Extending OpenStack Access Control with Domain Trust

Abstract

Abstract. OpenStack has been rapidly established as the most popular open-source platform for cloud Infrastrusture-as-a-Service in this fast moving industry. In response to increasing access control requirements from its users, the OpenStack identity service Keystone has introduced several entities, such as domains and projects in addition to roles, resulting in a rather complex and somewhat obscure authorization model. In this paper, we present a formalized description of the core OpenStack access control (OSAC). We further propose a domain trust extension for OSAC to facilitate secure cross-domain authorization. We have implemented a proof-of-concept prototype of this trust extension based on Keystone. The authorization delay introduced by the domain trusts is 0.7 percent on average in our experiments.

Authorization Federation in IaaS Multi Cloud

“…Other RBAC extensions towards collaboration uses centralized authority to manage collaboration which is not applicable in multi-cloud scenarios. Recent work on collaboration such as CTTM [21] and OSAC-DT [22] extended RBAC to inherit its benefits toward collaboration. CTTM enables trust between tenants in a single cloud.…”

“…In Figure 4, the conceptual administrative boundary of each realm with relation to services and users in a cloud is illustrated. Such conceptual structure of entities presents an extension the OSAC model for OpenStack [22].…”

Secure Information and Resource Sharing in Cloud Infrastructure as a Service

“…In the context of cloud, in [10], the author proposed trust relationships established between tenants to facilitate sharing. It makes outsourcing easy to implement by simply adding trust relationships among tenants in cloud.…”

“…OpenStack provides several services, including compute (Nova), identity (Keystone), block storage (Cin- In [10], the authors present a core OpenStack Access Control (OSAC) model based on the OpenStack Identity API v3, as shown in figure 2. The OSAC model consists of eight entities: users, groups, projects, domains, roles, services, operations, and tokens.…”

“…A user has one home domain but can be assigned to multiple projects, which can be distributed in different domains. That is, the ownership of users and Figure 2: OpenStack Access Control (OSAC) model [10] projects can be defined by assigning them to a domain. Note that users in a domain are powerless unless they are assigned to a project with a particular role.…”