\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={Exploring Predicate based Access Control for Cloud Workflow Systems},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2016-01-15 (revised: 15 January 2016)}
\def\TheID{\makeatother }
\def\TheDate{2016-01-15}
\title{Exploring Predicate based Access Control for Cloud Workflow Systems}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{B. Srinivasa  Rao}

             \author[2]{G. Appa  Rao}

             \affil[1]{  GITAM University}

\renewcommand\Authands{ and }

\date{\small \em Received: 15 December 2015 Accepted: 5 January 2016 Published: 15 January 2016}

\maketitle


\begin{abstract}
        


Authentication and authorization are the two crucial functions of any modern security and access control mechanisms. Authorization for controlling access to resources is a dynamic characteristic of a workflow system which is based on true business dynamics and access policies. Allowing or denying a user to gain access to a resource is the cornerstone for successful implementation of security and controlling paradigms. Role based and attribute based access control are the existing mechanisms widely used. As per these schemes, any user with given role or attribute respectively is granted applicable privileges to access a resource. There is third approach known as predicate based access control which is less explored. We intend to throw light on this as it provides more fine-grained control over resources besides being able to complement with existing approaches. In this paper we proposed a predicate-based access control mechanism that caters to the needs of cloud-based workflow systems.

\end{abstract}


\keywords{workflow systems, authorization, predicate based access control, fine-grained access control.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
sers of an application play different role in an organization. Based on their role they have previleges to gain access to application resources. The role is convenient way in managing users in large scale and controlling access to resources in better way. Authorization is a term that refers to an information secuirty mechanism that deals with access rights in order to deny or authorize a user to access particular resource. This is based on access policies and the criticality of resources. Authorization is the part of overall computer or information security which is synonymous to real world thinking of humans with respect to access control. For instance a user in manager role is privileged to perform certain action and the same is denied to a user in clerk role. This is what reflects the real world though process that is captured greatly with access control mechanisms. After authentication of a user which deals with finding whether user is genuine (identity of user), authorization is crucial for controllling the authenitcated user in accessing resources. To reiterate, the process of denying or granting access to resources is known as authorization. Figure \hyperref[fig_0]{1} shows overview of different authorization As can be seen in Figure \hyperref[fig_0]{1}, it is evident that the three models have different approaches in controlling access to resources. Stated differently, though resource is same, the users are controlled to access it differently. According to Jin \hyperref[b39]{[41]} role based access control (RBAC) has its drawbacks as described here. Explosion of roles parameters, privileges makes it complex. It is difficult to design roles and managing them. It is cumbersome to grant/revoke privileges to/from roles. Making changes based on global or local factors is difficult. And RBAC does not support a custom extension to it. Attribute based access control (ABAC) overcomes these drawbacks and provides a flexible means of granting access rights through attributes. Here attribute is a key/value pair. However, it can be a set of key/value pairs to which access rights can be granted to authorized users. Access implications when user's attributes are changed and reaching consensus on the meaning of attributes are the drawbacks in ABAC as discussed in \hyperref[b40]{[42]}.mechanism.   
\section[{Related Works}]{Related Works}\par
This section reviews literature on different kinds of authentication systems such as role based authentication, attribute based authentication and predicate based authentication. Leandro et al. \hyperref[b0]{[1]} proposed a multi-tenancy authorization system for cloud computing. It is based on Shibboleth without using a trusted third party. Similar kind of work is done in \hyperref[b1]{[2]}, \hyperref[b14]{[14]} for cloud architectures. Reeja \hyperref[b2]{[3]} focused on cooperative secondary authorization that is a method of role based access control mechanism with a recycling approach. Khalid et al. \hyperref[b3]{[4]} proposed a protocol for authorization and authentication for cloud that supports anonymous communication. Birgisson et al. \hyperref[b4]{[5]} employed cookies with contextual caveats for authorization in cloud. This mechanism is decentralized in nature with delegation of principals. Gonzalez et al. \hyperref[b5]{[6]} credentials based authorization and authentication for cloud computing. Continuous authorization reevaluation method is proposed by Marcon et al. \hyperref[b6]{[7]}. Lang \hyperref[b7]{[8]} proposed authorization as a service (AaaS) for cloud computing and Service Oriented Architecture (SOA) applications for reliable security. Chen et al. \hyperref[b8]{[9]} proposed authentication mechanisms for high quality applications that deal with multimedia.\par
Zareapoor et al. \hyperref[b9]{[10]} focused on data security model for safe cloud. Kumar and Sharma \hyperref[b11]{[11]} proposed mechanisms for protecting cloud systems from Distributed Denial of Service (DDoS) attacks. Ryoo et al. \hyperref[b12]{[12]} focused on secure mechanisms in cloud with auditing services. Masood et al. \hyperref[b13]{[13]} proposed an access control framework for cloud computing. They proposed a service layer for cloud known as Access Control as a Service (ACaaS). This is a generic solution for authenticaiotn and authorization. Zhu and Gong \hyperref[b15]{[15]} proposed fuzzy authorization scheme based on Cipher text-Policy Attribute Based Encryption (CP-ABE). It works fine with multiple clouds besides enabling fuzziness in authorization. For multi-platform clouds an authorization frameworks is proposed in \hyperref[b16]{[16]} and Vida \hyperref[b17]{[17]} proposed two-step authentication for cloud which is based on de-duplication which ensures privacy and integrity of data. Akimbo et al.\par
[18] focused on securing PaaS layer of cloud. Other authorization and authentication schemes can be found in  {\ref [19]} and \hyperref[b18]{[20]}.\par
Other mechanisms found in the literature include identity based encryption \hyperref[b19]{[21]} and other mechanisms as described here. Popa et al. \hyperref[b20]{[22]} proposed Cloud Policy for access control in cloud which is hypervisor based and proved to be robust. Ruj et al. \hyperref[b21]{[23]}, \hyperref[b24]{[26]} proposed a privacy preserving mechanism for access control in a decentralized fashion. She et al. \hyperref[b22]{[24]} proposed a rule bsed information flow control for cloud with fine-grained access control. Zhu and Ma \hyperref[b23]{[25]} proposed a role based access control for cloud that exploits Attributed-Based Encryption with Attribute Lattice (ABE-AL). Sun et al. \hyperref[b25]{[27]} presented multikeyword text search with secure authentication and authorization. Sun and Wang \hyperref[b26]{[28]} focused on purposebased access control for XML databases. Bauer et al. \hyperref[b27]{[29]} proposed logic-based access control with credentials and constraints for robust security. Similar work was done in \hyperref[b31]{[34]}. Tu et al. \hyperref[b28]{[30]} proposed a finegrained access control mechanism which also supports revocation of credentials. Ababneh et al. \hyperref[b38]{[31]} focused on the policy -based dialog for protecting systems with physical access control.\par
Jung and Joshi \hyperref[b33]{[36]} proposed Community Centric Property Based Access Control (CPBAC) which is an extension to Community Centric Role Interaction Based Access Control (CRiBAC) for Online Social Networks (OSNs). Service Level Agreement (SLA) based security risk analysis is explored in \hyperref[b34]{[37]}. Dara \hyperref[b35]{[38]} explored cryptography challenges in cloud. Jana and Bandyopadhyay \hyperref[b36]{[39]} explored controlled privacy in mobile cloud for protecting system from different threats. Yadav and Wanjari \hyperref[b37]{[40]} proposed an authentication mechanism for smart grid besides exploring its secure access to smart grid in real time environment. In this paper our focus is on the predicate based access control mechanisms for improved security in cloud. 
\section[{III.}]{III.} 
\section[{Predicate based Access Control Mechanism}]{Predicate based Access Control Mechanism}\par
In this section we provide a generic framework that can be used for any workflow system. Any workflow system needs data to be captured and protected besides giving controlled access to its legitimate users. Instead of giving a domain-specific solution, we provide a generic framework that can be adapted to different application domains. There are certain things common across domains. This is the basis for the generic framework. Every workflow system has to deal with data. Therefore the central point of discussion is the record or tuple that needs to be given controlled access to users. Therefore we considered the record or tuple as basis to which many aspects are associated with. The record is a master record that might have associated tuples in different relations based on the transactions made. However, the master record is very important as it does not generally subjected to frequent changes. Figure \hyperref[fig_1]{2} shows the generic framework that is further extended in Figure \hyperref[fig_2]{3}. The framework shows different aspects such as instance-based user-group, task-based privileges, privilege propagation, role, instance-based predicate and dynamic authorization. All these aspects are related to the record or tuple with respect to access control. Instance Based User Group: When a master record is created, there might be some users who are involved in that. Such user-group should be able to access that record to be precise. Therefore it is essential to have a instance-based user group associated with the master tuple. Instance-Based Predicate: Having access control record for every master tuple or record is not an effective practice. It leads to more number of access control records which exceed actual records in master relations. Therefore it is essential to have a predicate based access control. A predicate is some clause that can be used with queries. For instance a doctor can access all healthcare records in which his ID is stored. This kind of predicate can avoid maintaining so many access control records pertaining to different master tuples. Task-Based Privileges: Certain users are allowed to perform definite tasks for which privileges are to be granted. When performing a task user is allowed to access only one master record. And the same user may be allowed to gain access to multiple master tuples with respect to another task. Thus task-based privileges can simplify access control. Privilege Propagation: In some select situations privileges are propagated from one role to another role. Such privileges are not determined statically. Therefore it is essential to have privilege propagation feature for effective access control mechanism. For instance a user in clerk role needs to access different loan records based on the field officers' recommendations. Therefore they need to have different privileges in different situations though the task remains same.\par
Role: Role plays a vital role in controlling access. Even the predicate -based access control model presented in this paper can enjoy the advantages of role based access control. While performing a particular task a user who belongs to a role can gain access to a particular tuple only. It is true with all users of all roles. An important observation is here is that different users of a similar role also can involve in different process instances. Thus it is very clear that the concept of role and the concept of instance-based user group are distinct. They are not interchangeable. Dynamic Authorization: There are some situations in which users can gain access to historical records for learning and better decision making. Nevertheless, there are some sensitive tuples of particular department that needs are to be exempted from the dynamic authorization. Stated differently, there should be provision in the access control model to provide access to historical data while exercising restrictions to sensitive tuples at the same time. 
\section[{IV. Components of Access Control Model}]{IV. Components of Access Control Model}\par
Predicate based access control model, we presented in this paper is generic in nature and can be adapted to different domains with required changes. Apart from the aspects associated with master tuple shown in Figure \hyperref[fig_1]{2}, there are five components associated with predicate-based access control model. They are subject, task, object, constraint and privilege. These components are used with certain notations to have a comprehensive predicate-based access control model. Prior to describing the components, les us discuss some of the important notations used. A runtime instance is nothing but the ID of master record and its associated data. Different master records are distinguished by using unique ID. The state of runtime instance is represented using some variables. They are presented in Table \hyperref[tab_3]{2}. Apart from these variables which can be called as system variables, designers of application can create domain specific variables. These variables are accessible throughout the workflow system. Subject: It is the first component that is made up of user, and role, runtime instance based user group. A group of users is represented as U. Role represents a collection of privileges that are assigned to users of that specific role. In an organization, roles are hierarchically organized as shown in Figure \hyperref[fig_7]{5}. R denotes a set of roles. . R = r i (1?i?n) and < R r i , r j ? R r i precedes r j in the hierarchy (r i < R r j )\par
The runtime instance based user group denotes a set of users (individuals) who were involved when the master tuple is created. For instance in a health care workflow system (case study is given in the subsequent section) a patient is served by Doctor, Nurse, and Receptionist. In this case these three users are known as runtime instance based user group. And these three should be able to access the record as per privileges and roles. There is many to many relationship between users and roles. And the instance user group is dynamic and new users may be included at runtime. Task: The task is a component. A set of components of workflow is represented as a tree. An example is shown in Figure \hyperref[fig_9]{7}. Let T represent set of tasks. t i , t j ? T t i includes t j in the hierarchy (t i < T t j ) if t i has a subtask t j Object: This is the third component. There are many objects involved and each object can have properties or attributes pertaining to security and access control. Such attribute is known as security attribute. These are used to define diversifie set of files of different kinds such as audio, video, .exe, instance of Java classes, a relation instance, a database, set of relations and so on. O represents set of objects. The data generated by the current runtime instance of record can be of two types such as current and historical. Historical refers to the past runtime instance of the same kind produced data. Current refers to the data produced by the current runtime instance of the master record. Outside indicates that the data comes from outside of the workflow process to which the predicate based access control is employed. Constraint: This is the fourth component denoted by C which refers to set of constraints. Every constraint is a an expression that results in a Boolean value. There are many operators for which can produce Boolean result. The syntax is as follows. (a) ?o (o ? O ? o ? rel(c)) (b) ¬?(o 1 , o 2 ) (o 1 ? O ? o 2 ? O ? o 1 ? o 2 ? \{o 1 , o 2 \}\par
? rel(c)) In any constraint c ? C, only one object's security attributes should appear Privilege: This is the last component in the model. Let P represents set of access rights or privileges. These access rights are exercised by subjects on objects. There are different types of privileges such as new, destroy, select, insert, update, delete, read and edit. Out of them new, read, edit and destroy are for document files and the rest are for database objects. 
\section[{V. Case Study -Health Care Work Flow System}]{V. Case Study -Health Care Work Flow System}\par
Cloud computing has emerged as a new model of computing which provides pool of computing resources in pay as you use fashion. Any cloud based workflow system (or even without cloud) can make use of the proposed predicated based access control model. Figure \hyperref[fig_5]{4} shows a general work flow of the health care system. Many details are not considered for making it simple. However the flow can provide required functionalities that can be used to demonstrate the access control mechanisms. As shown in Figure \hyperref[fig_5]{4}, the flow starts with an appointment. On requesting appointment registration of the patient is completed. Then health service provider will check for any symptoms or temperature, blood pressure and so on in order to identify the problem. Sometimes, it is possible that investigation is made with different tests and problem is identified.\par
Once the problem is identified either medicine is prescribed or referred to a specialist doctor. After taking medicine, the patient will pay money. This is the flow which actually reflects a typical, though not elaborate, scenario in every healthcare unit. 
\section[{VI.}]{VI.} 
\section[{Roles in the Health Care System}]{Roles in the Health Care System}\par
The roles in any workflow system are hierarchical in nature. Healthcare system is no exception. It has many roles and some roles depend on other roles. Figure \hyperref[fig_7]{5} shows roles in hierarchical fashion.    As shown in Figure \hyperref[fig_9]{7}, the workflow repository contains many entities and attributes. These entities, attributes and relationships are mapped to related tables in relational database. Patient, problem identifier, privilege and physician are the entities with different attributes involved. The repository is not completely provided and the cardinality is not shown in the diagram.\par
As shown in Figure \hyperref[fig_8]{6}, there are many tasks involved in the healthcare system. The main tasks considered are appointment, registration, diagnosis, and money transfer. The registration process contains two sub tasks such as patient record, checking eligibility. Diagnosis has two sub tasks such as adding record and prescription. Money transfer has two sub tasks such as one related to patient and other one related to insurance. 
\section[{VII. Access Control Model Employed to}]{VII. Access Control Model Employed to}\par
Healthcare Workflow System\par
The following components and relationships are considered to have a formal access control system for the healthcare workflow system. In this query o is either a relational table or set of files that can be used to retrieve data. Here c' represents either privilege propagation or runtime-instance based access control based on the runtime situations. The union of privileges is used based on the constraints given for authorized access to the data. Once query operation is finished, the object IDs that satisfy predicate based access control are retrieved. Then further processing carried out. If the o belongs to a relation, join operation can be used to combine results. If not name and category of files can be used. Even if the o is a special data, that external interface is invoked to access it. Data can be migrated from current domain to historical domain. The object o' is used to represent historical object. The following operations complete the migration process.  
\section[{Experimental Results}]{Experimental Results}\par
We built a prototype application that caters to the needs of a healthcare workflow system. Then we applied the predicate based access control which combines the features of roles and attributes as well and obtains synergic effect in controlling access to application resources. The application has proved to be useful for the real world applications as it was able to provide controlled access with high flexibility and utility. The results of application with respect to the attributes, constraints and are presented here.  As can be seen in Figure 8 and Figure  {\ref 9}, it is evident that the horizontal axis represents number of attributes while the vertical axis represents the time taken. The results reveal the difference in time when constraints are applied while performing the proposed access control mechanisms. 
\section[{IX.}]{IX.} 
\section[{Conclusions and Future Work}]{Conclusions and Future Work}\par
In this paper, we studied different kinds of access control mechanisms. We found that there are two widely used access control mechanisms. They are RBAC and ABAC. The RBAC depends on the roles that represent set of privileges that can be assigned to users who belong to the role. RBAC has its drawbacks as described here. Explosion of roles parameters, privileges makes it complex. It is difficult to design roles and managing them. It is cumbersome to grant/revoke privileges to/from roles. Making changes based on global or local factors is difficult. And RBAC does not support a custom extension to it \hyperref[b39]{[41]}. Access implications when user's attributes are changed and reaching consensus on the meaning of attributes are the drawbacks in ABAC \hyperref[b40]{[42]}. We focused on the third alternative known as predicated based access control model which can also complement to the features of role and attributed based models. We proposed a generic model for predicate based access control that can be applied to any workflow system including cloud based workflow systems. Afterwards we applied the model to a case study "healthcare workflow system". We built a prototype application to demonstrate the proof of concept. The empirical results revealed that the proposed application is flexible and effective in controlling access to application resources. In future we intend to improve the PBAC and adapt it to different workflow systems.\begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_0}Figure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-3.png}
\caption{\label{fig_1}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{3}\includegraphics[]{image-4.png}
\caption{\label{fig_2}Figure 3 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-5.png}
\caption{\label{fig_3}O = \{o 1 ,}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-6.png}
\caption{\label{fig_4}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{4}\includegraphics[]{image-7.png}
\caption{\label{fig_5}Figure 4 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-8.png}
\caption{\label{fig_6}Exploring}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{5}\includegraphics[]{image-9.png}
\caption{\label{fig_7}Figure 5 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{6}\includegraphics[]{image-10.png}
\caption{\label{fig_8}Figure 6 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{7}\includegraphics[]{image-11.png}
\caption{\label{fig_9}Figure 7 :}\end{figure}
     \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{}
\end{longtable} \par
 
\caption{\label{tab_0}Table 1}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{1} \par 
\begin{longtable}{P{0.85\textwidth}}
II.\end{longtable} \par
 
\caption{\label{tab_1}Table 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2} \par 
\begin{longtable}{P{0.13315926892950392\textwidth}P{0.6924281984334203\textwidth}P{0.02441253263707572\textwidth}}
Variable\tabcellsep Description\\
\#This.ID\tabcellsep \multicolumn{2}{l}{It represents current}\\
\tabcellsep \multicolumn{2}{l}{runtime instance of}\\
\tabcellsep \multicolumn{2}{l}{master record. It is the}\\
\tabcellsep \multicolumn{2}{l}{instance to which user}\\
\tabcellsep \multicolumn{2}{l}{is associated with.}\\
\#This.TaskName\tabcellsep \multicolumn{2}{l}{It denotes the current}\\
\tabcellsep \multicolumn{2}{l}{task being performed}\\
\tabcellsep \multicolumn{2}{l}{by an authorized user.}\\
\#This.RoleName\tabcellsep \multicolumn{2}{l}{It represents the role}\\
\tabcellsep \multicolumn{2}{l}{name to which the}\\
\tabcellsep authorized\tabcellsep user\\
\tabcellsep belongs.\\
\#This.UserID\tabcellsep \multicolumn{2}{l}{It represents the unique}\\
\tabcellsep \multicolumn{2}{l}{ID of the user who}\\
\tabcellsep accesses\tabcellsep runtime\\
\tabcellsep \multicolumn{2}{l}{instance of master}\\
\tabcellsep record.\end{longtable} \par
 
\caption{\label{tab_3}Table 2 :}\end{figure}
 			\footnote{© 2016 Global Journals Inc. (US) 1} 			\footnote{© 2016 Global Journals Inc. (US)} 			\footnote{( ) b} 		 		\backmatter  			 			 			  				\begin{bibitemlist}{1}
\bibitem[ Evaluation. International Journal of Electronics and Information Engineering]{b10}\label{b10} 	 		\textit{},  	 	 		\textit{Evaluation. International Journal of Electronics and Information Engineering}  		1  (2)  p. .  	 
\bibitem[Zareapoor et al. ()]{b9}\label{b9} 	 		\textit{},  		 			Masoumeh Zareapoor 		,  		 			Pourya Shamsolmoali 		,  		 			M Afshar Alam 		.  		2014. Safe Cloud.  	 
\bibitem[Tu et al. ()]{b28}\label{b28} 	 		\textit{A fine-grained access control and revocation scheme on clouds},  		 			Shan-Shan Tu 		,  		 			Shao-Zhang Niu 		,  		 			Hui Li 		.  		2012. Ltd: John Wiley \& Sons. p. .  	 
\bibitem[Nelson Mimura Gonzalez et al. ()]{b5}\label{b5} 	 		‘A framework for authentication and authorization credentials in cloud computing’.  		 			* Nelson Mimura Gonzalez 		,  		 			Marco Antônio Torrez Rojas 		,  		 			Marcos Vinícius Maciel Da Silva 		,  		 			Fernando Redígolo 		,  		 			Tereza Cristina Melo De Brito Carvalho 		,  		 			* 		,  		 			Charles Christian Miers 		,  		 			? 		,  		 			Mats Näslund 		,  		 			? 		,  		 			Abu Sho 		.  	 	 		\textit{IEEE}  		2013. p. .  	 
\bibitem[Ababneh and Wijesekera ()]{b29}\label{b29} 	 		‘A Policy-Based Dialogue System for Physical Access Control’.  		 			Mohammad Ababneh 		,  		 			Duminda Wijesekera 		.  	 	 		\textit{James Bret Michael}  		2012. IEEE. p. .  	 
\bibitem[Ababneh and Wijesekera ()]{b38}\label{b38} 	 		‘A Policy-Based Dialogue System for Physical Access Control’.  		 			Mohammad Ababneh 		,  		 			Duminda Wijesekera 		.  	 	 		\textit{James Bret Michael}  		2012. IEEE. p. .  	 
\bibitem[Sun and Wang ()]{b26}\label{b26} 	 		\textit{A purpose-based access control in native XML databases},  		 			Lili Sun 		,  		 			Hua Wang 		.  		2011. Ltd: John Wiley \& Sons. p. .  	 
\bibitem[Md. Fakhrul Alam Onik, Syed Sabir Salman-Al-Musawi, Khairul Anam, Nafiul Rashid. ()]{b32}\label{b32} 	 		‘A Secured Cloud based Health Care Data Management System’.  	 	 		\textit{International Journal of Computer Applications}  		Md. Fakhrul Alam Onik, Syed Sabir Salman-Al-Musawi, Khairul Anam, Nafiul Rashid. (ed.)  		2012. 49  (12)  p. .  	 
\bibitem[Arlindo Luis Marcon et al. ()]{b6}\label{b6} 	 		‘A UCONABC Resilient Authorization Evaluation for Cloud Computing’.  		 			Altair Arlindo Luis MarconJr 		,  		 			Maicon Olivo Santin 		,  		 			Juliana Stihler 		,  		 			BachtoldJr 		.  	 	 		\textit{IEEE}  		2014. 25  (2)  p. .  	 
\bibitem[Primo? Cigoj & Borka Jerman Bla?i ?. ()]{b16}\label{b16} 	 		‘An Authentication and Authorization Solution for a Multiplatform Cloud Environment’.  	 	 		\textit{Information Security Journal: A Global Perspective}  		Primo? Cigoj \& Borka Jerman Bla?i ?. (ed.)  		2015. p. .  	 
\bibitem[Zhang and Wen ()]{b14}\label{b14} 	 		\textit{AN AUTHORIZATION MODEL FOR MULTI-TENANCY SERVICES IN CLOUD},  		 			Zhaohai Zhang 		,  		 			Qiaoyan Wen 		.  		2012. IEEE. p. .  	 
\bibitem[Vasantrao Rathod and Vaidya ()]{b17}\label{b17} 	 		‘An Authorized Duplicate Check Scheme for Removing Duplicate Copies of Repeating Data in The Cloud Environment to Reduce Amount of Storage Space’.  		 			Manohar Vasantrao Rathod 		,  		 			Prof S G Vaidya 		.  	 	 		\textit{International Journal \& Magazine of Engineering}  		Jannu. Prasanna Krishna, Macha. Ganesh Kumar. (ed.)  		2015. 2015. 19  (4)  p. .  	 	 (Management and Research) 
\bibitem[Teigao and Maziero ()]{b30}\label{b30} 	 		\textit{Applying a usage control model in an operating system kernel},  		 			Rafael Teigao 		,  		 			Carlos Maziero 		.  		2011. Elsevier. 24 p. .  	 
\bibitem[Jin ()]{b39}\label{b39} 	 		\textit{Attribute Based Access Control and Implementation in Infrastructure as a Service Cloud},  		 			Xin Jin 		.  		 \url{http://www.profsandhu.com/dissert/Dissertation\textunderscore Xin\textunderscore Jin.pdf}  		2014.  	 
\bibitem[Rahat et al. ()]{b13}\label{b13} 	 		\textit{Cloud authorization: exploring techniques and approach towards effective access control framewo rk},  		 			Masood Rahat 		,  		 			Muhammad Awais 		,  		 			Shibli Yumna 		,  		 			Ghazi 		,  		 			Ayesha Kanwal 		,  		 			Ali Arshad 		.  		2014. Berlin Heidelberg: Springer-Verlag. p. .  	 
\bibitem[Khalida et al. ()]{b3}\label{b3} 	 		‘Cloud based Secure and Privacy Enhanced Authentication \& Authorization Protocol’.  		 			Umer Khalida 		,  		 			Abdul Ghafoor 		,  		 			Misbah Irum 		.  	 	 		Muhammad Awais Shibli.  		2013. ELsevier. 22 p. .  	 
\bibitem[Nageshwar Dev yadav,Prof. Akash Wanjari. ()]{b37}\label{b37} 	 		‘Cloud Based Smart Metering Security Access and Monitoring System in the Real Time Environment’.  	 	 		\textit{International Journal of Engineering Research \& Technology}  		Nageshwar Dev yadav,Prof. Akash Wanjari. (ed.)  		2014. 3  (2)  p. .  	 
\bibitem[Popa et al. ()]{b20}\label{b20} 	 		\textit{Cloud Police: Taking Access Control out of the Network},  		 			Lucian Popa 		,  		 			Minlan Yu 		,  		 			Y Steven 		,  		 			Ko 		.  		2010. ACM. p. .  	 
\bibitem[Ryoo et al. ()]{b12}\label{b12} 	 		‘Cloud Security Auditing: Challenges and Emerging Approaches’.  		 			Jungwoo Ryoo 		,  		 			Syed Rizvi 		,  		 			William Aiken 		,  		 			John Kissell 		.  	 	 		\textit{IEEE}  		2013. p. .  	 
\bibitem[Bauer et al. ()]{b27}\label{b27} 	 		\textit{Constraining Credential Usage in Logic-Based Access Control},  		 			Lujo Bauer 		,  		 			Limin Jia 		,  		 			Divya Sharma 		.  		2010. IEEE. p. .  	 
\bibitem[Bauer et al. ()]{b31}\label{b31} 	 		\textit{Constraining Credential Usage in Logic-Based Access Control},  		 			Lujo Bauer 		,  		 			Limin Jia 		,  		 			Divya Sharma 		.  		2010. IEEE. p. .  	 
\bibitem[Jana and Bandyopadhyay ()]{b36}\label{b36} 	 		‘Controlled Privacy in Mobile Cloud’.  		 			Debasish Jana 		,  		 			Debasis Bandyopadhyay 		.  	 	 		\textit{IEEE}  		2015. p. .  	 
\bibitem[Jung A et al. ()]{b33}\label{b33} 	 		\textit{CPBAC: Property-based access control model for secure cooperation in online social networks},  		 			Youna Jung A 		,  		 			B D James 		,  		 			Joshi 		.  		2014. ELsevier. 41 p. .  	 
\bibitem[Dara ()]{b35}\label{b35} 	 		\textit{Cryptography Challenges for Computational Privacy in Public Clouds},  		 			Sashank Dara 		.  		2013. ACM. p. .  	 
\bibitem[Ruj and Stojmenovic ()]{b24}\label{b24} 	 		‘Decentralized Access Control with Anonymous Authentication of Data Stored in Clouds’.  		 			Sushmita Ruj 		,  		 			Milos Stojmenovic 		.  	 	 		\textit{Amiya Nayak}  		2014. 25  (2)  p. .  	 	 (IEEE.) 
\bibitem[Le et al. ()]{b19}\label{b19} 	 		\textit{Evaluation of an Enhanced Role-Based Access Control model to manage information access in collaborative processes for a statewide clinical education program},  		 			Xuan Hung Le 		,  		 			Terry Doll 		,  		 			Monica Barbosu 		,  		 			Amneris Luque 		,  		 			Dongwen Wang 		.  		2013. ELsevier. p. .  	 
\bibitem[Karp et al. ()]{b40}\label{b40} 	 		\textit{From ABAC to ZBAC: The Evolution of Access Control Models},  		 			Alan H Karp 		,  		 			Harry Haury 		,  		 			Michael H Davis 		.  		 \url{http://www.hpl.hp.com/techreports/2009/HPL-2009-30.pdf}  		2009.  	 
\bibitem[Zhu and Gong ()]{b15}\label{b15} 	 		\textit{Fuzzy Authorization for Cloud Storage},  		 			Shasha Zhu 		,  		 			Guang Gong 		.  		2013. IEEE. p. .  	 
\bibitem[Zhu et al. ()]{b23}\label{b23} 	 		\textit{How to Use Attribute-Based Encryption to Implement Rolebased Access Control in the Cloud},  		 			Yan Zhu 		,  		 			Changjun Hu 		,  		 			Di Ma 		,  		 			Jin Li 		.  		2013. ACM. p. .  	 
\bibitem[Chenz et al. ()]{b8}\label{b8} 	 		\textit{IMS Cloud Computing Architecture for High-Quality Multimedia Applications},  		 			Jiann-Liang Chenz 		,  		 			Szu-Lin Wuy 		,  		 			Yanuarius Teofilus Larosa 		,  		 			Pei-Jia Yang 		,  		 			Yang-Fang Li 		.  		2011. IEEE. p. .  	 
\bibitem[Stanik et al. ()]{b18}\label{b18} 	 		\textit{Local Authentication and Authorization System for Immediate Setup of Cloud Environments},  		 			Alexander Stanik 		,  		 			Patrick Bittner 		,  		 			Marvin Byfield 		,  		 			Fridtjof Sander 		,  		 			Daniel Sch¨oder 		.  		2013. IEEE. p. .  	 
\bibitem[Birgisson et al. ()]{b4}\label{b4} 	 		\textit{Macaroons: Cookies with Contextual Caveats for Decentralized Authorization in the Cloud},  		 			Arnar Birgisson 		,  		 			Joe Gibbs Politz 		,  		 			Ankur Lfar Erlingsson 		,  		 			Taly 		.  		2014. ACM. p. .  	 
\bibitem[Marcos et al. ()]{b0}\label{b0} 	 		‘Multi-Tenancy Authorization System with Federated Identity for Cloud-Based Environments Using Shibboleth’.  		 			A P Marcos 		,  		 			Leandro 		,  		 			J Tiago 		,  		 			Daniel R Nascimento 		,  		 			Carla M Santos 		,  		 			Carlos B Westphall 		,  		 			Westphall 		.  	 	 		\textit{The Eleventh International Conference on Networks},  				2012. p. .  	 
\bibitem[Lang ()]{b7}\label{b7} 	 		\textit{OpenPMF SCaaS: Authorization as a Service for Cloud \& SOA Applications},  		 			Ulrich Lang 		.  		2010. IEEE. p. .  	 
\bibitem[Ruj and Stojmenovic ()]{b21}\label{b21} 	 		‘Privacy Preserving Access Control with Authentication for Securing Data in Clouds’.  		 			Sushmita Ruj 		,  		 			Milos Stojmenovic 		.  	 	 		\textit{Amiya Nayak}  		2012. IEEE. p. .  	 
\bibitem[Sun et al. ()]{b25}\label{b25} 	 		\textit{Privacy-preserving Multi-keyword Text Search in the Cloud Supporting Similarity-based Ranking},  		 			Wenhai Sun 		,  		 			Bing Wang 		,  		 			Ning Cao 		,  		 			Ming Li 		,  		 			Wenjing Lou 		,  		 			Y Thomas Hou 		.  		2013. ACM. p. .  	 
\bibitem[Reeja ()]{b2}\label{b2} 	 		‘Role Based Access Control Mechanism In Cloud Computing Using Co -Operative Secondary Authorization Recycling Method’.  		 			S L Reeja 		.  	 	 		\textit{International Journal of Emerging Technology and Advanced Engineering}  		2012. 2  (10)  p. .  	 
\bibitem[She et al. ()]{b22}\label{b22} 	 		‘Rule-Based Run-Time Information Flow Control in Service Cloud’.  		 			Wei She 		,  		 			I-Ling Yen 		,  		 			Bhavani Thuraisingham 		.  	 	 		\textit{IEEE}  		2011. p. .  	 
\bibitem[Matthew et al. ()]{b34}\label{b34} 	 		‘Sec Agreement: Advancing Security Risk Calculations in Cloud Services’.  		 			L Matthew 		,  		 			Hale Rose 		,  		 			Gamble 		.  	 	 		\textit{IEEE}  		2012. p. .  	 
\bibitem[Bernal Bernabe A et al. ()]{b1}\label{b1} 	 		\textit{Semantic-aware multitenancy authorization system for cloud architectures},  		 			Jorge Bernal Bernabe A 		,  		 			Juan M Marin Perez B 		,  		 			Jose M Alcaraz Calero B 		,  		 			Felix J Garcia Clementec 		,  		 			Gregorio Martinez Perez A 		,  		 			Antonio F Gomez Skarmetaa 		.  		2012. ELsevier. p. .  	 
\bibitem[Kumar and Sharma ()]{b11}\label{b11} 	 		‘Study of Intrusion Detection System for DDoS Attacks in Cloud Computing’.  		 			Naresh Kumar 		,  		 			Shalini Sharma 		.  	 	 		\textit{IEEE}  		2013. p. .  	 
\end{bibitemlist}
 			 		 	 
\end{document}
