International Journal of Security and Its Applications Vol. 10, No. 11 (2016), pp.187-200 http://dx.doi.org/10.14257/ijsia.2016.10.11.17 ISSN: 1738-9976 IJSIA Copyright ⓒ 2016 SERSC Blacklisting and Forgiving Coarse-grained Access Control for Cloud Computing Khaled Riad 1,2 1 School of Computer and Communication Engineering, University of Science and Technology Beijing, Beijing, 100083, China 2 Mathematics Department, Faculty of Science, Zagazig University, Zagazig, 44519, Egypt khaled.riad@science.zu.edu.eg Abstract Cloud security is a shared responsibility between cloud providers and users. Reaching to an agreement about the dynamic policies considered for the access control decision- making process is not an easy task in cloud computing. Such dynamic policies can be built in a coarse-grained sharing manner between cloud providers and data owners. The trust notation can provide these dynamic policies, based on multiple factors that can accurately compute the user’s trust level for the granting access entity. In this paper, we have introduced the formal trust definition, which imports a novel method to provide the basis for granting access. It is based on two factors and their semantic relations which investigate important measures for the cloud environment. Also, a new Blacklisting and Forgiving Coarse-grained Access Control (BF-CAC) model has been proposed. The proposed model supports changing the user’s assigned permissions dynamically based on its trust level. In addition, BF-CAC ensures secure resource sharing between potential untrusted tenants. The proposed model has been implemented on our private cloud environment based on OpenStack. Finally, the experimental results have indicated that the trust level is decaying over time, thus no user can be trusted forever. Also, the number of assigned permissions for the same user is dynamically changing with the user’s final trust level. Keywords: Trust; cloud security; access control models; coarse-grained policy 1. Introduction Cloud computing is massively scalable, elastic, and inherently dynamic which pose several challenges for cloud access control. The cloud resources are provided by multiple service providers with different policies. Cloud computing is suffering from many security issues, which impacted its wide adoption for enterprises and organizations. Moreover the cloud resources are provided by different service providers, which may reside in another country with different regulations. As a shared environment, data may face issues like privacy and unauthorized access. Cloud providers offer flexible and always available access to users so, unfortunately, roles and access permissions are less controllable due to the distinguished nature of cloud computing [1]. Also, cloud users may need to acquire permissions from different domains based on the service they need. Cloud has to cooperate and spread across providers’ boundaries to accomplish the requested service. The distinguished cloud computing nature introduces novel challenges and authorization requirements, which are fully described in [1]. The basic authorization requirements, that any access control model is going to be applied for cloud computing must fulfill, are as follows: Least of Permissions () , Delegation of Capabilities Online Version Only. Book made by this file is ILLEGAL.