# Distributed Authentication and Authorization Models in Cloud Computing Systems: A Literature Review
## 1 Introduction  
Cloud computing is a prominent paradigm that provides cost-effective, on-demand services such as Software as a Service (SAAS), Platform as a Service (PAAS), and Infrastructure as a Service (IAAS). Despite these advantages, the cloud computing paradigm still confronts several challenges, including data security and privacy, cyber-attacks, and cloud service abuse.  
Among all cloud computing security techniques, access control (AC) plays an important role in preserving the integrity of the information by limiting alteration to resources only to legitimate users. In addition, access control protects confidentiality by ensuring that the data are disclosed only to customers who are authorized to access it. In addition, access control protects resources from unauthorized users launching denial-of-service attacks [1]. The data model that forms the basis of the implementation of access control is the \"Access Control Model\" (ACM) that defines the relationships between permissions, operations, objects, and subjects [2]. According to the definition of the National Institute for Standards and Technology (NIST), cloud computing is \" a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction\" [3]. In this definition, the cloud computing paradigm is specified as services working in distributed, open, dynamic, heterogeneous environments. As the functionality and services provided by cloud computing increase, access control to these services becomes more complex, andmore security breaches are generated [4]. This is primarily due to the advent of new requirements such as multi-tenant hosting, the dynamic change of the previously unknown users, the heterogeneity of users, security policies, resources, rules, and domains [5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19]. These requirements were not considered in full or partly in the design of the majority of traditional access control models such as in the mandatory access control (MAC), discretionary access control (DAC), and role-based access control (RBAC). Therefore, the identification of these new requirements is integral for designing an effective access control model for cloud environments, and they must be considered to specify access control for cloud-based services [6] Despite the importance of ACMs for data and privacy protection, there are relatively few studies that defined ACM requirements in a cloud environment, compared to a large number of proposed ACMs. This, therefore, leads to the design of ineffective ACMs. In this sense, the purpose of this paper is to present an integrative review of the research related to the requirements of ACMs in the cloud environment and to identify critical gaps that are not met by conventional access control models.  
This article is structured as follows: Section 2 presents the process of selecting articles, followed by Section 3 with a description of the results obtained through the analysis of selected articles. These results present the access control requirements and mechanisms in the cloud environment. In addition, the findings are discussed in Section 4, and the conclusions are presented in Section 5.