@conference {Ayache201655,
	title = {Towards an efficient policy evaluation process in multi-tenancy cloud environments},
	booktitle = {CCSW 2016 - Proceedings of the 2016 ACM Cloud Computing Security Workshop, co-located with CCS 2016},
	year = {2016},
	note = {cited By 0},
	pages = {55-59},
	abstract = {Cloud computing offers most of its services under multi-tenancy environments. To satisfy security requirements among collaborating tenants, each tenant may define a set of access control policies to secure access to shared data. Several cloud solutions make use of XACML to specify such policies. However, existing implementations of XACML perform a brute force search to compare a request to all existing rules in a given XACML policy. This decreases the decision process (i.e., policy evaluation) performance especially for policies with a large number of rules. In this paper, we propose an automata-based approach for an efficient XACML policy evaluation. We implemented our approach in a cloud policy engine called X2Automata. The engine first converts both XACML policies and access requests to automata. Second, it combines the two automata by a synchronous product. Third, it applies an evaluation procedure to the resulting automaton to decide whether an access request is granted or not. To highlight the efficiency of X2Automata, we compare its performance, based on the OpenStack cloud environment, with the XACML implementation named Balana. {\textcopyright} 2016 ACM.},
	doi = {10.1145/2996429.2996431},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-85001655008\&doi=10.1145\%2f2996429.2996431\&partnerID=40\&md5=8259d7215d88c0a1a7a94d837b9564a3},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b and Khoumsi, A.c}
}
@conference {Benkaouz201672,
	title = {Work in progress: K-nearest neighbors techniques for ABAC policies clustering},
	booktitle = {ABAC 2016 - Proceedings of the 2016 ACM International Workshop on Attribute Based Access Control, co-located with CODASPY 2016},
	year = {2016},
	note = {cited By 0},
	pages = {72-75},
	abstract = {In this paper, we present an approach based on the K- Nearest Neighbors algorithms for policies clustering that aims to reduce the ABAC policies dimensionality for high scale systems. Since ABAC considers a very large set of attributes for access decisions, it turns out that using such model for large scale systems might be very complicated. To date, researchers have proposed to use data mining techniques to discover roles for RBAC system construction. In this work in progress, we consider the usage of KNN-based techniques for the classification of ABAC policies based on similarity computations of rules in order to enhance the ABAC exibility and to reduce the number of policy rules. {\textcopyright} 2016 ACM.},
	doi = {10.1145/2875491.2875497},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84966549589\&doi=10.1145\%2f2875491.2875497\&partnerID=40\&md5=2378f9f3208a82bfc833b26f1a7ef267},
	author = {Benkaouz, Y.a and Erradi, M.a and Freisleben, B.b}
}
@conference {Ayache201526,
	title = {Access control policies enforcement in a cloud environment: Openstack},
	booktitle = {Proceedings of the 2015 11th International Conference on Information Assurance and Security, IAS 2015},
	year = {2015},
	note = {cited By 1},
	pages = {26-31},
	abstract = {Cloud computing has become a widely used paradigm in many IT domains such as e-health. It offers several advantages to the users, e.g. elasticity, flexibility and the rapid sharing of a huge set of digital data. However, many security and privacy concerns still pose significant challenges. In particular, the most identified problem is how to enforce the user{\textquoteright}s security policy in the access control of the outsourced data. In fact, cloud environments does not provide facilities to support high level defined security policies. For instance, the swift storage component of openstack supports only fine grained access control to execute a specific action on a specific defined object. In this paper, we designed and implemented a middleware to provide high level security policies while using such swift fine grained primitives. An e-health collaborative application dedicated for remote diagnosis is used to illustrate the suggested approach. {\textcopyright} 2015 IEEE.},
	doi = {10.1109/ISIAS.2015.7492740},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84979530321\&doi=10.1109\%2fISIAS.2015.7492740\&partnerID=40\&md5=bc070d8bb2973f9f221582272c86a588},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b}
}
@conference {Ayache2015771,
	title = {CurlX: A middleware to enforce access control policies within a cloud environment},
	booktitle = {2015 IEEE Conference on Communications and NetworkSecurity, CNS 2015},
	year = {2015},
	note = {cited By 3},
	pages = {771-772},
	abstract = {Today cloud security and privacy concerns pose significant challenges. One particular challenge consists in how to take into consideration the user{\textquoteright}s security policies while accessing the outsourced data. In fact, for a given application, we may have a set of rules, as high level security policy, which needs to hold prior to any query execution. Therefore, the main problem that we tackle in this ongoing project is how to enforce this high level security policy in the cloud storage layer without conflicts. To address this challenges, we propose a middleware denoted curlX which consists of two main processes: the security policy enforcement process and the verification process. {\textcopyright} 2015 IEEE.},
	doi = {10.1109/CNS.2015.7346928},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84966440949\&doi=10.1109\%2fCNS.2015.7346928\&partnerID=40\&md5=bc69af0f99d640d39aa014a6a06475e9},
	author = {Ayache, M.a and Erradi, M.a and Freisleben, B.b}
}
@article {Benkaouz201594,
	title = {Distributed privacy-preserving data aggregation via anonymization},
	journal = {Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)},
	volume = {9466},
	year = {2015},
	note = {cited By 0},
	pages = {94-108},
	abstract = {Data aggregation is a key element in many applications that draw insights from data analytics, such as medical research, smart metering, recommendation systems and real-time marketing. In general, data is gathered from several sources, processed, and publicly released for data analysis. Since the considered data might contain personal and sensitive information, special handling of private data is required. In this paper, we present a novel distributed privacy-preserving data aggregation protocol, called ADiPA. It relies on anonymization techniques for protecting personal data, such as k-anonymity, l-diversity and t-closeness. Its purpose is to allow a set of entities to derive aggregate results from data tables that are partitioned across these entities in a fully decentralized manner while preserving the privacy of their individual sensitive inputs. ADiPA neither relies on a trusted third party nor on cryptographic techniques. The protocol performs accurate aggregation when communication links and nodes do not fail. {\textcopyright} Springer International Publishing Switzerland 2015.},
	doi = {10.1007/978-3-319-26850-7_7},
	url = {https://www.scopus.com/inward/record.uri?eid=2-s2.0-84961141090\&doi=10.1007\%2f978-3-319-26850-7_7\&partnerID=40\&md5=518bf129894b27ee29b635e53f9baf0c},
	author = {Benkaouz, Y.a and Erradi, M.a and Freisleben, B.b}
}
