Untrusted Cloud Service Provider Research Articles

A Hybrid Multi-Cloud Framework Using the IBBE Key Management System for Securing Data Storage

Information storage and access in multi-cloud environments have become quite prevalent. In this paper, a multi-cloud framework is presented that secures users’ data. The primary goal of this framework is to secure users’ data from untrusted Cloud Service Providers (CSPs). They can collude with other malicious users and can hand over users’ data to these malicious users for their beneficial interests. In order to achieve this goal, the data are split into parts, and then each part is encrypted and uploaded to a different cloud. Therefore, client-side cryptography is used in this framework. For encrypting users’ data, the BDNA encryption technique is used. This framework presents a hybrid cryptographic approach that uses Identity-based Broadcast Encryption (IBBE) for managing the keys of the symmetric key algorithm (BDNA) by encrypting them with the particular version of IBBE. The work presented in this research paper is the first practical implementation of IBBE for securing encryption keys. Earlier, IBBE was only used for securely broadcasting data across many users over a network. The security of this hybrid scheme was proved through Indistinguishable Chosen-Ciphertext Attacks. This double encryption process makes the framework secure against all insiders and malicious users’ attacks. The proposed framework was implemented as a web application, and real-time storage clouds were used for storing the data. The workflow of the proposed framework is presented through screenshots of different working modules.

Lightweight MapReduce Application Service Integrity Auditing on the Cloud

Due to the advantages of MapReduce in both cost-saving and effectiveness for large-scale computation-intensive applications, a growing number of tenants are considering migrating their applications to the MapReduce cloud. For financial interests, an untrusted cloud service provider (CSP) may violate the service level agreement (SLA) when providing service to tenants. Therefore, essential security mechanisms are needed to protect the integrity of MapReduce services. To address this issue, a novel service accountability scheme is proposed to audit compliance for MapReduce on the cloud in this paper. The proposed scheme inserts auditing points into tenant’s applications and constructs a tamper-proof list at run time. By verifying the auditing list, the MapReduce cloud can be responsible and accountable, which can detect whether CSP should be held responsible for its service. Finally, the proposed scheme is deployed in experimental business processes, and its effectiveness is evaluated.

Privacy-Preserving Outsourced Logistic Regression on Encrypted Data from Homomorphic Encryption

Logistic regression is a data statistical technique, which is used to predict the probability that an event occurs. For some scenarios where the storage capabilities and computing resources of the data owner are limited, the data owner wants to train the logistic regression model on the cloud service provider, while the high sensitivity of training data requires effective privacy protection methods that enable efficient model training without exposing information about the training data to untrusted cloud service providers. Recently, several works have used cryptographic techniques to implement privacy-preserving logistic regression in such application scenarios. However, on large-scale training datasets, the existing works still have the problems of long model training time and poor model performance. To solve these problems, based on the homomorphic encryption (HE), we propose an efficient privacy-preserving outsourced logistic regression (P2OLR) on encrypted training data, which enables data owners to utilize the powerful storage and computing resources of cloud service providers for logistic regression analysis without exposing data privacy. Furthermore, the proposed scheme can pack multiple messages into one ciphertext and perform the same arithmetic evaluations on multiple plaintext slots by using the batching technique and single instruction multiple data (SIMD) mechanism in HE. On three public training datasets, the experimental results show that, compared with the existing schemes, the proposed scheme has better performance in terms of the encryption and decryption time of the data owner, the storage of encrypted training data, and the training time and accuracy of the model.

Improved Outsourced Provable Data Possession for Secure Cloud Storage

With the advent of data outsourcing, how to efficiently verify the integrity of data stored at an untrusted cloud service provider (CSP) has become a significant problem in cloud storage. In 2019, Guo et al. proposed an outsourced dynamic provable data possession scheme with batch update for secure cloud storage. Although their scheme is very novel, we find that their proposal is not secure in this paper. The malicious cloud server has ability to forge the authentication labels, and thus it can forge or delete the user’s data but still provide a correct data possession proof. Based on the original protocol, we proposed an improved one for the auditing scheme, and our new protocol is effective yet resistant to attacks.

DNA computing and table based data accessing in the cloud environment

The attractive benefits of cloud computing environment motivate Information Technology (IT) companies to move their IT infrastructure on the cloud server. In a cloud environment, companies must depend on the untrusted Cloud Service Provider (CSP), which raises data security issues due to the presence of numerous hackers and malicious users. Apart from data security, high searching time of data owner, high data accessing time and high system overheard are other issues during data accessing from the cloud environment. To solve all these issues, in this paper, a novel DNA based fast and secure data access control model has been introduced for the cloud environment. Here, the cloud service provider maintains a table for fast and efficient data accessing. In this proposed scheme, a long 1024-bit Deoxyribonucleic Acid (DNA) based password or secret key is used to encrypt users' confidential or personal data. Experimental results along with theoretical analysis prove the efficiency of the proposed model over the existing models.

RETRACTED ARTICLE: An enhanced approach on distributed accountability for shared data in cloud

Cloud computing contribute huge business opportunities. Cloud data has always hacked by the cyber attackers. The cloud user’s major concerns in cloud are lack of clarity and loss of control over their data. Data accountability is the way to ensure the trust on cloud service provider which allows to monitor the cloud user data usage. These computation and storage are distributed in nature. To address this issue we are utilizing a framework called Cloud Information Accountability. To provide security to the log recording encryption is performed that leads to lack of time and space. Further the untrusted cloud service provider cause key abuse attacks. To overcome the above limitation a novel information accountability system is proposed to ensure the tracking of user data usage in cloud. The Homomorphic encryption is utilized on user data which is uploaded on the cloud. This feature is called “strong binding” which means both data and policies travel with the data thus providing distributed accountability which is very essential because of distributed nature of the cloud. Hence this framework provides end to end accountability for user’s data at both Cloud Service Providers (CSP) and Cloud users by providing the log records for their data. Furthermore a protocol is designed based on objects for data access that prevents the key abuse attack. The method improves the security performance up to 95%.

On authenticated skyline query processing over road networks

SummaryIn recent times, many location‐based service providers (LBSPs) choose to outsource data query services to third‐party cloud service providers (CSPs). This allows users to easily search for points of interests (POIs), such as restaurants and parking lots in their vicinity, using their mobile devices and in‐vehicle infotainment units. Skyline query is one potential technique to be deployed for road networks. However, the untrusted CSPs may forge or omit query results, intentionally or not. Therefore, in this article, we posit that by observing the unique properties of skyline query results in road networks, we can bind each POI with four nearby POIs with special properties using signature chain technology. Our proposed approach not only provides users with skyline query result authentication ability over the road network, but also have low communication overhead. Specifically, the overhead analysis and experimental results show that our proposed approach decreases the communication overhead.

A Scalable Attribute-Based Access Control Scheme with Flexible Delegation cum Sharing of Access Privileges for Cloud Storage

Nowadays cloud servers have become the primary choice to store and share data with multiple users across the globe. The major challenge in sharing data using cloud servers is to protect data against untrusted cloud service provider and illegitimate users. Attribute-Based Encryption (ABE) has emerged as a useful cryptographic technique to securely share data with legitimate recipients in fine-grained manner. Several solutions employing ABE have been proposed to securely share data using cloud servers. However, most of the solutions are data owner-centric and focus on providing data owner complete control on his outsourced data. The existing solutions in cloud computing fail to provide shared access privileges among users and to enable cloud users to delegate their access privileges in a flexible manner. In order to simultaneously achieve the notion of fine-grained access control, scalability and to provide cloud users shared access privileges and flexibility on delegation of their access privileges, we propose a scalable attribute-based access control scheme for cloud storage. The scheme extends the ciphertext policy attribute-based encryption to achieve flexible delegation of access privileges and shared access privileges along with scalability and fine-grained access control. The scheme achieves scalability by employing hierarchical structure of users. Furthermore, we formally prove the security of our proposed scheme based on security of the ciphertext-policy attribute-based encryption. We also implement the algorithm to show its scalability and efficiency.

Outsourced dynamic provable data possession with batch update for secure cloud storage

With the advent of data outsourcing, how to efficiently verify the integrity of data stored at an untrusted cloud service provider (CSP) has become a significant problem in cloud storage. Provable data possession (PDP) is a model that allows clients or a trusted auditor to verify whether CSP possesses the outsourced data without downloading it. However, this model requires clients to tolerate non-negligible computation burden incurred by frequent verifications in private schemes, and does not provide any security assurances when client or/and auditor are dishonest. Therefore, it cannot be directly transformed into a secure outsourced auditing scheme, where any one of three participants (i.e., CSP, client and auditor) may be dishonest and any two participants may be colluded with each other. In this paper, we propose an outsourced dynamic provable data possession (ODPDP) scheme, which migrates frequent auditing task to an external auditor to reduce clients’ verification overhead, and simultaneously provides log audit mechanism with lower computation burden for clients to prevent from dishonest auditor. In addition, we propose a batch update algorithm that can perform and verify multiple update operations at once, avoiding repetitive calculations and transmissions. Security analysis proves that our scheme is secure in the enhanced threat model, and experimental results show that our scheme achieves high efficiency in terms of computation time and communication cost compared with existing outsourced auditing schemes.

Secure Fine-Grained Access Control and Data Sharing for Dynamic Groups in the Cloud

Cloud computing is an emerging computing paradigm that enables users to store their data in a cloud server to enjoy scalable and on-demand services. Nevertheless, it also brings many security issues, since cloud service providers (CSPs) are not in the same trusted domain as users. To protect data privacy against untrusted CSPs, existing solutions apply cryptographic methods (e.g., encryption mechanisms) and provide decryption keys only to authorized users. However, sharing cloud data among authorized users at a fine-grained level is still a challenging issue, especially when dealing with dynamic user groups. In this paper, we propose a secure and efficient fine-grained access control and data sharing scheme for dynamic user groups by: 1) defining and enforcing access policies based on the attributes of the data; 2) permitting the key generation center to efficiently update user credentials for dynamic user groups; and 3) allowing some expensive computation tasks to be performed by untrusted CSPs without requiring any delegation key. Specifically, we first design an efficient revocable attribute-based encryption (ABE) scheme with the property of ciphertext delegation by exploiting and uniquely combining techniques of identity-based encryption, ABE, subset-cover framework, and ciphertext encoding mechanism. We then present a fine-grained access control and data sharing system for on-demand services with dynamic user groups in the cloud. The experimental data show that our proposed scheme is more efficient and scalable than the state-of-the-art solution.

Formula: see text]: Oblivious similarity based searching for encrypted data outsourced to an untrusted domain.

Public cloud storage services are becoming prevalent and myriad data sharing, archiving and collaborative services have emerged which harness the pay-as-you-go business model of public cloud. To ensure privacy and confidentiality often encrypted data is outsourced to such services, which further complicates the process of accessing relevant data by using search queries. Search over encrypted data schemes solve this problem by exploiting cryptographic primitives and secure indexing to identify outsourced data that satisfy the search criteria. Almost all of these schemes rely on exact matching between the encrypted data and search criteria. A few schemes which extend the notion of exact matching to similarity based search, lack realism as those schemes rely on trusted third parties or due to increase storage and computational complexity. In this paper we propose Oblivious Similarity based Search () for encrypted data. It enables authorized users to model their own encrypted search queries which are resilient to typographical errors. Unlike conventional methodologies, ranks the search results by using similarity measure offering a better search experience than exact matching. It utilizes encrypted bloom filter and probabilistic homomorphic encryption to enable authorized users to access relevant data without revealing results of search query evaluation process to the untrusted cloud service provider. Encrypted bloom filter based search enables to reduce search space to potentially relevant encrypted data avoiding unnecessary computation on public cloud. The efficacy of is evaluated on Google App Engine for various bloom filter lengths on different cloud configurations.

A scalable attribute-set-based access control with both sharing and full-fledged delegation of access privileges in cloud computing

The benefits of cloud computing motivate enterprises to migrate their IT infrastructure on cloud servers. Enterprise needs to entrust untrusted cloud service provider, which gives rise to various security and privacy concerns. To address these concerns, numerous schemes in cloud computing employed attribute-based encryption schemes. However, existing schemes are neither flexible enough to provide users complete liberty on delegation of their access privileges nor grant shared access privileges among users of a group to jointly address a responsibility. This paper introduces hierarchical attribute-set-based access control scheme by employing ciphertext-policy attribute-set-based encryption with a hierarchical structure of users to achieve scalability. The proposed scheme simultaneously achieves the notion of fine-grained cum flexible access control, privacy preserving, efficient data utilization and imperatively provides users full-fledged liberty on delegation of their access privileges. Furthermore, we formally prove that proposed scheme is secure under decisional bilinear Diffie–Hellman assumption.

Private and Efficient Query Processing on Outsourced Genomic Databases.

Applications of genomic studies are spreading rapidly in many domains of science and technology such as healthcare, biomedical research, direct-to-consumer services, and legal and forensic. However, there are a number of obstacles that make it hard to access and process a big genomic database for these applications. First, sequencing genomic sequence is a time consuming and expensive process. Second, it requires large-scale computation and storage systems to process genomic sequences. Third, genomic databases are often owned by different organizations, and thus, not available for public usage. Cloud computing paradigm can be leveraged to facilitate the creation and sharing of big genomic databases for these applications. Genomic data owners can outsource their databases in a centralized cloud server to ease the access of their databases. However, data owners are reluctant to adopt this model, as it requires outsourcing the data to an untrusted cloud service provider that may cause data breaches. In this paper, we propose a privacy-preserving model for outsourcing genomic data to a cloud. The proposed model enables query processing while providing privacy protection of genomic databases. Privacy of the individuals is guaranteed by permuting and adding fake genomic records in the database. These techniques allow cloud to evaluate count and top-k queries securely and efficiently. Experimental results demonstrate that a count and a top-k query over 40 Single Nucleotide Polymorphisms (SNPs) in a database of 20000 records takes around 100 and 150s, respectively.

Privacy-Aware Relevant Data Access with Semantically Enriched Search Queries for Untrusted Cloud Storage Services.

Privacy-aware search of outsourced data ensures relevant data access in the untrusted domain of a public cloud service provider. Subscriber of a public cloud storage service can determine the presence or absence of a particular keyword by submitting search query in the form of a trapdoor. However, these trapdoor-based search queries are limited in functionality and cannot be used to identify secure outsourced data which contains semantically equivalent information. In addition, trapdoor-based methodologies are confined to pre-defined trapdoors and prevent subscribers from searching outsourced data with arbitrarily defined search criteria. To solve the problem of relevant data access, we have proposed an index-based privacy-aware search methodology that ensures semantic retrieval of data from an untrusted domain. This method ensures oblivious execution of a search query and leverages authorized subscribers to model conjunctive search queries without relying on predefined trapdoors. A security analysis of our proposed methodology shows that, in a conspired attack, unauthorized subscribers and untrusted cloud service providers cannot deduce any information that can lead to the potential loss of data privacy. A computational time analysis on commodity hardware demonstrates that our proposed methodology requires moderate computational resources to model a privacy-aware search query and for its oblivious evaluation on a cloud service provider.

METADATA DRIVEN EFFICIENT KEY GENERATION AND DISTRIBUTION IN CLOUD SECURITY

With rapid development of cloud computing to a greater extent IT industries outsource their sensitive data at cloud data storage location. To keep the stored data confidential against untrusted cloud service providers, a natural way is to store only encrypted data in the cloud severs and providing an efficient access control mechanism using a competent cipher key-Cmxn, which is becoming a promising cryptographic solution. In this proposed model the cipher key is generated based on attributes of metadata. The key problems of this approach includes, the generation of cipher key-Cmxn and establishing an access control mechanism for the encrypted data using cipher key, where keys cannot be revoked without the involvement of data owner and the Metadata Data Server (MDS), hence makes data owner feels comfortable about the data stored. From this study, we propose a novel Metadata driven efficient key generation and distribution policies for cloud data security system by exploiting the characteristic of the metadata stored. Our design enforces security by providing two novel features. 1. Generation of Cipher key-Cmxn using modified feistel network, which holds good for the avalanche effect as each round of the feistel function, depends on the previous round. 2. A novel key distribution policy is designed where the encryption and decryption keys cannot be compromised without the involvement of data owner and the Metadata Data Server (MDS), hence makes data owner comfortable about the data stored. We have implemented a security model that incorporates our ideas and evaluated the performance and scalability of the secured model.

Metadata Driven Efficient CRE based Cipher Key Generation and Distribution in Cloud Security

The increasing popularity of cloud storage services has lead companies that handle critical data to think about using these services for their storage needs. To keep their sensitive data against untrusted cloud service providers, a natural way is to store only encrypted data in the cloud severs and providing an efficient access control mechanism.. The proposed model involves the attributes of metadata for key generation and distribution techniques. The key problems of this approach includes, the generation of cipher key and establishing an access control mechanism for the encrypted data using cipher key, where keys cannot be revoked without the involvement of user, metadata data server (MDS) and Data Server (DS). From this study, we propose a novel metadata driven cipher key generation and distribution policies by means of exploiting the characteristic of the metadata stored called CRE Scheme, a Cloud Re-Encryption model that improves the confidentiality of the data stored through the cipher-key Cmxn. We have implemented our security model using eucalyptus tool and evaluated the performance and scalability of the secured model. We observed that our protocols improved the security of the data stored and compared with existing security models.

SECURE RETRIEVAL OF FILES USING HOMOMORPHIC ENCRYPTION FOR CLOUD COMPUTING

Clouds allow users to store data and access can be made anywhere, any time by using any device. Highly sensitive information such as business documents, medical records and personal information may be stored in a cloud. Security and privacy are thus very important issues in cloud computing. To keep user data confidential from an untrusted Cloud Service Provider and third parties, a natural way is encryption. The data decryption key should be disclosed only to users who have been authorized. Users can search their files using keywords in the cloud. In existing literature many schemes have been proposed. In this paper, a new technique is described: Multi-keyword searching using homomorphic encryption. It is an algorithm which performs operations on encrypted data which will provide results without decrypting that data. It provides privacy for user querying patterns and user data. It allows Cloud Service Providers to perform operations on the encrypted data. The Cloud Service Provider is unaware of the files and keywords stored in the cloud. Ranking is used for efficient and fast retrieval of the desired files. Ranks will be assigned to files based on the frequency of access of the files.

A fine‐grained access control and revocation scheme on clouds

SummaryIn recent years, more and more companies outsource their data to the cloud service provider to greatly reduce the cost. However, it also raises underlying security and privacy issues for the significant corporate data. Therefore, a natural way to keep sensitive data confidential against an untrusted cloud service provider is only to store the encrypted data in the cloud. Flexible encryption schemes can provide a fine grain access control for the encrypted data and ensure legitimate user to decrypt the corresponding data. The key problems of this approach include establishing access control for the encrypted data and revoking the access rights from users when they are no longer authorized to access the encrypted data on cloud servers. This paper aims to solve these problems. First, with the attribute encryption and the dual encryption system, we propose a concrete access control scheme constructed over the composite‐order bilinear groups, and we prove its security under the standard model. Then, we propose a fully fine‐grained revocation scheme under the direct revocation model so as to efficiently revoke access rights from users on cloud servers. Copyright © 2012 John Wiley & Sons, Ltd.

Hierarchical attribute-based encryption and scalable user revocation for sharing data in cloud servers

With rapid development of cloud computing, more and more enterprises will outsource their sensitive data for sharing in a cloud. To keep the shared data confidential against untrusted cloud service providers (CSPs), a natural way is to store only the encrypted data in a cloud. The key problems of this approach include establishing access control for the encrypted data, and revoking the access rights from users when they are no longer authorized to access the encrypted data. This paper aims to solve both problems. First, we propose a hierarchical attribute-based encryption scheme (HABE) by combining a hierarchical identity-based encryption (HIBE) system and a ciphertext-policy attribute-based encryption (CP-ABE) system, so as to provide not only fine-grained access control, but also full delegation and high performance. Then, we propose a scalable revocation scheme by applying proxy re-encryption (PRE) and lazy re-encryption (LRE) to the HABE scheme, so as to efficiently revoke access rights from users.

Secure and privacy preserving keyword searching for cloud storage services

Cloud storage services enable users to remotely access data in a cloud anytime and anywhere, using any device, in a pay-as-you-go manner. Moving data into a cloud offers great convenience to users since they do not have to care about the large capital investment in both the deployment and management of the hardware infrastructures. However, allowing a cloud service provider (CSP), whose purpose is mainly for making a profit, to take the custody of sensitive data, raises underlying security and privacy issues. To keep user data confidential against an untrusted CSP, a natural way is to apply cryptographic approaches, by disclosing the data decryption key only to authorized users. However, when a user wants to retrieve files containing certain keywords using a thin client, the adopted encryption system should not only support keyword searching over encrypted data, but also provide high performance. In this paper, we investigate the characteristics of cloud storage services and propose a secure and privacy preserving keyword searching (SPKS) scheme, which allows the CSP to participate in the decipherment, and to return only files containing certain keywords specified by the users, so as to reduce both the computational and communication overhead in decryption for users, on the condition of preserving user data privacy and user querying privacy. Performance analysis shows that the SPKS scheme is applicable to a cloud environment.