement learning environment for targeted molecular generation and optimization. In: 2023 12th International Conference on Software and Information Engineering (2023)
Mayfield, T., et al.: Integrity in automated information systems. Nat. Secur. Agency, Tech. Rep. 79 (1991)
Osborn, S., Sandhu, R., Munawer, Q.: Configuring role-based access control to enforce mandatory and discretionary access control policies. ACM Trans. Inf. Syst. Secur. (TISSEC) 3(2), 85–106 (2000)
Rahman, M.U.: Scalable role-based access control using the EOS blockchain. arXiv preprint: arXiv:2007.02163 (2020)
Sandhu, R., et al.: The NIST model for role-based access control: towards a unified standard. In: ACM Workshop on Role-Based Access Control, vol. 10, no. 344287.344301 (2000)
Sandhu, R., Munawer, Q.: How to do discretionary access control using roles. In: Proceedings of the Third ACM Workshop on Role-Based Access Control, pp. 47–54 (1998)
Sandhu, R.S.: The typed access matrix model. In: IEEE Symposium on Security and Privacy, pp. 122–136. Citeseer (1992)
Sandhu, R.S.: The schematic protection model: its definition and analysis for acyclic attenuating schemes. J. ACM (JACM) 35(2), 404–432 (1988)
Sultan, S., Ahmad, I., Dimitriou, T.: Container security: issues, challenges, and the road ahead. IEEE Access 7, 52976–52996 (2019)
Wang, X., Du, J., Liu, H.: Performance and isolation analysis of RunC, gVisor and Kata containers runtimes. Cluster Comput. 25(2), 1497–1513 (2022)
Zhang, Z., Zhang, X., Sandhu, R.: ROBAC: scalable role and organization based access control models. In: 2006 International Conference on Collaborative Computing: Networking, Applications and Worksharing, pp. 1–9. IEEE (2006)
Acknowledgment
We extend our heartfelt gratitude to the National Institute of Informatics (NII) and the Centre National de la Recherche Scientifique (CNRS) for their invaluable collaboration through the signed MOU, which has paved the way for this impactful joint research.
Funding
This work is funded by the French Ministry of Higher Education and Research in the context of DATACENTER 2023. This is a governmental call for projects to provide a secure deployment of storage services in the Cloud. We would like to thank you the National Institute of Informatics (Japan) for its support for this research.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Greneche, N. et al. (2024). Leverage Data Security Policies Complexity for Users: An End-to-End Storage Service Management in the Cloud Based on ABAC Attributes. In: Renault, É., Boumerdassi, S., Mühlethaler, P. (eds) Machine Learning for Networking. MLN 2023. Lecture Notes in Computer Science, vol 14525. Springer, Cham. https://doi.org/10.1007/978-3-031-59933-0_14
Download citation
DOI: https://doi.org/10.1007/978-3-031-59933-0_14
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-59932-3
Online ISBN: 978-3-031-59933-0
eBook Packages: Computer ScienceComputer Science (R0)