Untrusted Cloud Server Research Articles

Secure and verifiable outsourcing protocol for non-negative matrix factorisation

With the rapid development of cloud computing services, resource-constrained clients can outsource their expensive computation tasks, such as scientific computations, to untrusted cloud servers. Furthermore, it is essential for these clients to protect their sensitive data and verify the validity of the returned computation results. In this paper, we focus on outsourcing protocol of non-negative matrix factorisation, which is an expensive computation task and has been widely applied to image processing, face recognition, text analysis, and so on. The permutation technique is employed to transform the original problem into a new one in our proposed protocol so as to protect the privacy, and the matrix 1-norm technique is utilised to verify the result returned from the cloud server in order to reduce the verification cost. Based on these two techniques, we construct a secure and verifiable outsourcing protocol for non-negative matrix factorisation. Moreover, the theoretical analysis and the experimental results show that our proposed protocol brings great computation savings for resource-constrained clients and fulfills the goals of correctness, security, verifiability and high efficiency.

Attribute-Hiding Predicate Encryption With Equality Test in Cloud Computing

Public key encryption with equality test (PKE-ET) enables anyone to perform equivalence test between two messages encrypted under distinct public keys. Attribute-hiding predicate encryption is a paradigm for public key encryption that supports both attribute-hiding and fine-grained access control. In this paper, we first initialize the concept of attribute-hiding predicate encryption with equality test (AH-PE-ET) by incorporating the notions of PKE-ET and PE, and then propose a concrete AH-PE-ET scheme. Inheriting the merits of predicate encryption, versatile access control can be achieved such that the ciphertexts and the secret key are, respectively, associated with the descriptive attributes $x$ and the boolean functions $f$ and decryption can only be done if $f(x)$ returns true . In the AH-PE-ET scheme, one data receiver can calculate a trapdoor using his/her private key and delivers this trapdoor to an untrusted cloud server, who in turn compares the ciphertexts from this receiver with other receivers’ ciphertexts. During the comparison, the information about the trapdoor as well as the attributes associated with the ciphertexts will not be disclosed to this cloud server. Furthermore, it is also proven to be selectively secure against the chosen plaintext attack in the standard model under the decisional bilinear Diffie-Hellman assumption. Finally, the theoretical performance analysis and experimental simulation indicate the feasibility and practicability of our suggested scheme.

EOABS: expressive outsourced attribute-based signature

Emerging attribute based signature (ABS) can be used in the system to protect the individual privacy from being divulged. However, heavy computational cost is required during the signing phase because it grows linearly with the size of attributes. Besides, traditional ABS only supports threshold access structure, which impedes system managers to define more flexible access policy. Aiming at tackling the problems above, we utilize the outsourcing technique with which users can deliver majority of the computation operation to an untrusted cloud server without revealing the private signing key, then propose an expressive outsourced attribute based signature scheme. The proposed scheme is proven unforgeable under selective-attribute chosen message attack in the standard model. Comparing with existing work, our scheme not only reduces users’ computation overhead, but also supports more flexible access structure. Finally, experiments are performed to illustrate the efficiency and practicality of our scheme.

Analysis of a mobile payment protocol with outsourced verification in cloud server and the improvement

Today, mobile payment is becoming one of the most frequently used approach to provide payment services under business and financial organization via mobile devices, such as smart phone, ipad. However, the limited resources of the mobile devices cause that it can not perform large-scale computing. Thus, it is a better way to outsource securely some computation of mobile payment to the untrusted cloud server. Recently, Qin et al. proposed a mobile payment protocol with outsourced verification in the untrusted cloud server. In this paper, we firstly show that their protocol exists two issues: one is an unreasonable construction, which causes their protocol not to be implemented; the other is that there is a colluding attack of customers and the untrusted cloud server at outsourced verification phase, which causes the verification of their protocol to be insecure. Next, we improve their protocol and analyze the security of our improved protocol.

Privacy preserving multi factor authentication using trust management

A proper access control mechanism is the need of the hour, as the data stored in the cloud needs to be protected securely. Generally, a multifactor authentication (MFA) is preferred, one that needs the authentication of two or even more aspects based on identity, information and facts, and ownership which needs to check the value and correctness of users while logging into cloud services. Clouds such as Amazon, Google, Microsoft etc. generally have an additional attribute, one that is automatically made inactive. The MFA are intrusive and untrusted cloud servers can access user’s sensitive information. The objective of this work is to use a trust model which can identify client device. For instance, if the client device is public then a biometric authentication is provided. Based on the client device, trust is computed and the authentication process will be reduced from multifactor to single factor. Experimental results show that improved performance is attained by the proposed trust based MFA.

Formula: see text]: Oblivious similarity based searching for encrypted data outsourced to an untrusted domain.

Public cloud storage services are becoming prevalent and myriad data sharing, archiving and collaborative services have emerged which harness the pay-as-you-go business model of public cloud. To ensure privacy and confidentiality often encrypted data is outsourced to such services, which further complicates the process of accessing relevant data by using search queries. Search over encrypted data schemes solve this problem by exploiting cryptographic primitives and secure indexing to identify outsourced data that satisfy the search criteria. Almost all of these schemes rely on exact matching between the encrypted data and search criteria. A few schemes which extend the notion of exact matching to similarity based search, lack realism as those schemes rely on trusted third parties or due to increase storage and computational complexity. In this paper we propose Oblivious Similarity based Search () for encrypted data. It enables authorized users to model their own encrypted search queries which are resilient to typographical errors. Unlike conventional methodologies, ranks the search results by using similarity measure offering a better search experience than exact matching. It utilizes encrypted bloom filter and probabilistic homomorphic encryption to enable authorized users to access relevant data without revealing results of search query evaluation process to the untrusted cloud service provider. Encrypted bloom filter based search enables to reduce search space to potentially relevant encrypted data avoiding unnecessary computation on public cloud. The efficacy of is evaluated on Google App Engine for various bloom filter lengths on different cloud configurations.

PUBLIC INTEGRITY AUDITING FOR SHARED DYNAMIC CLOUD DATA WITH GROUP USER REVOCATION

Cloud computing is the protracted revelation of computing as effectiveness, where data owners can remotely store their data. The essential service presents by the Cloud is Data Storage. On the other hand, it is a tricky task for sharing data in multi-owner manner anywhere group admin and all group members can store and alter data while protecting data and identity privacy from an untrusted cloud server, due to the frequent change of the membership. So secure multi-owner data sharing scheme for dynamic groups in the cloud computing have been projected which absorb addition of group signature and broadcast encryption techniques. However this system also recognized some boundaries in terms of competence and security. since multi-owner data storing and sharing in a dynamic surroundings dumps enormous amount of data files in the cloud, which leftovers in cloud for imprecise period of time. The confidential information stored may changed by service providers. To maintain cloud file’s security and privacy regular elimination of unwanted files is needed. To determine this drawback we propose new framework which is Reliable and Scalable Secure Method to Store and Share Secrete Data for groups in Cloud i.e MONA that remove unnecessary files automatically when the predefined time period for sharing specified by data owner has been run out which improve performance of the system in terms of security and efficiency. Also this method decreases the overhead at the time of upload and download file in the cloud. At last proposed method by name Multi Owner Data Sharing Over Cloud (MODOC) declares required efficiency and most importantly security. We apply a working prototype of the MODOC method and assess its performance based on the time addicted during various operations The results give you an idea about that MODOC has the prospective to be effectively used for secure data sharing in the cloud.

Flexible and Lightweight Access Control for Online Healthcare Social Networks in the Context of the Internet of Things

Online healthcare social networks (OHSNs) play an essential role in sharing information among medical experts and patients who are equipped with similar experiences. To access other patients’ data or experts’ diagnosis anywhere and anytime, it is necessary to integrate the OHSN into the Internet as part of the Internet of Things (IoT). Therefore, it is crucial to design an efficient and versatile access control scheme that can grant and revoke a user to access the OHSN. In this paper, we propose novel attribute-based encryption (ABE) features with user revocation and verifiable decryption outsourcing to control the access privilege of the users. The security of the proposed ABE scheme is given in the well-studied random oracle model. With the proposed ABE scheme, the malicious users can be excluded from the system and the user can offload most of the overhead in the decryption to an untrusted cloud server in a verifiable manner. An access control scheme for the OHSN has been given in the context of the IoT based on the proposed ABE scheme. The simulation demonstrates that our access control mechanism is practical.

PMDP: A Framework for Preserving Multiparty Data Privacy in Cloud Computing

The amount of Internet data is significantly increasing due to the development of network technology, inducing the appearance of big data. Experiments have shown that deep mining and analysis on large datasets would introduce great benefits. Although cloud computing supports data analysis in an outsourced and cost-effective way, it brings serious privacy issues when sending the original data to cloud servers. Meanwhile, the returned analysis result suffers from malicious inference attacks and also discloses user privacy. In this paper, to conquer the above privacy issues, we propose a general framework for Preserving Multiparty Data Privacy (PMDP for short) in cloud computing. The PMDP framework can protect numeric data computing and publishing with the assistance of untrusted cloud servers and achieve delegation of storage simultaneously. Our framework is built upon several cryptography primitives (e.g., secure multiparty computation) and differential privacy mechanism, which guarantees its security against semihonest participants without collusion. We further instantiate PMDP with specific algorithms and demonstrate its security, efficiency, and advantages by presenting security analysis and performance discussion. Moreover, we propose a security enhanced framework sPMDP to resist malicious inside participants and outside adversaries. We illustrate that both PMDP and sPMDP are reliable and scale well and thus are desirable for practical applications.

Optimized Homomorphic Scheme on Map Reduce for Data Privacy Preserving

Security insurance is a paramount cloud services issue in the most recent decade. Therefore, Mapreduce which is a programming framework for preparing and creating huge data collections should be optimized and securely implemented. But, conventional operations on ciphertexts were not relevant. So there is a foremost need to enable particular sorts of calculations to be done on encrypted data and additionally optimize data processing at the Map stage. Thereby schemes like (DGHV) and (Gen 10) are presented to address data privacy issue. However private encryption key (DGHV) or key’s parameters (Gen 10) are sent to untrusted cloud server which compromise the information security insurance. Therefore, in this paper we propose an optimized homomorphic scheme (Op_FHE_SHCR) which speed up ciphertext (Rc) retrieval and addresses metadata dynamics and authentication through our secure Anonymiser agent. Additionally for the efficiency of our proposed scheme regarding computation cost and security investigation, we utilize a scalar homomorphic approach instead of applying a blinding probabilistic and polynomial-time calculation which is computationally expensive. Doing as such, we apply an optimized ternary search tries (TST) algorithm in our metadata repository which utilizes Merkle hash tree structure to manage metadata authentication and dynamics.

Revocable Identity-Based Access Control for Big Data with Verifiable Outsourced Computing

To be able to leverage big data to achieve enhanced strategic insight, process optimization and make informed decision, we need to be an efficient access control mechanism for ensuring end-to-end security of such information asset. Signcryption is one of several promising techniques to simultaneously achieve big data confidentiality and authenticity. However, signcryption suffers from the limitation of not being able to revoke users from a large-scale system efficiently. We put forward, in this paper, the first identity-based (ID-based) signcryption scheme with efficient revocation as well as the feature to outsource unsigncryption to enable secure big data communications between data collectors and data analytical system(s). Our scheme is designed to achieve end-to-end confidentiality, authentication, non-repudiation, and integrity simultaneously, while providing scalable revocation functionality such that the overhead demanded by the private key generator (PKG) in the key-update phase only increases logarithmically based on the cardiality of users. Although in our scheme the majority of the unsigncryption tasks are outsourced to an untrusted cloud server, this approach does not affect the security of the proposed scheme. We then prove the security of our scheme, as well as demonstrating its utility using simulations.

A scalable attribute-set-based access control with both sharing and full-fledged delegation of access privileges in cloud computing

The benefits of cloud computing motivate enterprises to migrate their IT infrastructure on cloud servers. Enterprise needs to entrust untrusted cloud service provider, which gives rise to various security and privacy concerns. To address these concerns, numerous schemes in cloud computing employed attribute-based encryption schemes. However, existing schemes are neither flexible enough to provide users complete liberty on delegation of their access privileges nor grant shared access privileges among users of a group to jointly address a responsibility. This paper introduces hierarchical attribute-set-based access control scheme by employing ciphertext-policy attribute-set-based encryption with a hierarchical structure of users to achieve scalability. The proposed scheme simultaneously achieves the notion of fine-grained cum flexible access control, privacy preserving, efficient data utilization and imperatively provides users full-fledged liberty on delegation of their access privileges. Furthermore, we formally prove that proposed scheme is secure under decisional bilinear Diffie–Hellman assumption.

A secure and privacy-preserving mobile wallet with outsourced verification in cloud computing

Mobile wallet, also known as mobile payment, is becoming one of the most frequently used approach to provide payment services under financial regulation via mobile device and may redefine our lifestyle with the rapid popularity of mobile Internet. In this paper, we address the security of the mobile wallet by providing a detailed threat analysis and identifying some unique design requirements in terms of security and privacy protection for mobile wallet. We then provide a novel approach to secure the mobile wallet and protect the privacy of the mobile user by incorporating the digital signature and pseudo-identity techniques. In view of several advantages of cloud computing, the computation task on the client side, which is usually featured with limited computation resources, is outsourced to the untrusted cloud server securely. The performance of our approach is evaluated via both theoretic analysis and experimental simulations. Also, the security analysis demonstrate that our approach can achieve desirable security properties of mobile wallet.

Private and Efficient Query Processing on Outsourced Genomic Databases.

Applications of genomic studies are spreading rapidly in many domains of science and technology such as healthcare, biomedical research, direct-to-consumer services, and legal and forensic. However, there are a number of obstacles that make it hard to access and process a big genomic database for these applications. First, sequencing genomic sequence is a time consuming and expensive process. Second, it requires large-scale computation and storage systems to process genomic sequences. Third, genomic databases are often owned by different organizations, and thus, not available for public usage. Cloud computing paradigm can be leveraged to facilitate the creation and sharing of big genomic databases for these applications. Genomic data owners can outsource their databases in a centralized cloud server to ease the access of their databases. However, data owners are reluctant to adopt this model, as it requires outsourcing the data to an untrusted cloud service provider that may cause data breaches. In this paper, we propose a privacy-preserving model for outsourcing genomic data to a cloud. The proposed model enables query processing while providing privacy protection of genomic databases. Privacy of the individuals is guaranteed by permuting and adding fake genomic records in the database. These techniques allow cloud to evaluate count and top-k queries securely and efficiently. Experimental results demonstrate that a count and a top-k query over 40 Single Nucleotide Polymorphisms (SNPs) in a database of 20000 records takes around 100 and 150s, respectively.

Attribute-based data access control in mobile cloud computing: Taxonomy and open issues

With the thriving growth of the cloud computing, the security and privacy concerns of outsourcing data have been increasing dramatically. However, because of delegating the management of data to an untrusted cloud server in data outsourcing process, the data access control has been recognized as a challenging issue in cloud storage systems. One of the preeminent technologies to control data access in cloud computing is Attribute-based Encryption (ABE) as a cryptographic primitive, which establishes the decryption ability on the basis of a user’s attributes. This paper provides a comprehensive survey on attribute-based access control schemes and compares each scheme’s functionality and characteristic. We also present a thematic taxonomy of attribute-based approaches based on significant parameters, such as access control mode, architecture, revocation mode, revocation method, revocation issue, and revocation controller. The paper reviews the state-of-the-art ABE methods and categorizes them into three main classes, such as centralized, decentralized, and hierarchal, based on their architectures. We also analyzed the different ABE techniques to ascertain the advantages and disadvantages, the significance and requirements, and identifies the research gaps. Finally, the paper presents open issues and challenges for further investigations.

Privacy-Aware Relevant Data Access with Semantically Enriched Search Queries for Untrusted Cloud Storage Services.

Privacy-aware search of outsourced data ensures relevant data access in the untrusted domain of a public cloud service provider. Subscriber of a public cloud storage service can determine the presence or absence of a particular keyword by submitting search query in the form of a trapdoor. However, these trapdoor-based search queries are limited in functionality and cannot be used to identify secure outsourced data which contains semantically equivalent information. In addition, trapdoor-based methodologies are confined to pre-defined trapdoors and prevent subscribers from searching outsourced data with arbitrarily defined search criteria. To solve the problem of relevant data access, we have proposed an index-based privacy-aware search methodology that ensures semantic retrieval of data from an untrusted domain. This method ensures oblivious execution of a search query and leverages authorized subscribers to model conjunctive search queries without relying on predefined trapdoors. A security analysis of our proposed methodology shows that, in a conspired attack, unauthorized subscribers and untrusted cloud service providers cannot deduce any information that can lead to the potential loss of data privacy. A computational time analysis on commodity hardware demonstrates that our proposed methodology requires moderate computational resources to model a privacy-aware search query and for its oblivious evaluation on a cloud service provider.

A Survey-Decentralized Access Control with Anonymous Authentication and Deduplication of Data Stored in Clouds

Cloud computing is a rising computing standard in which assets of the computing framework are given as a service over the Internet. It delivers new challenges for data security and access control when clients outsource sensitive data for offering on cloud servers. These results unavoidably present a substantial processing overhead on the data possessor for key distribution and data administration when fine-grained data access control is in demand, and subsequently don't scale well. The issue of at the same time accomplishing fine-graininess, scalability, and data confidentiality of access control really still remains uncertain. The system characterize and implements access policies based on data qualities, and, then again, permits the data owner to represent the majority of the calculation included in fine-grained data access control to un-trusted cloud servers without unveiling the underlying data substance. This can be achieved by exploiting and combining techniques of decentralized key policy Attribute Based Encryption (KP-ABE). The proposed approach is highly efficient and secure. Also Data deduplication is one of important data compression techniques for eliminating duplicate copies of repeating data, and has been widely used in cloud storage to reduce the amount of storage space and save bandwidth. To protect the confidentiality of sensitive data while supporting deduplication, the convergent encryption technique has been proposed to encrypt the data before outsourcing it also represents several new deduplication constructions supporting authorized duplicate check in hybrid decentralized cloud architecture.

Secure independent-update concise-expression access control for video on demand in cloud

Video on demand (VoD) is a popular application on the Internet. In the past few years, more and more VoD services are shifted to cloud. Although this transformation introduces many benefits, it arouses new challenges of data security due to the outsourcing storage on untrusted cloud servers. For satisfying the requirements of fine-grained access control in cloud, Attribute-Based Encryption (ABE) algorithms are applied to this field. However, due to the large number of videos and users in cloud, there exist frequent subscribing/unsubscribing behaviors and numerous categories, which induce the challenges for higher flexibility and efficiency. Most of existing schemes do not discuss these challenges sufficiently. In this paper, we propose an ABE-based Secure Independent-update Concise- expression Access Control (SICAC) scheme in Cloud, to provide flexible and efficient authentication and authorization for VoD services. In the aspect of access policy update, to guarantee that users cannot affect each other, we design an independent-update key policy ABE (KP-ABE) algorithm which allows users to update their keys separately, while most of existing schemes require that all members of a group should be updated simultaneously. In the aspect of attribute description, to reduce the storage cost, we propose a concise-expression access structure which can describe various logic relationships flexibly and efficiently. The security is proved in standard model and the experiment is implemented with Pairing-Based Cryptography(PBC) library. Both the theoretical analysis and the experimental results show that our scheme is efficient and effective for VoD services in cloud.

Succinct multi-authority attribute-based access control for circuits with authenticated outsourcing

Multi-authority attribute-based access control (MABAC), which allows different independent authorities to distribute secret keys, could be adopted to control access and keep data confidential. To circumvent efficiency drawbacks during the decryption, the notion of MABAC with outsourcing is applied. However, untrusted cloud server may respond a forged transformation or deceive a permissioned user with a terminator altogether. In addressing the above issue, a construction of circuit MABAC with authenticated outsourcing is considered, which enjoys succinct ciphertext and realizes the most flexible form of expression up to now. In such a scheme, combined MABAC with two types of authenticated messages (a publicly verifiable message and a privately verifiable one), both the fine-grained data access and the authenticity of the outsourcing are well guaranteed. Furthermore, the security and authentication of the proposed scheme are intensively proved. For the sake of completeness, we then simulate the scheme and show that it is appropriate for cloud computing.

Full integrity and freshness for cloud data

Data outsourcing relieves cloud users of the heavy burden of infrastructure management and maintenance. However, the handover of data control to untrusted cloud servers significantly complicates the security issues. Conventional signature verification widely adopted in cryptographic storage systems only guarantees the integrity of retrieved data, for those rarely or never accessed data, it does not work. This paper integrates proof of storage technique with data dynamics support into cryptographic storage design to provide full integrity for outsourced data. Besides, we provide instantaneously freshness check for retrieved data to defend against potential replay attacks. We achieve these goals by designing flexible block structures and combining broadcast encryption, key regression, Merkle hash tree and proof of storage together to provide a secure storage service for outsourced data. Experimental evaluation of our prototype shows that the cryptographic cost and throughput are reasonable and acceptable.