  There is an increasing trend for businesses to migrate their systems towards
the cloud. Security concerns that arise when outsourcing data and computation
to the cloud include data confidentiality and privacy. Given that a tremendous
amount of data is being generated everyday from plethora of devices equipped
with sensing capabilities, we focus on the problem of access controls over live
streams of data based on triggers or sliding windows, which is a distinct and
more challenging problem than access control over archival data. Specifically,
we investigate secure mechanisms for outsourcing access control enforcement for
stream data to the cloud. We devise a system that allows data owners to specify
fine-grained policies associated with their data streams, then to encrypt the
streams and relay them to the cloud for live processing and storage for future
use. The access control policies are enforced by the cloud, without the latter
learning about the data, while ensuring that unauthorized access is not
feasible. To realize these ends, we employ a novel cryptographic primitive,
namely proxy-based attribute-based encryption, which not only provides security
but also allows the cloud to perform expensive computations on behalf of the
users. Our approach is holistic, in that these controls are integrated with an
XML based framework (XACML) for high-level management of policies. Experiments
with our prototype demonstrate the feasibility of such mechanisms, and early
evaluations suggest graceful scalability with increasing numbers of policies,
data streams and users.
