Cloud Storage Scheme Research Articles

An optimized and efficient multiuser data sharing using the selection scheme design secure approach and federated learning in cloud environment

An optimized and efficient multiuser data sharing using the selection scheme design secure approach and federated learning in cloud environment

Efficient and accountable anti-leakage attribute-based encryption scheme for cloud storage

To ensure secure and flexible data sharing in cloud storage, attribute-based encryption (ABE) is introduced to meet the requirements of fine-grained access control and secure one-to-many data sharing. However, the computational burden imposed by attribute encryption renders it unsuitable for resource-constrained environments such as the Internet of Things (IoT) and edge computing. Furthermore, the issue of accountability for illegal keys is crucial, as authorized users may actively disclose or sell authorization keys for personal gain, and keys may also passively leak due to management negligence or hacking incidents. Additionally, since all authorization keys are generated by the attribute authorization center, there is a potential risk of unauthorized key forgery. In response to these challenges, this paper proposes an efficient and accountable leakage-resistant scheme based on attribute encryption. The scheme adopts more secure online/offline encryption mechanisms and cloud server-assisted decryption to alleviate the computational burden on resource-constrained devices. For illegal keys, the scheme supports accountability for both users and the authorization center, allowing the revocation of decryption privileges for malicious users. In the case of passively leaked keys, timely key updates and revocation of decryption capabilities for leaked keys are implemented. Finally, the paper provides selective security and accountability proofs for the scheme under standard models. Efficiency analysis and experimental results demonstrate that the proposed scheme enhances encryption/decryption efficiency, and the storage overhead for accountability is also extremely low.

Blockchain-Based Data Auditing Protocol with Signcryption Scheme in Cloud Storage

Blockchain-Based Data Auditing Protocol with Signcryption Scheme in Cloud Storage

Survey of Post-Quantum Lattice-based Ciphertext-Policy Attribute-based Encryption Schemes for Cloud Storage: Taxonomy, Open Issues, and Future Directions

Survey of Post-Quantum Lattice-based Ciphertext-Policy Attribute-based Encryption Schemes for Cloud Storage: Taxonomy, Open Issues, and Future Directions

Research on abnormal access control of database management system under cloud computing platform

Abstract Access control is a security technique that can restrict access to protected resources, and data to only authorized users. In this paper, we design a blockchain-based access control scheme for cloud storage that is enabled by revocation. First, initialize blockchain to generate global parameters, generate complete user encryption keys and decryption keys, and perform data encryption. When the blockchain receives a user’s access request, the authorization contract determines if it is on the revocation list. If not, the key is checked. Then, it determines abnormal access and adds its identity to the revocation list, preventing further access to the database. The access control model is created by combining attribute-based encryption. After the security analysis and operational efficiency test, it can be considered that the model meets the security features, such as IND-CPA security. Regarding the time overhead of generating encryption keys, the computational overhead of this paper is the lowest, and the time required to generate encryption keys for 10 attributes is only 0.09 seconds, and for 100 attributes is only 1.62 seconds, which is better than the performance of the two attribute-based access control schemes, FIFC and AACE. The user access time overhead for 10 to 100 attributes at user encryption time is 1.38, 1.56, 1.98, 2.1, 2.53, 2.76, 3.03, 3.27, 3.66, and 3.94 seconds, respectively. The lowest decryption time consumed ensures data security and a good access experience. This study achieves fine-grained access control while protecting data privacy.

Multi-Client Secure and Efficient DPF-Based Keyword Search for Cloud Storage

In this paper, we propose a multi-client secure and efficient keyword search scheme for cloud storage, which is built upon distributed point function (DPF). Specifically, outsourced keyword indexes are encoded by using garbled bloom filter and cuckoo filter, instead of bloom filter adopted by most of the state-of-the-art DPF-based schemes. In this way, clients can apply cuckoo hashing into DPF and utilize a segmentation method to interact with cloud servers for keyword search, and servers can obliviously aggregate DPF evaluation results to perform the search. Accordingly, the computational complexity at server side can be significantly reduced. Furthermore, the proposed scheme preserves constant downlink overheads, which is more communication-efficient for multi-keyword conjunctive search. To achieve privacy preservation and access control for multiple clients, we propose a double encryption method to encrypt outsourced indexes and correspondingly put forward an authorization algorithm from set-constrained pseudorandom functions by which fine-grained search-authorized keys can be generated, and collusion attacks among clients are addressed by integrating Wegman-Carter message authentication codes and cover-free systems. Since our scheme is designed under both semi-honest and malicious models (i.e., malicious servers may return incorrect query results), we use a simulation-based proof to formally demonstrate its security properties. Finally, we develop a proof-of-concept prototype and perform extensive experiments to show our scheme's practicality and efficiency in terms of computation, communication, and storage overheads.

A portable blind cloud storage scheme against compromised servers

Applications (Apps) generate large amounts of data on users’ storage-limited local devices. To alleviate the burden of local storage, users can outsource their App-generated data to a remote cloud server. Secure data outsourcing needs data portability and blindness. The former enables users to access data from multiple devices using a single password, and the latter ensures data privacy against unauthorized individuals. Portable blind cloud storage (PBCS) can satisfy both requirements. However, existing PBCS schemes are vulnerable to offline password guessing attacks (OPGA) if both the App server and the cloud server are compromised: an adversary can learn users’ passwords from compromised registered information of users. In this paper, we propose a PBCS scheme called IPBCS that is secure against OPGA. In IPBCS, a user hardens her/his password with a secret key, which is stored in trusted execution environments (TEE). With the hardened password and a user-specific randomness, a token can be derived for user authentication. By adopting TEE to protect secret keys, IPBCS guarantees security against OPGA even if both servers are compromised. Moreover, IPBCS adopts a password-based authentication mechanism to support authentication over public channels. Security analysis and performance evaluation demonstrate that IPBCS is secure and efficient.

Public Integrity Verification for Cloud Storage with Efficient Key-update

<p>To improve the security of the data on cloud storage, numbers of data integrity auditing schemes have been proposed in the past several years. However, there only a few schemes considered the security challenge that the user’s key is exposed unknowingly which is very likely to happen in real-life. To cope with the problem, we propose a public data integrity auditing scheme for cloud storage with efficient key updating. In our scheme, the user’s key is updated periodically to resist the risk of key exposure. Meanwhile, the authentication tags of blocks are updated simultaneously with the key updating so as to guarantee the data integrity can be verified normally. The algorithm of key updating in our scheme is very efficient which only needs a hash operation while previous schemes need two or three exponentiation operations. Moreover, the workload of tag updating is undertaken by cloud servers with a re-tag-key which reduces the burden of users and improves the efficiency of the scheme. The communication cost of the scheme is also reduced greatly, for instance, the information size in ‘re-key’ step is decreased from two group members to one. Furthermore, we give the formal security model of our scheme and prove the security under the CDH assumption. The experimental results show that our proposal is efficient and feasible.</p> <p> </p>

Quantum-secure fault-tolerant distributed cloud storage system

With the increasing prominence of data security in cloud storage, we propose a practical and robust cloud storage scheme, which uses quantum random numbers as encryption keys, disperses the keys using Shamir’s secret sharing scheme, applies erasure coding to the ciphertext, and securely transmits the data through quantum key distribution protected networks to the distributed clouds. This system offers several key advantages, including quantum-level security, fault tolerance, and storage space saving. To validate its feasibility, we conduct comprehensive experimental tests covering essential functionalities such as encryption/decryption, key preservation, and data storage. By successfully demonstrating the effectiveness of our proposal, we aim to accelerate the application of quantum technology in cloud storage.

Forward and backward secure updatable ElGamal encryption scheme for cloud storage

Updatable encryption can support key/ciphertext update functionality, resist key compromise attacks, and be applicable to cloud storage. However, as a type of partitioning strategy, leakage sets or firewalls technique has been adopted by the existing updatable encryption schemes to build a relaxed security model, which forbids the adversary from querying the secret key at the challenge-equal epochs and hardly captures forward and backward security. In this paper, an enhanced security model can be built by considering a corruption oracle that allows any secret key query without requiring leakage sets. Then we utilize the indistinguishability obfuscation technique of the punctured program to construct an updatable ElGamal encryption scheme with no-directional key update and uni-directional ciphertext update. Furthermore, under the framework of the enhanced security model, the proposed scheme is proven to be IND-CPA. Finally, by comparison with the existing updatable encryption schemes, the proposed scheme eliminates leakage sets and firewalls, and can achieve both forward and backward security.

Searchable encryption over encrypted speech retrieval scheme in cloud storage

Aiming at the privacy and security issues of sensitive speech data in cloud storage, and how to achieve efficient retrieval with privacy-preserving for encrypted speech data in cloud storage, a searchable encryption over encrypted speech retrieval scheme in cloud storage was proposed. Firstly, the data owner encrypts the original speech data adopting symmetric encryption algorithm Lorenz chaotic mapping. Secondly, the encrypted speech data is uploaded to the cloud server for storage, and meanwhile the Mel frequency cepstrum coefficient (MFCC) features of original speech are extracted as the input of the convolutional neural network (CNN) to execute the deep semantic feature extraction, which is taken as the speech keywords. Finally, the extracted speech keywords are encrypted and stored in the cloud. When the authorized user sends a retrieval request, the trained CNN is utilized to extract the keywords of the speech to be retrieved, and the search trapdoor is generated and sent to the cloud server. In the process of retrieval, the Euclidean distance is used to match the encrypted keywords with the search trapdoor. The theoretical analysis and experimental results show that the proposed scheme has higher security and retrieval accuracy, and can be suitable for the encrypted storage of speech data and efficient secure retrieval.

Verifiable Keyword Search Encryption Scheme That Supports Revocation of Attributes

In recent years, searchable encryption technology and attribute encryption technology have been widely used in cloud storage environments, and attribute-based searchable encryption schemes can both achieve the retrieval of encrypted data and effectively solve the access control problem. Considering that existing attribute-based searchable encryption schemes for cloud storage only support keyword search and do not support attribute revocation, most of the schemes that support attribute revocation only consider the computational overhead of users and ignore the large amount of computational resources consumed by attribute authorization centers when updating keys. In addition, keyword search may lead to partial errors in the returned search results, leading to the wastage of computational and broadband resources. To solve these issues, this paper proposes an attribute-based searchable encryption scheme that supports attribute revocation and is verifiable. To realize fine-grained ciphertext search of encrypted data, support scenarios of dynamic changes of user attributes, and ensure that third-party servers perform the search process reliably and honestly while minimizing computation and storage costs, first, this paper implements attribute revocation with the attribute authorization center by creating a user revocation list and an attribute key revocation list. At the same time, the system updates the attribute key at the time of user search request, which effectively reduces the computational overhead. Second, a third-party auditor is introduced to ensure the correctness of the search results. Finally, the security of this paper is verified by theoretical analysis, and the efficiency and practicality of this paper are verified by comparing it to other schemes through simulation experiments.

CACPA: Credible Alliance-Chain-Based Public Auditing Scheme for Cloud Storage

CACPA: Credible Alliance-Chain-Based Public Auditing Scheme for Cloud Storage

Improved cloud storage auditing scheme with deduplication.

Cloud storage has become a crucial service for many users who deal with big data. The auditing scheme for cloud storage is a mechanism that checks the integrity of outsourced data. Cloud storage deduplication is a technique that helps cloud service providers save on storage costs by storing only one copy of a file when multiple users outsource the same file to cloud servers. However, combining storage auditing and deduplication techniques can be challenging. To address this challenge, in 2019 Hou et al. proposed a cloud storage auditing scheme with deduplication that supports different security levels of data popularity. This proposal is interesting and has practical applications. However, in this paper, we show that their proposal has a flaw: the cloud or other adversaries can easily forge the data block's authenticators, which means the cloud can delete all the outsourced encrypted data blocks but still provide correct storage proof for the third-party auditor. Based on Hou et al.'s scheme, we propose an improved cloud storage auditing scheme with deduplication and analyze its security. The results show that the proposed scheme is more secure.

Identity-Based Public Auditing for Cloud Storage of Internet-of-Vehicles Data

The Internet of Vehicles (IoV) , with the help of cloud computing, can provide rich and powerful application services for vehicles and drivers by sharing and analysing various IoV data. However, how to ensure the integrity of IoV data with multiple sources and diversity outsourced in the cloud is still an open challenge. To address this concern, this paper first presents an identity-based public auditing scheme for cloud storage of IoV data, which can fully achieve the essential function and security requirements, such as classified auditing, multi-source auditing and privacy protection. Particularly, we design a new authenticated data structure, called data mapping table, to track the distribution of each type of IoV data to ensure fine and rapid audits. Moreover, our scheme can reduce the overheads for both the key management and the generation of block tags. We formally prove the security of the presented scheme and evaluate its performance by comprehensive comparisons with the state-of-the-art schemes designed for traditional scenarios. The theoretical analyses and experimental results demonstrate that our scheme can securely and efficiently realize public auditing for IoV data, and outperforms the previous ones in both the computation and communication overheads in most cases.

A Decentralized Public Auditing Scheme for Secure Cloud Storage Based on Blockchain

The cloud storage service has brought great convenience to the customer, which can save massive storage and computation resources via outsourcing the data to cloud service provider (CSP). However, the security issues are the biggest challenge such as data integrity. The user can verify the integrity of outsourced data through a remote data auditing solution without retrieving original data from cloud, however, the auditing procedure has heavy computational overhead, which employs third party auditor (TPA) to conduct auditing task on behalf of users. In this paper, we propose a decentralized public auditing scheme for cloud storage based on blockchain, which removes TPA and increases the number of CSP, the auditing task was assigned to multiple CSPs, and the blockchain technology was used to record the audit process. Meanwhile, the structure of e-voting system is utilized to realize the audit result statistics of multiple CSPs via smart contract, which enhanced the credibility and stability of final auditing result. The theoretical analysis and experimental results demonstrate that proposed scheme is secure and efficient.

TCA-PEKS: Trusted certificateless authentication public-key encryption with keyword search scheme in cloud storage

Public key encryption with keyword search (PEKS) technology is capable of achieving accurate ciphertext retrieval while protecting data privacy. However, curious or malicious semi-trusted cloud servers can cause privacy breaches, which then creates a trust problem for ciphertext management and searching. To address this problem, we propose a trusted certificateless authentication public-key encryption with a keyword search scheme in cloud storage (TCA-PEKS), which ensuring trusted retrieval, simultaneously resolves the problems of key escrow and certificate management that exist in PEKS. In the scheme, the security of the ciphertext storage and verifications are strengthened based on blockchain non-tampering features, which assists users in verifying the correctness of a file. In particular, we construct an open and transparent smart contract to limit the malicious behaviour of cloud servers, in which the user’s complete private key splits the secret value and the partial private key, further guaranteeing the correctness of the retrieval process. Finally, the scheme is proven to satisfy ciphertext and trapdoor indistinguishability under the random oracle model, and the performance evaluation results show that the scheme is highly efficient.

A probabilistic public key encryption switching scheme for secure cloud storage

The high demand for user-centric applications such as secure cloud storage laid the foundation for the development of user-centric security schemes with multiple security features in recent years. But, the current state-of-art techniques primarily emphasized only one type of security feature i.e., either homomorphism or non-malleability. To fill this gap and provide a common platform for both homomorphic and non-malleable cloud applications, we have introduced a new public key-based probabilistic encryption switching method. The proposed scheme generates {mathcal {O}}(m+2 log N) bits of ciphertext where min {mathbb {N}} and m<n, nin {mathbb {N}} is the plaintext size, N is the RSA composite. The superior performance of the proposed scheme has been tested in comparison to existing methods and is reported in this paper.

Blockchain-Based Offline Auditing for the Cloud in Vehicular Networks

The rapid growth of various vehicular apps such as automotive navigation and in-car entertainment has brought the explosion of vehicular data. Such a growth has given rise to a huge challenge of maintaining the quality of cloud storage services for the whole period of storage in vehicular networks. As a result, poor quality of services easily causes data corruption problems and thereby threats vehicular data integrity. Blockchain, a tamper-proofing technique, is considered a promising approach for mitigating data integrity risks in cloud storage. However, existing blockchain-based schemes for auditing long-term cloud data integrity suffer from poor communication performance in a vehicular network. In this study, a blockchain-based offline auditing scheme for cloud storage in the vehicular network is proposed to improve auditing performance. Inspired by the data structure of blockchain, we design an evidence chain to achieve offline auditing, which allows the cloud to spontaneously generate data integrity evidence without communicating with auditors during the evidence generation phase. Furthermore, we extend our scheme to support public and automatic validation based on the smart contract. We prove the security of the proposed scheme under the random oracle model and further provide the performance evaluation by comparing with the state-of-the-art approaches.

Improved Efficient Privacy-Preserving Certificateless Provable Data Possession Scheme for Cloud Storage

Cloud storage technology is evolving at a high speed; effectively auditing the cloud data’s integrity has become a focal point. Recently, Ming and Shi proposed a certificateless integrity auditing scheme with a privacy protection function. The scheme used the certificateless cryptosystem to solve the certificate management problem of the auditing schemes based on public key infrastructure and the key escrow problem of the identity-based auditing schemes. Although their scheme is novel and efficient, we found that their scheme was not secure and could not achieve integrity auditing of cloud data. The malicious cloud server can generate the proof through the blocks and tags sent by the user. On the basis of the original scheme, we propose an improved auditing scheme; our new scheme is more secure and effective. In addition, for the problem of idle tags in the existing cloud data integrity auditing scheme, we propose the idea of intermediate tags and we applied the idea to the improved scheme to improve audit efficiency.