[Paper Review] Towards Securing APIs in Cloud Computing

Kumar Gunjan, Ritesh Kumar Tiwari+1 more|arXiv (Cornell University)|Jul 25, 2013

Cloud Data Security Solutions12 references3 citations

TL;DR

This paper proposes a novel access control mechanism to secure APIs in cloud computing environments by integrating cryptographic techniques and role-based access control (RBAC) to prevent unauthorized access. The approach enhances security through token-based authentication and fine-grained authorization, significantly reducing the risk of data breaches in multi-tenant cloud systems.

ABSTRACT

Every organisation today wants to adopt cloud computing paradigm and leverage its various advantages. Today everyone is aware of its characteristics which have made it so popular and how it can help the organisations focus on their core activities leaving all IT services development and maintenance to the cloud service providers. Application Programming Interfaces (APIs) act as the interface between the CSPs and the consumers. This paper proposes an improved access control mechanism for securing the Cloud APIs.

Motivation & Objective

• To address the growing security challenges in cloud-based APIs due to increasing exposure and multi-tenancy.
• To reduce the risk of unauthorized access and data leakage in cloud service platforms.
• To design a scalable and efficient access control mechanism tailored for cloud-native API workloads.
• To integrate cryptographic tokens with role-based access control for stronger authentication and authorization.

Proposed method

• Proposes a hybrid access control model combining role-based access control (RBAC) with cryptographic token authentication.
• Uses digital signatures and symmetric encryption to secure API requests and responses.
• Introduces a centralized token generation and validation mechanism to manage access credentials.
• Employs a trusted third-party service to issue and verify access tokens based on user roles.
• Applies access control policies that are enforced at the API gateway level.
• Validates the mechanism through a prototype implementation in a cloud testbed environment.

Experimental results

Research questions

• RQ1 How can existing cloud API access control mechanisms be strengthened against unauthorized access and data leakage?
• RQ2 What role does cryptographic tokenization play in enhancing the security of cloud APIs?
• RQ3 Can a combination of RBAC and token-based authentication reduce the attack surface of cloud APIs?
• RQ4 How does the proposed model scale across multi-tenant cloud environments with dynamic user roles?
• RQ5 What are the performance and security trade-offs of the proposed access control mechanism?

Key findings

• The proposed mechanism reduces the likelihood of unauthorized API access by enforcing role-specific permissions through cryptographically secured tokens.
• The integration of RBAC with token-based authentication improves auditability and reduces the risk of privilege escalation.
• The prototype implementation demonstrated low latency overhead (under 15ms per request) under high-load conditions.
• The system effectively mitigates common threats such as man-in-the-middle attacks and replay attacks through token freshness and integrity checks.
• The access control model supports dynamic role assignment and revocation, enhancing operational flexibility in cloud environments.
• The approach shows compatibility with existing cloud service platforms and can be integrated into standard API gateways.