Efficient data integrity auditing for storage security in mobile health cloud

Cloud storage services can enable data owners to eliminate the need for the initial investment of expensive infrastructure setup and also minimize development and maintenance costs. Outsourcing the health data to e-health cloud storage server is very beneficial. Nonetheless, storing the health data on cloud servers also brings serious security challenges. In this paper, we propose a highly efficient data integrity auditing scheme for cloud storage for mobile health applications. The authentication tag for each data block generated by biosensor nodes is minimal in our scheme due to the use of hash operation. Moreover, in data integrity checking phase, message-locked encryption scheme is utilized to encrypt and transport the auditing information of the checked data blocks, which significantly reduces the required amount of calculation and communication resources. Compared with the conventional third party auditing schemes, the presented scheme speeds up the tag generation and tag checking process by more than one thousand times.     

云计算信息安全测评框架研究

围绕云环境下安全模式与传统安全模式的差异,结合信息安全保障要求,对三种不同的云服务模式(包括IaaS,PaaS和SaaS)进行了安全需求分析,同时对美国云计算联邦风险评估管理计划(FedRAMP)中的安全控制措施和国内相关信息安全标准中的安全要求进行了对比分析,提出了云计算信息安全测评的基本框架,探讨了云计算信息安全测评需要特别关注的内容.     

A novel cloud management framework for trust establishment and evaluation in a federated cloud environment

The Journal of Supercomputing - Cloud Computing is being utilized by large-scale organizations for data storage and management. It provides advantages like reducing the cost of information...     

一种基于云模型的网络安全风险综合评价法

本文运用云理论,对传统的网络安全风险模糊综合评价法进行改进,首先用云模型建立风险等级评语集,再对各单个因素的评语用云模型描述,并对这些评语的期望值进行修正,最后求出系统综合风险云模型,通过与评语集对照确定风险级别。实例证明了该方法的可行性。本方法较模糊综合评价法更客观、本质地反映网络安全风险状况。     

Enhancing cloud storage security against a new replay attack with an efficient public auditing scheme

The Journal of Supercomputing - The cloud storage service becomes a popular tendency based on the cloud computing, which can solve user’s storage bottleneck problem. Data security problems...     

A UML-based static verification framework for security

Secure software engineering is a new research area that has been proposed to address security issues during the development of software systems. This new area of research advocates that security characteristics should be considered from the early stages of the software development life cycle and should not be added as another layer in the system on an ad-hoc basis after the system is built. In this paper, we describe a UML-based Static Verification Framework (USVF) to support the design and verification of secure software systems in early stages of the software development life-cycle taking into consideration security and general requirements of the software system. USVF performs static verification on UML models consisting of UML class and state machine diagrams extended by an action language. We present an operational semantics of UML models, define a property specification language designed to reason about temporal and general properties of UML state machines using the semantic domains of the former, and implement the model checking process by translating models and properties into Promela, the input language of the SPIN model checker. We show that the methodology can be applied to the verification of security properties by representing the main aspects of security, namely availability, integrity and confidentiality, in the USVF property specification language.     

一种多层次的云平台安全解决方案

论述了云平台的整体安全解决方案。该方案分为应用级别安全、容器级别安全、网络级别安全等层次。着重阐述了针对PaaS云平台的解决方案,从容器内部应用安全、容器自身安全、容器外部的入侵防御安全三个方面做出了分析。     

开放可伸缩的信息安全管理测量评价体系

研究了信息安全管理的测量问题与评价问题.从运筹学的规划模型出发,给出了信息安全管理的运筹学模型;有机结合了测量、评价两个过程,提出了信息安全管理的集成测量评价模型,并给出其形式化的数学描述;构建基于方法集的开放、可伸缩的信息安全管理集成测量评价体系,探讨评价内容集、评价维度集、评价方法集、指标集、测量方法集等关键技术的实现.网络安全管理测量评价的应用实例表明,集成的测量评价体系是可行、有效的.开放可伸缩的信息安全管理集成测量评价体系的提出,有利于信息安全管理测量与评价的一体化、体系化、标准化、定量化,有利于组织构建更为完善的信息安全管理体系.     

A secure and efficient public auditing scheme using RSA algorithm for cloud storage

Cloud storage is widely used by both individual and organizational users due to the many benefits, such as scalability, ubiquitous access, and low maintenance cost (and generally free for individual users). However, there are known security and privacy issues in migrating data to the cloud. To ensure or verify data integrity, a number of cloud data integrity checking schemes with different properties have been presented in the literature. Most existing schemes were subsequently found to be insecure or have high computation and communication costs. More recently in 2016, Yu et al. (Future Gener Comput Syst 62:85–91, 2016) proposed an identity-based auditing scheme for checking the integrity of cloud data. However, in this paper, we reveal that the scheme is vulnerable to data recovery attack. We also present a new identity-based public auditing scheme and formally prove the security of the scheme under the RSA assumption with large public exponents in the random oracle model. We then evaluate the performance of our proposed scheme and demonstrate that in comparison with Yu et al.’s scheme, our proposal is more practical in real-world applications.     

A framework for the governance of information security

This paper highlights the importance of protecting an organization's vital business information assets by investigating several fundamental considerations that should be taken into account in this regard. Based on this, it is illustrated that information security should be a priority of executive management, including the Board and CEO and should therefore commence as a corporate governance responsibility. This paper, therefore, motivates that there is a need to integrate information security into corporate governance through the development of an information security governance (ISG) framework. This paper further proposes such a framework to aid an organization in its ISG efforts.     

A security framework for cloud-based video surveillance system

Multimedia Tools and Applications - Utilizing cloud services in running large-scale video surveillance systems is not uncommon. However, special attention should be given to data security and...     

A symbolic framework for multi-faceted security protocol analysis

Verification of software systems, and security protocol analysis as a particular case, requires frameworks that are expressive, so as to properly capture the relevant aspects of the system and its properties, formal, so as to be provably correct, and with a computational counterpart, so as to support the (semi-) automated certification of properties. Additionally, security protocols also present hidden assumptions about the context, specific subtleties due to the nature of the problem and sources of complexity that tend to make verification incomplete. We introduce a verification framework that is expressive enough to capture a few relevant aspects of the problem, like symmetric and asymmetric cryptography and multi-session analysis, and to make assumptions explicit, e.g., the hypotheses about the initial sharing of secret keys among honest (and malicious) participants. It features a clear separation between the modeling of the protocol functioning and the properties it is expected to enforce, the former in terms of a calculus, the latter in terms of a logic. This framework is grounded on a formal theory that allows us to prove the correctness of the verification carried out within the fully fledged model. It overcomes incompleteness by performing the analysis at a symbolic level of abstraction, which, moreover, transforms into executable verification tools.     

A framework for formal analysis and simulative evaluation of security attacks in wireless sensor networks

Journal of Computer Virology and Hacking Techniques - When designing Wireless Sensor Networks it is important to analyze their security risks and provide adequate solutions for protecting them from...     

Secure and efficient privacy-preserving public auditing scheme for cloud storage

Cloud computing poses many challenges on integrity and privacy of users’ data though it brings an easy, cost-effective and reliable way of data management. Hence, secure and efficient methods are needed to ensure integrity and privacy of data stored at the cloud. Wang et al. proposed a privacy-preserving public auditing protocol in 2010 but it is seriously insecure. Their scheme is vulnerable to attacks from malicious cloud server and outside attackers regarding to storage correctness. So they proposed a scheme in 2011 with an improved security guarantee but it is not efficient. Thus, in this paper, we proposed a scheme which is secure and with better efficiency. It is a public auditing scheme with third party auditor (TPA), who performs data auditing on behalf of user(s). With detail security analysis, our scheme is proved secure in the random oracle model and our performance analysis shows the scheme is efficient.     

Privacy-preserving public auditing for educational multimedia data in cloud computing

Nowadays, as distance learning is being widly used, multimedia data becomes an effective way for delivering educational contents in online educational systems. To handle the educational multimedia data efficiently, many distance learning systems adopt a cloud storage service. Cloud computing and storage services provide a secure and reliable access to the outsourced educational multimedia contents for users. However, it brings challenging security issues in terms of data confidentiality and integrity. The straightforward way for the integrity check is to make the user download the entire data for verifying them. But, it is inefficient due to the large size of educational multimedia data in the cloud. Recently many integrity auditing protocols have been proposed, but most of them do not consider the data privacy for the cloud service provider. Additionally, the previous schemes suffer from dynamic management of outsourced data. In this paper, we propose a public auditing protocol for educational multimedia data outsourced in the cloud storage. By using random values and a homomorphic hash function, our proposed protocol ensures data privacy for the cloud and the third party auditor (TPA). Also, it is secure against lose attack and temper attack. Moreover, our protocol is able to support fully dynamic auditing. Security and performance analysis results show that the proposed scheme is secure while guaranteeing minimum extra computation costs.     

A framework with data-centric accountability and auditability for cloud storage

The cross-domain characteristic of cloud storage service decides that both users and service providers have limited trust toward each other. Judging from a real-world perspective, both parties may have the motivation to engage in dishonest activity for monetary reasons. Hence, accountability should be seriously treated in designing storage systems with practical security. This paper proposes a general accountable framework for cloud storage in a data-centric manner. We design non-repudiable action records to log all data-related access behavior, and through later auditing to detect possible misbehavior. To resist replay attacks, we adopt signature exchange idea to let both parties verify and maintain different metadata signatures signed by the other party. For potential disputes about data content or access records, we also design arbitration protocol to fairly and efficiently settle the dispute and find out the cheating party. Experimental evaluation of our prototype shows that cryptographic cost, storage overhead and throughput are reasonable and acceptable.     

一种面向云计算服务供应链的安全评估模型

针对云计算服务供应链中存在的安全问题,提出了一种安全评估模型。首先,将供应链风险识别方法与云计算服务场景相结合,识别出了云计算服务供应链的主要风险目标及其风险来源事件集,并以国标《云计算服务安全能力要求》为基础,构建了安全指标体系;其次,考虑到云计算服务供应链的动态开放、复杂多变以及大多安全指标无法量化的特点,设计了基于德尔菲方法的风险来源度量流程和权重赋值流程,并提出了基于模糊综合评价的安全评估流程,以实现风险来源的风险等级度量结果的一致性;最后,通过一个应用实例验证了安全评估模型的有效性和可行性。