# RACHEM: Reinforced Reliable Computing in Cloud by Ensuring Restricted Access Control
## 2 Literature Survey
### Algorithmic Procedure for RACHEIM
The RMM issues (\(\text{ID}_{\text{U}_{\text{K}}}\),revoke) to the CSP and random values of \(\text{SEK}_{\text{R}_{\text{i}}}\) and \(\text{DK}_{\text{U}_{\text{K}}}\) values, \((\text{SEK}_{\text{R}_{\text{i}}})^{\prime}\) and \((\text{DK}_{\text{U}_{\text{K}}})^{\prime}\) are generated by the CSP to manage the revoked users at later stages. The flowchart for the algorithmic procedure of the proposed model is depicted in Figure 3.

Figure 3: Flowchart for the algorithmic procedure of RACHEIM. ### Security Analysis of RACHEIM

In recent times, there has been a significant growth in the need for the cloud and the reliance of SUs in the cloud domain. If the projections made in [94] come to fruition, by the end of 2025, more than 80 percent of \(\Pi\)-rendering enterprises will scale their business outsourcing to the cloud domain. Hence, it becomes imperative for the service providers to associate and build strong security. RACHEIM uses role-based hierarchical relationships to demonstrate appropriate user-to-role mapping in the ACL. The identity management module initiates a system call to check if the key privileges are authenticated. RACHEIM security analysis defines access control through role hierarchy as \"A partially ordered set of roles R (r\({}_{1}\), r\({}_{2}\), r\({}_{3}\).....r\({}_{i}\), r\({}_{j}\).. r\({}_{n}\)), with a reflexive-transitive inheritance relation inherits (r\({}_{i}\), r\({}_{j}\)) where r\({}_{i}\) inherits all permissions from r\({}_{j}\). The ACL maps each user u \(\in\) U to a role r \(\in\) R, and permissions are assigned to roles. Access is granted if there exists a valid assignment assign (u, r) such that permission holds true for that role, considering the inherited permissions across the hierarchy. This function returns a permit or deny decision based on the user's identity, role assignment\". Once the testimony is attained for both of the two phases, authorized access is said to be granted. Figure 4 shows an inheritance-based role hierarchy with double authentication. RACHEIM suggests a mitigation scheme to handle cloud assaults like Privilege Escalation, Service Injection threats, Sybil attacks through the dynamic update of roles, key parameters and revoked users. #### 3.4.1 Privilege Escalation and Service-Injection Attack

RACHEIM handles the Service-Injection Attacks and Escalation of Privileges by monitoring the inherent role-based hierarchy. The role-based hierarchical relationship shown in Figure 4 illustrates that the roles R\({}_{2}\) and R\({}_{3}\) inherit their permissions and accessibility from

Figure 4: Role-based inheritance hierarchy. their parent role R\({}_{1}\). Access privileges are managed by the role-inheritance hierarchy. The proposed model implements least privilege policy by performing the following:

* Ensuring that the role R\({}_{1}\) has permissions strictly required for role hierarchy control, not unnecessary access to sensitive data;
* Following Key Isolation Rule for each role that maintains cryptographic separation between the roles, so that even if R\({}_{1}\) is compromised, it does not expose the access keys to roles R\({}_{2}\)-R\({}_{6}\);
* Appropriate validation rules are executed at each stage for every role using Salesforce Cloud to check user-to-role mapping and access permissions;
* Continuously monitoring role inheritance hierarchy to identify any excessive privilege propagation. Role R\({}_{2}\) may have permission to issue a write operation for transactions accessed by roles R\({}_{4}\) and R\({}_{5}\). However, role R\({}_{3}\) may only have permission to read those files. Roles R\({}_{4}\) and R\({}_{5}\), not being direct descendants of role R\({}_{1}\), may inherit write permissions from their parent role R\({}_{2}\), while role R\({}_{3}\) may not inherit these permissions directly from [PERSON]\({}_{1}\). Hence, if role R\({}_{3}\) issues a write request, the data access is denied. Hence, restricted access is managed using the hierarchical structure.