An administrative model for UCON ABC UCON is an emerging access control framework that lacks an administration model. In this paper we define the problem of administration and propose a novel administrative model. At the core of this model is the concept of attribute, which is also the central component of UCON. In our model, attributes are created by the assertions of subjects, which ascribe propertiesrights to other subjects or objects. Through such a treatment of attributes, administration capabilities can be delegated from one subject to another and as a consequence UCON is improved in three aspects. First, immutable attributes that are currently considered as external to the model can be incorporated and thereby treated as mutable at tributes. Second, the current arbitrary categorisation of users (as modifiers of attributes), to system and administrator can be removed. Attributes and objects are only modifiable by those who possess administration capability over them. Third, the delegation of administration over objects and properties that is not currently expressible in UCON is made possible.

Preauthorization Usage Control Mechanism for CrossDomain in Cloud With the increase of information resources, resources are uploaded to different cloud services in different domains. In order to facilitate crossdomain access, it is necessary to grant access authority to the subject before crossdomain access. Therefore, it has gradually become a necessary trend to apply preauthorization access control mechanism in crossdomain. However, in this cloud service mode, preauthorization for crossdomain access still has some problems, such as illegal access to resources, high cost of attribute mapping, easy disclosure of privacy, etc. The above problems bring a series of new requirements for crossdomain access control in cloud, such as finegrained preauthorization access control, privacy protection and reducing mapping cost. In order to meet these requirements, a preauthorization usage control mechanism for attribute update in access execution (UCONpreA2) is proposed in this paper, and formally described. And then, the global attribute is divided into static attribute and dynamic attribute, and using local attributes for mapping. Our case analysis shows that the access control mechanism can meet the above series of requirements.