# RACHEM: Reinforced Reliable Computing in Cloud by Ensuring Restricted Access Control
## 2 Literature Survey
### Working Principle of RACHEIM  
In its initial phase, the proposed model employs a division-based homomorphic encryption scheme, utilizing a division operation to encrypt the data before it is uploaded to the cloud. Following encryption, the model enforces restricted access control through an RBAC mechanism. The proposed framework, RACHEIM, adopts an integrated approach to ensure secure and restricted access by managing secret key privileges based on user-to-role mapping credentials. During the second phase, the model implements an appropriate revocation scheme to address unauthorized service requests. Over time, there has been a significant surge in malicious web-based services, particularly those utilizing ransomware models [91]. These models compromise systems by issuing fraudulent permissions. The identity management component of RACHEIM effectively identifies and blocks such adversarial access attempts. Furthermore, it revokes malicious users from the ACL and places them on a revocation list. The proposed work underscores the importance of a role-based hierarchy in enforcing restricted access. Consequently, any service request to access cloud data is revoked by the Trusted Manager Module (TMM) and the Role Monitor Module (RMM) if the requesting user is not listed in the ACL. A primary concern for CSPs is the prevention of unauthorized access by previously authorized users whose access rights have since been revoked. RACHEIM addresses this by initializing role-based access parameters for the integrated model, with an RBAC controller subsequently managing privilege rights. This controller maps user-to-role credentials, as illustrated in [29], to represent the inheritance relationships among various roles. The proposed approach constructs an ACL consisting of permissible users and roles, managing data access accordingly. Figure 2 illustrates the working of the proposed model. Figure 2: Reinforced access control using homomorphic encryption and identity management (RACHEIM). The prime entities of the proposed model are the data owner, cipher cloud gateway, service user, ACL, Trusted Manager Module, Role Monitor Module, and the revocation list, as discussed below:  
1. Data Owner: The data owner is the primary entity whose data is under consideration for resource computation. Since the local servers of business enterprises have a heavy load of data, they often outsource their data for resource computations to cloud servers. Outsourcing of the data increases the possibility of data breach issues. 2. Cipher Cloud Gateway: The cipher cloud gateway encapsulates the owner's data with the arithmetic operator received from him with a homomorphic encryption function. 3. Service User: A service user in the RACHEIM model has two variants: (a) an authentic user that has a valid user-to-role membership in the ACL; (b) an adversary that aims to inject malicious script in the Cloud domain through the service request. 4. Access Control List (ACL): An ACL is a set of rules that specify which users/ roles are authorized to access data. The permission to grant a service is validated by authenticating appropriate role mapping in the ACL. If, for a requested service, a role-to-user mapping is not found in the ACL, then the respective request is revoked, and restricted access control is ensured. 5. Trusted Manager Module (TMM): This module manages the relationship among the roles in the role-based hierarchy. The TMM supervises the privilege rights and manages them strictly according to the authorized roles. Once the data access rights and permissions are validated, the TMM generates the keys for authentic service users and roles. The TMM is an integral component of RACHEIM. 6. Role Monitor Module (RMM): This module administers the roles. Hence, contrary to the traditional RBAC schemes, the need to assign role managers for individual tasks is eliminated in this work. Both the TMM and the RMM are extensive entities for handling system credentials. 7.