# RACHEM: Reinforced Reliable Computing in Cloud by Ensuring Restricted Access Control
## 2 Literature Survey
### Algorithmic Procedure for RACHEIM
Hence, the CSP does not have any direct access to the original data. **Theorem 2**. : _Let A be an adversary operating under the Canetti-Krauczyk (C and K) model attempting unauthorized access to cloud resources by leveraging a previously issued Secured Cookie Value (SCV). The RACHEIM protocol, which employs an ACL-validated role hierarchy and cryptographic role-secret mappings, ensures that unauthorized service requests are invalidated and that Perfect Forward Secrecy (PFS) is preserved. This holds even if the SCV is shared between the authentic user and an attacker._

Proof Sketch:The incapability of the attacker to distinguish between the actual key value and the random key values, assures \"Perfect Forward Secrecy\". The security analysis for the RACHEIM approach illustrates that the attacker maintains a set of fake role identities and the challenger maintains a set of authentic public identities and revoked role identities. To safeguard the system from continuous attacks, the formal analysis of the RACHEIM approach under the unauthenticated communication link model assumes that the attacker initiates the request to access the role secret value and the decryption key. The role secret value and decryption key ensures dual layer authentication by allowing only the users mapped at appropriate level in the role hierarchy to derive valid decryption keys. Further, malicious user_ids are revoked from the system and random values for role secret and decryption key ensure the soundness of access control. This theorem prevents privilege escalation and enforces consistent role-based access control across branches. \(\square\)

Initial information:

**SIG KEY-PERMISSION**

Step:1 Establish Session (user_id, role_id, ACL, S = Session)

If (S =1), and If (role_id, user_id) \(\in\) ACL, go to Step2, // {S = 1} implies an active session. else if S = 0 (session expires), re-establish the session. Step:2 For each active role_id, on input (role_id, KEY-PERMISSION MODULE)

**Initiate (PROTOCOL Perfect_Forward_Role_Key_Secrecy)**

Initial information

**SIG_Perfect Forward Role and Key Secrecy**

\(\mathrm{SEK}^{\prime}_{\mathrm{R_{i}}}\) : Random value of Role secret key

\(\mathrm{DK}^{\prime}_{\mathrm{U_{K}}}\) : Random value of Decryption key

Step 1: The attacker initiates a query [id, data access] to the system. Step 2: The Monitor-Role-Module of the RACHEIM validates the identity of the requested id. If a match exists between the requested id and the revoked id, then random deceptive key values are generated for role secret and decryption key \(\left(\mathrm{SEK}_{\mathrm{R_{i}}}\right)^{\prime}\) and \(\left(\mathrm{DK}_{\mathrm{U_{K}}}\right)^{\prime}\). Step 3: The attacker falsely believes that he has won the battle of data access since he is unable to distinguish between the actual key values and the fake key values. The security analysis for the RACHEIM approach emulates the notion of Perfect Forward Secrecy stated in C and K model and validates that the proposed work complies with the C and K adversary model. Step 4: If the session is active and the KEY PERMISSIONS = Denied, the attacker does obtain the access to the system, but is not able to fabricate the messages or hamper the integrity of the system. Step 5: An authentic service user qualifies for the KEY PERMISSION PROTOCOL and then decrypts the data encapsulated under the HE function using the SECRET KEY. Hence, the RACHEIM approach complies with the Secure Key-Exchange protocol and Network Authentication protocol to deal with the vulnerable CSP achieve the research gap REG-1. The proposed model complies with the Perfect Forward Secrecy protocol of the C and K adversary model to ensure restricted access control and achieve the research gap REG-2. The formal results demonstrate that RACHEIM not only protects data confidentiality but also guarantees policy-compliant, revocation-aware access enforcement in dynamic cloud environments.