# RACHEM: Reinforced Reliable Computing in Cloud by Ensuring Restricted Access Control
## 2 Literature Survey
### Algorithmic Procedure for RACHEIM  
This section illustrates the algorithmic procedure for RACHEIM. The work manages restricted access control by integrating modified identity and broadcast-based encryption schemes and RBAC policy. The approach has seven algorithms for identity-based encryption to implement RBAC. These include system setup, extraction of a user, role management, addition of a user, encryption, decryption, and revocation. The algorithmic approach for RACHEIM is given below (Algorithm 1). ```
Function Setup() {  Initiate the system and permit requests;  if (the request is within the permissible range of created ACL)  Permit request to enter Extract phase;  else  Reject the request; }
```  
\begin{table}
\begin{tabular}{c l} \hline \hline
```
FunctionExtract() { Input:newrequest(eitherID\({}_{U_{K}}\)orID\({}_{R_{i}}\)); if(request==newrequest) { CheckACLforthemappingofID\({}_{U_{K}}\)toID\({}_{R_{i}}\); if(requestedID==ID\({}_{U_{K}}\))  TMMcomputesandgrantsD\({}_{U_{K}}\)totheuser; elseif(ID==ID\({}_{R_{i}}\))  TMMcomputesandgrantsthetuple<ID\({}_{R_{i}}\),SEK\({}_{R_{i}}\)>toRMM; } }
```  
FunctionRole_Management() { Input:ID\({}_{R_{i}}\),{RUL},role_attributes={read,write,modify}; if(attributesofID\({}_{R_{i}}\)matchattributesofanyrolein{RUL}) { AssignID\({}_{R_{i}}\)anewparentroleID;  Updatetherolehierarchy; } } FunctionAdd_User_to_Role() { Input:ID\({}_{U_{K}}\),{RUL},ID\({}_{R_{i}}\); if(ID\({}_{U_{K}}\)\(\
otin\){RUL}) {  RMMsendsatuple<ID\({}_{U_{K}}\),SEK\({}_{R_{i}}\)>toCSP; if(CSPreturnsavalvalidSEK\({}_{R_{i}}\)valueforID\({}_{U_{K}}\))  AdduserID\({}_{U_{K}}\)totheroleID\({}_{R_{i}}\); else  Rejecttheadduserrequest; } } FunctionRevoke_User() { Input:ID\({}_{U_{K}}\),{RUL},Role(ID\({}_{R_{i}}\)); ForeachuserID\({}_{U_{K}}\)wheretheSEK\({}_{R_{i}}\)valueisinconsistentwithCSP: { (i)RMMinitiates(ID\({}_{U_{K}}\),revoke)athesCSP'send; (ii)CSPgeneratesrandomvaluesofsecretkeys: \(\text{SEK}^{\prime}_{R_{i}}\)and\(\text{DK}^{\prime}_{U_{K}}\)topreventherafiousactivitiesbytherevokedusers; } } } FunctionEncrypt()```
The data owner encrypts a message V (Plaintext) related to role \(\text{R}_{\text{i}}\) using Equations (1) and (2) through a secure encryption scheme; Generate Ciphertext (C) and send to CSP;  Ciphertext can only be decrypted by authenticated users; } Function Decrypt() { Input: \(\text{ID}_{\text{U}_{\text{K}}}\), Role(\(\text{ID}_{\text{R}_{\text{i}}}\)); if (\(\text{ID}_{\text{U}_{\text{K}}}\in\{\text{RUL}\}\)) {  CSP returns \(\text{D}\text{K}_{\text{U}_{\text{K}}}\) to the user;  User sends tuple <CT, \(\text{D}\text{K}_{\text{U}_{\text{K}}}\)> to CSP;  Access is granted and file is decrypted using Equation (3); } else if (\(\text{ID}_{\text{U}_{\text{K}}}\)@ { {RUL}} OR \(\text{ID}_{\text{U}_{\text{K}}}\in\{\text{revoked user list}\}\)) { CSP generates random values: \(\text{SE}\text{K}_{\text{R}_{\text{i}}}^{\prime}\) and \(\text{D}\text{K}_{\text{U}_{\text{K}}}^{\prime}\) for unauthorized request IDs; } }
```

**Algorithm 1**_Cont_. Each module defined in the algorithmic procedure is defined below as follows:

1. Setup: This procedure handles new service requests. A service request can be for the addition of a new user_id or a new role_id. The proposed model restricts a limit on the number of role_ids an SU holds in a role-based hierarchy. Any service request exceeding the permissible limit is rejected at the administrator end by the TMM and at the extraction stage by the monitor role module (RMM). 2. Extraction: This stage forwards the service requests initiated during the setup phase to the Trusted Group Manager module. Following calculations are carried out by the TMM. New service request parameters are matched with the existing identities (roles or users) in the ACL.