Paper accepted at ASIACCS 2020

Published: Feb 15, 2020
The following paper has been accepted at the 15th ACM ASIA Conference on Computer and Communications Security (ASIACCS 2020):
  • Title: Exploring Architectures for Cryptographic Access Control Enforcement in the Cloud for Fun and Optimization
  • Authors: Stefano Berlato, Roberto Carbone, Adam J. Lee and Silvio Ranise
  • Abstract: To facilitate the adoption of cloud by organizations, Cryptographic Access Control (CAC) is the obvious solution to control data sharing among users while preventing partially trusted Cloud Service Providers (CSP) to access sensitive data. Indeed, several CAC schemes have been proposed in the literature. Despite their differences, available solutions are based on a common set of entities—e.g., a data storage service or a proxy mediating the access of users to encrypted data—that operate in different (security) domains—e.g., on-premise or the CSP. However, the majority of the CAC schemes assumes a fixed assignment of entities to domains; this has security and usability implications that are not made explicit and can make inappropriate the use of a CAC scheme in certain scenarios with specific requirements. For instance, assuming that the proxy runs at the premises of the organization avoids the vendor lock-in effect but may substantially mine scalability. To the best of our knowledge, no previous work considers how to select the best possible architecture (i.e., the assignment of entities to domains) to deploy a CAC scheme for the requirements of a given scenario. In this paper, we propose a methodology to assist administrators to explore different architectures of CAC schemes for a given scenario. We do this by identifying the possible architectures underlying the CAC schemes available in the literature and formalize them in simple set theory. This allows us to reduce the problem of selecting the most suitable architecture satisfying a heterogeneous set of requirements arising from the considered scenario to a Multi-Objective Optimization Problem (MOOP) for which state-of-the-art solvers can be invoked. Finally, we show how the capability of solving the MOOP can be used to build a prototype tool assisting administrators to preliminary perform a ``What-if'' analysis to explore the trade-offs among the various architectures and then use available standards and tools (such as TOSCA and Cloudify) for automated deployment in multiple CSPs.
  • DOI: 10.1145/3320269.3384767
  • Complementary Material: Link

About the conference

  • Name: 15th ACM ASIA Conference on Computer and Communications Security (ASIACCS 2020)
  • Date: from October 05, 2020 to October 09, 2020
  • Location: Virtual Event
  • Website:

Involved People

Berlato Stefano

Stefano Berlato

Carbone Roberto

Roberto Carbone

Ranise Silvio

Silvio Ranise

Lee Adam J.

Adam J. Lee