# RACHEM: Reinforced Reliable Computing in Cloud by Ensuring Restricted Access Control
## 2 Literature Survey
### Identity and Key Validation in RACHEIM  
The proposed work suggests a two-phase restricted access mechanism by validating identity and key credentials as follows. The owner of the data prepares a message encapsulating the data and the arithmetic operator through which computation is to be carried out on the data. The query for resource computation then passes through the interface of the CCG. Furthermore, the secure cipher cloud gateway safeguards the data by enclosing the original data and the division operator using the HE algorithm. This encrypted text is then uploaded onto the cloud domain along with the division operator, through which the computation is to be performed. This hides the contents of the owner's data and resource computation details from an untrusted CSP. Equations (1)-(3) illustrate the encryption and decryption processes for the proposed approach RACHEIM using a division-based approach [92; 93]. Encryption is carried out using Equation (1):  
\[\text{C}=(\text{V})^{\text{e}}\bmod(\text{n}) \tag{1}\]  
The CSP stores the result of the homomorphic encryption carried out using the division operator between two ciphertexts \(\text{C}_{1}\) and \(\text{C}_{2}\) as, \(\text{C}_{1}=\left(\text{V}_{1}\right)^{\text{e}}(\bmod\text{n})\) and \(\mathrm{C_{2}}=(\mathrm{V_{2}})^{\mathrm{e}}(\mathrm{mod}\,\mathrm{n})\)--and stores the value of the encoded text in \(\mathrm{C3}\) in the cloud to show division operation as an inverse multiplication using Equation (2):  
\[\mathrm{C_{3}}=\left(\mathrm{V_{1}}\times\mathrm{V_{2}}^{-1}\right)^{\mathrm{e} }\mathrm{mod}(\mathrm{n}) \tag{2}\]  
Decryption is performed using Equation (3):  
\[\mathrm{V}=(\mathrm{C})^{\mathrm{d}}\mathrm{mod}\,\mathrm{n} \tag{3}\]  
where \((\mathrm{d},\mathrm{n})\) is the generated private key for decryption. This model ensures data confidentiality and privacy even if the integrity of a CSP is compromised. The proposed model also suggests that the data owner need not blindly trust the CSP. Hence, it is imperative that during resource computation, the contents of the original data must be hidden from the CSP. In addition, RACHEIM also ensures that malicious attacks do not jeopardize the owner's data during any stage of the service communication. The work executes this by integrating partial homomorphic encryption with role-based access control. The use of homomorphic encryption enables secure computations on encrypted data without revealing its contents, protecting confidentiality, even from the CSP. Role-based access control further restricts data access through encrypted role keys and authenticated identity verification, preventing unauthorized use and privilege escalation. The framework also includes dynamic updates to access policies and revocation mechanisms, ensuring that revoked or malicious users are denied access in real-time. Together, these measures secure the data during storage, processing, and transmission, effectively mitigating risks from insider threats, interception, and misuse. In the proposed framework, all computations performed by the CSP are executed in encrypted form and are governed by the RBAC module. For each incoming service request, an identity management module is activated to verify the existence of a valid data entry. The validated identity and its corresponding role mapping are then cross-checked against the ACL. If a valid mapping is found, access is granted; otherwise, the request is denied. To ensure robust data integrity, the proposed model introduces a two-phase authentication mechanism. In the first phase, the system verifies the user-to-role mapping within the ACL. If a valid entry exists, the request proceeds to the second phase. This phase involves validating the key permissions associated with the request. Upon successful validation, the sender's private key is securely shared with the authorized service user to facilitate decryption.