PERM: Streamlining Cloud Authorization With Flexible and Scalable Policy Enforcement

Authorization is a key component of cloud security. However, the differences in access control mechanisms in heterogeneous cloud environments bring many challenges to cloud users, such as the need to learn multiple policy languages and the difficulty in implementing unified access control across clouds. To address these issues, this paper proposes a new access control policy language called PERM, which achieves flexible support for various fine-grained access control models by separating authorization logic from specific policy rules, and significantly reduces the complexity of policy definition. In addition, we also design a distributed PERM enforcement framework named List-Leafed Decision Tree (L2DT), which leverages a list-tree structure and distributed key-value storage to achieve efficient policy storage and execution. We implement prototypes of PERM and L2DT based on Java and Python, and conduct comprehensive evaluations using OpenStack and XACML datasets. Experimental results show that L2DT can achieve scalable policy execution with small latency overhead (an average of 8.63% in the OpenStack scenario and 5.45% in the XACML scenario). The research in this paper provides new ideas for building flexible, efficient, and scalable access control mechanisms in cloud environments.