@article {Ayache2016189,
	title = {Analysis and verification of XACML policies in a medical cloud environment},
	journal = {Scalable Computing},
	volume = {17},
	number = {3},
	year = {2016},
	note = {cited By 2},
	pages = {189-205},
	abstract = {The connectivity of devices, machines and people via Cloud infrastructure can support collaborations among doctors and specialists from different medical organisations. Such collaborations may lead to data sharing and joint tasks and activities. Hence, the collaborating organisations are responsible for managing and protecting data they share. Therefore, they should define a set of access control policies regulating the exchange of data they own. However, existing Cloud services do not offer tools to analyse these policies. In this paper, we propose a Cloud Policy Verification Service (CPVS) for the analysis and the verification of access control policies specified using XACML. The analysis process detects anomalies at two policy levels: a) intra-policy: detects discrepancies between rules within a single security policy (conflicting rules and redundancies), and b) interpolicies: detects anomalies between several security policies such as inconsistency and similarity. The verification process consists in verifying the completeness property which guarantees that each access request is either accepted or denied by the access control policy. In order to demonstrate the efficiency of our method, we also provide the time and space complexities. Finally, we present the implementation of our method and demonstrate how efficiently our approach can detect policy anomalies. {\textcopyright} 2016 SCPE.},
	doi = {10.12694/scpe.v17i3.1180},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84986332574\&doi=10.12694\%2fscpe.v17i3.1180\&partnerID=40\&md5=86b782c01a2231027ed2e7308e178385},
	author = {Ayache, M.a and Erradi, M.a and Khoumsi, A.b and Freisleben, B.c}
}
@conference {Ayache201655,
	title = {Towards an efficient policy evaluation process in multi-tenancy cloud environments},
	booktitle = {CCSW 2016 - Proceedings of the 2016 ACM Cloud Computing Security Workshop, co-located with CCS 2016},
	year = {2016},
	note = {cited By 0},
	pages = {55-59},
	abstract = {Cloud computing offers most of its services under multi-tenancy environments. To satisfy security requirements among collaborating tenants, each tenant may define a set of access control policies to secure access to shared data. Several cloud solutions make use of XACML to specify such policies. However, existing implementations of XACML perform a brute force search to compare a request to all existing rules in a given XACML policy. This decreases the decision process (i.e., policy evaluation) performance especially for policies with a large number of rules. In this paper, we propose an automata-based approach for an efficient XACML policy evaluation. We implemented our approach in a cloud policy engine called X2Automata. The engine first converts both XACML policies and access requests to automata. Second, it combines the two automata by a synchronous product. Third, it applies an evaluation procedure to the resulting automaton to decide whether an access request is granted or not. To highlight the efficiency of X2Automata, we compare its performance, based on the OpenStack cloud environment, with the XACML implementation named Balana. {\textcopyright} 2016 ACM.},
	doi = {10.1145/2996429.2996431},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85001655008\&doi=10.1145\%2f2996429.2996431\&partnerID=40\&md5=8259d7215d88c0a1a7a94d837b9564a3},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b and Khoumsi, A.c}
}
@conference {Ayache201526,
	title = {Access control policies enforcement in a cloud environment: Openstack},
	booktitle = {Proceedings of the 2015 11th International Conference on Information Assurance and Security, IAS 2015},
	year = {2015},
	note = {cited By 1},
	pages = {26-31},
	abstract = {Cloud computing has become a widely used paradigm in many IT domains such as e-health. It offers several advantages to the users, e.g. elasticity, flexibility and the rapid sharing of a huge set of digital data. However, many security and privacy concerns still pose significant challenges. In particular, the most identified problem is how to enforce the user{\textquoteright}s security policy in the access control of the outsourced data. In fact, cloud environments does not provide facilities to support high level defined security policies. For instance, the swift storage component of openstack supports only fine grained access control to execute a specific action on a specific defined object. In this paper, we designed and implemented a middleware to provide high level security policies while using such swift fine grained primitives. An e-health collaborative application dedicated for remote diagnosis is used to illustrate the suggested approach. {\textcopyright} 2015 IEEE.},
	doi = {10.1109/ISIAS.2015.7492740},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84979530321\&doi=10.1109\%2fISIAS.2015.7492740\&partnerID=40\&md5=bc070d8bb2973f9f221582272c86a588},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b}
}
@conference {Ayache2015771,
	title = {CurlX: A middleware to enforce access control policies within a cloud environment},
	booktitle = {2015 IEEE Conference on Communications and NetworkSecurity, CNS 2015},
	year = {2015},
	note = {cited By 3},
	pages = {771-772},
	abstract = {Today cloud security and privacy concerns pose significant challenges. One particular challenge consists in how to take into consideration the user{\textquoteright}s security policies while accessing the outsourced data. In fact, for a given application, we may have a set of rules, as high level security policy, which needs to hold prior to any query execution. Therefore, the main problem that we tackle in this ongoing project is how to enforce this high level security policy in the cloud storage layer without conflicts. To address this challenges, we propose a middleware denoted curlX which consists of two main processes: the security policy enforcement process and the verification process. {\textcopyright} 2015 IEEE.},
	doi = {10.1109/CNS.2015.7346928},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84966440949\&doi=10.1109\%2fCNS.2015.7346928\&partnerID=40\&md5=bc69af0f99d640d39aa014a6a06475e9},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b}
}
