When an organization moves its hardware resources to a cloud infrastructure as a service (IaaS) provider, it faces 2 major issues: (1) cumbersome abstractions of access control facilities provided by the cloud service provider over its virtual assets (compute, storage, networking, etc.), and (2) multi-tenancy and availability concerns arising due to lack of control of virtual resource placement in the physical infrastructure. This project develops a foundational, formal theory of attribute-based access control (ABAC) and constraints specification, and associated enforcement and implementation as means to address these problems. The ABAC models are designed in such a way so as to provide each customer of the cloud service provider autonomy over access control design and specification, and administrative functions involving the customer's virtual resources and users. The constraints specification framework allows for customers to express resource scheduling preferences to mitigate multi-tenancy and availability issues (e.g. do not co-locate virtual machines tagged as sensitive with those of other customers) which are then algorithmically enforced by the service provider. Rigorous evaluation is performed by augmenting OpenStack, widely-deployed open-source cloud IaaS software, with ABAC and studying its expressiveness, user-friendliness and performance on large-scale physical infrastructure. The expected outcome of this research is to gain consensus in the research and practitioner community that ABAC would be a standard and viable approach for effective access control in the multi-billion dollar cloud IaaS industry.
