Cloud Auditing Research Articles

CPDA: A Confidentiality-Preserving Deduplication Cloud Storage With Public Cloud Auditing

With growing popularity of cloud storage, the number of users of outsourcing data to cloud servers has increased dramatically. On the one hand, the rapidly increasing volume of data in the cloud is accompanied by a lot of data duplication. On the other hand, the cloud server stores only a unique copy of outsourced data in deduplication cloud storage system and the corruption or missing of the unique copy may bring immeasurable loss. Therefore, the file deduplication and integrity auditing are very important and how to securely and efficiently achieve them simultaneously needs to be settled urgently in academia and industry. In this paper, we propose a confidentiality-preserving deduplication cloud storage with public cloud auditing (CPDA). Firstly, our CPDA scheme achieves secure file deduplication on encrypted file, which supports public integrity auditing for the unique copy in the deduplication cloud storage system. Particularly, our CPDA scheme also realizes secure authentication tag deduplication. Secondly, our CPDA scheme utilizes the convergent encryption and random masking techniques to ensure data confidentiality during the file deduplication and integrity auditing process. Thirdly, our scheme not only supports each data owner to independently launch the integrity auditing of their own files, but also supports cloud server to periodically delegate the third party auditor to concurrently handle multiple auditing tasks to ensure the integrity of the outsourced files. Finally, the security of our scheme is formally proved and its performance is confirmed by numerical analyses and simulation experiments.

CPA FIRM’S CLOUD AUDITING PROVIDER FOR PERFORMANCE EVALUATION AND IMPROVEMENT: AN EMPIRICAL CASE OF CHINA

While CPA (Certified Public Accountant) firms utilize cloud auditing technologies to generate auditing reports and convey information to their clients in the Internet of Things (IoT) Era, they often cannot determine whether cloud auditing is a secure and effective form of communication with clients. Strategies related to cloud auditing provider evaluation and improvement planning are inherently multiple attribute decision making (MADM) issues and are very important to the auditor industry. To overcome these problems, this paper proposes an evaluation and improvement planning model to be a reference for CPA firms selecting the best cloud auditing provider, and illustrates an application of such a model through an empirical case study. The DEMATEL (decision-making trial and evaluation laboratory) approach is first used to analyze the interactive influence relationship map (IIRM) between the criteria and dimensions of cloud auditing technology. DANP (DEMATEL-based ANP) is then employed to calculate the influential weights of the dimensions and criteria. Finally, the modified VIKOR method is utilized to provide improvement priorities for performance cloud auditing provider satisfaction. Based on expert interviews, the recommendations for improvement priorities are privacy, security, processing integrity, availability, and confidentiality. This approach is expected to support the auditor industry to systematically improve their cloud auditing provider selection.

Threshold privacy-preserving cloud auditing with multiple uploaders

Data integrity is a critical security issue in cloud storage. The data integrity checking schemes by a third-party auditor (TPA) have attracted a lot of attention. Sharing data among multiple users (uploaders) is an attractive feature of cloud storage. Considering the scenario of multiple uploaders, privacy-preserving cloud auditing makes it possible for the TPA to publicly verify the data integrity while guarantees that it cannot learn the identity of the data uploader. In this paper, we propose a (t, n)-threshold privacy-preserving auditing scheme. Every user could generate a tag piece of a message from the tag generation algorithm individually. To respond a challenge from the TPA, the server needs at least t tag pieces from different users among all n users. Our scheme does not resort to ring signature or group signature techniques. The tag of a message consists of only one element, which is independent of the number of the users within the group. Therefore, the efficiency of tag generation and auditing of our scheme is compatible with an efficient construction (Wu et al., in: International conference on information security practice and experience ISPEC 2016, Springer, New York, 2016). We use the pairing-based cryptography library (PBC library-0.5.14) to implement the scheme and compare both the computation and transmission cost of our scheme with some existing schemes.

Secure and efficient parallel hash function construction and its application on cloud audit

Rapid development of cloud computing has created enormous security challenges on authenticity, integrity, availability and reliability of outsourced data. Cloud audit is an effective solution for massive data verification and provides reliable and credible authentication results. High efficiency of audit is needed because real-time verification of data is necessary for most of applications on cloud. Since hashing operation is an essential function in audit scheme which occupies most of audit overhead, this paper proposes a parallel iterative structure and a message padding procedure to construct a novel parallel lattice hash function (PLHF). Moreover, inside the parallel iterative structure, a lattice-based hash compression function is proposed to reduce the hardness of PLHF cracking into the solution of shortest vector problem. Based on experimental results and security analysis, the cloud audit scheme with PLHF does not only perform significant higher efficiency, but also has stronger security.

Cloud Audit Server based verification for enhancing Information Security in cloud

Cloud Audit Server based verification for enhancing Information Security in cloud

Restrictive Ambiguity and Add-On Architecture Prototype for Privacy Preservation in Cloud Auditing

Restrictive Ambiguity and Add-On Architecture Prototype for Privacy Preservation in Cloud Auditing

<bold>CASTLE:</bold> Enhancing the Utility of Inequality Query Auditing Without Denial Threats

We consider a private data set composed of a set of individuals, and the data are outsourced to a remote cloud server. We revisit the classic query auditing problem in this outsourcing scenario; the cloud audits each newly arrived query on a single attribute, and the query is rejected if answering it compromises any individual's privacy. Various query auditing issues have been studied and addressed before. However, previous auditing schemes either have the difficulty of removing denial threats, or lack the analysis of utility (which is defined as the number of answered queries). In this paper, we study the auditing of a sequence of polynomial-time computable queries. Each query is of format f(X̃) a, where f is any polynomial function, X̃ is a subset of the private data set, and the answer is either “yes” or “no”. Existing methods cannot be applied directly to audit such a query, because it intermingles several types of functions (e.g., sum and max/min). Hence, we propose CASTLE, which is an inequality query auditing scheme that evaluates the risk of answering a query based on the query history and determines whether a newly arrived query should be answered correctly against a denial threat. Furthermore, to overcome the limitations of the existing query auditing mechanisms, which are of low utility, we relax CASTLE to increase the utility by returning answers with slight perturbations. We show that our method can be applied to audit intermingled equality queries with an extension. Experiments are conducted to evaluate the efficiency and effectiveness of our methods.

Distributed System in Cloud Audit Data Storage

Distributed System in Cloud Audit Data Storage

Research on Application and Synergy Mechanism of Cloud Computing in Government Audit

The emergence and development of cloud computing technology has brought changes in audit thinking and auditing technology and methods. However, there is still a lack of in-depth research and practical application of cloud computing technology in auditing in China. Based on the characteristics of cloud computing and the research results of collaborative theory, we proposed a basic framework for a cloud audit platform including four platform services, two management modules and a collaborative center. Through the establishment of a tripartite evolutionary game model, analyzes the factors that affect the efficient sharing of government audit cloud platform. The results show that the efficiency of the government audit cloud platform can be enhanced by establishing effective information sharing compensation mechanism and improving supervision and assessment mechanism of supervision departments. This study can provide a reference for the development of cloud auditing in China.

Cloud Audit: A Data Integrity Verification Approach for Cloud Computing

Cloud computing is the fastest growing and promising field in the sector of service provision. It is a very trendy situation for security implementation in the Cloud. Thus, security restrictions are increasing on users and service providers as the growth of Cloud environment. The purpose of this paper is to suggest a better and efficient integrity verification technique for data (referred as “Cloud Audit”). The building blocks of our technique are a variant of the Paillier homomorphic cryptography system with homomorphic tag and combinatorial batch codes. A Paillier Homomorphic Cryptography (PHC) system used to obtain homomorphic encryption on data blocks. Homomorphic tags along with the Paillier cryptography system assigns a special verifiable value to each data block, which helps us in unleashing data operations on this block. Combinatorial batch codes are used to assign and store integral data into different distributed cloud sever. To demonstrate our approach, we have implemented an application based on Hadoop and MapReduce framework. We have tested this application based on various parameters. Effectiveness of the proposed method has been shown by the experimental results. Our method has shown large improvement over the other modern methods.

OPoR: Enabling Proof of Retrievability in Cloud Computing with Resource-Constrained Devices

Cloud computing moves the application software and databases to the centralized large data centers, where the management of the data and services may not be fully trustworthy. In this work, we study the problem of ensuring the integrity of data storage in cloud computing. To reduce the computational cost at user side during the integrity verification of their data, the notion of public verifiability has been proposed. However, the challenge is that the computational burden is too huge for the users with resource-constrained devices to compute the public authentication tags of file blocks. To tackle the challenge, we propose OPoR, a new cloud storage scheme involving a cloud storage server and a cloud audit server, where the latter is assumed to be semi-honest. In particular, we consider the task of allowing the cloud audit server, on behalf of the cloud users, to pre-process the data before uploading to the cloud storage server and later verifying the data integrity. OPoR outsources and offloads the heavy computation of the tag generation to the cloud audit server and eliminates the involvement of user in the auditing and in the pre-processing phases. Furthermore, we strengthen the proof of retrievability (PoR) model to support dynamic data operations, as well as ensure security against reset attacks launched by the cloud storage server in the upload phase.

Overview of Auditing Cloud Consistency

Cloud storage services have become very popular due to their infinite advantages. To provide always-on access, a cloud service provider (CSP) maintains multiple copies for each piece of data on geographically distributed servers. A major disadvantage of using this technique in clouds is that it is very expensive to achieve strong consistency on a worldwide scale. In this system, a novel consistency as a service (CaaS) model is presented, which involves a large data cloud and many small audit clouds. In the CaaS model we are presented in our system, a data cloud is maintained by a CSP. A group of users that participate an audit cloud can verify whether the data cloud provides the promised level of consistency or not. The system proposes a two level auditing architecture, which need a loosely synchronize clock in the audit cloud. Then design algorithms to measure the severity of violations with two metrics: the commonality of violations, and the oldness value of read. Finally, heuristic auditing strategy (HAS) is devised to find out as many violations as possible. Many experiments were performed using a combination of simulations and a real cloud deployment to validate HAS. KeywordsCloud Service Provider (CSP), Consistency as a Service (CaaS), Heuristic Auditing strategy, Service Level Agreement, User Operation Table, Directed Acyclic Graph, Network Time Protocol __________________________________________________*****_________________________________________________

Maintain the Consistency of Auditing Cloud

In day to day life cloud is most essential part. Now cloud storage are use for business purpose the cloud is popular due to their huge amount of advantages the cloud is portable we can able to access the cloud anywhere globally. A cloud service provider maintains much duplication and each piece of data are globally distributed on servers. The main problem of cloud is to handle duplication of data which is too costly to achieve powerful consistency on world wide .In this paper we present a novel consistency service model which contain a large amount of data cloud and multiple audit clouds In The Consistency Service model . a data cloud is maintain by Cloud service Provider (CSP) and the number of user constitute group and that group of user can constitute an audit cloud Which can check whether the data cloud provides the valid level of consistency or not we suggest the 2 level auditing architecture, two level auditing architecture requires a loosely synchronize clock in the audit cloud. Then, design algorithms to quantify the commonality of violations metrics, and the staleness of the value of a read metrics. Finally, a Analytical Auditing Strategy (AAS) to shows as many violations as possible. Thus system performed using a combination of simulations and real cloud deployments to validate Analytical Auditing Strategy (AAS). KeywordsGlobal Consistency Auditing, Local Consistency Auditing, Analytical Auditing Strategy (AAS). __________________________________________________*****_________________________________________________

Secure and Efficient Audit Service Outsourcing for Data Integrity in Clouds

Cloud-based outsourced storage relieves the client’s load for storage management and maintenance by providing a comparably low-cost, scalable, location-independent platform. Though, the information that clients no longer have physical control of data specifies that they are facing a potentially formidable risk for missing or corrupted data. To avoid the security risks, inspection services are serious to ensure the integrity and availability of outsourced data and to achieve digital forensics and reliability on cloud computing. Provable data possession (PDP), which is a cryptographic method for validating the reliability of data without retrieving it at an untrusted server, can be used to realize audit services. In this project, profiting from the interactive zero-knowledge proof system, the construction of an interactive PDP protocol to prevent the fraudulence of prover (soundness property) and the leakage of verified data (zero knowledge property).To prove that our construction holds these properties based on the computation Diffie–Hellman assumption and the rewindable black-box knowledge extractor. An efficient mechanism on probabilistic queries and periodic verification is proposed to reduce the audit costs per verification and implement abnormal detection timely. Also, we present an efficient method for choosing an optimal parameter value to reduce computational overheads of cloud audit services.

Auditing and analysis of network traffic in cloud environment

Cloud computing allows users to remotely store their data into the cloud and provides on-demand access to applications and services. The security of the outsourced data in the cloud is dependent on the security of the cloud computing system and network. Though there have been numerous efforts on securing data on the cloud computing system, evaluation of security of cloud networks is still a very challenging task. Specifically, the audit of the cloud computing network will provide insights onto the level of protection provided within and outside data centres. This paper presents key technologies for cloud auditing to assess the security level within and outside cloud data centres: cloud data geolocation and cloud network risk assessment. We evaluate their performance on commercial cloud platforms and our experimental results demonstrate that cloud auditing technologies provide users the ability to assess the security of the cloud network.

Cloud Auditing: Privacy Preserving using Fully Homomorphic Encryption in TPA

Cloud computing is the future of the next generation architecture of IT solutions. Cloud provides computing resources on subscription basis over the internet. The Cloud data storage network includes a Third Party Auditor which has the power and capabilities that a client does not have. It is a trusted entity that has the access to, other than cloud and check on the exposed risk involved in cloud storage data on behalf of the client. In this paper, the problem of data security and integrity has been presented. Also, a scheme to provide maximum data integrity. In proposed scheme, existing fully homomorphic encryption is integrated with TPA auditing system is proposed. This scheme can audit data integrity without decrypting it.

FlipIt: The Game of “Stealthy Takeover”

Recent targeted attacks have increased significantly in sophistication, undermining the fundamental assumptions on which most cryptographic primitives rely for security. For instance, attackers launching an Advanced Persistent Threat (APT) can steal full cryptographic keys, violating the very secrecy of “secret” keys that cryptographers assume in designing secure protocols. In this article, we introduce a game-theoretic framework for modeling various computer security scenarios prevalent today, including targeted attacks. We are particularly interested in situations in which an attacker periodically compromises a system or critical resource completely, learns all its secret information and is not immediately detected by the system owner or defender. We propose a two-player game between an attacker and defender called FlipIt or The Game of “Stealthy Takeover.” In FlipIt, players compete to control a shared resource. Unlike most existing games, FlipIt allows players to move at any given time, taking control of the resource. The identity of the player controlling the resource, however, is not revealed until a player actually moves. To move, a player pays a certain move cost. The objective of each player is to control the resource a large fraction of time, while minimizing his total move cost. FlipIt provides a simple and elegant framework in which we can formally reason about the interaction between attackers and defenders in practical scenarios. In this article, we restrict ourselves to games in which one of the players (the defender) plays with a renewal strategy, one in which the intervals between consecutive moves are chosen independently and uniformly at random from a fixed probability distribution. We consider attacker strategies ranging in increasing sophistication from simple periodic strategies (with moves spaced at equal time intervals) to more complex adaptive strategies, in which moves are determined based on feedback received during the game. For different classes of strategies employed by the attacker, we determine strongly dominant strategies for both players (when they exist), strategies that achieve higher benefit than all other strategies in a particular class. When strongly dominant strategies do not exist, our goal is to characterize the residual game consisting of strategies that are not strongly dominated by other strategies. We also prove equivalence or strict inclusion of certain classes of strategies under different conditions. Our analysis of different FlipIt variants teaches cryptographers, system designers, and the community at large some valuable lessons: Interestingly, FlipIt finds applications in other security realms besides modeling of targeted attacks. Examples include cryptographic key rotation, password changing policies, refreshing virtual machines, and cloud auditing.

An agent based business aware incident detection system for cloud environments

Classic intrusion detection mechanisms are not flexible enough to cope with cloud specific characteristics such as frequent infrastructure changes. This makes them unable to address new cloud specific security issues. In this paper we introduce the cloud incident detection system Security Audit as a Service (SAaaS). It is built upon intelligent autonomous agents, which are aware of underlying business driven intercommunication of cloud services. This enables the presented SAaaS architecture to be flexible and to supported cross customer event monitoring within a cloud infrastructure. A contribution of this paper it to provide a high-level design of the SAaaS architecture, an introduction into the proposed Security Business Flow Language (SBFL), a first prototype of an autonomous agent and an evaluation about, which cloud specific security problems are addressed by the presented architecture. It is shown that autonomous agents and behaviour analysis are fertile approaches to detect cloud specific security problems and can create a cloud audit system.

Efficient audit service outsourcing for data integrity in clouds

Cloud-based outsourced storage relieves the client's burden for storage management and maintenance by providing a comparably low-cost, scalable, location-independent platform. However, the fact that clients no longer have physical possession of data indicates that they are facing a potentially formidable risk for missing or corrupted data. To avoid the security risks, audit services are critical to ensure the integrity and availability of outsourced data and to achieve digital forensics and credibility on cloud computing. Provable data possession (PDP), which is a cryptographic technique for verifying the integrity of data without retrieving it at an untrusted server, can be used to realize audit services.In this paper, profiting from the interactive zero-knowledge proof system, we address the construction of an interactive PDP protocol to prevent the fraudulence of prover (soundness property) and the leakage of verified data (zero-knowledge property). We prove that our construction holds these properties based on the computation Diffie–Hellman assumption and the rewindable black-box knowledge extractor. We also propose an efficient mechanism with respect to probabilistic queries and periodic verification to reduce the audit costs per verification and implement abnormal detection timely. In addition, we present an efficient method for selecting an optimal parameter value to minimize computational overheads of cloud audit services. Our experimental results demonstrate the effectiveness of our approach.