Cloud Auditing Research Articles

Impact of external auditor–cloud specialist engagement on cloud auditing challenges

PurposeThis study aims to investigate the impact of external auditor–cloud specialist engagement on cloud auditing challenges from the perspective of auditors from the Association of Certified Public Accountants in a developing country as an example of Middle East emerging economies.Design/methodology/approachA quantitative research design was used to assess the influence of external auditor–cloud specialist engagement on three main cloud auditing challenges (i.e. technology security, regulatory standards and strategy). Data collection was conducted through field and online surveys. A total of 201 (181 male and 20 female) auditors made up a sample of a developing country’s economy. In addition, structural equation modelling was performed to test the proposed hypotheses of the study’s conceptual model.FindingsThe study found a significant effect of external auditor–cloud specialist engagement on overcoming the challenges of cloud auditing. Results showed that using IT specialists helps overcome strategic challenges more than other kinds of challenges, such as technology security and organisational standards.Practical implicationsThe findings suggest that efforts to promote cloud auditing in organisations may succeed if the focus is on overcoming cloud auditing challenges and highlighting the external auditor–cloud specialist engagement to enhance job performance.Originality/valueThis study is one of the few studies that analyse the impact of external auditor–cloud specialist engagement on cloud auditing challenges by adopting a quantitative approach from the perspective of auditors from the Iraqi Association of Certified Public Accountants.

Integrity Auditing for Multi-Copy in Cloud Storage Based on Red-Black Tree

With the rapid development of cloud storage, cloud users are willing to store data in the cloud storage system, and at the same time, the requirements for the security, integrity, and availability of data storage are getting higher and higher. Although many cloud audit schemes have been proposed, the data storage overhead is too large and the data cannot be dynamically updated efficiently when most of the schemes are in use. In order to solve these problems, a cloud audit scheme for multi-copy dynamic data integrity based on red-black tree full nodes is proposed. This scheme uses ID-based key authentication, and improves the classic Merkel hash tree MHT to achieve multi-copy storage and dynamic data manipulation, which improves the efficiency of real-time dynamic data update (insertion, deletion, modification). The third-party audit organization replaces users to verify the integrity of data stored on remote cloud servers, which reduces the computing overhead and system communication overhead. The security analysis proves that the security model based on the CDH problem and the DL problem is safe. Judging from the results of the simulation experiment, the scheme is safe and efficient.

Improved Lightweight Cloud Storage Auditing Protocol for Shared Medical Data

Now, it is common for patients and medical institutions to outsource their data to cloud storage. This can greatly reduce the burden of medical information management and storage and improve the efficiency of the entire medical industry. In some cases, the group‐based cloud storage system is also very common to be used. For example, in an medical enterprise, the employees outsource the working documents to the cloud storage and share them to the colleagues. However, when the working documents are outsourced to the cloud servers, how to ensure their security is a challenge problem for they are not controlled physically by the data owners. In particular, the integrity of the outsourced data should be guaranteed. And the secure cloud auditing protocol is designed to solve this issue. Recently, a lightweight secure auditing scheme for shared data in cloud storage is proposed. Unfortunately, we find this proposal not secure in this paper. It’s easy for the cloud server to forge the authentication label, and thus they can delete all the outsourced data when the cloud server still provide a correct data possession proof, which invalidates the security of the cloud audit protocol. On the basis of the original security auditing protocol, we provide an improved one for the shared data, roughly analysis its security, and the results show our new protocol is secure.

Detecting impersonation attacks in cloud computing environments using a centric user profiling approach

Cloud computing has become the most needed technology for the IT industry. Impersonation attacks are among the most dangerous threats that Clouds face. In this paper, we present an approach to detect masquerade attacks in Clouds. The efficient detection of these attacks should correlate user behaviors in distinct environments and also should apply to several deployment models. We present and evaluate three approaches to detect Impersonation and masquerade attacks. The first approach analyzes sequences of correlated system calls from the VMs operating systems, while the second analyzes the NetFlow data from the network environment. The third approach integrates these two approaches by using a neural network that will produce better detections than any of the first two approaches. To simplify the testing and the evaluation of the three methods, the Cloud Intrusion Detection Dataset (CIDD) is used as a source for cloud audits data. The evaluation has considered alternative deployment models through our two intrusion detection frameworks, CIDS and CIDS-VIRT. The paper also shows that the proposed detection approaches are more accurate and outperform the SWAD-MMD, a recent masquerade detection framework that works in the cloud computing systems. Furthermore, the paper details our experimental results and evaluates the computational performance and the detection accuracy of these approaches.

Improved publicly verifiable auditing protocol for cloud storage

SummaryOutsourcing data to cloud servers is a popular service for data owners, however, how to check the integrity and freshness of the outsourced data is very challenge. Recently, Jin et al. proposed a cloud auditing protocol with full integrity and freshness support for cloud data, unfortunately in this article, we show their proposal is not secure. Concretely, the cloud servers can forge the authentication tag and thus has the ability to forge proof of data possession, which obviously invalidates their cloud auditing protocol. We also give a new cloud auditing protocol and analysis its security and performance. The results show our protocol is more efficient and secure.

Merkle Tree and Blockchain-Based Cloud Data Auditing

Cloud computing is the fastest growing and most promising field in the service provisioning segment. It has become a challenging task to provide security in the cloud. The purpose of this article is to suggest a better and efficient integrity verification technique for data referred to as cloud audit. The deployment of cloud storage services has significant benefits in the management of data for users. However, this raises many security concerns, and one of them is data integrity. Though public verification techniques serve the purpose they are vulnerable to procrastinating auditors who may not perform verifications on time. In this article, a cloud data auditing system is proposed. The proposed cloud data auditing system integrates Merkle Tree-based Cloud audit and the blockchain-based audit recording system, thus the core idea is to record each verification result into a blockchain as a transaction. Utilizing the time-sensitive nature of blockchain, the verifications are time-stamped after the corresponding transaction is recorded into the blockchain, which enables users to check whether auditors have performed the verifications at the prescribed time. The proposed cloud data auditing system is experimentally validated. The investigations with varied dataset size revealed less time taken, on an average of 0.25 milliseconds with the use of Merkle Tree. Further results reveal consistency of the data integrity checking.

The Audit Implications of Cloud Computing

SYNOPSIS Over the last decade, many firms have shifted from in-house managed information systems to cloud computing arrangements. Despite regulatory interest in the audit impact of new technologies, little empirical work has studied how auditors behave when clients introduce cloud platforms into their accounting information system. Ex ante, it is unclear whether cloud computing allows for increased audit efficiency through reliance on service organization control reports or introduces additional complexity and risk to the audit. Leveraging a 2015 accounting standards update from the Financial Accounting Standards Board to identify material cloud users, we find that these firms pay an audit fee premium of approximately 5 percent compared to nonusers. This premium attenuates when hiring an audit office with more cloud users in its portfolio, suggesting that cloud audit experience can reduce auditors' costs when conducting such audits. We also explore how audit lag and subsequent restatements vary cross-sectionally with cloud use. JEL Classifications: M41; M48. Data Availability: Data are available from the public sources cited in the text.

Research on the Social Security Fund Risk Control and ManagementMeasures Based on Cloud Audit and Big Data Era

Affected by the continuous development of China's national economy and other aspects, the number of people participating in social security and the amount of money in China have continued to expand. As a result, the scale of social security fund financial data will continue to expand. In such cases, traditional auditing techniques are often used to standardize this data. With the continuous development of big data technology and cloud audit technology, it has provided corresponding technical support for the development of China's social security fund audit technology. However, the risks involved cannot be ignored. This paper is based on the social security fund system in the era of cloud auditing and big data. Based on the analysis of the problems, it puts forward corresponding measures on how to better control and manage the risks in order to provide corresponding management for the financial data risk management control of social security funds in China. reference.

Enhanced Certificateless Auditing Protocols for Cloud Data Management and Transformative Computation

Due the advent of new wireless communication, Internet of Things (IoT) and cloud computing, outsourcing the data processing and management to the cloud servers has become a typical transformative computing paradigm. In this context, a cloud auditing protocol is an effective way to check the data integrity for cloud data management. We present a cryptanalysis of two recently proposed certificateless public verifiable auditing protocols, the Zhang et al.’s protocol and the Kang et al.’s protocol. We argue that the tags in the Zhang et al.’s protocol and the semi-tags in the Kang et al.’s protocol can be forged, leading to insecure protocols. We propose improved versions of both protocols and analyze their security and efficiency. Our new protocols can be used as a very effective way for checking the integrity of outsourced cloud storage in the context of transformative computation.

Digital forensics cloud log unification: Implementing CADF in Apache CloudStack

Cloud computing is an important step in our era, delivering many advantages in business and our daily life. However, as every new technology, various challenges are brought into light with one of them being the misuse of Cloud computing environments for criminal activities. As such, Cloud service providers have to establish adequate forensic capabilities in order to support forensics investigations in the event of illegal activities in the cloud. In order to help forensics investigations, this paper deals with log format unification in cloud platforms using Distributed Management Task Force's (DMTF) Cloud Auditing Data Federation (CADF) standard. CADF event logging is utilised in the widely used OpenStack, and we have modified the Apache CloudStack platform to become forensically sound. Furthermore, we investigated the existing CloudStack platform along with the proposed CADF event model implemented, with regards to the principles of the Association of Chief Police Officers (ACPO) on handling digital evidence. The results are provided in this paper as well as an automated parsing tool/CADF event consumer, named C.Lo.D, which is freely available and can be downloaded from Github.

Security of Auditing Protocols Against Subversion Attacks

In 2013, the revelation of Edward Snowden rekindled cryptographic researchers’ interest in subversion attacks. Since then, many works have been carried out to explore the power of subversion attacks and feasible effective countermeasures as well. In this work, we investigate the study of subversion attacks against cloud auditing protocol, which has been well-known as useful primitive for secure cloud storage. We demonstrate that subverted auditing protocol enables the cloud server to recover secret information stored on the data owner side. Particularly, we first define an asymmetric subversion attack model for auditing protocol. This model serves as the principle for analyzing the undetectability and key recovery of subversion attacks against auditing protocols. We then show a general framework of asymmetric subversion attacks against auditing protocols with index-coefficient challenge. To illustrate the feasibility of our paradigm, several concrete auditing protocols are provided. As a feasible countermeasure, we propose a subversion-resilient auditing protocol with index-coefficient challenge.

Secure Computing Resource Allocation Framework For Open Fog Computing

AbstractFog computing has become an emerging environment that provides data storage, computing and some other services on the edge of network. It not only can acquire data from terminal devices, but also can provide computing services to users by opening computing resources. Compared with cloud computing, fog devices can collaborate to provide users with powerful computing services through resource allocation. However, as many of fog devices are not monitored, there are some security problems. For example, since fog server processes and maintains user information, device information, task parameters and so on, fog server is easy to perform illegal resource allocation for extra benefits. In this paper, we propose a secure computing resource allocation framework for open fog computing. In our scheme, the fog server is responsible for processing computing requests and resource allocations, and the cloud audit center is responsible for auditing the behaviors of the fog servers and fog nodes. Based on the proposed security framework, our proposed scheme can resist the attack of single malicious node and the collusion attack of fog server and computing devices. Furthermore, the experiments show our proposed scheme is efficient. For example, when the number of initial idle service devices is 40, the rejection rate of allocated tasks is 10% and the total number of sub-tasks is changed from 150 to 200, the total allocation time of our scheme is only changed from 15 ms to 25 ms; additionally, when the task of 5000 order matrix multiplication is tested on 10 service devices, the total computing time of our scheme is $\sim$250 s, which is better than that of single computer (where single computer needs more than 1500 s). Therefore, our proposed scheme has obvious advantages when it faces some tasks that require more computational cost, such as complex scientific computing, distributed massive data query, distributed image processing and so on.

New group user based privacy preserving cloud auditing protocol

Cloud storage is now a very popular service for many enterprises and their users. However, ensuring the integrity of the outsourced data is a very challenging problem. The concept of provable data possession is very effective for solving this problem. Based on this concept, in this paper we propose a new group-user-based privacy-preserving secure cloud auditing protocol for enterprise users and analyse its security. This protocol is also constructed on a recently proposed lightweight and privacy-preserving secure cloud auditing scheme for group users via a third-party medium. We point out that scheme is not secure and that the authenticators corresponding to the outsourced data blocks can be easily forged, that means the cloud servers can delete all the outsourced data but can still give correct proof for the possession of outsourced data, while our protocol has no such shortcoming. The performance analysis results demonstrate that our proposal is very practical and can have large-scale applications.

Identity-Based Public Auditing Scheme for Cloud Storage with Strong Key-Exposure Resilience

Secured storage system is a critical component in cloud computing. Cloud clients use cloud auditing schemes to verify the integrity of data stored in the cloud. But with the exposure of the auditing secret key to the Cloud Service Provider, cloud auditing becomes unsuccessful, however strong the auditing schemes may be. Therefore, it is essential to prevent the exposure of auditing secret keys, and even if it happens, it is necessary to minimize the damage caused. The existing cloud auditing schemes that are strongly resilient to key exposure are based on Public Key Infrastructure and so have challenges of certificate management/verification. These schemes also incur high computation time during integrity verification of the data blocks. The Identity-based schemes eliminate the usage of certificates but limit the damage due to key exposure, only in time periods earlier to the time period of the exposed key. Some of the key exposure resilient schemes do not provide support for batch auditing. In this paper, an Identity-based Provable Data Possession scheme is proposed. It protects the security of Identity-based cloud storage auditing in time periods both earlier and later to the time period of the exposed key. It also provides support for batch auditing. Analysis shows that the proposed scheme is resistant to the replace attack of the Cloud Service Provider, preserves the data privacy against the Third Party Auditor, and can efficiently verify the correctness of data.

Stateless Cloud Auditing Scheme for Non-Manager Dynamic Group Data With Privacy Preservation

As one of the core services of cloud computing, cloud storage could satisfy various storage and management requirements caused by the growth of data. Considering the complexity and uncontrollability of the cloud storage environment, many cloud auditing schemes were presented to assure the integrity of data in the cloud. However, most existing schemes have security risks, such as identity privacy and data privacy disclosure, authority abuse of group managers and collusion attacks during user revocation. To solve these problems, we propose a stateless cloud auditing scheme for non-manager dynamic group data with privacy preservation. The proposed scheme not only realizes user identity privacy preservation but also preserves data privacy security with the random masking technique. Unlike other solutions, our scheme allows $t$ group users to trace the user’s identity cooperatively without group managers, which eliminates authority abuse of group managers and provides non-frameability. Meanwhile, utilizing the concept of Shamir Secret Sharing, our scheme divides the re-signing process into several parts to resist collusion attacks during user revocation. By the designed binary tree, group users could trace dynamic data changes and recover the latest data when existing data are damaged. Besides, both users and the third-party auditor (TPA) are stateless in our scheme; that is, they no need to maintain data index information during cloud auditing. Our scheme also achieves mutual supervision between users and cloud service providers (CSPs), which ensures data are non-repudiation on both parties. Furthermore, we construct an efficient incentive for data visitors by using the blockchain technology and design a secure data sharing model to guarantee that data owners control their data ownership. Certificateless cryptography assures that the proposed scheme avoids certificate management and key escrow problems. Finally, security analysis and performance evaluation show that our scheme is secure and efficient.

A Solution to Defend Cloud Auditing Protocols from A Potential Attack

PRISM, a monitoring plan carried out by American government and revealed to the public in 2013, brought subversion attack back to the centre of cryptography research. In this work, we propose a kind of subversion attack on the cloud auditing protocols, where the cloud server plays the role of subversion attacker, manages to recover the secret message stored by the users of the auditing protocol. Then we propose a general frame of defence solutions with experiments to evaluate the practicability of our theme.

Privacy-Preserving Public Cloud Audit Scheme Supporting Dynamic Data for Unmanned Aerial Vehicles

As one of the most popular applications in recent years, cloud storage has been gradually integrated into all walks of life. In the field of communication techniques for the unmanned aerial vehicles (UAVs), UAVs use sensors to upload collected data to cloud servers during various exploration activities, but UAVs can only store and calculate valid information currently collected due to the limited storage and computing performance. In the actual exploration, UAVs need not only to upload complete data to the cloud server, but also to support the data dynamic update efficiently. Moreover, due to security requirements, the privacy of data uploaded by UAVs must be protected. However, the existing auditing schemes for dynamic data and integrity have many problems, such as high computation cost, low efficiency of dynamic update, low privacy and security. For this reason, we propose a public cloud audit scheme that supports dynamic data and privacy protection based on distributed string equality check protocol and Merkle-hash tree multi-level index structure. First of all, a third-party server (TPS) is set between the cloud service provider and users, which complete digital signature, integrity auditing, and data dynamic operations significantly in place of users to reduce the local computing cost. Users then locally upload data which has been encrypted to the TPS. Secondly, to further improve the security of the scheme, TPS implement signature for encrypted data based on the distributed string equality check protocol. By designing authorizations with time constraints, it is guaranteed that only the legitimate TPS with time constraints can operate with cloud servers. Finally, we implement dynamic data operation efficiently based on MHT multi-level index structure. The security proof and performance analysis show that our proposed scheme is safe and effective.

Merkle Hellman Knapsack Cryptosystem based Cloud Auditing Protocol

The cloud environment provided the cloud storage services to allow the users for storing, managing and accessing their data through the internet. The user worried about the integrity of data because of their data can be modified by external hackers due to the limited control. The new auditing technology is required for allowing the user to use local storage without worrying about the integrity of the data. An independent entity called Third Party Auditor (TPA) is presented for auditing task rather than putting the burden of task to the user themselves. In our proposed work, the Cloud Auditor (CA) plays the role of monitoring the modifications done to the block by any external hacker if it happens; original data is recovered from its cache log. Every data that transacts between the storage, user and the CA are encrypted with Merkle Hellman Knapsack Cryptosystem based Cloud Auditing Protocol (MHKC-CAP) algorithm. Thus the proposed methodology outperforms the existing algorithms like Message Digest 5 (MD5) algorithm and Advanced Encryption Standard (AES) by means of auditing time around 13 milliseconds and accuracy in terms of False Positive Rate (FPR) and False Negative Rate (FNR) are around 0.67% and 0.5%.

Privacy-Preserving Certificateless Cloud Auditing with Multiple Users

Cloud auditing is one of the important processes to ensure the security and integrity of data in cloud storage. Implementing cloud auditing requires various cryptographic tools such as identity-based cryptography and its variant: certificateless cryptography which solves the inherent key escrow problem in identity-based cryptography. Applying certificateless cryptography to cloud auditing has shown many merits. However, in a multi-user setting, certificateless cloud auditing (CLCA) schemes require additional security requirements. For instance, the identity privacy becomes an important issue that should be taken into consideration in some applications. In this paper, we concentrate on the identity privacy of CLCA schemes. We define the security models of privacy-preserving CLCA schemes, namely the uncheatability and anonymity and propose an efficient CLCA scheme, which is secure in the security models. As a feature of our scheme, the tag of a message is compact, which consists of only one group element. The uncheatability is based on variants of bilinear Diffie–Hellman assumption in the random oracle model. The identity privacy of the user is information-theoretically guaranteed against the third party auditor.

BST-MRPAS: Binary Search Tree based Multi Replica for Public Cloud Auditing System

BST-MRPAS: Binary Search Tree based Multi Replica for Public Cloud Auditing System