![](bg2.png)
role-based encryption (RBE) scheme has been
proposed in (Zhou et al., 2011). In this scheme,
the user memberships are managed by individual
roles as opposed to a central administrator like in
other cryptographic RBAC schemes. These schemes
combine cryptographic techniques and access control
to protect the privacy of the data in an outsourced
environment where data can be encrypted in such a
way that only the users who are allowed by the access
policies can decrypt and view the data.
In some cases though the access control policies
may be specified by the cloud provider authority
itself in a centralised way, there could be multiple
authorities to enforce these access policies distributed
throughout the cloud system. Therefore there would
be a need to trust these authorities to correctly specify
the access control policies and enforce them properly.
In some cryptographic RBAC schemes, roles and
their users are managed by administrators who hold
the master secrets of the systems. All the administra-
tion tasks in these schemes are centralised. Therefore,
if one wants to know if a RBAC system is secure,
s/he only needs to determine the trustworthiness of
the administrator of the system.
However, in large-scale RBAC systems, it is
impractical to centralise the task of managing these
users and permissions, and their relationships with
the roles in a small team of security administrators.
The paper (Zhou et al., 2011) proposes a new crypto-
graphic RBAC scheme called Role-based Encryption
(RBE) in which the user management can be decen-
tralised to individual roles; that is, the administrators
only manage the roles and the relationship among
them while the role managers have the flexibility in
specifying the user memberships themselves. In this
paper, we consider trust models for cloud storage
systems that are using cryptographic RBAC schemes
like RBE, where each individual role manager can
manage their user memberships without the need of
involving the administrators. We believe this case is
more general and can be used in large-scale RBAC
systems. In such systems, the trust on the individual
roles needs to be considered instead of the trust on
the administrators.
There have been several trust models
(Chakraborty and Ray, 2006; Toahchoodee et al.,
2009) for RBAC proposed in the literature. These
trust model considered the trust on users to assist
the decision making about whether or not to grant
permissions to the users. In a cloud storage system
using cryptographic RBAC schemes, it would also
be helpful if a user could determine whether or not
a role in the system is trusted before joining it. This
would be useful especially in systems where there
is a cost for users to join a role, for example, users
need to pay the subscription fee for joining roles.
When a user evaluates the trust value of a role, s/he
will only proceed with joining the role if the trust
value of the role is above a certain trust threshold
(this threshold being set by the users, and being
different for different applications and context). In
a system where owners are allowed to choose the
roles to assign their data, from the users’ perspective,
malicious owners can also cause negative behaviours
of roles by assigning bad resources (e.g. virus,
malware) to roles. Therefore, roles will also need to
consider the trust of the data owners so that only data
from well-behaved owners will be accepted.
Contributions of this Paper. The main contributions
of this paper are trust models for securing data stor-
age in cloud storage systems that are using crypto-
graphic RBAC schemes. Though much work exists
on trust models in RBAC, none of this work consid-
ers the trust on the RBAC system itself. The pro-
posed trust models address the missing aspect of trust
in cryptographic RBAC schemes to improve the deci-
sion making for entities (users and role managers) in
the cloud system. This paper proposes trust models
to assist (i) the users to evaluate the trust on the roles
in a RBAC system and use this trust evaluation to de-
cide whether to join a particular role or not, and (ii)
the role managers to evaluate the trust on the owners
in the RBAC system and use this trust in the decision
to accept data from an owner. We refer to these trust
models as User RBAC and Role RBAC trust models
respectively. These trust models can not only prevent
users from joining roles which have bad historical be-
haviour in terms of sharing poor quality resources or
misleading users on the content of resources, but also
assist the roles to identify the malicious owners who
have caused bad impact on the roles’ trustworthiness.
Our users’ trust model takes into account the effect of
role inheritance in RBAC systems on the trust evalua-
tion. If a role A inherits all the permissions that a role
B has, then we say role A is a ancestor role of role
B, and role B is a descendent role of role A . We also
present the architecture of a trust-based cloud storage
system which integrates the trust models in a crypto-
graphic RBAC system. Furthermore, we describe the
relevance of the trust models by considering practi-
cal application scenarios and then illustrate how the
trust evaluations can be used to enhance the quality
of secure decision making by users and roles of cloud
storage service.
The paper is organised as follows. Section 2 re-
views relevant preliminary knowledge that is needed
for the design of our trust models. Section 3 describes
the trust issues in a cryptographic RBAC system and
Trust-basedSecureCloudDataStoragewithCryptographicRole-basedAccessControl
63