Decentralized Access Control with Anonymous
Authentication of Data Stored in Clouds
Abstract:
Abstract—We propose a new decentralized access control scheme for secure data storage in
clouds that supports anonymous authentication. In the proposed scheme, the cloud verifies the
authenticity of the series without knowing the user’s identity before storing data. Our scheme
also has the added feature of access control in which only valid users are able to decrypt the
stored information. The scheme prevents replay attacks and supports creation, modification, and
reading data stored in the cloud. We also address user revocation. Moreover, our authentication
and access control scheme is decentralized and robust, unlike other access control schemes
designed for clouds which are centralized. The communication, computation, and storage
overheads are comparable to centralized approaches.
Introduction:
RESEARCH in cloud computing is receiving a lot of attention from both academic and
industrial worlds. In cloud computing, users can outsource their computation and storage to
servers (also called clouds) using Internet. This frees users from the hassles of maintaining
resources on-site. Clouds can provide several types of services like applications (e.g., Google
Apps, Microsoft online), infrastructures (e.g., Amazon’s EC2, Eucalyptus, Nimbus), and
platforms to help developers write applications (e.g., Amazon’s S3, Windows Azure). Much of
the data stored in clouds is highly sensitive, for example, medical records and social networks.
Security and privacy are, thus, very important issues in cloud computing. In one hand, the user
should authenticate itself before initiating any transaction, and on the other hand, it must be
ensured that the cloud does not tamper with the data that is outsourced. User privacy is also
required so that the cloud or other users do not know the identity of the user. The cloud can hold
the user accountable for the data it outsources, and likewise, the cloud is itself accountable for
the services it provides. The validity of the user who stores the data is also verified. Apart from
the technical solutions to ensure security and privacy, there is also a need for law enforcement.
Recently, Wang et al. [2] addressed secure and dependable cloud storage. Cloud servers prone to
Byzantine failure, where a storage server can fail in arbitrary ways [2]. The cloud is also prone to
data modification and server colluding attacks. In server colluding attack, the adversary can
compromise storage servers, so that it can modify data files as long as they are internally
consistent. To provide secure data storage, the data needs to be encrypted. However, the data is
often modified and this dynamic property needs to be taken into account while designing
efficient secure storage techniques.
Literature Survey:
S. Ruj, M. Stojmenovic and A. Nayak, &ldquo,Privacy Preserving Access Control with
Authentication for Securing Data in Clouds,&rdquo, Proc. IEEE/ACM Int',l Symp. Cluster,
Cloud and Grid Computing, pp. 556-563, 2012
In this paper, we propose a new privacy preserving authenticated access control scheme for
securing data in clouds. In the proposed scheme, the cloud verifies the authenticity of the user
without knowing the user's identity before storing information. Our scheme also has the added
feature of access control in which only valid users are able to decrypt the stored information. The
scheme prevents replay attacks and supports creation, modification, and reading data stored in
the cloud. Moreover, our authentication and access control scheme is decentralized and robust,
unlike other access control schemes designed for clouds which are centralized. The
communication, computation, and storage overheads are comparable to centralized approaches
C. Wang, Q. Wang, K. Ren, N. Cao and W. Lou, &ldquo,Toward Secure and Dependable
Storage Services in Cloud Computing,&rdquo, IEEE Trans. Services Computing, vol. 5, no.
2, pp. 220-232, Apr.-June 2012.
Cloud storage enables users to remotely store their data and enjoy the on-demand high quality
cloud applications without the burden of local hardware and software management. Though the
benefits are clear, such a service is also relinquishing users' physical possession of their
outsourced data, which inevitably poses new security risks toward the correctness of the data in
cloud. In order to address this new problem and further achieve a secure and dependable cloud
storage service, we propose in this paper a flexible distributed storage integrity auditing
mechanism, utilizing the homomorphic token and distributed erasure-coded data. The proposed
design allows users to audit the cloud storage with very lightweight communication and
computation cost. The auditing result not only ensures strong cloud storage correctness
guarantee, but also simultaneously achieves fast data error localization, i.e., the identification of
misbehaving server. Considering the cloud data are dynamic in nature, the proposed design
further supports secure and efficient dynamic operations on outsourced data, including block
modification, deletion, and append. Analysis shows the proposed scheme is highly efficient and
resilient against Byzantine failure, malicious data modification attack, and even server colluding
attacks.
J. Li, Q. Wang, C. Wang, N. Cao, K. Ren and W. Lou, &ldquo,Fuzzy Keyword Search
Over Encrypted Data in Cloud Computing,&rdquo, Proc. IEEE INFOCOM, pp. 441-445,
2010
As Cloud Computing becomes prevalent, more and more sensitive information are being
centralized into the cloud. For the protection of data privacy, sensitive data usually have to be
encrypted before outsourcing, which makes effective data utilization a very challenging task.
Although traditional searchable encryption schemes allow a user to securely search over
encrypted data through keywords and selectively retrieve files of interest, these techniques
support only exact keyword search. That is, there is no tolerance of minor typos and format
inconsistencies which, on the other hand, are typical user searching behavior and happen very
frequently. This significant drawback makes existing techniques unsuitable in Cloud Computing
as it greatly affects system usability, rendering user searching experiences very frustrating and
system efficacy very low. In this paper, for the first time we formalize and solve the problem of
effective fuzzy keyword search over encrypted cloud data while maintaining keyword privacy.
Fuzzy keyword search greatly enhances system usability by returning the matching files when
users' searching inputs exactly match the predefined keywords or the closest possible matching
files based on keyword similarity semantics, when exact match fails. In our solution, we exploit
edit distance to quantify keywords similarity and develop an advanced technique on constructing
fuzzy keyword sets, which greatly reduces the storage and representation overheads. Through
rigorous security analysis, we show that our proposed solution is secure and privacy-preserving,
while correctly realizing the goal of fuzzy keyword search.
D.F. Ferraiolo and D.R. Kuhn, &ldquo,Role-Based Access Controls,&rdquo, Proc. 15th
Nat',l Computer Security Conf., 1992
For original paper see Ninghui Li et al., vol. 5, no. 6, p.41, (2007)". Some notion of roles for
access control predates the research papers cited by the authors by at least a decade. Our work
was designed to formalize RBAC and add features (such as hierarchies and constraints) to make
it more useful to software developers and administrators. Extensive discussion of these and
subsequent papers over many years led to the consensus standard for RBAC
S. Ruj, A. Nayak and I. Stojmenovic, &ldquo,DACC: Distributed Access Control in
Clouds,&rdquo,Proc. IEEE 10th Int',l Conf. Trust, Security and Privacy in Computing and
Communications (TrustCom), 2011.
We propose a new model for data storage and access in clouds. Our scheme avoids storing
multiple encrypted copies of same data. In our framework for secure data storage, cloud stores
encrypted data (without being able to decrypt them). The main novelty of our model is addition
of key distribution centers (KDCs). We propose DACC (Distributed Access Control in Clouds)
algorithm, where one or more KDCs distribute keys to data owners and users. KDC may provide
access to particular fields in all records. Thus, a single key replaces separate keys from owners.
Owners and users are assigned certain set of attributes. Owner encrypts the data with the
attributes it has and stores them in the cloud. The users with matching set of attributes can
retrieve the data from the cloud. We apply attribute-based encryption based on bilinear pairings
on elliptic curves. The scheme is collusion secure; two users cannot together decode any data
that none of them has individual right to access. DACC also supports revocation of users,
without redistributing keys to all the users of cloud services. We show that our approach results
in lower communication, computation and storage overheads, compared to existing models and
schemes.
D. X. Song, D. Wagner, and A. Perrig, "Practical techniques for searches on encrypted
data," in IEEE Symposium on Security and Privacy, 2000, pp. 44-55.
It is desirable to store data on data storage servers such as mail servers and file servers in
encrypted form to reduce security and privacy risks. But this usually implies that one has to
sacrifice functionality for security. For example, if a client wishes to retrieve only documents
containing certain words, it was not previously known how to let the data storage server perform
the search and answer the query, without loss of data confidentiality. We describe our
cryptographic schemes for the problem of searching on encrypted data and provide proofs of
security for the resulting crypto systems. Our techniques have a number of crucial advantages.
They are provably secure: they provide provable secrecy for encryption, in the sense that the
untrusted server cannot learn anything about the plaintext when only given the ciphertext; they
provide query isolation for searches, meaning that the untrusted server cannot learn anything
more about the plaintext than the search result; they provide controlled searching, so that the
untrusted server cannot search for an arbitrary word without the user's authorization; they also
support hidden queries, so that the user may ask the untrusted server to search for a secret word
without revealing the word to the server. The algorithms presented are simple, fast (for a
document of length n, the encryption and search algorithms only need O(n) stream cipher and
block cipher operations), and introduce almost no space and communication overhead, and hence
are practical to use today
J. Bethencourt, A. Sahai and B. Waters, &ldquo,Ciphertext-Policy Attribute-Based
Encryption,&rdquo, Proc. IEEE Symp. Security and Privacy, pp. 321-334, 2007
In several distributed systems a user should only be able to access data if a user posses a certain
set of credentials or attributes. Currently, the only method for enforcing such policies is to
employ a trusted server to store the data and mediate access control. However, if any server
storing the data is compromised, then the confidentiality of the data will be compromised. In this
paper we present a system for realizing complex access control on encrypted data that we call
ciphertext-policy attribute-based encryption. By using our techniques encrypted data can be kept
confidential even if the storage server is untrusted; moreover, our methods are secure against
collusion attacks. Previous attribute-based encryption systems used attributes to describe the
encrypted data and built policies into user's keys; while in our system attributes are used to
describe a user's credentials, and a party encrypting data determines a policy for who can
decrypt. Thus, our methods are conceptually closer to traditional access control methods such as
role-based access control (RBAC). In addition, we provide an implementation of our system and
give performance measurements
J. Hur and D. Kun Noh, &ldquo,Attribute-Based Access Control with Efficient Revocation
in Data Outsourcing Systems,&rdquo, IEEE Trans. Parallel and Distributed Systems, vol.
22, no. 7, pp. 1214-1221, July 2011
Some of the most challenging issues in data outsourcing scenario are the enforcement of
authorization policies and the support of policy updates. Ciphertext-policy attribute-based
encryption is a promising cryptographic solution to these issues for enforcing access control
policies defined by a data owner on outsourced data. However, the problem of applying the
attribute-based encryption in an outsourced architecture introduces several challenges with
regard to the attribute and user revocation. In this paper, we propose an access control
mechanism using ciphertext-policy attribute-based encryption to enforce access control policies
with efficient attribute and user revocation capability. The fine-grained access control can be
achieved by dual encryption mechanism which takes advantage of the attribute-based encryption
and selective group key distribution in each attribute group. We demonstrate how to apply the
proposed mechanism to securely manage the outsourced data. The analysis results indicate that
the proposed scheme is efficient and secure in the data outsourcing systems.
J. Bethencourt, A. Sahai and B. Waters, &ldquo,Ciphertext-Policy Attribute-Based
Encryption,&rdquo, Proc. IEEE Symp. Security and Privacy, pp. 321-334, 2007.
In several distributed systems a user should only be able to access data if a user posses a certain
set of credentials or attributes. Currently, the only method for enforcing such policies is to
employ a trusted server to store the data and mediate access control. However, if any server
storing the data is compromised, then the confidentiality of the data will be compromised. In this
paper we present a system for realizing complex access control on encrypted data that we call
ciphertext-policy attribute-based encryption. By using our techniques encrypted data can be kept
confidential even if the storage server is untrusted; moreover, our methods are secure against
collusion attacks. Previous attribute-based encryption systems used attributes to describe the
encrypted data and built policies into user's keys; while in our system attributes are used to
describe a user's credentials, and a party encrypting data determines a policy for who can
decrypt. Thus, our methods are conceptually closer to traditional access control methods such as
role-based access control (RBAC). In addition, we provide an implementation of our system and
give performance measurements.
S. Pearson and A. Benameur, "Privacy, Security and Trust Issues Arising from Cloud
Computing," in The 2nd International Conference on Cloud Computing 2010, Indiana,
USA, 2010, pp. 693-702.
Cloud computing is an emerging paradigm for large scale infrastructures. It has the advantage of
reducing cost by sharing computing and storage resources, combined with an on-demand
provisioning mechanism relying on a pay-per-use business model. These new features have a
direct impact on the budgeting of IT budgeting but also affect traditional security, trust and
privacy mechanisms. Many of these mechanisms are no longer adequate, but need to be
rethought to fit this new paradigm. In this paper we assess how security, trust and privacy issues
occur in the context of cloud computing and discuss ways in which they may be addressed.
S. Chen and C. Wang, "Accountability as a Service for the Cloud: From Concept to
Implementation with BPEL," in 6th IEEE World Congress on Services (SERVICES-1),
2010, pp. 91-98.
Summary form only given. Accountability in Service Oriented Architecture (SOA) is a
capability of making business processes across all participants (services, applications and people)
accountable in terms of both business logic and Quality of Services (QoS). While accountability
is a critical mechanism to enhance trust between collaborative services, there is the lack of
standard accountability support in the current SOA infrastructure. For example, it is difficult
with the existing technologies/infrastructure to resolve a dispute between two (web) services if
some interactions between the two services go wrong; there is also little existing accountability
support for a service consumer to collect quantity evidences to complain a service provider, who
fails to meet its Service Level Agreement (SLA). As the increasing real-world activities are
performed through the Internet connected services, we envision that there will be growing
requirements for making the behaviors of both service providers and consumers accountable. In
the business world, one may be reluctant to transact directly with a stranger. But a mutually
trusted middleman can be used to facilitate transactions and resolve possible disputes. In this
tutorial, we will share our observations and research results on building accountability into SOA.
First, we will review related work on accountability in traditional distributed systems, ranging
from Internet protocols and network file systems to outsourced database management systems.
We will examine what methods embodied in these work can fit service computing in Internet
scale and what cannot. Then we will present our research work on middleman-based approach to
delivering accountability as a service, including our recent research results. This tutorial will
focus on the major technical challenges of enabling SOA accountable and our solutions to these
challenges. Finally, we will demonstrate our solutions using a collaborative services scenario
deployed in - - Amazon EC^2 cloud. The goal of this tutorial is to provide detailed understanding
of accountability issues and related technologies in SOA with in-depth related work discussions,
recent research outcomes and a deployed accountability service prototype.
C. Wang, Q. Wang, K. Ren, N. Cao, and W. Lou, “Toward
Secure and Dependable Storage Services in Cloud Computing,”
IEEE Trans. Services Computing, vol. 5, no. 2, pp. 220-232, Apr.June 2012.
Cloud storage enables users to remotely store their data and enjoy the on-demand high quality
cloud applications without the burden of local hardware and software management. Though the
benefits are clear, such a service is also relinquishing users' physical possession of their
outsourced data, which inevitably poses new security risks toward the correctness of the data in
cloud. In order to address this new problem and further achieve a secure and dependable cloud
storage service, we propose in this paper a flexible distributed storage integrity auditing
mechanism, utilizing the homomorphic token and distributed erasure-coded data. The proposed
design allows users to audit the cloud storage with very lightweight communication and
computation cost. The auditing result not only ensures strong cloud storage correctness
guarantee, but also simultaneously achieves fast data error localization, i.e., the identification of
misbehaving server. Considering the cloud data are dynamic in nature, the proposed design
further supports secure and efficient dynamic operations on outsourced data, including block
modification, deletion, and append. Analysis shows the proposed scheme is highly efficient and
resilient against Byzantine failure, malicious data modification attack, and even server colluding
attacks.
C. Wang, Q. Wang, K. Ren and W. Lou, &ldquo,Ensuring Data Storage Security in Cloud
Computing,&rdquo, Proc. 17th Int',l Workshop Quality of Service (IWQoS ',09), pp. 1-9,
July 2009
Cloud computing has been envisioned as the next-generation architecture of IT enterprise. In
contrast to traditional solutions, where the IT services are under proper physical, logical and
personnel controls, cloud computing moves the application software and databases to the large
data centers, where the management of the data and services may not be fully trustworthy. This
unique attribute, however, poses many new security challenges which have not been well
understood. In this article, we focus on cloud data storage security, which has always been an
important aspect of quality of service. To ensure the correctness of users' data in the cloud, we
propose an effective and flexible distributed scheme with two salient features, opposing to its
predecessors. By utilizing the homomorphic token with distributed verification of erasure-coded
data, our scheme achieves the integration of storage correctness insurance and data error
localization, i.e., the identification of misbehaving server (s). Unlike most prior works, the new
scheme further supports secure and efficient dynamic operations on data blocks, including: data
update, delete and append. Extensive security and performance analysis shows that the proposed
scheme is highly efficient and resilient against Byzantine failure, malicious data modification
attack, and even server colluding attacks.
R. Curtmola, O. Khan, R. Burns and G. Ateniese, &ldquo,MR-PDP: Multiple-Replica
Provable Data Possession,&rdquo, Proc. IEEE 28th Int',l Conf. Distributed Computing
Systems (ICDCS ',08), pp. 411-420, 2008
Many storage systems rely on replication to increase the availability and durability of data on
untrusted storage systems. At present, such storage systems provide no strong evidence that
multiple copies of the data are actually stored. Storage servers can collude to make it look like
they are storing many copies of the data, whereas in reality they only store a single copy. We
address this shortcoming through multiple-replica provable data possession (MR-PDP): A
provably-secure scheme that allows a client that stores t replicas of a file in a storage system to
verify through a challenge-response protocol that (1) each unique replica can be produced at the
time of the challenge and that (2) the storage system uses t times the storage required to store a
single replica. MR-PDP extends previous work on data possession proofs for a single copy of a
file in a client/server storage system (Ateniese et al., 2007). Using MR-PDP to store t replicas is
computationally much more efficient than using a single-replica PDP scheme to store t separate,
unrelated files (e.g., by encrypting each file separately prior to storing it). Another advantage of
MR-PDP is that it can generate further replicas on demand, at little expense, when some of the
existing replicas fail.
Q. Wang, C. Wang, K. Ren, W. Lou and J. Li, &ldquo,Enabling Public Auditability and
Data Dynamics for Storage Security in Cloud Computing,&rdquo, IEEE Trans. Parallel
and Distributed Systems, vol. 22, no. 5, pp. 847-859, 2011.
Cloud Computing has been envisioned as the next-generation architecture of IT Enterprise. It
moves the application software and databases to the centralized large data centers, where the
management of the data and services may not be fully trustworthy. This unique paradigm brings
about many new security challenges, which have not been well understood. This work studies the
problem of ensuring the integrity of data storage in Cloud Computing. In particular, we consider
the task of allowing a third party auditor (TPA), on behalf of the cloud client, to verify the
integrity of the dynamic data stored in the cloud. The introduction of TPA eliminates the
involvement of the client through the auditing of whether his data stored in the cloud are indeed
intact, which can be important in achieving economies of scale for Cloud Computing. The
support for data dynamics via the most general forms of data operation, such as block
modification, insertion, and deletion, is also a significant step toward practicality, since services
in Cloud Computing are not limited to archive or backup data only. While prior works on
ensuring remote data integrity often lacks the support of either public auditability or dynamic
data operations, this paper achieves both. We first identify the difficulties and potential security
problems of direct extensions with fully dynamic data updates from prior works and then show
how to construct an elegant verification scheme for the seamless integration of these two salient
features in our protocol design. In particular, to achieve efficient data dynamics, we improve the
existing proof of storage models by manipulating the classic Merkle Hash Tree construction for
block tag authentication. To support efficient handling of multiple auditing tasks, we further
explore the technique of bilinear aggregate signature to extend our main result into a multiuser
setting, where TPA can perform multiple auditing tasks simultaneously. Extensive security and
performance analysis show that the proposed schemes are highly efficient and provably secure.
Statement of the Problem:
Security and privacy protection in clouds are being explored by many researchers. Wang et al.
[2] addressed storage security using Reed-Solomon erasure-correcting codes. Authentication of
users using public key cryptographic techniques has been studied in [5]. Many homomorphic
encryption techniques have been suggested [6], [7] to ensure that the cloud is not able to read the
data while performing computations on them. Using homomorphic encryption, the cloud
receives ciphertext of the data and performs computations on the ciphertext and returns the
encoded value of the result. The user is able to decode the result, but the cloud does not know
what data it has operated on. In such circumstances, it must be possible for the user to verify that
the cloud returns correct results. Existing work [12], [13], [14], 15], [16], [18], [38] on access
control in cloud are centralized in nature. Except [38] and [18], all other schemes use ABE. The
scheme in [38] uses a symmetric key approach and does not support authentication. The schemes
[12], [13], [16] do not support authentication as well. Earlier work by Zhao et al. [15] provides
privacy preserving authenticated access control in cloud. However, the authors take a centralized
approach where a single key distribution center (KDC) distributes secret keys and attributes to all
users. Unfortunately, a single KDC is not only a single point of failure but difficult to maintain
because of the large number of users that are supported in a cloud environment.
Objective
1. Distributed access control of data stored in cloud so that only authorized users with valid
attributes can access them.
2. Authentication of users who store and modify their data on the cloud.
3. The identity of the user is protected from the cloud during authentication.
4. The architecture is decentralized, meaning that there can be several KDCs for key
anagement.
5. The access control and authentication are both collusion resistant, meaning that no two
users can collude and access data or authenticate themselves, if they are individually not
authorized.
References
S. Ruj, M. Stojmenovic, and A. Nayak, “Privacy Preserving Access
Control with Authentication for Securing Data in Clouds,” Proc.
IEEE/ACM Int’l Symp. Cluster, Cloud and Grid Computing, pp. 556563, 2012.
[2] C. Wang, Q. Wang, K. Ren, N. Cao, and W. Lou, “Toward
Secure and Dependable Storage Services in Cloud Computing,”
IEEE Trans. Services Computing, vol. 5, no. 2, pp. 220-232, Apr.June 2012.
[3] J. Li, Q. Wang, C. Wang, N. Cao, K. Ren, and W. Lou, “Fuzzy
Keyword Search Over Encrypted Data in Cloud Computing,”
Proc. IEEE INFOCOM, pp. 441-445, 2010.
[4] S. Kamara and K. Lauter, “Cryptographic Cloud Storage,” Proc.
14th Int’l Conf. Financial Cryptography and Data Security, pp. 136149, 2010.
[5] H. Li, Y. Dai, L. Tian, and H. Yang, “Identity-Based Authentication
for Cloud Computing,” Proc. First Int’l Conf. Cloud Computing
(CloudCom), pp. 157-166, 2009.
[6] C. Gentry, “A Fully Homomorphic Encryption Scheme,” PhD
dissertation, Stanford Univ., http://www.crypto.stanford.edu/
craig, 2009.
[7] A.-R. Sadeghi, T. Schneider, and M. Winandy, “Token-Based
Cloud Computing,” Proc. Third Int’l Conf. Trust and Trustworthy
Computing (TRUST), pp. 417-429, 2010.
[8] R.K.L. Ko, P. Jagadpramana, M. Mowbray, S. Pearson, M.
Kirchberg, Q. Liang, and B.S. Lee, “Trustcloud: A Framework
for Accountability and Trust in Cloud Computing,” HP Technical
Report HPL-2011-38, http://www.hpl.hp.com/techreports/
2011/HPL-2011-38.html, 2013.
[9] R. Lu, X. Lin, X. Liang, and X. Shen, “Secure Provenance: The
Essential of Bread and Butter of Data Forensics in Cloud
Computing,” Proc. Fifth ACM Symp. Information, Computer and
Comm. Security (ASIACCS), pp. 282-292, 2010.
[10] D.F. Ferraiolo and D.R. Kuhn, “Role-Based Access Controls,” Proc.
15th Nat’l Computer Security Conf., 1992.
[11] D.R. Kuhn, E.J. Coyne, and T.R. Weil, “Adding Attributes to Role-
Based Access Control,” IEEE Computer, vol. 43, no. 6, pp. 79-81,
June 2010.
[12] M. Li, S. Yu, K. Ren, and W. Lou, “Securing Personal Health
Records in Cloud Computing: Patient-Centric and Fine-Grained
Data Access Control in Multi-Owner Settings,” Proc. Sixth Int’l
ICST Conf. Security and Privacy in Comm. Networks (SecureComm),
pp. 89-106, 2010.
[13] S. Yu, C. Wang, K. Ren, and W. Lou, “Attribute Based Data
Sharing with Attribute Revocation,” Proc. ACM Symp. Information,
Computer and Comm. Security (ASIACCS), pp. 261-270, 2010.
[14] G. Wang, Q. Liu, and J. Wu, “Hierarchical Attribute-Based
Encryption for Fine-Grained Access Control in Cloud Storage
Services,” Proc. 17th ACM Conf. Computer and Comm. Security
(CCS), pp. 735-737, 2010.
[15] F. Zhao, T. Nishide, and K. Sakurai, “Realizing Fine-Grained and
Flexible Access Control to Outsourced Data with Attribute-Based
Cryptosystems,” Proc. Seventh Int’l Conf. Information Security
Practice and Experience (ISPEC), pp. 83-97, 2011.
[16] S. Ruj, A. Nayak, and I. Stojmenovic, “DACC: Distributed Access
Control in Clouds,” Proc. IEEE 10th Int’l Conf. Trust, Security and
Privacy in Computing and Communications (TrustCom), 2011.
[17] http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-cs01-en.pdf, 2013.
[18] http://securesoftwaredev.com/2012/08/20/xacml-in-the-cloud,
2013.