# Distributed Authentication and Authorization Models in Cloud Computing Systems: A Literature Review
## 3 Results
### Cloud Access Control Mechanisms Included in the Review
#### 3.2.3 Role-Based Access Control (RBAC)  
The central purpose of RBAC proposed by [30] is to deal with security management complexity in large organizations by replacing the subjects in the ACLs model with roles and assigning separately each subject to a role. This means that access control decisions are made based on the user's roles and responsibilities that are trying to access services or protected resources. RBAC uses security assurance principles such as least privilege and static and dynamic separation of duties. This model has a centralized administration by using a central protected base managed by a single authority, which comprises all the security policies for the organization. When a user is assigned a role, that user instantly has all the rights and privileges of that role. Although this approach simplifies the management of subjects and objects in the system and reduces the cost, complexity, and errors, it cannot be scaled for many anonymous users, especially in a coalition environment where organizations that collaborate in the cloud have no secure centralized authority [30]. In RBAC, subjects are assigned roles and permissions to objects by the administrator, which is cumbersome and expensive because of \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Mechanism** & **Description** & **Research** \\ \hline \multirow{3}{*}{Discretionary access control (DAC)} & Each user is uniquely distinguished by his/her identity and, on the basis of this identity and authorization policies, DAC can make access control decisions & [27; 28; 29] \\ \hline Mandatory access control (MAC) & The owner does not make access decisions; instead, a central authority makes the policy decision & [6; 28] \\ \hline \multirow{3}{*}{Role-based access control (RBAC)} & Access control decisions are made based on the user’s roles and responsibilities, that are trying to access services or protected resources & [22; 26; 35; 36; 37] \\ \hline \multirow{3}{*}{Attribute-based access control (ABAC)} & The attributes of the involved entities are the basis to make the access control decision. & [13; 23; 37] \\ \hline \multirow{3}{*}{Identity-Based Encryption (IBE)} & A master public key and private key are used for encryption and decryption, the data owner can encrypt the data using the receiver’s public key, and the receiver can decrypt the data using his private key & [20; 24] \\ \hline \multirow{3}{*}{Attribute-based encryption access control (ABAC)} & The ABEAC generates encryption keys and a ciphertext based on the user’s attributes & [38; 39] \\ \hline \multirow{3}{*}{Trust-based Access Control Model (TBAC)} & The roles are assigned to users based on their trust value. & [19; 25; 38] \\ \hline \multirow{3}{*}{Risk-based Access control models (RiskBAC)} & Statistical methods are used to determine and calculate factors contributing to risk in a user’s inquiry & [21; 25] \\ \hline \multirow{3}{*}{Multi-Tenant Access Control (MTAC)} & The access decision depends on the attributes of tenants, networks, storage, and other resources in the cloud & [15] \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Access control mechanisms included in the review. the large number of users and resources in the cloud. The traditional operation-object form is used to represent the authorization in RBAC. However, this paradigm makes security management worse with many objects, different operations, and object hierarchy [31]. A common drawback of RBAC is that it is a coarse-grained access control model that is incapable of dynamically adapting permissions by environment information, such as time and location. However, such factors are used partially in RBAC extensions [37]. Most of the existing cloud platforms do not support assigning users to roles. Instead, each user in the cloud is independent of others and is assigned a root privilege to access resources [32]. In IaaS platforms such as Amazon's EC2, Eucalyptus provides limited support for the RBAC mechanism.