Cryptanalysis and improvement of Panda - public auditing for shared data in cloud and internet of things

Cloud computing and internet of things have gained remarkable popularity by a wide spectrum of users recently. Despite of the convenience of cloud storage, security challenges have risen upon the fact that users do not physically possess their data any more. Thus, some auditing schemes are introduced to ensure integrity of the outsourced data. And among them Panda is a public auditing scheme for shared data with efficient and secure user revocation proposed by Wang et al. It argued that it could verify the integrity of shared data with storage correctness and public auditing. In this paper, we analyze this scheme and find some security drawbacks. Firstly, Panda cannot preserve shared data privacy in cloud storage. Furthermore, our analysis shows that Panda is vulnerable to integrity forgery attack, which can be performed by malicious cloud servers to forge a valid auditing proof against any auditing challenge even without correct data storage. Then we pinpoint that the primary cause of the insecurity is the linear combinations of sampled data blocks without random masking properly. Finally, we propose an improvement of Panda together with data privacy preserving and sound public auditing while incurring optimal communication and computation overhead.     

Data storage auditing service in cloud computing: challenges,methods and opportunities

Cloud computing is a promising computing model that enables convenient and on-demand network access to a shared pool of configurable computing resources. The first offered cloud service is moving data into the cloud: data owners let cloud service providers host their data on cloud servers and data consumers can access the data from the cloud servers. This new paradigm of data storage service also introduces new security challenges, because data owners and data servers have different identities and different business interests. Therefore, an independent auditing service is required to make sure that the data is correctly hosted in the Cloud. In this paper, we investigate this kind of problem and give an extensive survey of storage auditing methods in the literature. First, we give a set of requirements of the auditing protocol for data storage in cloud computing. Then, we introduce some existing auditing schemes and analyze them in terms of security and performance. Finally, some challenging issues are introduced in the design of efficient auditing protocol for data storage in cloud computing.     

基于盲签名的云共享数据完整性审计方案

云端共享数据完整性审计用来验证一个用户群组共享在云端的数据的完整性。传统方式下,成员用户需要为每一个数据块生成认证器,再将数据块和对应的认证器上传到云服务器中保存。然而用户的计算资源有限且计算能力不高,由用户产生数据块认证器需要消耗用户很大的计算开销。为了节省用户的计算资源,提高认证器生成的效率,提出基于盲签名算法的云共享数据完整性审计方案。用户先对数据块进行盲化再发送到认证器生成中心生成相应的认证器,此外,方案中对第三方审计者TPA进行审计授权,有效地避免了攻击者对于云服务器的DDoS攻击。安全性分析和实验结果表明该方案是安全、高效的。     

高效可撤销的共享数据云存储审计

共享数据的云存储审计是指对群用户共享的云数据的完整性进行审计. 由于在共享数据云存储审计中, 用户可能因各种原因加入和离开用户群, 因此这种方案通常支持群用户撤销. 在大多数现存的共享数据云审计方案中, 用户撤销的计算开销与用户群要上传的文件块总数成线性关系, 造成很大的计算和通信代价, 如何减少用户撤销产生的计算和通...     

Data error locations reported by public auditing in cloud storage service

Public auditing is an important issue in cloud storage service because a cloud service provider may try to hide management mistakes and system errors from users or even steal or tamper with a user’s data for monetary reasons. Without the protection of a proper auditing mechanism, cloud users would have to run high risks of having their legal rights and interests spoiled without their knowledge. Therefore, many data integrity, assurance, and correctness schemes have been proposed for data auditing. Most of these schemes work by randomly sampling and aggregating signatures from bilinear maps (for more efficiency) to check whether the cloud storage service is honest and whether the data stored in the cloud is correct. Although aggregating signatures can reduce the auditor’s computing overhead and time, unfortunately, none of these schemes have offered any workable solution to giving detailed information on where the errors are when the cloud data as a whole fails the auditing. To fix this problem, we shall propose a new public auditing scheme with a mechanism integrated into it especially to locate the problematic data blocks when they exist. With efficiency, the proposed scheme is capable not only of giving an accurate pass/fail report but also providing detailed information on the locations of the errors detected.     

云存储服务中数据完整性审计方案综述

云存储是由云计算提供的一个重要服务,允许数据拥有者将数据远程存储到云服务器上,同时又能够从云服务器上便捷、高效地获取这些数据,没有本地存储和维护数据的负担。然而,这种新的数据存储模式也引发了众多安全问题,一个重要的问题就是如何确保云服务器中数据拥有者数据的完整性。因此,数据拥有者以及云存储服务提供商亟需一个稳定、安全、可信的完整性审计方案,用于审核云服务器中数据的完整性和可用性。不仅如此,一个好的数据完整性审计方案还需满足如下功能需求：支持数据的动态操作,包括插入、删除、修改;支持多用户、多云服务器的批量审计;确保用户数据的隐私性;注重方案的执行效率,尽量减少数据拥有者和云服务器的计算开销与通信开销。为了促进云存储服务的广泛应用与推广,文章重点对云数据完整性审计方案的研究现状进行综述,描述云存储以及数据完整性审计的相关概念、特点,提出云计算环境下数据完整性审计模型和安全需求,阐述云存储数据完整性审计的研究现状,并重点分析部分经典方案,通过方案对比,指出当前方案存在的优点及缺陷。同时,文章还指出了本领域未来的研究方向。     

云数据持有性审计研究与进展

作为云计算的重要分支,云存储以高性能和低成本等优势吸引了越来越多的组织和个人将大规模数据托管于其上。然而,云数据的外包特性和近年来频繁爆出的安全事件,使得用户对云存储服务的信心不足,其关键问题是如何确保存储在云端的数据的完整性。为应对该挑战,云数据持有性审计在最近几年被提出并受到了广泛的关注,文中对此进行了综述。首先,回顾了云数据持有性审计的一般模型和审计系统的设计目标;其次,按照实现的审计功能,对近年来的研究成果进行了分类介绍及对比分析;最后,指出了云数据持有性审计研究中存在的开放问题及发展趋势。     

Comment on “Privacy-preserving public auditing for non-manager group shared data”

Using cloud storage, users can remotely store their data without the burden on complicated local storage management and maintenance. However, users will no longer physically possess the storage of their data after they upload the data to the cloud. It is very natural for users to suspect whether their data stored in the cloud is intact. To help users efficiently check the integrity of the outsourced data, many public auditing schemes have been proposed. Recently, Huang et al. have proposed a privacy-preserving public auditing scheme for non-manager group shared data. In this paper, we find a security flaw in their auditing scheme. Even if the cloud has deleted or polluted the whole outsourced data, it still can pass the verification of the verifier. And then, we overcome this shortcoming by improving their scheme, which prevents the cloud forging a valid proof to pass the integrity auditing. Last, we perform the concrete implementation of our improved scheme and Huang et al. ’s scheme.

     

Defense schemes for variants of distributed denial-of-service (DDoS) attacks in cloud computing: A survey

Cloud computing is a fast-growing and promising technology segment that aims to reduce maintenance and management costs by shifting high-quality computing infrastructure to the Internet. It is emerging as a dominant technology because it provides an on-demand, self-service, scalable, and pay-per-use business model. Despite its numerous benefits, it suffers from several security challenges. As a consequence of on-demand service, availability of computing resources is the crucial attribute of cloud computing among security necessities. In this work, a survey is presented on various issues related to the availability of resources in a cloud environment. Ensuring availability and security of computing/storage resources are still challenging tasks. The adversary class readily exploits the vulnerabilities in the cloud infrastructure for attack implementation. The article presents a study of various categories of distributed denial-of-service (DDoS) attacks in cloud computing and their defense mechanisms. It is believed that this is the first work which surveys all varieties of DDoS attacks in the cloud environment.     

Fuzzy User Access Trust Model for Cloud Access Control

Cloud computing belongs to a set of policies, protocols, technologies through which one can access shared resources such as storage, applications, networks, and services at relatively low cost. Despite the tremendous advantages of cloud computing, one big threat which must be taken care of is data security in the cloud. There are a dozen of threats that we are being exposed to while availing cloud services. Insufficient identity and access management, insecure interfaces and Applications interfaces (APIs), hijacking, advanced persistent threats, data threats, and many more are certain security issues with the cloud platform. APIs and service providers face a huge challenge to ensure the security and integrity of both network and data. To overcome these challenges access control mechanisms are employed. Traditional access control mechanisms fail to monitor the user operations on the cloud platform and are prone to attacks like IP spoofing and other attacks that impact the integrity of the data. For ensuring data integrity on cloud platforms, access control mechanisms should go beyond authentication, identification, and authorization. Thus, in this work, a trust-based access control mechanism is proposed that analyzes the data of the user behavior, network behavior, demand behavior, and security behavior for computing trust value before granting user access. The method that computes the final trust value makes use of the fuzzy logic algorithm. The trust value-based policies are defined for the access control mechanism and based on the trust value outcome the access control is granted or denied.     

具有紧凑标签的基于身份匿名云审计方案

云存储技术具有效率高、可扩展性强等优点。用户可以借助云存储技术节省本地的存储开销,并与他人共享数据。然而,数据存储到云服务器后,用户失去对数据的物理控制,需要有相应的机制保证云中数据的完整性。数据拥有证明（PDP,provable data possession）机制允许用户或用户委托的第三方审计员（TPA,third party auditor）对数据完整性进行验证。但在实际应用中,数据通常由多个用户共同维护,用户在进行完整性验证请求的同时泄露了自己的身份。匿名云审计支持TPA在完成数据完整性验证时保证用户的匿名性。在基于身份体制下,匿名云审计方案通常需要借助基于身份的环签名或群签名技术实现,数据标签的构成元素与用户数量相关,使得数据标签不够紧凑,存储效率较低。为了解决这一问题,提出一种基于身份的匿名云审计方案通用构造,使用一个传统体制下的签名方案和一个传统体制下的匿名云审计方案即可构造一个基于身份的匿名云审计方案。基于该通用构造,使用BLS签名和一个传统体制下具有紧凑标签的匿名云审计方案设计了具有紧凑标签的基于身份匿名云审计方案。该方案主要优势在于数据标签短,能够减少云服务器的存储...     

Privacy-preserving public auditing for educational multimedia data in cloud computing

Nowadays, as distance learning is being widly used, multimedia data becomes an effective way for delivering educational contents in online educational systems. To handle the educational multimedia data efficiently, many distance learning systems adopt a cloud storage service. Cloud computing and storage services provide a secure and reliable access to the outsourced educational multimedia contents for users. However, it brings challenging security issues in terms of data confidentiality and integrity. The straightforward way for the integrity check is to make the user download the entire data for verifying them. But, it is inefficient due to the large size of educational multimedia data in the cloud. Recently many integrity auditing protocols have been proposed, but most of them do not consider the data privacy for the cloud service provider. Additionally, the previous schemes suffer from dynamic management of outsourced data. In this paper, we propose a public auditing protocol for educational multimedia data outsourced in the cloud storage. By using random values and a homomorphic hash function, our proposed protocol ensures data privacy for the cloud and the third party auditor (TPA). Also, it is secure against lose attack and temper attack. Moreover, our protocol is able to support fully dynamic auditing. Security and performance analysis results show that the proposed scheme is secure while guaranteeing minimum extra computation costs.     

Security analysis of a publicly verifiable data possession scheme for remote storage

As an essential technology of cloud computing, the cloud storage can exactly satisfy the demand of users with the service of scalability, ubiquitous access and low maintenance cost. However, moving data to the cloud servers will bring some significant security challenges due to the loss of the physical data possession. In order to verify the data integrity, many verifiable data possession schemes have been proposed in last several years. Very recently, Tang and Zhang proposed a new publicly verifiable data possession (PVDP) scheme for remote storage. They claimed that their scheme was suitable for checking the storage correctness and secure against various types of attacks. In this paper, we analyze the security of Tang and Zhang’s PVDP scheme and prove that it is vulnerable to the data recovery attack. We also demonstrate that PVDP scheme works incorrectly with a concrete instance. Our analysis shows that their scheme is not suitable for practical applications. Our work can help cryptographers and engineers design and implement more secure and efficient public auditing schemes for the cloud storage data.     

BB-tree based secure and dynamic public auditing convergence for cloud storage

Cloud computing is a current phrase in marketing for an idea which has been recognized for years: Outsourcing. Cloud computing provides a large amount of gratuities for each customer and enterprise agency. “Cloud model” is a more of a notion in which the data are hosted online and accessed in a time-anywhere manner, on a pay-per-use model. However, the users may not fully trust the cloud service providers (CSPs) in that environment. So, it is hard to decide whether the CSP meet their expectations to provide the proper secrecy to shared data. Moreover, in the environment of outsourcing, users have no longer control and ownership of data which may cause serious major issues related to data integrity. Previously, many researchers have committed themselves to draft auditing protocols for attaining proper public verification schemes through third-party auditor (TPA). On the other hand, these schemes may leak identity or data value to the third-party auditor. Therefore, to deal with these problems, we introduce an efficient public auditing protocol by constructing binary binomial tree (BBT)-like data structure with Boneh–Lynn–Shacham signature-based Homomorphic Verifiable Authenticator (BLS-HVA). This model also consists an index hash table (IHT), situated at TPA to record the information about the data block’s properties for auditing procedure. This model supports sampling blockless verification, batch auditing, and dynamic updating operations. Moreover, with such novel dynamic data structure, the proposed model guarantees that user’s group can easily trace any type of data changes through the designated BBT. Along with this, the users can also easily recover the accurate data blocks whenever the current data blocks are corrupted. The experimental results demonstrate that the proposed auditing model efficiently attains secure auditing for the cloud environment and outperforms the existing models in terms of communication and computation overhead.

     

支持受损数据定位与恢复的动态群用户可证明存储

云计算的外包存储模式导致数据拥有者的数据所有权和管理权分离,进而改变了数据存储网络模型和安全模型。为了有效应对云服务器端的软硬件故障及潜在的不诚实服务提供商,确保数据拥有者数据的可用性,设计安全、高效的数据可用性、可恢复性审计方案对于解决用户担忧、保证云数据安全具有重要的理论和实践价值。然而,现有研究多针对数据完整性或者可恢复性方案的安全性和效率进行设计,没有考虑动态群用户下受损数据的快速定位和可靠恢复问题。因此,针对动态群用户环境中受损数据定位与恢复问题,设计了一个可公开验证的动态群组云用户存储证明方案。该方案在检测到数据受损时,任何可信的第三方审计者能够通过挑战协议快速定位受损数据,并在数据受损程度小于纠错能力门限情况下允许云平台对数据进行可靠恢复。该方案结合关联计算和累加计算,有效减少了受损数据定位的计算次数;通过纠删码与共享编码技术,方案能够实现用户受损数据的有效恢复。同时,方案支持用户的动态撤销,确保了群用户共享数据在用户撤销后的完整性审计和可靠恢复。定义了方案的网络模型和威胁模型,并在相应安全模型下证明了所设计方案的安全性。通过真实环境下的原型系统实现和模块化性能分析,证明...     

云计算下的数据存储安全可证明性综述

云计算的数据服务外包可以减少数据所有者本地的存储和维护压力,然而用户会因此失去对数据可靠性和安全的物理控制。于是如何确保云中数据的安全就成为了非常有挑战性的任务和难题。在全面研究云计算数据存储安全现有成果的基础上,介绍了云计算数据存储的基本架构,并从可检索证明和可证明数据拥有两个角度分析了相关研究方案的发展,从公共认证、同态认证、数据动态化、隐私保护、批审计和多服务器环境得方面讨论了协议的功能设计,并且列表进行了功能和开销对比,在此基础上提出了一个比较完备的云计算环境下的协议框架。最后总结并阐述了后续工作。     

An Evaluation of the Cost and Performance of Scientific Workflows on Amazon EC2

Workflows are used to orchestrate data-intensive applications in many different scientific domains. Workflow applications typically communicate data between processing steps using intermediate files. When tasks are distributed, these files are either transferred from one computational node to another, or accessed through a shared storage system. As a result, the efficient management of data is a key factor in achieving good performance for workflow applications in distributed environments. In this paper we investigate some of the ways in which data can be managed for workflows in the cloud. We ran experiments using three typical workflow applications on Amazon’s EC2 cloud computing platform. We discuss the various storage and file systems we used, describe the issues and problems we encountered deploying them on EC2, and analyze the resulting performance and cost of the workflows.     

Cloud data integrity checking with an identity-based auditing mechanism from RSA

Cloud data auditing is extremely essential for securing cloud storage since it enables cloud users to verify the integrity of their outsourced data efficiently. The computation overheads on both the cloud server and the verifier can be significantly reduced by making use of data auditing because there is no necessity to retrieve the entire file but rather just use a spot checking technique. A number of cloud data auditing schemes have been proposed recently, but a majority of the proposals are based on Public Key Infrastructure (PKI). There are some drawbacks in these protocols: (1) It is mandatory to verify the validity of public key certificates before using any public key, which makes the verifier incur expensive computation cost. (2) Complex certificate management makes the whole protocol inefficient. To address the key management issues in cloud data auditing, in this paper, we propose ID-CDIC, an identity-based cloud data integrity checking protocol which can eliminate the complex certificate management in traditional cloud data integrity checking protocols. The proposed concrete construction from RSA signature can support variable-sized file blocks and public auditing. In addition, we provide a formal security model for ID-CDIC and prove the security of our construction under the RSA assumption with large public exponents in the random oracle model. We demonstrate the performance of our proposal by developing a prototype of the protocol. Implementation results show that the proposed ID-CDIC protocol is very practical and adoptable in real life.     

云计算及其在军事领域中的应用研究

云计算是一种新兴的共享基础架构的方法,它以公开的标准和服务为基础,以互联网为中心,提供安全、快速、便捷的数据存储和网络计算服务.描述了云计算的概念及发展现状,分析了云计算军事应用的重要意义;结合云计算在军事领域的应用,重点阐述了云计算军事应用中的关键问题研究;最后,对云计算的军事应用进行了展望.     

Secure and efficient privacy-preserving public auditing scheme for cloud storage

Cloud computing poses many challenges on integrity and privacy of users’ data though it brings an easy, cost-effective and reliable way of data management. Hence, secure and efficient methods are needed to ensure integrity and privacy of data stored at the cloud. Wang et al. proposed a privacy-preserving public auditing protocol in 2010 but it is seriously insecure. Their scheme is vulnerable to attacks from malicious cloud server and outside attackers regarding to storage correctness. So they proposed a scheme in 2011 with an improved security guarantee but it is not efficient. Thus, in this paper, we proposed a scheme which is secure and with better efficiency. It is a public auditing scheme with third party auditor (TPA), who performs data auditing on behalf of user(s). With detail security analysis, our scheme is proved secure in the random oracle model and our performance analysis shows the scheme is efficient.