# RACHEM: Reinforced Reliable Computing in Cloud by Ensuring Restricted Access Control
### Cloud Security
Attribute-based RBAC implementations generally lack real-time credential validation and auditability, both of which are crucial in security-sensitive and compliance-driven cloud infrastructures. Traditional RBAC models also tend to assume the existence of a trusted identity management system but do not cryptographically bind roles to users in a verifiable and tamper-resistant manner. For example, the research work illustrated in [8] employs a homomorphic encryption scheme to ensure data privacy but does not integrate it with role-based access decisions that require identity validation. Likewise, the work suggested in [9] proposes a scalable and fine-grained access control system using proxy re-encryption and key policies, yet the approach presumes trusted key management and does not explicitly verify user role legitimacy during access enforcement. These models often depend on centralized control mechanisms and pre-defined encryption structures, which are unsuitable for the dynamic, scalable, and multi-tenant nature of cloud environments. Therefore, while traditional RBAC schemes and their extensions in [7; 8; 9; 10] provide a foundational framework for access control, they fall short in delivering secure and dynamic validation of user role credentials. Addressing these gaps requires the integration of hard security mechanisms, such as cryptographic role secrets, real-time authentication, and dynamic access policy updates, which are either inadequately handled or entirely absent in existing schemes. Data security at the cloud level can be compromised by various threats, including data breaches, unauthorized data access, Service-Level Agreement (SLA) violations, and cloud service abuse [11; 12; 13]. Major cloud platforms such as Amazon Web Services (AWS), Microsoft Azure, Google Cloud, and Oracle Cloud each employ their own proprietary security mechanisms to mitigate these risks. Oracle Cloud Infrastructure (OCI), for example, provides a comprehensive framework for managing user identities and controlling access to cloud resources. Its IAM system allows administrators to define precise access control policies, determining who can access specific resources and what actions they are permitted to perform. These policies are applied to user groups within organizational compartments, enabling fine-grained access control. OCI also supports advanced security features such as Single Sign-On (SSO), Multi-Factor Authentication (MFA), and identity federation, which collectively facilitate secure and seamless user authentication and authorization across Oracle's ecosystem and integrated third-party applications [14]. In the broader cloud computing industry, as of Q4 2024, AWS led the global cloud infrastructure market with a 31% share, followed by Microsoft Azure at 25%, and Google Cloud at 10%. IBM Cloud and Oracle Cloud accounted for smaller market shares, with 4% and 2%, respectively. These figures reflect the highly competitive nature of the cloud service landscape, where Oracle continues to expand its footprint by offering robust IAM solutions and integrated security services [15]. The security and access control features of AWS function according to a shared security responsibility framework, in which AWS maintains the underlying security of the cloud infrastructure, and the service users are responsible for protecting workloads that they utilize on AWS [16; 17]. The identity and access management in Microsoft Azure is supported using Azure Active Directory (AD) for role and service delegation. The role manager can grant and manage access privileges with Azure AD for RBAC. Azure AD provides conformity to safeguard the Cloud domain from unauthorized access by confirming whether the requested role resource's Application Programming Interface (API) call contains valid membership information; if not, the access is restricted [18]. Google Cloud grants permissions to their end users for data access by grouping them into roles and then authenticating them by their respective Google accounts [19].