An Adaptive and Risk-Aware Access Control Framework for Secure Cloud File Sharing Using Hybrid Cryptography and Context-Aware Key Release

Abstract: Cloud platforms have become a common place to keep business records because they are easy to use and accessible from anywhere. Still, sensitive documents stored this way face two problems: the service provider should not be able to read them, and a password alone should not decide whether a request is genuine. This study proposes ARAC- HC, a framework where the key needed to open a document is released only after the system judges the situation of each request. At upload time, the document is protected on the user’s own device with a 256-bit AES-GCM key. This key is then wrapped separately for every approved reader through a short-lived X25519 exchange followed by HKDF. Before handing over the wrapped key, the framework checks seven signals: device state, location, access time, failed login attempts, recent user activity, stored trust level and the sensitivity of the requested document. Based on the calculated risk, the system either allows normal access, asks for an extra check, permits restricted access or refuses the request. In tests, protecting a 100 MB document took close to 75 ms. The X25519-based method finished key protection roughly 2.6 times faster than RSA-2048. Across 20,000 simulated requests, the framework caught 95.3% of malicious attempts, and 97% of legitimate users got access without any extra verification step.

Keywords: Context-aware key release, risk-based authorisation, cloud document sharing, envelope encryption, AES- GCM, X25519, insider misuse, zero trust.