Abstract
Storing data in the cloud is a new multi-tenant database solution that has recently emerged to deliver database for multiple users, who can store and access their data over the internet. This multi-tenant database designed to be used by multiple tenants and each tenant may have multiple users. Therefore, this database type demands a special multi-tenant access control model, which provides an access control not only for multiple tenants, but also for multiple users per tenant. In this paper, we are proposing a multi-tenant access control model based on a multi-tenant database schema called Elastic Extension Tables (EET). In this model, we define access control data architecture, and the EET access grants which can be granted to tenants' users. Moreover, we propose an access control algorithm, which allows users to access the data granted to them based on a number of groups or roles assigned to these users.
I. INTRODUCTION
The growth of multi-tenant Cloud Computing services draws attention to security challenges, which are emerging due to the cloud vendor’s resource sharing [13]. It is unlikely that the cloud users would risk their data and their computing applications over the cloud in favour of reducing the Total Cost of Ownership (TCO), or using a flexible cloud service, unless the cloud service providers provide reliable and secure services [18]. Outsourcing data to the cloud is one of the critical security challenges because this data is accessed among a large number of users from different organisations [18]. There are three data isolation approaches applied to the cloud. The first approach is called Separate Database, which is the simplest data isolation approach that stores each tenant data in a separate database. The second approach is called Shared Database - Separate Schema, which hosts all the tenants in the same database instance, but each tenant has his own database schema. The last approach is called Shared Database - Shared Schema, which allows tenants to store their data in the same database and same schema. In other words, a given table can store different table rows for different tenants, and a tenant ID column will differentiate and isolate the tenant’s data [8],[9],[12],[19].
VIII. CONCLUSION
In this paper, we have proposed a multi-tenant access control method, called Elastic Extension Table Access Control (EETAC) that allows each tenant in a multi-tenant database to have several users with different types of access grants to access the tenant’s data. The concept of retrieving data from the multi-tenant database is slightly different from the single-tenant database. Single-tenant database does not differentiate between the data of different tenants’ users. Whereas, the data of the multitenant database is partitioned by differentiating between the data owned by a particular tenant, and by accessing columns and rows granted to a tenants’ users based on a number of groups or roles assigned to them.
