Cryptcloud+: Secure and Expressive Data Access Control for Cloud Storage

PurposeThe purpose of this paper Computing is a recent emerging cloud model that affords clients limitless facilities, lowers the rate of customer storing and computation and progresses the ease of use, leading to a surge in the number of enterprises and individuals storing data in the cloud. Cloud services are used by various organizations (education, medical and commercial) to store their data. In the health-care industry, for example, patient medical data is outsourced to a cloud server. Instead of relying onmedical service providers, clients can access theirmedical data over the cloud.Design/methodology/approachThis section explains the proposed cloud-based health-care system for secure data storage and access control called hash-based ciphertext policy attribute-based encryption with signature (hCP-ABES). It provides access control with finer granularity, security, authentication and user confidentiality of medical data. It enhances ciphertext-policy attribute-based encryption (CP-ABE) with hashing, encryption and signature. The proposed architecture includes protection mechanisms to guarantee that health-care and medical information can be securely exchanged between health systems via the cloud. Figure 2 depicts the proposed work's architectural design.FindingsFor health-care-related applications, safe contact with common documents hosted on a cloud server is becoming increasingly important. However, there are numerous constraints to designing an effective and safe data access method, including cloud server performance, a high number of data users and various security requirements. This work adds hashing and signature to the classic CP-ABE technique. It protects the confidentiality of health-care data while also allowing for fine-grained access control. According to an analysis of security needs, this work fulfills the privacy and integrity of health information using federated learning.Originality/valueThe Internet of Things (IoT) technology and smart diagnostic implants have enhanced health-care systems by allowing for remote access and screening of patients’ health issues at any time and from any location. Medical IoT devices monitor patients’ health status and combine this information into medical records, which are then transferred to the cloud and viewed by health providers for decision-making. However, when it comes to information transfer, the security and secrecy of electronic health records become a major concern. This work offers effective data storage and access control for a smart healthcare system to protect confidentiality. CP-ABE ensures data confidentiality and also allows control on data access at a finer level. Furthermore, it allows owners to set up a dynamic patients health data sharing policy under the cloud layer. hCP-ABES proposed fine-grained data access, security, authentication and user privacy of medical data. This paper enhances CP-ABE with hashing, encryption and signature. The proposed method has been evaluated, and the results signify that the proposed hCP-ABES is feasible compared to other access control schemes using federated learning.

Modern technological advances have given rise to the popularity and success of cloud in organizations and industries because it provides data storage facility and computing services at minimal cost. Data security is one of the important requirements for outsourced data in a cloud storage environment. It also brings new security vulnerabilities for assuring the data confidentiality, data integrity and data access control. Data security of a cloud system depends heavily on the cloud service provider, data owner and cloud users. So, there needs to be some methodology to monitor security vulnerabilities and providing data security in cloud environment. Now a day’s providing data security in cloud storage is one of the most critical tasks. For the past few years many works have been done to assure data security but they are failed in providing data security such as information leakage, secret-key management, cloud-user authentication, breach of data confidentiality, because of collusion attack and lots of computational activities (because of large number of secret keys).In this paper, we used threshold cryptography technique for providing data security in cloud storage system. Proposed approach addresses the data security issues in cloud system more efficiently. In this Threshold cryptography technique data owner create users in groups based on place or location, project, and department, data owner allocates single secret key to each group of users for decryption of data and every users in the group shares parts or pieces of the secret key. Proposed methodology also uses data access control list to control the data access. Proposed approach provides data security more efficiently, it also increases the performance of the system and also it minimizes the number of secret keys.

Cloud storage provides the great convenience for people to access their data at anytime from any place. Since cloud storage is usually run by the third-party service provider, keyword search over cloud data with privacy protection is of great importance. Many studies in the literature have proposed keyword search scheme for document search, but, in most schemes, the query keywords must exactly match those in the document indexes. However, it is impractical to restrict query keywords provided by the user when performing the search. This paper proposes the scheme for semantic multi-keyword search over encrypted cloud data. Users are able to select query keywords on their own choice. In addition, the query privacy of the user and the security of the documents are protected simultaneously through encrypted document search to prevent snooping from the cloud service provider. Experiments are conducted using a dataset of massive real world papers. The results show that the proposed scheme can effectively perform the semantic multi-keyword search over encrypted cloud data with great efficiency.

DNA similarity search has proven to be an essential demand in human genomic researches. Since DNA sequences contain many sensitive personal information, the acquisition and dissemination of DNA data have been tightly controlled and restricted by authorities. Although the problem of private DNA similarity query has been an active research issue, the latest research findings are still inadequate in terms of security, functionality and efficiency. In this paper, we propose an Efficient DNA Similarity Search scheme (EDSS) which can achieve fine-grained query and data access control over encrypted cloud data. Our original contributions are fourfold. First, we creatively put forward a private edit distance approximation algorithm to realize the efficient and high accurate DNA similarity query. Second, we classify the whole DNA sequences and design a multiple genes search strategy to achieve complicated logic query such as mixed “AND” and “NO” operations on genes. Third, the proposed scheme can also efficiently support data access control by employing a novel polynomial based design. Finally, security analysis and extensive experiments demonstrate the high security and efficiency of EDSS compared with existing schemes.

The cloud is the most suitable platform for storing and processing of data. Users are outsourcing data to the cloud to reduce the storage and maintenance cost locally. However, there are challenges to both cloud users as well as to the cloud service provider. The challenge for cloud service providers is to optimize the associated cost for the management and maintenance of uploaded data. The challenge for users is data privacy. To address these issues, encrypted data deduplication schemes proposed, but existing schemes suffer from security weakness and do not support data access control. In this paper, we propose an efficient ciphertext policy attribute-based encryption scheme for deduplication over encrypted data (ECP-ABE) in the cloud storage. Our scheme achieves privacy,deduplication along with access controls. The security and performance analysis demonstrates that our scheme is secure and efficient.

Data privacy and data availability remain the major concern in centralized cloud storage, which could be handled effectively through the concept of decentralized data storage. However, the secrecy of data sharing is a rising concern in the decentralized data storage for which the effective access control and data sharing scheme, hash and session key-dependent attribute-based encryption (HS-ABE) is proposed in this research. Accordingly, the multi-level access control and sharing strategy authenticates the genuine requestors and assures access to the requestors upon the authentication of their attribute sets. In this perspective of access control and secure data sharing, Ethereum blockchain, decentralized Interplanetary File System (IPFS), HS-ABE are organized. The data owners (DOs) provide the secret attribute set for the requestors ensuring fine-grained access over the data. The performance of the developed HS-ABE scheme is investigated and compared with the conventional strategies, where the memory usage of the proposed scheme is 5812 Kbps, which proclaims a well-defined secure access control and authentication in the Blockchain-based cloud storage.

As the demand for data sharing and complex access-control policies continues to grow, traditional encryption mechanisms, which are generally established using a Public Key Infrastructure, face the problem of massive processing overheads and huge network bandwidth consumption. Attribute-Based Encryption (ABE) schemes have been proposed as a potential means of addressing these issues and have attracted great attention in recent years. Most previous studies on ABE focus on issues such as the revocation mechanism, multi-authority, the access structure design, and traceability. However, very few studies consider the storage efficiency problem and the present study proposes a novel data deduplication scheme based on ciphertext-policy ABE with convergent encryption and block-level data. The scheme can be deployed in third-party semi-trusted environments, and not only provides flexible, fine-grained access control over encrypted data, but also allows for the in-line elimination of redundancies in order to save cloud storage space. The experimental results show that the proposed scheme has an acceptable computational overhead and provides a promising solution for real-world data cloud storage and access scenarios.

Cloud Service Providers (CSPs) allow data owners to migrate their data to resource-rich and powerful cloud servers and provide access to this data by individual users. Some of this data may be highly sensitive and important and CSPs cannot always be trusted to provide secure access. It is also important for end users to protect their identities against malicious authorities and providers, when they access services and data. Attribute-Based Encryption (ABE) is an end-to-end public key encryption mechanism, which provides secure and reliable fine-grained access control over encrypted data using defined policies and constraints. Since, in ABE, users are identified by their attributes and not by their identities, collecting and analyzing attributes may reveal their identities and violate their anonymity. Towards this end, we define a new anonymity model in the context of ABE. We analyze several existing anonymous ABE schemes and identify their vulnerabilities in user authorization and user anonymity protection. Subsequently, we propose a Privacy-Preserving Access Control Scheme (PACS), which supports multi-authority, anonymizes user identity, and is immune against users collusion attacks, authorities collusion attacks and chosen plaintext attacks. We also propose an extension of PACS, called Statistical Privacy-Preserving Access Control Scheme (SPACS), which supports statistical anonymity even if malicious authorities and providers statistically analyze the attributes. Lastly, we show that the efficiency of our scheme is comparable to other existing schemes. Our analysis show that SPACS can successfully protect against Collision Attacks and Chosen Plaintext Attacks.

Social networking and growing popularity of cloud services have made everyone to communicate each other in an easiest way. File sharing and distribution are the frequently used services provided by cloud service providers, although these facilities reduce cost of data sharing but at the same time data security and access control is the major problem. Many renowned service providers have faced the challenges to secure data and provide better access control, and we know once the data is leaked we cannot recover the data loss. Thus in order to ensure better security we need for focus on the two major problems, and those are access control and encryption policy. Cipher text policy attribute based encryption is the most effective solution for access control in real time scenarios where owner can actually decide the access rights for the end-user, but it comes with key escrow problem. We are proposing our modified escrow-free key issuing protocol to solve the problem of key escrow and our Modified Attribute Based Encryption scheme to achieve all security requirements to get a robust and secure system. Further we evaluate our model on the basis of results and lastly we conclude the paper.

Data access control is an effective way to ensure the data security in the cloud. Due to data outsourcing and untrusted cloud servers, the data access control becomes a challenging issue in cloud storage systems. Ciphertext-Policy Attribute-based Encryption (CP-ABE) is regarded as one of the most suitable technologies for data access control in cloud storage, because it gives data owners more direct control on access policies. However, it is difficult to directly apply existing CP-ABE schemes to data access control for cloud storage systems because of the attribute revocation problem. In this paper, we design an expressive, efficient and revocable data access control scheme for multi-authority cloud storage systems, where there are multiple authorities co-exist and each authority is able to issue attributes independently. Specifically, we propose a revocable multi-authority CP-ABE scheme, and apply it as the underlying techniques to design the data access control scheme. Our attribute revocation method can efficiently achieve both forward security and backward security. The analysis and simulation results show that our proposed data access control scheme is secure in the random oracle model and is more efficient than previous works.

Attribute-based data access control in mobile cloud computing: Taxonomy and open issues

Hierarchical attribute-based encryption and scalable user revocation for sharing data in cloud servers

WSN-integrated cloud computing (WCC) has become a promising cloud service architecture, in which sensors and mobile devices are utilized as the data collecting and processing nodes for the cloud service model, while cloud servers can provide computing services and storage services with high performance and reliability. However, since cloud servers are not fully trusted, and sensors and mobile devices have very limited computing capability and storage capacity, WCC brings forth new challenges for data confidentiality, data integrity and access control when sensors store important data for sharing in the WCC environment. Moreover, there are still no proper solutions for fine-grained, efficient and secure data access control in WCC. To solve this issue, we propose a fine-grained and lightweight data access control scheme for WCC, namely FLAC, which includes a ciphertext-policy attribute-based encryption algorithm for data confidentiality and fine-grained data access control, and an attribute-based signature algorithm for data integrity and the many-read-many-write case of data access. By delegating most computation intensive tasks to cloud services, FLAC enables resource constrained sensors and mobile devices to perform security operations rapidly. The security assessment and performance evaluation demonstrate that FLAC is secure, highly efficient and well suited for WSN applications.

SummaryThe block chain is the emerging domain that offers the features like shared, immutable, and decentralized dataset that saves the asset's history. Security and storage are the most challenging aspect. The classical techniques' issues and challenges are an encouragement for developing a fresh block chain‐assisted IPFS model with access control policies. Hence, this research paper introduces an effective access control and authentication based on an interplanetary file system (IPFS)‐based block chain and access control system for attaining secured transactions. The developed method comprises five entities, that is smart contract, data owner, data requester, block chain and IPFS along with eight phases, to be exact setup, user registration, initialization, storage and data encryption, authentication, testing, access control, and decryption phase, to provide better access control and storage capacity. The proposed IPFS‐based block chain and access control system offered effective storage and secure transactions in the block chain network. The highest detection rate (0.870), lowest communication overhead (0.766 MB), and highest privacy rate (0.719) are all achieved by the proposed IPFS‐based block chain and access control system.

In a Decentralized Identifier (DID), the Holder does not depend on a third party but controls self-identity information and is authenticated by the Verifier. Therefore, the Verifier can request verification data for access control from the Verifiable Data Registry (VDR) and credentials to authenticate the Holder. Data access control should be used when requesting data access such that only authorized Verifiers can access it. Consequently, studies on secure and efficient data access control have been conducted, and among them a scheme using Ciphertext Policy Attribute-based Encryption (CP-ABE) is underway. However, when the CP-ABE scheme is applied to the DID, the Holder’s extended Self-Sovereign Identity (SSI), which proves that the Holder has approved access to the Holder’s data stored in the VDR, is not ensured. Furthermore, the VDR does not verify the Verifier’s data access rights, resulting in unauthorized verification and illegal access to data by the user. And issue infringement of the Holder’s privacy, where Verifiers can infer the Holder by sharing and connecting the same DID-based Verifiable Presentations (VPs) of the Holder. Also, it leads to overheads in the amount of computation and search time for encryption/decryption. Therefore, in this paper, we propose a data access control for secure authentication by solving the security vulnerabilities of CP-ABE and using a CP-ABE-based dual Verifiable Credential (VC) scheme in DID.