Multi-authority Cloud Storage Research Articles

CEMAR: a fine grained access control with revocation mechanism for centralized multi-authority cloud storage

CEMAR: a fine grained access control with revocation mechanism for centralized multi-authority cloud storage

A dynamic and hierarchical access control for IoT in multi-authority cloud storage

Internet-of-Things (IoT) is massively growing and introducing several benefits that are able to transform the world. Also, cloud computing has become significantly important due to its ability to handle large sets of data. IoT and cloud computing present a stalwart combination that can enrich several analytics and applications. Nevertheless, cloud data security and users privacy can have gaps. Especially when the IoT and cloud systems deal with a dynamically behaving users within a centralized and costly environment. Therefore, there is an urgent need for a dynamic access control scheme that considers the users’ behavior while making the access control decisions within a reasonable time. In this paper, we introduce a Multi-Dimensional Access Control (MD-AC) scheme for dynamically authorizing and revoking users in the cloud with multiple authorities. The experimental results indicate that MD-AC can evaluate access requests within reasonable and acceptable processing times. By considering very hard experimental conditions and numerous transactions, the average encryption and decryption times are 18 and 10 ms respectively. Furthermore, the proposed scheme is validated and compared with recent state-of-art schemes. The results demonstrate that the proposed scheme is fast and robust against different well-known attacks. Moreover, MD-AC can be used for keeping the privacy of IoT services over the cloud environment.

ERAC-MAC efficient revocable access control for multi-authority cloud storage system

In the current scenario, there is an appreciable escalation in the utilisation of cloud computing by critical industrial applications due to its cost-effective storage and computing. However, due to an untrusted server in a cloud, the access control turns out to be the challenging issue to ensure the confidentiality of sensitive data. The ciphertext policy attribute-based encryption (CP-ABE) is deliberated to be an apt technique to enforce the access control for encrypted cloud outsourced data. But, due to the computation complexity of decryption, user revocation and complexity of key management for achieving granularity, prevailing CP-ABE schemes when applied directly to multi authority attribute system, incurs more computational costs in the order of NP. In this paper, an efficient CP-ABE based multi authority attribute system is put forth that supports decryption and user revocation by CSP with the advent of a blind encryption/decryption technique and a novel colouring scheme for predicting user behaviour analysis. Security and performance of ERAC-MAC was analysed and found to be much better than the other prevailing schemes. The implementation was done using the paring based cryptography library of the Stanford University in Ubuntu environment.

ERAC-MAC efficient revocable access control for multi-authority cloud storage system

In the current scenario, there is an appreciable escalation in the utilisation of cloud computing by critical industrial applications due to its cost-effective storage and computing. However, due to an untrusted server in a cloud, the access control turns out to be the challenging issue to ensure the confidentiality of sensitive data. The ciphertext policy attribute-based encryption (CP-ABE) is deliberated to be an apt technique to enforce the access control for encrypted cloud outsourced data. But, due to the computation complexity of decryption, user revocation and complexity of key management for achieving granularity, prevailing CP-ABE schemes when applied directly to multi authority attribute system, incurs more computational costs in the order of NP. In this paper, an efficient CP-ABE based multi authority attribute system is put forth that supports decryption and user revocation by CSP with the advent of a blind encryption/decryption technique and a novel colouring scheme for predicting user behaviour analysis. Security and performance of ERAC-MAC was analysed and found to be much better than the other prevailing schemes. The implementation was done using the paring based cryptography library of the Stanford University in Ubuntu environment.

Secure Multi-Authority Data Access Control Scheme in Cloud Storage System Based on Attribute-Based Signcryption

Nowadays, secure data access control has become one of the major concerns in a cloud storage system. As a logical combination of attribute-based encryption and attribute-based signature, attribute-based signcryption (ABSC) can provide confidentiality and an anonymous authentication for sensitive data and is more efficient than traditional “encrypt-then-sign” or “sign-then-encrypt” strategies. Thus, ABSC is suitable for fine-grained access control in a semi-trusted cloud environment and is gaining more and more attention in recent years. However, in many previous ABSC schemes, user’s sensitive attributes can be disclosed to the authority, and only a single authority that is responsible for attribute management and key generation exists in the system. In this paper, we propose PMDAC-ABSC, a novel privacy-preserving data access control scheme based on Ciphertext-Policy ABSC, to provide a fine-grained control measure and attribute privacy protection simultaneously in a multi-authority cloud storage system. The attributes of both the signcryptor and the designcryptor can be protected to be known by the authorities and cloud server. Furthermore, the decryption overhead for user is significantly reduced by outsourcing the undesirable bilinear pairing operations to the cloud server without degrading the attribute privacy. The proposed scheme is proven to be secure in the standard model and has the ability to provide confidentiality, unforgeability, anonymous authentication, and public verifiability. The security analysis, asymptotic complexity comparison, and implementation results indicate that our construction can balance the security goals with practical efficiency in computation.

On the Security of Data Access Control for Multiauthority Cloud Storage Systems

Data access control has becoming a challenging issue in cloud storage systems. Some techniques have been proposed to achieve the secure data access control in a semitrusted cloud storage system. Recently, K. Yang et al. proposed a basic data access control scheme for multiauthority cloud storage system (DAC-MACS) and an extensive data access control scheme (EDAC-MACS). They claimed that the DAC-MACS could achieve efficient decryption and immediate revocation and the EDAC-MACS could also achieve these goals even though nonrevoked users reveal their Key Update Keys to the revoked user. However, through our cryptanalysis, the revocation security of both schemes cannot be guaranteed. In this paper, we first give two attacks on the two schemes. By the first attack, the revoked user can eavesdrop to obtain other users’ Key Update Keys to update its Secret Key, and then it can obtain proper Token to decrypt any secret information as a nonrevoked user. In addition, by the second attack, the revoked user can intercept Ciphertext Update Key to retrieve its ability to decrypt any secret information as a nonrevoked user. Secondly, we propose a new extensive DAC-MACS scheme (NEDAC-MACS) to withstand the above two attacks so as to guarantee more secure attribute revocation. Then, formal cryptanalysis of NEDAC-MACS is presented to prove the security goals of the scheme. Finally, the performance comparison among NEDAC-MACS and related schemes is given to demonstrate that the performance of NEDAC-MACS is superior to that of DACC, and relatively same as that of DAC-MACS.

Two-Factor Data Access Control With Efficient Revocation for Multi-Authority Cloud Storage Systems

Attribute-based encryption, especially for ciphertext-policy attribute-based encryption, can fulfill the functionality of fine-grained access control in cloud storage systems. Since users’ attributes may be issued by multiple attribute authorities, multi-authority ciphertext-policy attribute-based encryption is an emerging cryptographic primitive for enforcing attribute-based access control on outsourced data. However, most of the existing multi-authority attribute-based systems are either insecure in attribute-level revocation or lack of efficiency in communication overhead and computation cost. In this paper, we propose an attribute-based access control scheme with two-factor protection for multi-authority cloud storage systems. In our proposed scheme, any user can recover the outsourced data if and only if this user holds sufficient attribute secret keys with respect to the access policy and authorization key in regard to the outsourced data. In addition, the proposed scheme enjoys the properties of constant-size ciphertext and small computation cost. Besides supporting the attribute-level revocation, our proposed scheme allows data owner to carry out the user-level revocation. The security analysis, performance comparisons, and experimental results indicate that our proposed scheme is not only secure but also practical.

Multi-authority attribute-based encryption access control scheme with policy hidden for cloud storage

For realizing the flexible, scalable and fuzzy fine-grained access control, ciphertext policy attribute-based encryption (CP-ABE) scheme has been widely used in the cloud storage system. However, the access structure of CP-ABE scheme is outsourced to the cloud storage server, resulting in the disclosure of access policy privacy. In addition, there are multiple authorities that coexist and each authority is able to issue attributes independently in the cloud storage system. However, existing CP-ABE schemes cannot be directly applied to data access control for multi-authority cloud storage system, due to the inefficiency for user revocation. In this paper, to cope with these challenges, we propose a decentralized multi-authority CP-ABE access control scheme, which is more practical for supporting the user revocation. In addition, this scheme can protect the data privacy and the access policy privacy with policy hidden in the cloud storage system. Here, the access policy that is realized by employing the linear secret sharing scheme. Finally, the security and performance analyses demonstrate that our scheme has high security in terms of access policy privacy and efficiency in terms of computational cost of user revocation.

SDSS-MAC: Secure data sharing scheme in multi-authority cloud storage systems

Secure data access control has become a challenging issue in cloud storage system schemes. Some attribute-based encryption techniques have been proposed to achieve more secure data access control for sharing data in a semi-trusted cloud storage system with multiple attribute authorities. However, based on Dolev–Yao model, security goals such as active attack resistance, confidentiality, anti-collusion, and attribute revocation security for most schemes cannot be all perfectly guaranteed since the capable adversary can overhear, intercept, replay, and synthesis arbitrary information in the open communication channels. In this paper, we first propose a Security-enhanced Multi-Authority Attribute-Based Encryption (SMA-ABE) scheme against common drawbacks for existing Multi-Authority Attribute-Based Encryption (MA-ABE) schemes such as key distribution on secure channel assumption and non-reliable decryption algorithms. Then based on our SMA-ABE scheme, a Secure Data Sharing Scheme in Multi-Authority Cloud-storage-systems (SDSS-MAC) is constructed to achieve fine-grained access control and efficient decryption with offloaded and verifiable transformation on cloud, and to support secure attribute-level immediate revocation of users' attribute. It can be formally proved that SDSS-MAC can achieve the confidentiality, provenance verification and integrity of data, secure key distribution, multiple collusions resistance, and attribute-revocation security. Finally, performance comparison among SDSS-MAC and other related schemes are given to demonstrate that SDSS-MAC can balance above security goals with practical efficiency of storage, computation and communication comparing with other related schemes.

Upgraded Secrecy of Cloud Storage Data Users Using Improved Data Access Control Strategy for Multi-Authority Cloud Storage

Upgraded Secrecy of Cloud Storage Data Users Using Improved Data Access Control Strategy for Multi-Authority Cloud Storage

Survey on Re-encryption based Attribute Revocation in Data Access Control for Multi-Authority Cloud Storage

Survey on Re-encryption based Attribute Revocation in Data Access Control for Multi-Authority Cloud Storage

Multi-authority proxy re-encryption based on CPABE for cloud storage systems

The dissociation between data management and data ownership makes it difficult to protect data security and privacy in cloud storage systems. Traditional encryption technologies are not suitable for data protection in cloud storage systems. A novel multi-authority proxy re-encryption mechanism based on ciphertext-policy attribute-based encryption (MPRE-CPABE) is proposed for cloud storage systems. MPRE-CPABE requires data owner to split each file into two blocks, one big block and one small block. The small block is used to encrypt the big one as the private key, and then the encrypted big block will be uploaded to the cloud storage system. Even if the uploaded big block of file is stolen, illegal users cannot get the complete information of the file easily. Ciphertext-policy attribute-based encryption (CPABE) is always criticized for its heavy overload and insecure issues when distributing keys or revoking user's access right. MPRE-CPABE applies CPABE to the multi-authority cloud storage system, and solves the above issues. The weighted access structure (WAS) is proposed to support a variety of fine-grained threshold access control policy in multi-authority environments, and reduce the computational cost of key distribution. Meanwhile, MPRE-CPABE uses proxy re-encryption to reduce the computational cost of access revocation. Experiments are implemented on platforms of Ubuntu and CloudSim. Experimental results show that MPRE-CPABE can greatly reduce the computational cost of the generation of key components and the revocation of user's access right. MPRE-CPABE is also proved secure under the security model of decisional bilinear Diffie-Hellman (DBDH).

Effective and Secure Access Control for Multi-Authority Cloud Storage Systems

Ciphertext-Policy Attribute-Based Encryption (CP-ABE) is a promising cryptographic tool to implement access control for secure cloud storage systems. However, most existing access control schemes based on CP-ABE for the multi-authority cloud storage systems rely on a fully trusted global certificate authority. It is just an ideal assumption while there never exists a fully trusted global certificate authority in reality. In this paper, we construct a system with multiple certificate authorities (CA). The parameters of those CAs could be verified when an authority suspects the messages received from the correlative certificate authority. Besides, we construct a verifiable secret sharing (VSS) scheme to realize the decentralization of the certificate authority in our scheme. The scheme adopts the Pedersen commitment in combination with the properties of bilinear-pairs on elliptic curve and bilinear Diffie-Hellman problem. The analysis shows that our scheme is highly efficient, authentic and provably secure under the security model. Our scheme simultaneously supports efficient attribute revocation.

Enhanced Retreat of Cloud Storage Data users by Using Improved Data Access Control Scheme for Multi-Authority Cloud Storage

Enhanced Retreat of Cloud Storage Data users by Using Improved Data Access Control Scheme for Multi-Authority Cloud Storage

Comments on “DAC-MACS: Effective Data Access Control for Multiauthority Cloud Storage Systems”/Security Analysis of Attribute Revocation in Multiauthority Data Access Control for Cloud Storage Systems

In the above paper, Yang <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">et al</i> . have proposed a multi-authority ciphertext-policy attribute-based encryption-based data access control for cloud storage, in which the authors claimed that the mechanism in dealing with attribute revocation could achieve both forward security and backward security. Unfortunately, our further analysis and investigation show that their work adopts a bidirectional re-encryption method in ciphertext updating, so a security vulnerability appears. Our proposed attack method demonstrates that a revoked user can still decrypt new ciphertexts that are claimed to require the new-version secret keys to decrypt.

Collective advancements on access control scheme for multi-authority cloud storage system

In this information age, the amount of data generated by an individual and organisation is increasing exponentially. Cloud computing has come as a rescue to store and compute the data efficiently at a low cost. On the other hand, according to cloud security alliance, the threats and vulnerabilities related to cloud computing are on the rise and they may reach an uncontrollable level if cloud security inhabits the same shape. Attribute-based encryption techniques are used in several critical applications for data access control. Our proposed work enhances the security of DAC-MAC during the user registration phase by the advent of digital signature over user credentials for avoiding man-in-the-middle attack and providing non-repudiation during user registration phase. Secondly, a verification scheme based on user-privilege list for file access request is included. Lastly, by logging the user behaviours in the separate database table, the authenticity of the access node can be verified, monitored and DDoS attack can be nullified. The framework could be used for IaaS application.

Expressive, Efficient, and Revocable Data Access Control for Multi-Authority Cloud Storage

Data access control is an effective way to ensure the data security in the cloud. Due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Ciphertext-Policy Attribute-based Encryption (CP-ABE) is regarded as one of the most suitable technologies for data access control in cloud storage, because it gives data owners more direct control on access policies. However, it is difficult to directly apply existing CP-ABE schemes to data access control for cloud storage systems because of the attribute revocation problem. In this paper, we design an expressive, efficient and revocable data access control scheme for multi-authority cloud storage systems, where there are multiple authorities co-exist and each authority is able to issue attributes independently. Specifically, we propose a revocable multi-authority CP-ABE scheme, and apply it as the underlying techniques to design the data access control scheme. Our attribute revocation method can efficiently achieve both forward security and backward security. The analysis and simulation results show that our proposed data access control scheme is secure in the random oracle model and is more efficient than previous works.

DAC-MACS: Effective Data Access Control for Multiauthority Cloud Storage Systems

Data access control is an effective way to ensure data security in the cloud. However, due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Existing access control schemes are no longer applicable to cloud storage systems, because they either produce multiple encrypted copies of the same data or require a fully trusted cloud server. Ciphertext-policy attribute-based encryption (CP-ABE) is a promising technique for access control of encrypted data. However, due to the inefficiency of decryption and revocation, existing CP-ABE schemes cannot be directly applied to construct a data access control scheme for multiauthority cloud storage systems, where users may hold attributes from multiple authorities. In this paper, we propose data access control for multiauthority cloud storage (DAC-MACS), an effective and secure data access control scheme with efficient decryption and revocation. Specifically, we construct a new multiauthority CP-ABE scheme with efficient decryption, and also design an efficient attribute revocation method that can achieve both forward security and backward security. We further propose an extensive data access control scheme (EDAC-MACS), which is secure under weaker security assumptions.