Attribute-based access control management for multicloud collaboration

Security of applications has been identified as one of the major concerns in today's multicloud collaborative environment. These applications are often bounded by the constraints of the disparate cloud domains they are deployed in. A fine-grained access control mechanism such as attribute-based access control (ABAC) is considered to be an appropriate choice for authorization management in this context. However, identifying a suitable set of ABAC rules, often called rule mining, is a critical step in building ABAC-based systems. We propose 2 approaches for intercloud rule formation in ABAC. In the first approach, we consider cross domain rule mining as the problem of forming a minimal set of positive authorizations only. The second approach shows the advantage of developing deny rules along with positive authorizations in reducing the total number of rules, and hence, the response time for evaluating access requests. The problem is proved to be NP-hard. Heuristic solutions are proposed and evaluated on benchmark datasets showing encouraging results.