# Distributed Authentication and Authorization Models in Cloud Computing Systems: A Literature Review
## 3 Results
### Cloud Access Control Requirements Included in the Review
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Nr** & **Requirement** & **Description** & **Research** \\ \hline R1 & The privacy & The identities and attributes of cloud users must be unknown to the system at the time of the request & [9, 19, 20, 21] \\ \hline R2 & Users’ heterogeneity & An AC system should be able to effectively deal with the authorizations and authentication of many users with different attributes & [9, 15, 21, 22] \\ \hline R3 & Resource’s heterogeneity & AC should be able to support access to many resources of any kind & [22, 23, 24] \\ \hline R4 & Contextual information & All constraints should be taken into account in the decision-making process of AC & [20, 25, 26] \\ \hline R5 & Fine-grained AC & AC must have the ability to specify fine-grained policy which represents different access scenarios & [20, 22, 23, 25] \\ \hline R6 & The tenant can control users & Cloud ACM should provide the tenant with the opportunity to control its users and support policy specifications and apply them properly & [13, 20, 23] \\ \hline R7 & AC for network access & AC allows heterogeneous client devices to have access to a wide range of networks and through conventional protocols. & [20, 25, 27] \\ \hline R8 & Resource pooling & AC must consider the methods of implementing resource pooling while ensuring the isolation of shared resources & [21, 25] \\ \hline R9 & Rapid elasticity & AC must have the ability to quickly assess the security of new VMs and determine whether the newly added VMs are qualified to carry out a given activity & [21, 25, 26, 27] \\ \hline R10 & Protection of metering data & AC must consider the protection of metering data & [20, 21] \\ \hline R11 & Data Sharing & To make data sharing easier, concepts such as federated identity trust and AC attributes must be considered. Regardless of the service model, consumers are allowed to be accountable for the security of their data on the cloud and who has the right to access it & [20, 22, 28] \\ \hline R12 & Policy description & AC languages are compatible with all access control techniques and processes. & [9, 21, 25] \\ \hline R13 & Least privilege principle & Every subject in the cloud should be assigned the basic permissions & [20, 26, 28] \\ \hline R14 & Separation of duties & SoD should be considered in the design of the cloud access control model & [13, 25, 20] \\ \hline R15 & Delegation & It is essential to support the delegation in the access control policy & [21, 25, 29] \\ \hline R16 & Interoperability & AC support interoperability, integration, or migration from one service provider to another & [26, 27] \\ \hline R17 & Scalability & The maintenance, operation, and administration costs should not increase as the number of applications and customers rises & [20, 21, 26] \\ \hline R18 & Flexibility & The access rules and constraints in cloud AC should be applied without affecting the flexibility of the system. & [25, 26, 30] \\ \hline R19 & Confidentiality & When access control sets up a delegation in the cloud, the system should protect data confidentiality and user privacy & [20, 21, 22, 31] \\ \hline R20 & Functionality & AC implements different types of SoD without affecting the functionality of the system & [15, 25, 26, 31, 32, 33] \\ \hline R21 & Auditing & In AC systems, the audit is responsible for keeping track of the present state of the system, recording any failure to make a decision, and reporting any attempts to circumvent the access policy or change privileges & [20, 21, 34] \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Requirements included in the review. Six requirements (R6-R11) have defined the security requirements of cloud computing. However, these requirements have been defined based on a specific perspective of cloud models, implementation, or the type of service provided. The other requirements (R16-R22) represent the control characteristics for determining the ability of ACM to work in an open and dynamic environment.