## 4 Blockchain-Assisted Cloud Frameworks: Security Perspective
### Decentralized Access Control Mechanisms
A SR has attributes like channel_ID, block height, and transaction offset. LR stores the data in the form of a key and value pair. The attributes of A LR are data type, data owner name, cloud name, and the path of the data file in the cloud. A SR is generated by the client and distributed among all the consumers by the data owner. Using this SR, anyone can locate the LR in the blockchain. In this model, the operation tracing method is discussed by two protocols, which are operation logging and tracing protocol. Every operation held on the cloud is submitted by the client and recorded by the smart contract. If the operation reaches consensus, then a temporary operation record will be created. After this, the client submits the block height and transaction offset of the temporary operation record. Then, it will be converted into a permanent operation record. The value part of the operation record contains three fields and the traceability field is one of them. This field stores the prior and next operation keys; hence, it will be easy to trace the operation. A CP-ABE-based access control scheme along with a re-encryption process is suggested in [64]. As per the requested user's attribute list, the data owner and attribute authority generate an access policy using CP-ABE and they share their generated keys with the user. After obtaining the keys, the user now send a request for secret key generation to a blockchain. The data owner generates the ciphertext of the data using an access structure and for the re-encryption process they share the ciphertext with the attribute authority. The attribute authority then sends the storage request for the re-encrypted text and header information to the CSP. Only the authenticated user can decrypt the re-encrypted data. Attribute-based access control along with accountability was proposed with the name \"BC-ABAC\" by the authors of paper [65]. The storage and access procedure of data is shown in Figure 8, where the storage and access steps are defined with the prefixes O and U. First of all, the user provides his/her attributes to Trusted Attribute Authorities (TAAs) for verification, after which the CSP creates an access session for this user. To maintain accountability, after each access session the CSP publishes the URL of all data usages files along with the hash and user address and stores it on a blockchain to make it available publicly, so that all participants of the network can monitor the user activities. Figure 7: The procedure of data uploading and sharing of the model “CBFF” [63]. A cloud access control scheme with attribute-based searchable encryption is proposed in the paper [66]. In this paper, the data owner uses the AES algorithm to encrypt the data. Then, they share the access policy and public key with a proxy encryption server, which calculates the proxy-encrypted ciphertext. The data owner now runs an encryption algorithm by parsing the public key, symmetric key, keyword, and proxy-encrypted ciphertext to obtain the ciphertext. To access the data, the user first of all calls the token generation algorithm. Through the keyword and token, a search operation is executed in a blockchain. Whenever the keywords match, the blockchain returns the ciphertext to the user. Table 1 shows the comparison of the above-discussed models in terms of five security factors, confidentiality, integrity, availability, accountability, and privacy, where factors that are achieved by these models are represented as True, and those that are not with False. There is no suggested technique to trace the records of executed operations in the papers [61, 62, 63, 64, 66]. As a result, accountability is compromised. This problem is solved in the models named \"CBFF\" and \"BC-ABAC\" [63, 65]. In \"CBFF\" [63], the SR is used to locate the LR in the blockchain, which is shared with all users by the data owner. Due to this, privacy may be compromised. In [65], the data owner stores both the encrypted data and decryption key in the cloud.