# RACHEM: Reinforced Reliable Computing in Cloud by Ensuring Restricted Access Control
## 2 Literature Survey
### Algorithmic Procedure for RACHEIM
The MRM initiates a tuple \(<\mathrm{id}_{\mathrm{revu_{1}}}\mathrm{,add}_{\mathrm{user}}>\) to the CSP, where \(\mathrm{id}_{\mathrm{revu_{1}}}\) is the id of the revoked user, whose match is found in the set V. When the CSP encounters that the id initiating the request for accessing the system is a revoked user, they generate random role secret and decryption key values \(\left(\mathrm{SEK}_{\mathrm{R}_{\mathrm{i}}}\right)^{\prime}\) and \(\left(\mathrm{DK}_{\mathrm{U_{K}}}\right)^{\prime}\). These random key values are then forwarded by the challenger to the attacker. The attacker is given fake role secret and decryption key values. The attacker believes that as it has the role secret key \(\left(\mathrm{SEK}_{\mathrm{R}_{\mathrm{i}}}\right)^{\prime}\) and the decryption key \(\left(\mathrm{DK}_{\mathrm{U_{K}}}\right)^{\prime}\), the data access battle is won. Phase 2: During this phase, the attacker initiates system calls using the role secret and decryption key values received in the previous phase. However, since fake values of \(\left(\mathrm{SEK}_{\mathrm{R}_{\mathrm{i}}}\right)^{\prime}\) and \(\left(\mathrm{DK}_{\mathrm{U_{K}}}\right)^{\prime}\) were sent by the challenger, the attacker is neither able to access the data by acquiring a suitable role and nor is he able to decrypt it. Moreover, the attacker is revoked and added to the revocation list. #### 3.4.4 Threat-Response Mapping for RACHEIM

The proposed work discusses risks such as Sybil attacks (identity spoofing). To enhance the clarity of the proposed model, a formal threat-based tabular interpretation of the STRIDE framework (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is depicted in Table 3. \begin{table}
\begin{tabular}{c c c c} \hline \hline \multirow{2}{*}{\begin{tabular}{c} **Threat Category** \\ **(STRIDE)** \\ \end{tabular} } & \multirow{2}{*}{\begin{tabular}{c} **Potential Attack** \\ **Scenario** \\ \end{tabular} } & \multicolumn{1}{c}{\begin{tabular}{c} **Mitigation** \\ **Strategy Proposed** \\ **in** \\ **RACHEIM** \\ \end{tabular} } & \multirow{2}{*}{\begin{tabular}{c} **Security** \\ **Mechanism** \\ **Employed** \\ \end{tabular} } \\ \hline Spoofing & \begin{tabular}{c} Impersonation of a legitimate user to \\ gain unauthorized \\ access. \\ \end{tabular} & \begin{tabular}{c} User identity is \\ validated against \\ the ACL and role \\ hierarchy before \\ request processing. \\ \end{tabular} & \begin{tabular}{c} Role–user mapping \\ validation, ACL \\ checks, and role \\ secret verification. \\ \end{tabular} \\ \hline Tampering & \begin{tabular}{c} Malicious \\ modification of \\ data during \\ processing or \\ transit. \\ \end{tabular} & \
\begin{tabular}{c} CSP performs \\ computations only \\ on encrypted data \\ without access to \\ plaintext. \\ \end{tabular} &
\begin{tabular}{c} Partial \\ homomorphic \\ encryption (PHE) \\ for secure data \\ processing. \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Threat-response mapping for RACHEIM. ## 4 Simulation Results

The simulation for RACHEIM has been carried out in two phases. ### Analysis Based on Time

The simulation for the proposed model has been carried out in Python 3.13 on an Intel (R) Core (TM) i-7 processor, 1 TB HDD, 16.0 GB RAM, with Windows 11 Operating System. The service request of the data owner is handled by the cipher cloud gateway, which transforms the original data into an encrypted form. The ciphertext is then uploaded to the centralized cloud and the role-based access control policies are applied. The baseline cryptographic scheme for performance evaluation of the proposed model RACHEIM is the RSA Multiplicative Homomorphic Encryption Scheme [93]. The comparison is also carried out with the Paillier Additive Homomorphic Encryption Scheme [92]. Table 4 represents a quantitative comparison of the proposed RACHEIM model with two widely recognized partial homomorphic encryption schemes.