Malicious Cloud Server Research Articles

Cumulus: Blockchain-Enabled Privacy Preserving Data Audit in Cloud

Data owners upload large files to cloud storage servers, but malicious servers may potentially tamper data. To check integrity of remote data, Proof of Retrievability (PoR) schemes were introduced. Existing PoR protocols assume that data owners and third-party auditors are honest and audit only the potentially malicious cloud server to check integrity of stored data. In this paper we consider a system where any party may attempt to cheat others and consider collusion cases. We design a protocol, Cumulus, that is secure under such adversarial assumptions and use blockchain smart contracts to act as mediator in case of dispute and payment settlement. We use state channels to reduce blockchain interactions in order to build a practical audit solution. The security of the protocol has been proven in Universal Composability (UC) framework. Finally, we illustrate several applications of our basic protocol and evaluate practicality of our approach via a prototype implementation for fairly selling large files over the Ethereum platform. We evaluate the prototype and show that our scheme has comparable performance.

An improved identity-based public audit protocol for cloud storage

With the rapid development of informatization, a vast amount of data is continuously generated and accumulated, leading to the emergence of cloud storage services. However, data stored in the cloud is beyond the control of users, posing various security risks. Cloud data auditing technology enables the inspection of data integrity in the cloud without the necessity of data downloading. Among these, public auditing schemes have experienced rapid development due to their ability to avoid additional user auditing expenses. However, malicious third-party auditors can compromise data privacy. This paper proposes an improved identity-based cloud auditing scheme that can resist malicious auditors. This scheme is also constructed on an identity-based public auditing scheme using blockchain to prevent malicious auditing. We found the scheme is not secure because a malicious cloud server can forge authentication tags for outsourced data blocks, while our scheme has not these security flaws. Through security proofs and performance analysis, we further demonstrate that our scheme is secure and efficient. Additionally, our scheme has typical application scenarios.

A lattice‐based searchable encryption scheme with multi‐user authorization for the certificateless cloud computing environment

AbstractPublic key encryption with keyword search (PEKS) is able to enhance cloud data security. On the other hand, the existence of malicious cloud servers and untrusted central authorities, in addition the keyword space faces a low entropy, attackers often launch keyword guessing attacks (KGA), thereby leaking data privacy. Therefore, we use certificateless authentication and proxy re‐encryption technology to construct a lattice‐based verifiable PEKS scheme for Multi‐Data Users (MDU). Certificateless authentication can ensure that our scheme does not require key escrow, and proxy re‐encryption technology allows us to perform multi‐user authorization and use the verification block for data users to ensure the integrity of search results. Security research proves that, under the assumption that the learning with errors (LWE) problem is hard, the ciphertext is indistinguishable and resistant to KGA. Results from experiments show that our scheme is significantly more effective than current schemes.

Indoor localization using device sensors: A threat to privacy

The localization techniques used in today’s smartphone are mainly based on Global Positioning System (GPS). However, GPS Sensors cannot work properly under in-door and underground locations. Therefore, many applications utilize device sensors such as accelerometer, gyrometer, and magnetometer for indoor localization. In this paper, we present a misuse case of how device sensors can be used to exploit the privacy of a user by geo-tracking. We propose an attack model through which the user location can be compromised without using the GPS sensors. The proposed attack model comprises of two stages. The first stage consists of deployment of the malicious application on the users’ smart-phones and gathering the information of various sensors in the background. The collected sensor data is uploaded to the malicious cloud server set up by the adversary. The second stage consists of pre-processing the sensor data received from the malicious cloud server and plot the user’s trajectory onto a graph in real-time. The proposed attack model is evaluated by developing two applications. The victim application tracks location, direction, and trajectory of the user without any location permission from the user. The proposed model achieves an accuracy of 98% without using special infrastructure and separate training phase. Further, we have discussed three mitigation schemes, which can be adapted by the Android developers in order to protect the user’s privacy.

Encryption Scheme of Verifiable Search Based on Blockchain in Cloud Environment

While transferring data to cloud servers frees users from having to manage it, it eventually raises new problems, such as data privacy. The concept of searchable encryption has drawn more and more focus in research as a means of resolving the tension between data accessibility and data privacy. Due to the lack of integrity and correctness authentication in most searchable encryption techniques, malicious cloud servers may deliver false search results to users. Based on public key encryption with searching (PEKS), the study suggests a privacy-preserving method for verifiable fuzzy keyword searches based on the Ethernet blockchain in a cloud context to overcome the aforementioned security concerns. The search user can check the accuracy and integrity of the query document using the unalterability characteristics of the Ethernet blockchain system in this scheme to prevent the cloud server from giving incorrect query results. Furthermore, a fair transaction between the cloud server and the data user is achieved and can be tracked back to the malicious user using hash functions and Ethereum smart contracts, even if the user or the cloud is malicious. Finally, the security analysis shows that, under the random oracle model, our technique fulfils the adaptive selection keyword’s semantic security. The performance assessment demonstrates that the proposed scheme outperforms other related schemes in terms of computational efficiency.

Secure and Efficient Item Traceability for Cloud-Aided IIoT

Cloud computing is an essential technique to provide item traceability for industrial internet of things (IIoT) systems by providing item data sharing services. However, a malicious cloud server may prevent industrial participants from acquiring accurate traceability of items by providing inconsistent item data. To fix this issue, we propose Acics, an item data consistency auditing scheme in untrusted cloud services for cloud-aided IIoT systems. Acics presents two variants named S-Acics and L-Acics. S-Acics enables industrial participants to audit item data consistency for each item and circularly play the auditing role. L-Acics further enables industrial participants to audit item data consistency for a sampled subset of items while resisting data selection attack via a new separated storage mechanism. Finally, Acics integrates a fair payment mechanism built on smart contract to incentivize the cloud server to provide consistent item data access service for industrial participants. The experiment results show that our solution can audit item data consistency with reasonable cost.

Security analysis and improvement of a public auditing scheme for secure data storage in fog-to-cloud computing

Human society has drastically changed as a result of the widespread application of Internet of Things (IoT) technology, particularly in various industrial fields. In spite of the advantages brought by IoT services, the underlying security challenges cannot be underestimated. Cloud-based IoT data collection poses a number of challenges, including how to ensure its integrity. In order to address this issue, Tian et al. have proposed a fog-to-cloud computing-based public auditing scheme in IoT scenarios, which provides the data-privacy preserving mechanism and tag transformation strategy. However, in this paper, we show that Tian et al.’s scheme fails to achieve soundness, an essential security property, by giving two attacks. In the first attack, the malicious cloud server can delete all the data and then deceive the Third Party Auditor (TPA) into believing that the data is well-preserved. In the second attack, the malicious cloud server can modify the outsourced data and then deceive TPA into believing that all the data is kept intact. We further provide a simple but effective solution for Tian et al.’s scheme to resist the above-mentioned attacks. Security analysis and performance evaluation are also given to demonstrate the robustness and high efficiency of the improved scheme.

A Verifiable and Fair Attribute-Based Proxy Re-Encryption Scheme for Data Sharing in Clouds

To manage outsourced encrypted data sharing in clouds, attribute-based proxy re-encryption (ABPRE) has become an elegant primitive. In ABPRE, a cloud server can transform an original recipient’s ciphertext to a new one of a shared user’s. As the transformation is computation consuming, a malicious cloud server may return an incorrect re-encrypted ciphertext to save its computation resources. Moreover, a shared user may accuse the cloud server of returning an incorrect re-encrypted ciphertext to refuse to pay the cost of using the cloud service. However, existing ABPRE schemes do not support a mechanism to achieve verifiability and fairness. In this article, a novel verifiable and fair attribute-based proxy re-encryption (VF-ABPRE) scheme is introduced to support verifiability and fairness. The verifiability enables a shared user to verify whether the re-encrypted ciphertext returned by the server is correct and the fairness ensures a cloud server escape from malicious accusation if it has indeed conducted the re-encryption operation honestly. Additionally, we conduct a performance experiment to show the efficiency and practicality of the new VF-ABPRE scheme.

Improved Efficient Privacy-Preserving Certificateless Provable Data Possession Scheme for Cloud Storage

Cloud storage technology is evolving at a high speed; effectively auditing the cloud data’s integrity has become a focal point. Recently, Ming and Shi proposed a certificateless integrity auditing scheme with a privacy protection function. The scheme used the certificateless cryptosystem to solve the certificate management problem of the auditing schemes based on public key infrastructure and the key escrow problem of the identity-based auditing schemes. Although their scheme is novel and efficient, we found that their scheme was not secure and could not achieve integrity auditing of cloud data. The malicious cloud server can generate the proof through the blocks and tags sent by the user. On the basis of the original scheme, we propose an improved auditing scheme; our new scheme is more secure and effective. In addition, for the problem of idle tags in the existing cloud data integrity auditing scheme, we propose the idea of intermediate tags and we applied the idea to the improved scheme to improve audit efficiency.

Blockchain-Based Privacy-Preserving and Rewarding Private Data Sharing for IoT

The Internet of Things (IoT) devices possessed by individuals produce massive amounts of data. The private data onto specific IoT devices can be combined with intelligent platform to provide help for future research and prediction. As an important digital asset, individuals can sell private data to get rewards. Problems, such as privacy, security, and access control prevent individuals from sharing their private data. The blockchain technology is widely used to build an anonymous trading system. In this article, we construct a blockchain-based privacy-preserving and rewarding private data-sharing scheme (BPRPDS) for IoT. A privacy issue worth considering is that the malicious cloud server may establish a behavior profile database of data users (DUs). In the case of anonymity, the transactions of private data sharing are easy to cause disputes. When anonymous DUs are framed, it is hard to protect their rights. With the help of the deniable ring signature and Monero, we realize the behavior profile building prevention and nonframeability of BPRPDS. At the same time, we utilize the licensing technology executed by smart contracts to ensure flexible access control of multisharing. The proposed BPRPDS is provably secure. Performance analysis and experimental results show that BPRPDS is efficient and practical.

Application of Personal Information Privacy Protection Based on Machine Learning Algorithm.

Based on a machine learning algorithm, this paper deeply explores the privacy protection of personal information. In this paper, the definition of the machine learning algorithm is put forward, the design idea of privacy protection in joint machine learning platform is studied, and the architecture model and model parameter updating strategy of joint machine learning under privacy protection are designed. To protect the privacy of personal information, this paper also proposes a data homomorphic verification mechanism to prevent the global parameters from being tampered with by malicious cloud servers. In order to verify the performance of the models constructed in this paper, the comparative experiments of different models are carried out. The experimental results show that this algorithm has a fast convergence speed, and the average error rate decreases by 4.17% compared with the traditional algorithm. Moreover, the accuracy of this algorithm reaches 95.37%, which is about 8.76% higher than the previous algorithm. This model is applied to the field of personal information privacy protection, which can provide a safe and reliable environment for personal information privacy and effectively protect the privacy of data owners. And, means and reference value is provided for the development direction of privacy protection.

Decentralized Self-Auditing Scheme With Errors Localization for Multi-Cloud Storage

With the popularity of cloud storage, increasing users begin to outsource data to the cloud. In order to resist possible data analysis for centralized outsourced data and improve the fault tolerance, users prefer to distribute data to cloud servers of different cloud service providers. However, once the data have been outsourced, it will be out of user’s control and many security issues may occur, such as outsourced data being illegally tamper with, or rarely accessed data being secretly deleted. In this article, we propose a decentralized self-auditing scheme for multi-cloud storage, called DSAS. First, based on the symmetric balanced incomplete block design, DSAS achieves integrity verification for outsourced data via the interactions of cloud servers and the auditing costs are shared by the participating CSs. Second, DSAS can locate misbehavior cloud server with low computation costs, and resist denial of service attack initiated by malicious cloud servers which attempts to destroy the audit. Third, DSAS can recover the corrupted data without fetching data, and support the revocation of cloud servers and batch auditing. Finally, security proof and function evaluation show that DSAS has comprehensive security and functionality, and performance simulations and experiment results show that DSAS is efficient.

An Improved Secure Public Cloud Auditing Scheme in Edge Computing

Cloud storage plays an important role in the data processing of edge computing. It is very necessary to protect the integrity of these data and the privacy of users. Recently, a cloud auditing scheme which can be used to smart cities has been proposed, which is lightweight and privacy-preserving. Although this scheme has very good performance and is a very valuable work, we find that there is insecurity in it. By giving two kinds of attacks, we prove that a malicious cloud server provider (CSP) can forge auditing proof and can successfully pass the verification of the third-party auditor (TPA) even if the CSP deletes the user’s data. Then, based on this scheme, we propose an improved scheme, which can resist the forgery attack from malicious CSP. Through security analysis, our scheme improves the security compared to the original scheme without reducing the efficiency.

Audit as You Go: A Smart Contract-Based Outsourced Data Integrity Auditing Scheme for Multiauditor Scenarios with One Person, One Vote

The data outsourcing services provided by cloud storage have greatly reduced the headache of data management for users, but the issue of remote data integrity poses further security concerns and computing burdens. The introduction of a third-party auditor (TPA) frees data owners from the auditing burden and alleviates disputes over the audit results between data owners and cloud storage providers. However, malicious cloud servers may collude with TPAs to deceive users for financial profits. Hiring multiple auditors in a single audit assignment appears to be a method to address the above problem, but the ensuing voting issues need to be further explored. In this paper, we proposed a smart contract-based outsourced data integrity auditing scheme for multiauditor scenarios. Unlike some existing schemes using reputation like factors as their voting weights, auditors in our scheme vote equally and audit as they go, without any maintenance. This mechanism not only frees auditors from trivia not related to the auditing but also avoids the drawbacks of centralization associated with over-high voting weights. The challenge used to check the integrity of the outsourced data is jointly generated by each involved auditor. Any collusion would be detected as long as there exists more than one honest auditor in the audit. We implement and deploy the scheme as Ethereum smart contracts. With the help of blockchain, the entire auditing process is public and transparent. Both the generated data and the obtained results are persisted with immutability, which ensures the traceability of all historical audits. The comprehensive theoretical and experimental analyses demonstrate that our scheme meets the claimed targets with high efficiency and low gas costs.

Improved Cloud Auditing Protocol and Its Application for Pandemic Data Management

Data integrity verification mechanisms play an important role in cloud environments. Recently, a lightweight identity-based cloud storage audit scheme has been proposed; this paper points out security vulnerabilities of their OffTagGen algorithm. That is, the attackers such as malicious cloud servers can forge the tags, which can destroy data integrity. By improving the construction of OffTagGen algorithm, an improved security cloud auditing protocol is proposed in this work to better protect user’s privacy. The analysis shows that the new protocol is effective and resistant to attacks.

VRFMS: Verifiable Ranked Fuzzy Multi-keyword Search over Encrypted Data

Searchable encryption(SE) allows users to efficiently retrieve data over encrypted cloud data, but most existing SE schemes only support exact keyword search, resulting in false results due to minor typos or format inconsistencies of queried keywords. The fuzzy keyword search can avoid this limitation, but still incurs low search accuracy and efficiency. Besides, most of fuzzy keyword search schemes do not consider malicious cloud servers which may execute a fraction of search operations or forge some results due to various interest incentives such as saving computation or storage resources. To solve these problems, we propose an efficient and Verifiable Ranked Fuzzy Multi-keyword Search scheme, called VRFMS. VRFMS uses locality-sensitive hashing and bloom filter to implement fuzzy keyword search, and employs Term Frequency-Inverse Document Frequency(TF-IDF) to sort the relevant results. Aiming to further improve the search accuracy, we design an improved bi-gram keyword transformation method. Furthermore, the homomorphic MAC technique and a random challenge technique are utilized to verify the correctness and completeness of returned results, respectively. Formal security analysis and empirical experiments demonstrate that VRFMS is secure and efficient in practical applications, respectively.

An Outsourced Decryption ABE Model using ECC in Internet of Things

Internet of Things (IoT) is a modern technology that is applicable almost everywhere nowadays. Everything is connected to the Internet in the modern digital era. IoT is a collection of things that are interconnected to share information. Devices connected to IoT networks have some limitations in performing heavy computational tasks because of the availability of less computational and battery power. Attribute Based Encryption (ABE) is a modern public-key cryptographic technique that provides privacy with access control. The bilinear map is an expensive operation that is used in most of the ABE schemes. Elliptic Curve Cryptography (ECC) is an alternative for bilinear pairing to reduce the computation of encryption and decryption in ABE schemes. The process of encryption and decryption of ABE is a heavy computational task for resource-constrained devices. In this paper, an outsourcing-based decryption of ABE using ECC is proposed to reduce the decryption overhead of devices that have limited computational resources. Our scheme divides the computation of the decryption of ABE into two stages: first, the partial decryption of ciphertext in the cloud server, and second, the final decryption of partially decrypted ciphertext by the data user to retrieve the original message. This scheme is secure against the malicious cloud server by adding a blinding factor into the secret to be shared. The blinding factor is shared with intended users through attribute authority. The experimental results demonstrate that our scheme can reduce the decryption complexity and save the computational time of devices, compared to the existing schemes. Thus the proposed scheme is applicable for lightweight devices used in IoT.

A robust and distributed architecture for 5G-enabled networks in the smart blockchain era

Internet-of-Things (IoT) integrates ubiquitous computing to extend the Internet connectivity to the various application environments such as e-Health, smart cities, cyber–physical systems, etc. It connects the real-time objects to experience high-speed data transfer in 5G network deployment. It may periodically collect and process the data to control the access mechanism that utilizes a dedicated network protocol to fetches the information from different network domains. However, most of the access mechanisms cannot be applicable to the industrial application as it is based on a centralized architecture. This architecture has a complexity of computation overhead to deteriorate the performance of device-to-device (D2D) communication. In the industrial sectors, security and privacy preservation are majorly concerned to perform expensive operations and to prevent malicious cloud servers. Moreover, the real-time objects should be coordinated to optimize communication efficiencies. Thus, this paper presents a robust blockchain-based lightweight distributed architecture (RB-LDA) for 5G-enabled networks. The proposed RB-LDA authenticates the device access that advertises genuine data possession to restrict the key exposure. Moreover, the qualitative analysis proves the identity management continuously monitors the activities of IoT devices to perform a better auditing process. Above all, the experimental analysis shows that the proposed RB-LDA can achieve better data privacy to preserve sensitive information against the trusted third parties.

Improved Outsourced Provable Data Possession for Secure Cloud Storage

With the advent of data outsourcing, how to efficiently verify the integrity of data stored at an untrusted cloud service provider (CSP) has become a significant problem in cloud storage. In 2019, Guo et al. proposed an outsourced dynamic provable data possession scheme with batch update for secure cloud storage. Although their scheme is very novel, we find that their proposal is not secure in this paper. The malicious cloud server has ability to forge the authentication labels, and thus it can forge or delete the user’s data but still provide a correct data possession proof. Based on the original protocol, we proposed an improved one for the auditing scheme, and our new protocol is effective yet resistant to attacks.

Fair multi-owner search over encrypted data with forward and backward privacy in cloud-assisted Internet of Things

The trend towards the Internet of Things (IoT) technology promises the growth of home and organizational automation in the world. Due to the large amount of IoT data stored in the semi-trust cloud server, the IoT is vulnerable to cyberattacks. Therefore, the privacy violation of outsourced data is an obstacle to efficient IoT data storage. Searchable encryption is a promising solution for secure storage and selective data retrieval. However, achieving desired privacy, performance, and attributes such as dynamics, access control, scalability, and fair arbitration is still a challenge in searchable encryption schemes. In this paper, we propose a fair and dynamic multi-owner searchable encryption scheme wherein dynamics does not leak the sensitive information. In the proposed scheme, the verifiability and fair arbitration, respectively, prevent the malicious cloud servers and malicious users from having any motivation to disrupt the accuracy of the exchanged data. Generating a single trapdoor corresponding to the conjunctive keyword query, a client can search over all documents stored in the cloud, the owner of which has allowed the client to access. We also prove that our scheme is secure against the keyword guessing attack in the standard model. Finally, evaluating the performance of the proposed scheme on a real dataset, we demonstrate its efficiency as well.