Outsourced Data Research Articles

Fibonacci tree structure based privacy preserving public auditing for IoT enabled data in cloud environment

Presently, Internet of Things (IoT) adopts cloud storage services to facilitate the efficient integration of IoT devices and the seamless management of collected data. Nevertheless, data owners have no direct control over outsourced data in the cloud storage model, leading to substantial data integrity issues. Earlier, many public auditing models have been introduced to ensure data integrity in the cloud environment. However, these models cannot guarantee - data dynamics with proper retrievability and privacy-preservation against trusted third party auditor (TPA) during auditing procedure. To address the limitations of public auditing models, we introduce a Fibonacci Tree (FT) structure-based efficient public auditing model supporting dynamic data updates with a standard security model. Specifically, Fibonacci Tree (FT) structure is designed to achieve real-time data updates with proper data traceability. The proposed model also includes an extended index-hash-table (E-IHT) located at TPA and records the data block’s properties for efficient data dynamics and auditing procedure. The comprehensive security analysis with standard proof guarantees the computational intractability of the proposed model. At last, the experimental analysis demonstrates the feasibility and practicability of the proposed model.

Audit as You Go: A Smart Contract-Based Outsourced Data Integrity Auditing Scheme for Multiauditor Scenarios with One Person, One Vote

The data outsourcing services provided by cloud storage have greatly reduced the headache of data management for users, but the issue of remote data integrity poses further security concerns and computing burdens. The introduction of a third-party auditor (TPA) frees data owners from the auditing burden and alleviates disputes over the audit results between data owners and cloud storage providers. However, malicious cloud servers may collude with TPAs to deceive users for financial profits. Hiring multiple auditors in a single audit assignment appears to be a method to address the above problem, but the ensuing voting issues need to be further explored. In this paper, we proposed a smart contract-based outsourced data integrity auditing scheme for multiauditor scenarios. Unlike some existing schemes using reputation like factors as their voting weights, auditors in our scheme vote equally and audit as they go, without any maintenance. This mechanism not only frees auditors from trivia not related to the auditing but also avoids the drawbacks of centralization associated with over-high voting weights. The challenge used to check the integrity of the outsourced data is jointly generated by each involved auditor. Any collusion would be detected as long as there exists more than one honest auditor in the audit. We implement and deploy the scheme as Ethereum smart contracts. With the help of blockchain, the entire auditing process is public and transparent. Both the generated data and the obtained results are persisted with immutability, which ensures the traceability of all historical audits. The comprehensive theoretical and experimental analyses demonstrate that our scheme meets the claimed targets with high efficiency and low gas costs.

Efficient Data Integrity Auditing Supporting Provable Data Update for Secure Cloud Storage

Cloud storage, an economically attractive service offered by cloud service providers (CSPs), has attracted a large number of tenants. However, because the ownership and management of outsourced data are separated, outsourced data faces a lot of security challenges, for instance, data security, data integrity, data update, and so on. In this article, we primarily investigate the problem of efficient data integrity auditing supporting provable data update in cloud computing environment. Subsequently, on the basis of the Merkel sum hash tree (MSHT), we introduce an efficient outsourced data integrity auditing scheme. Our designed scheme could synchronously meet the requirements of provable data update and data confidentiality without dependency on a third authority. At the same time, the numerical analysis shows that the computing complexity logarithmically grows with the number of outsourced subfiles. Finally, a prototype implementation is developed to simulate our designed scheme and measure its performance. The consequences of experiments present that compared with some previous solutions, our designed scheme has much more attractive practicality and higher efficiency in practical applications.

RETRACTED ARTICLE: Securing medical data by role-based user policy with partially homomorphic encryption in AWS cloud

Cloud technology provides services for storing and accessing a large amount of data with ease of access and less cost. Sensitive data such as patients' electronic health information should be encrypted before outsourcing into the cloud. Many traditional encryption methods are used for protecting data in the cloud, but unable to perform computation on encrypted data. Homomorphic encryption operates directly on the ciphertext. In this study, a Secure Partially Homomorphic Encryption (SPHE) algorithm is proposed to secure the outsourced data and perform multiplication and division operations on the ciphertext. The access control policy in the cloud environment is more flexible. An attacker can easily collect sensitive data by abusing the access policy of another user. Therefore, the database privacy is compromised. Creating a role hierarchy and managing the session is difficult in the cloud environment. The above issues motivate us to develop a model which is the integration of the proposed scheme SPHE with role-based user policy. The model is implemented in Eclipse IDE (Integrated Development Environment) and AWS (Amazon Web Service) Toolkit for Eclipse and deployed in Amazon Elastic Beanstalk (EB) environment. This model is particularly used for securing the patient e-health details and performing computation on outsourced data. The patient details are encrypted by the algorithm SPHE and uploaded in AWS S3 (Simple Storage Service) bucket. The users are created by AWS Identity and Access Management (IAM) service and the access level policy is defined based on user roles in EB environment. The proposed model performance is studied by comparing with other partially homomorphic methods Elgamal, Pailler, and Benaloh. This model achieves data integrity and data confidentiality using the role-based user policy with SPHE.

A Blockchain-Empowered Arbitrable Multimedia Data Auditing Scheme in IoT Cloud Computing

As increasing clients tend to outsource massive multimedia data generated by Internet of Things (IoT) devices to the cloud, data auditing is becoming crucial, as it enables clients to verify the integrity of their outsourcing data. However, most existing data auditing schemes cannot guarantee 100% data integrity and cannot meet the security requirement of practical multimedia services. Moreover, the lack of fair arbitration leads to clients not receiving compensation in a timely manner when the outsourced data is corrupted by the cloud service provider (CSP). In this work, we propose an arbitrable data auditing scheme based on the blockchain. In our scheme, clients usually only need to conduct private audits, and public auditing by a smart contract is triggered only when verification fails in private auditing. This hybrid auditing design enables clients to save audit fees and receive compensation automatically and in a timely manner when the outsourced data are corrupted by the CSP. In addition, by applying the deterministic checking technique based on a bilinear map accumulator, our scheme can guarantee 100% data integrity. Furthermore, our scheme can prevent fraudulent claims when clients apply for compensation from the CSP. We analyze the security strengths and complete the prototype’s implementation. The experimental results show that our blockchain-based data auditing scheme is secure, efficient, and practical.

Group data freshness scheme for outsourced data in distributed systems

Data freshness ensures accessing recent data that could help in achieving high business values and providing effective customer service. Group data freshness is a challenging aspect in a distributed outsourced environment, as stale data among different entities may mislead the business goal of the system. Generally, three-party data outsourcing model is found in practice: users, data owner, and cloud service provider. The users require to register with the data owner to access data files directly from the cloud service provider. A scheme verifying the freshness of whole outsourced data of its readers is called the group data freshness auditing scheme (GDFAS). Existing GDFASs focus on a probabilistic guarantee and require high computational cost at the data owner. In this paper, an efficient group data freshness auditing scheme is proposed, where the data owner does auditing in a distributed system with the help of the system users. As the data owner is not directly involved in their user’s data access, it needs mechanisms such as auditing data through an additional third-party to ensure the data is fresh. However, the third-party data storage service provider may not be fully trusted by a data owner. In such context, auditing data with respect to its freshness property without involving additional third-party storage service is challenging, but would be more effective in terms of the system’s performance and efficacy. The proposed GDFAS provides real-time data freshness verification using Merkle hash trees. In comparison to the existing scheme, it takes less computational cost at the data owner without involving any third party and less communication cost between the data owner and the service provider. The proposed GDFAS is implemented on the AWS cloud and the auditing cost at the data owner is experimentally evaluated. The proposed GDFAS is analyzed and compared with the relevant existing scheme and is found that the proposed GDFAS outperforms other schemes with respect to its security and efficiency.

Multi-Recipient encryption with keyword search without pairing for cloud storage

With the rapid development of cloud computing technology and communication technology, cloud storage has become a tool used by people in daily life. Cloud storage service enables users to outsource data to cloud servers and retrieve desired document efficiently. Individual privacy in outsource data are very sensitive and should be prevented from any leakage. Public-key encryption with keyword search (PEKS) scheme resolves this tension, while public-key authentication encryption with keyword search (PAEKS) scheme improve its keyword guessing attacks problem potentially. Whereas, the loss of keyword privacy, the limitation of single user interaction and low efficiency make PEKS/PAEKS schemes far from enough in practical applications.In this paper, we develop a multi-recipient public key encryption scheme with keyword search without pairing (MREKS) for cloud storage under public key infrastructure. The proposed scheme has the merits of supporting multi-recipient keyword search way as well as requiring no expensively bilinear pairing operations under standard model. We present a concrete and efficient construction of MREKS, and prove its security based on discrete logarithm assumptions. Furthermore, we embed the algorithm of data plaintext encryption and decryption into the scheme, which makes the scheme more practical. We show that our scheme enjoys much more efficiency than previous PEKS/PAEKS scheme in the simulation experiment, especially the keyword encryption is optimized by 79.5%.

An Efficient User’s Attribute Revocation Scheme Suitable for Data Outsourcing in Cloud Storage

With the advances of cloud data centers and cloud service, many application scenarios are developed such as enterprise business, the Vehicular Ad Hoc Networks (VANET), Sensor network. Confidentiality and efficiency are two key problems. CP-ABE is one of fine-grained access control cryptographic technologies and it is widely applied in outsourced data in cloud storage to protect the user’s privacy. In addition, besides confidentiality, computational cost is an important factor which makes the application of CP-ABE possible in the situations. In this paper, we propose a novel and fast scheme based on CP-ABE algorithm from the respect of the user’s attribute revocation to make it faster. In this scheme, we construct an identical tree T2 that has the same structure as the actual access control tree T1. When the user issues to request the encrypted text preserved on CSP, CSP first tries to decrypt CT2 which is encrypted according to the access policy based on the identical tree T2 and also preserved on it, with the subset of the secret keys corresponding to the indexes of the attributes provided by the user. If CSP can successfully decrypt it, it proves that he/she has the authorization to access the cryptographic text CT1 and CSP will send CT1 to the user. Otherwise, CSP recognizes that the user has no access to CT1 and rejects to send CT1 to the user. Namely, we can decide if we authorize the right to access CT1 by judging if the secret key provided by the user can decrypt CT2. Because CT1 and CT2 have the same access control structure, they have the same secret key for decryption; that is, when some attributes are revoked, if the secret key cannot decrypt CT2, it cannot decrypt CT1. While CSP can directly decrypt CT2, but not CT1, CSP can judge if the user has access to CT1 after the attribute revocation by decryption of CT2. Moreover, we propose the construction method of CT1 and CT2. Finally, we prove that the scheme is secure and viable.

Identity-based remote data checking with a designated verifier

Traditional remote data possession auditing mechanisms are usually divided into two types: private auditing and public auditing. Informally, private auditing only allows the original data owner to check the integrity of its outsourced data, whereas anyone is allowed to perform the checking task in public auditing. However, in many practical applications, the data owner expects some designated verifier (instead of others) to audit its data file, which cannot be covered by the existing private or public auditing protocols. Thus, in a recent work, Yan et al. proposed a new auditing technique with a designated verifier [IEEE Systems Journal, 12(4): 1788-1797, 2020]. Nevertheless, we note that this protocol suffers from complicated management of certificates and hence heavily relies on public key infrastructure. To overcome this shortcoming, in this paper, we propose an identity-based auditing protocol with a designated verifier, which not only avoids the introduction of certificates, but also has the desired property of only allowing specific verifier to audit. Its security is based on the classical computational Diffie-Hellman and Weil Diffie-Hellman assumptions. Finally, performance analysis shows that our proposed protocol is very efficient and suitable for some real-life applications.

Accountable outsourcing data storage atop blockchain

Outsourcing data integrity auditing enables users to efficiently check whether their cloud data are stored intactly without retrieving them. However, a problem arises that how to hold the storage server accountable when the auditing results show that the data has been lost or tampered with. In this paper, we propose a blockchain-based accountable data outsourcing storage protocol, which enables users to obtain fine-grained compensation based on the damage of data. We provide an accurate and verifiable damage assessment method to achieve quantitative compensation. Specifically, the damage is assessed by the server and verified by smart contract. Furthermore, our protocol ensures the fairness of participants by deposit mechanism and smart contract. If any participant behaves dishonestly, it cannot obtain any benefit or even be punished. To reduce user’s overhead, we propose a new provable data possession scheme, PDP in short, supporting outsourcing the calculation of tags. Moreover, we provide a detailed security proof for the proposed protocol as well. Finally, we evaluate the time cost of off-chain functions and the gas cost of on-chain operations for our protocol, which demonstrates that it is practical and suitable in reality.

A Provably Secure and Efficient Range Query Scheme for Outsourced Encrypted Uncertain Data From Cloud-Based Internet of Things Systems

The outsourcing of data is becoming increasingly commonplace as data is constantly been synchronized between user systems (e.g., personal computers and sensor devices) and cloud computing servers. However, to ensure data privacy, it is necessary to encrypt sensitive data prior to outsourcing. Limitations such as measurement, network delays, and data obfuscation may, however, result in uncertain data. Compared with searching over encrypted certain data, processing queries for encrypted uncertain data is more challenging. In this article, we propose a secure and efficient range query scheme over outsourced encrypted uncertain data, for example, from Internet of Things (IoT) systems. Specifically, we use pivot mapping to map data to a low-dimensional space to facilitate calculation and processing while preserving some of the original relevance among the data. Additionally, we encode data and then map codes into multiple Bloom filters which are organized by a binary tree-based index. Our scheme achieves data privacy, hides the relevance among data, and also supports efficient queries. We analyze the security and evaluate the performance of our approach using experiments on Microsoft Azure. The analysis and experimental results demonstrate that our proposed approach is secure and efficient.

An optimal swift key generation and distribution for QKD

Secured transmission between users is essential for communication system models. Recently, cryptographic schemes were introduced for secured transmission and secret transmission between cloud users. In a cloud environment, there are many security issues that occur among the cloud users such as, account hacking, data breaches, broken authentication, compromised credentials, and so on. Quantum mechanics has been implemented in cryptography that made it efficient for strong security concerns over outsourced data in a cloud environment. Therefore, the present research focuses on providing excellent security for cloud users utilizing a swift key generation model for QKD cryptography. The Quantum Key Distribution (QKD) is an entirely secure scheme known as Cloud QKDP. Initially, a random bit sequence is generated to synchronize the channel. An eavesdropper will not permit to synchronize parameters between them. In this key reconciliation technique, the random bit sequence is concatenated with the photon polarisation state. BB84 protocol is improved by optimizing its bit size using FireFly Optimization (FFO) at the compatibility state, and in the next state, both transmitter and receiver generate a raw key. Once the key is generated, it is then used for the transmission of messages between cloud users. Furthermore, a Python environment is utilized to execute the proposed architecture, and the accuracy rate of the proposed model attained 98 %, and the error rate is 2 %. This proves the performance of the proposed firefly optimization algorithm based swift key generation model for QKD performs better than previous algorithms.

Blockchain-based random auditor committee for integrity verification

With the popularity of cloud storage, integrity verification for outsourced data has attracted more and more attention. The majority of existing research works rely on a unique third-party auditor (TPA) or fixed TPAs to audit the integrity of outsourced data, and thus they are vulnerable to DoS and collusion attacks as the TPA is not completely trusted. To conquer this problem, a blockchain-based random auditor committee is proposed to replace the fixed TPAs for the integrity verification (call BRAC scheme for short). The proposed blockchain consensus algorithm utilizes a verifiable random function (VRF) to select the third-party auditor committee (TPAC) which performs contract verification. The leader of TPAs (LTPA) packs the verification proof into a blockchain called verification chain. The main idea is employing the output of a VRF for leader election to make it probabilistic, such that specific nodes cannot be targeted in advance and a certain fraction of the nodes being malicious can be tolerated. We present rigorous security analysis to demonstrate the security of the proposed scheme. Meanwhile, the comprehensive performance evaluation shows that the proposed scheme improves the performance of data integrity verification effectively.

Provable data deletion from efficient data integrity auditing and insertion in cloud storage

With the widespread popularity of cloud storage, a growing number of data owners are willing to outsource their massive data to remote cloud servers, thus effectively avoiding the heavy burden of storing and managing the massive data by themselves in local physical storage mediums. Despite the tremendous advantages, cloud storage inescapably suffers from some severe security challenges resulting from the separation of outsourced data management and its ownership, such as data integrity, data deletion, and data insertion. In this paper, we aim to deal with the problems of integrity auditing, dynamic insertion and provable deletion over outsourced data. Specifically, we design a novel authentication data structure, namely, number-rank-based Merkle hash tree (NR-MHT), which can achieve data dynamic operations. Meanwhile, NR-MHT can maintain many data blocks in each leaf node, thus effectively solving the problem of the height indefinitely increases with the total number of data blocks. Subsequently, we adopt NR-MHT to propose a new provable data deletion scheme based on efficient data integrity auditing and dynamic data insertion. In our presented scheme, the data owner can not only permanently delete the unnecessary outsourced data blocks to save storage expenditures but also efficiently insert new data blocks to dynamically update the outsourced data set. Meanwhile, we analyze the security to formally demonstrate that our presented scheme can satisfy all of the expected security requirements without interacting with a third party auditor. Finally, we also develop a prototype implementation of our presented scheme and provide an accurate efficiency evaluation. The numerical analysis and experimental results show that compared with the existing schemes, our presented scheme is more attractive in efficiency and practicability.

Verifiable online/offline multi-keyword search for cloud-assisted Industrial Internet of Things

Attribute-based encryption (ABE) and attribute-based keyword search (ABKS) facilitate fine-grained access and search control for cloud-assisted Industrial Internet of Things (IIoT). However, existing schemes suffer from the following drawbacks: (1) their computational overhead in data outsourcing and retrieval is exceptionally high; (2) they obtain wrong search results if one or more of the queried keywords are wrongly selected; (3) in most existing ABKS, the untrustworthiness of the cloud server is not taken into account, and the correctness of the search results is not verified; (4) existing verifiable ABKS schemes do not support search results verification without the main data, and verifiers have to first download the search results and then check their correctness. In this paper, we design a verifiable online/offline multi-keyword search (VMKS) scheme providing high-level solutions to the aforementioned problems. We use the healthcare setting as a case study, and we demonstrate how our VMKS can be deployed in cloud-assisted Healthcare IIoT (HealthIIoT). We prove the security of our VMKS in the standard model and under the hardness assumption of the decisional bilinear Diffie-Hellman (DBDH) problem. Empirical results demonstrate that our VMKS speeds up encryption and verification processes by more than 70% and 90%, respectively. Moreover, our scheme reduces the communication overhead in the verification phase by more than 80%.

Privacy-Preserving Query Scheme (PPQS) for Location-Based Services in Outsourced Cloud

Pervasive smartphones boost the prosperity of location-based service (LBS) and the increasing data prompt LBS providers to outsource their LBS datasets to the cloud side. The privacy issues of LBS in the outsourced cloud scenario have attracted considerable interest recently. However, current schemes cannot provide sufficient privacy preservation against practical challenges and are little concerned about the data retrieval efficiency of the cloud side. Therefore, we present an efficient Privacy-Preserving LBS Query Scheme (i.e., PPQS ). In our scheme, two cloud entities are employed to store the sensitive information of the outsourced data and provide the query service, which enhances the ability of privacy preservation for sensitive information. Besides, by using the techniques of homomorphic encryption and searchable symmetric encryption, the proposed scheme supports both the type query and the range query, which can significantly improve the data retrieval efficiency of the cloud side and reduce the computation burden on the cloud side and the user side. Through detailed analysis on security and computation cost, we show the enhanced ability of privacy preservation and the lower computation cost compared to previous schemes. Based on a real dataset, extensive simulations are performed to validate the effectiveness and performance of our scheme.

Exponential Ant-Lion Rider Optimization for Privacy Preservation in Cloud Computing

The innovative trend of cloud computing is outsourcing data to the cloud servers by individuals or enterprises. Recently, various techniques are devised for facilitating privacy protection on untrusted cloud platforms. However, the classical privacy-preserving techniques failed to prevent leakage and cause huge information loss. This paper devises a novel methodology, namely the Exponential-Ant-lion Rider optimization algorithm based bilinear map coefficient Generation (Exponential-AROA based BMCG) method for privacy preservation in cloud infrastructure. The proposed Exponential-AROA is devised by integrating Exponential weighted moving average (EWMA), Ant Lion optimizer (ALO), and Rider optimization algorithm (ROA). The input data is fed to the privacy preservation process wherein the data matrix, and bilinear map coefficient Generation (BMCG) coefficient are multiplied through Hilbert space-based tensor product. Here, the bilinear map coefficient is obtained by multiplying the original data matrix and with modified elliptical curve cryptography (MECC) encryption to maintain data security. The bilinear map coefficient is used to handle both the utility and the sensitive information. Hence, an optimization-driven algorithm is utilized to evaluate the optimal bilinear map coefficient. Here, the fitness function is newly devised considering privacy and utility. The proposed Exponential-AROA based BMCG provided superior performance with maximal accuracy of 94.024%, maximal fitness of 1, and minimal Information loss of 5.977%.

Public Key Encryption with Authorized Equality Test on Outsourced Ciphertexts for Cloud-Assisted IoT in Dual Server Model

In cloud computing, the outsourced data face many privacy and security threats. To allow the cloud server to perform comparison, search, and classification on outsourced ciphertexts while simultaneously providing privacy guarantee, the encryption method that supports the ciphertext equality test is considered as a promising way. Users are able to authorize the cloud server to conduct the ciphertext equality test, so that two ciphertexts can be determined whether they encrypt the same message without being decrypted. In this process, users do not need to retrieve, decrypt, and then perform comparison on data; thus, the computing and communication efficiency can be greatly improved, and the privacy of user data can be guaranteed at the cloud server side. However, existing encryption schemes supporting authorized ciphertext equality test in the single server model cannot resist the keyword guessing attacks, and the solutions in the dual server model do not provide simultaneous authorization on two servers. To address these issues, this paper proposes a public key encryption scheme supporting authorized equality test on ciphertexts in the dual server model (PKE-AUT), where the primary server and secondary server must get the authorization from users before performing a sequential equality test on ciphertexts. Security and performance analysis demonstrate that the proposed PKE-AUT scheme not only guarantees the privacy of user data and authorization but also is practical in cloud-assisted IoT-related applications.

A secure searchable encryption scheme for cloud using hash-based indexing

Cloud service for data outsourcing has triggered security and privacy needs that can be satisfied by encrypting data prior to outsourcing to the cloud. Searchable Encryption that uses methods like homomorphic encryption is inefficient and impractical. In this paper, we have proposed a secure searchable encryption scheme using Hash based Indexing that consists of Elliptic curve based ElGamal additive homomorphic encryption. The use of indexing reduces computational load on the cloud server and users. The scheme obviates the need for generation and resource intensive processing on complex trapdoor system and binary query scheme. The security of this system relies on the Elliptic curve discrete logarithm problem assumption. Comparison analysis is performed and experimental results prove the suitability for the large data sets, while efficiently supporting the dynamic updates and effective ranking of precise files corresponding to the requested multi keywords.

Secure Client-Side Deduplication Scheme for Cloud with Dual Trusted Execution Environment

Data deduplication is the process that eliminates excessive redundant data in a dataset to improve storage and bandwidth utilization by significantly reducing the storage costs and increasing capacity. Therefore, a novel client-side secured dual-TEE (Trusted Execution Environment) based deduplication model (Dual-TEE) in the cloud is introduced. The proposed system prototype includes system setup, Data outsourcing, Proof of ownership (PoW) protocol initialize, and Data update. The traditional deduplication approach had a single TEE, which was prone to man-in-middle attacks and there has a high chance for authentication compromise. As a solution to this, dual TEE is implied in this research work, such that, the cryptosystem improves its ability to resist attacks. Moreover, a privilege set is assigned to each of the cloud users and the deduplication can be performed if and only if the correct privilege is with the cloud users. Further, dual TEE model attains a low value of 0.55179 for KPA analysis which is 7.088%, 7.5%, 1.83% better than the existing models like POW, POSD, and 3R-PoOR for file size 20. Hence, from the result, it is evident that the proposed Dual TEE secured model is secure to sustain data deduplication.