Cryptographic Cloud Storage with Hadoop Implementation

Cloud storage enables users to remotely store their data and benefit of the demand high quality cloud applications without the difficulty of local hardware and software management. Though the benefits are clear, such a service is also reliable to the users’ physical possession of their outsourced data, which inevitably poses new security risks towards the recovery of the data in cloud. In order to address this new problem and further achieve a secure and useful cloud storage service, we propose in this study a flexible distributed storage integrity mechanism, utilizing the homomorphic token and distributed data. The proposed design allows users to check the cloud storage with very lightweight communication and computation cost. The auditing result not only ensures strong cloud storage correctness guarantee, efficiency, but also simultaneously to access data error localization, i.e., the identification of misbehaving server. Considering the cloud data are dynamic in nature, the proposed design future supports secure and efficient dynamic operations on outsourced data, including block modification, update, deletion and append. The proposed scheme is highly efficient and secure against Byzantine failure, malicious data modification attack and even server colluding attacks.

The rapid adoption of cloud computing has transformed the way data is stored, shared, and accessed across organizationsand individuals. Despite its scalability and cost efficiency, cloud storage introduces serious security and privacy challenges, particularly when sensitive data is outsourced to third-party cloud service providers. Traditional access control mechanisms often rely on the cloud provider’s trustworthiness, which may expose data to unauthorized access, insider threats, and data breaches. To address these concerns, CryptCloud+ is proposed as a secure and expressive data access control framework that enforces fine-grained authorization directly through cryptographic techniques. CryptCloud+ focuses on ensuring data confidentiality while enabling flexible and policy-driven access control over encrypted cloud data. The system leverages encryption-based access control, where data is encrypted before being uploaded to the cloud, and only authorized users possessing valid cryptographic credentials can decrypt and access the data. This approach eliminates the need to trust the cloud service provider, as all sensitive operations related to data access are handled at the client side. A key contribution of CryptCloud+ is its support for expressive access policies, allowing data owners to define complex rules based on user attributes such as roles, departments, access levels, or time constraints. These policies enable fine grained access control without requiring data owners to manage individual permissions manually. The framework ensures that users can access only the data they are authorized for, while unauthorized users, including cloud administrators, are unable to infer any meaningful information from the encrypted data. The proposed system is implemented using Python, taking advantage of its robust cryptographic libraries, simplicity, and integration capabilities. Python-based modules handle key generation, encryption, decryption, and policy enforcement, making the system modular and easy to extend. The implementation demonstrates how secure key management and attribute-based access enforcement can be achieved efficiently in a real-world cloud environment. CryptCloud+ also addresses scalability and performance concerns by minimizing computation overhead during data access. Encryption and decryption operations are optimized to ensure that system performance remains practical even as the number of users and data files increases. Experimental results indicate that the framework maintains strong security guarantees while providing acceptable response times for authorized users. In addition to security, the system enhances usability by allowing seamless data sharing among multiple users without re encrypting data for each individual. This significantly reduces management complexity for data owners while preserving strict access control policies. The system design ensures compatibility with existing cloud storage services, making itadaptable to various deployment scenarios. Overall, CryptCloud+ presents a secure, flexible, and effiient solution for cloud data access control. By combining cryptographic enforcement with expressive policy definition and Python-based implementation, the frameworkstrengthens data security, protects user privacy, and improves trust in cloud storage systems. The proposed model demonstrates the feasibility of practical, cryptography-driven access control for modern cloud environments.

With the wide adoption of cloud computing paradigm, it is important to develop appropriate techniques to protect client data privacy in the cloud. Encryption is one of the major techniques that could be used to achieve this goal. However, data encryption at the rest alone is insufficient for secure cloud computation environments. There is also the need for efficient techniques to carry out computation over encrypted data. Fully homomorphic encryption (FHE) and garbled circuits are naturally used to process encrypted data without leaking any information about the data. However, existing FHE schemes are inefficient for processing large amount of data in cloud and garbled circuits are one time programs and cannot be reused. Based on quaternion/octonion algebra and Jordan algebra over finite rings \(\mathbb {Z}_q\), this paper designs efficient fully homomorphic symmetric key encryption (FHE) schemes without bootstrapping (that is, noise-free FHE schemes) that are secure in the weak ciphertext-only security model assuming the hardness of solving multivariate quadratic equation systems and solving univariate high degree polynomial equation systems in \(\mathbb {Z}_q\). The FHE scheme designed in this paper is sufficient for privacy preserving computation in cloud.

Homomorphic encryption (HE) schemes enable computing functions on encrypted data, by means of a public Eval procedure that can be applied to ciphertexts. But the evaluated ciphertexts so generated may differ from freshly encrypted ones. This brings up the question of whether one can keep computing on evaluated ciphertexts. An i-hop homomorphic encryption scheme is one where Eval can be called on its own output up to i times, while still being able to decrypt the result. A multi-hop homomorphic encryption is a scheme which is i-hop for all i. In this work we study i-hop and multi-hop schemes in conjunction with the properties of function-privacy (i.e., Eval's output hides the function) and compactness (i.e., the output of Eval is short). We provide formal definitions and describe several constructions. First, we observe that bootstrapping techniques can be used to convert any (1-hop) homomorphic encryption scheme into an i-hop scheme for any i, and the result inherits the function-privacy and/or compactness of the underlying scheme. However, if the underlying scheme is not compact (such as schemes derived from Yao circuits) then the complexity of the resulting i-hop scheme can be as high as nO(i). We then describe a specific DDH-based multi-hop homomorphic encryption scheme that does not suffer from this exponential blowup. Although not compact, this scheme has complexity linear in the size of the composed function, independently of the number of hops. The main technical ingredient in this solution is a re-randomizable variant of the Yao circuits. Namely, given a garbled circuit, anyone can re-garble it in such a way that even the party that generated the original garbled circuit cannot recognize it. This construction may be of independent interest.

Message-Locked Encryption (MLE) is a useful tool to enable deduplication over encrypted data in cloud storage. It can significantly improve the cloud service quality by eliminating redundancy to save storage resources, and hence user cost, and also providing defense against different types of attacks, such as duplicate faking attack and brute-force attack. A typical MLE scheme only focuses on deduplication. On the other hand, supporting search operations on stored content is another essential requirement for cloud storage. In this article, we present a message-locked searchable encryption (MLSE) scheme in a dual-server setting, which achieves simultaneously the desirable features of supporting deduplication and enabling users to perform search operations over encrypted data. In addition, it supports both multi-keyword and negative keyword searches. We formulate the security notions of MLSE and prove our scheme satisfies all the security requirements. Moreover, we provide an interesting extension of our construction to support Proof of Storage (PoS). Compared with the existing solutions, MLSE achieves better functionalities and efficiency, and hence enables more versatile and efficient cloud storage service.

As the demand for data sharing and complex access-control policies continues to grow, traditional encryption mechanisms, which are generally established using a Public Key Infrastructure, face the problem of massive processing overheads and huge network bandwidth consumption. Attribute-Based Encryption (ABE) schemes have been proposed as a potential means of addressing these issues and have attracted great attention in recent years. Most previous studies on ABE focus on issues such as the revocation mechanism, multi-authority, the access structure design, and traceability. However, very few studies consider the storage efficiency problem and the present study proposes a novel data deduplication scheme based on ciphertext-policy ABE with convergent encryption and block-level data. The scheme can be deployed in third-party semi-trusted environments, and not only provides flexible, fine-grained access control over encrypted data, but also allows for the in-line elimination of redundancies in order to save cloud storage space. The experimental results show that the proposed scheme has an acceptable computational overhead and provides a promising solution for real-world data cloud storage and access scenarios.

An encryption scheme is homomorphic if it supports operations on encrypted data. Homomorphic encryption allows a device to perform arbitrary computations on encrypted data without user secret key. Recently it is introduced new homomorphic encryption schemes with improved performance that can be implemented in IoT device in production environments. The IoT concept encompasses devices, sensors, and services existing within an interconnected infrastructure with an efficient access to sample computational facilities. In this paper we evaluated features of exact arithmetic homomorphic encryption mechanisms: BFV and BGV and approximate homomorphic encryption scheme: CKKS. In the paper we measured performances of operations of homomorphic encryption schemes: BGV, BFV and CKKS that are implemented in Raspberry Pi 4 IoT device.

Cryptographic cloud storage (CCS) is a secure architecture built in the upper layer of a public cloud infrastructure. In the CCS system, a user can define and manage the access control of the data by himself without the help of cloud storage service provider. The ciphertext-policy attribute-based encryption (CP-ABE) is considered as the critical technology to implement such access control. However, there still exists a large security obstacle to the implementation of CP-ABE in CCS. That is, how to identify the malicious cloud user who illegally shares his private keys with others or applies his keys to construct a decryption device/black-box, and provides the decryption service. Although several CP-ABE schemes with black-box traceability have been proposed to address the problem, most of them are not practical in CCS systems, due to the absence of scalability and expensive computation cost, especially the cost of tracing. Thus, we present a new black-box traceable CP-ABE scheme that is scalable and high efficient. To achieve a much better performance, our work is designed on the prime order bilinear groups that results in a great improvement in the efficiency of group operations, and the cost of tracing is reduced greatly to O ( N ) or O ( 1 ) , where N is the number of users of a system. Furthermore, our scheme is proved secure in a selective standard model. To the best of our knowledge, this work is the first such practical and provably secure CP-ABE scheme for CCS, which is black-box traceable.

Cloud storage provides the great convenience for people to access their data at anytime from any place. Since cloud storage is usually run by the third-party service provider, keyword search over cloud data with privacy protection is of great importance. Many studies in the literature have proposed keyword search scheme for document search, but, in most schemes, the query keywords must exactly match those in the document indexes. However, it is impractical to restrict query keywords provided by the user when performing the search. This paper proposes the scheme for semantic multi-keyword search over encrypted cloud data. Users are able to select query keywords on their own choice. In addition, the query privacy of the user and the security of the documents are protected simultaneously through encrypted document search to prevent snooping from the cloud service provider. Experiments are conducted using a dataset of massive real world papers. The results show that the proposed scheme can effectively perform the semantic multi-keyword search over encrypted cloud data with great efficiency.

The Snowden incident illustrates that an adversary may launch an algorithm substitution attack (ASA) by tampering with the algorithms of protocol participants to obtain users' secret information. A measure against ASA is to equip the protocol participants with cryptographic reverse firewalls (CRF). Public key encryption with keyword search (PEKS) as a cryptographic primitive allows users to search encrypted file in cloud servers while ensuring the security of the original file. The existing CRF constructions for PEKS does not consider the trust level of CRFs, leaving honest-but-curious CRF to deal with trapdoors that should be sent in the secure channels, which brings new security risks. This paper firstly introduces the notion of malleable designated tester public key encryption with keyword search (M-DPEKS). Based on M-DPEKS, we propose the generic construction of public key encryption with keyword search with cryptographic reverse firewalls to overcome the privacy leakage issue in cloud storage. Security proof indicates the generic construction is secure against ASA. Lastly, we instantiate the generic construction with a concrete M-DPEKS scheme and analyze the computation cost and communication overhead to evaluate the efficiency.

Cryptography algorithms play a vital role in Information Security and Management. To test the credibility, reliability of metadata exchanged between the sender and the recipient party of IoT applications different algorithms must be used. The hashing is also used for Electronic Signatures and based on how hard it is to hack them; various algorithms have different safety protocols. SHA-1, SHA-2, SHA3, MD4, and MD5, etc. are still the most accepted hash protocols. This article suggests the relevance of hash functions and the comparative study of different cryptographic techniques using blockchain technology. Cloud storage is amongst the most daunting issues, guaranteeing the confidentiality of encrypted data on virtual computers. Several protection challenges exist in the cloud, including encryption, integrity, and secrecy. Different encryption strategies are seeking to solve these problems of data protection to an immense degree. This article will focus on the comparative analysis of the SHA family and MD5 based on the speed of operation, its security concerns, and the need of using the Secure Hash Algorithm.

In trusted public cloud, allowing data consumers to recover the information with full integrity. The most of research efforts were focused on a single data owner for safe cloud-based encryption of encrypted data. Additionally, searchable encryption makes it possible for a data user to locate a specific encrypted document from a cloud of encrypted data by searching for keywords (KS). This study isn't useful for retrieving relevant results from keyword searches. Such issues may be overcome using the secure and privacy-preserving keyword search retrieval (SPKSR) technology, which allows users to recover hashed encrypted files from cloud data that is also hashed encrypted. Three distinct entities are included in the proposed system: (a) cloud server (CS), (b) data owner (DO), and (c) data users (DU). It is the CS that generates a searchable index tree for the owner’s hashed encrypted files. The CS keeps the index tree structure and the hashed encrypted document set in its own storage. The encrypted data is hashed and DU executes the “search” over it. Analyses and comparisons of the experimental findings of the suggested system with the other existing system demonstrate its superiority.KeywordsCloud serverCloud computingData usersData ownerIndex treeKeyword‐based searchHashed encrypted document

Updatable encryption (UE) plays an important role in mitigating the impact of key compromise on ciphertext in the scenario of cloud storage. Nevertheless, most of the existing UE schemes focus on making symmetric encryption updatable. In this paper, to give play to advantages of symmetric and asymmetric encryption, we present an updatable hybrid encryption (UHE) scheme. By setting the REACT transform as the underlying encryption scheme and using the indistinguishable obfuscation to convert the private key into a public key encryption program, the synchronous update of public/private key pair and ciphertext can be realized. More importantly, the generation and update of private key are stored locally in hybrid encryption, the update token is not used to derive the private key, and thus the no-directional key update can be achieved. Furthermore, considering for the adversarial attack behaviors, we build a reasonable security model. Finally, since the decryption ability of the punctured keys is limited at the punctured points, the adversary can be allowed to access to all oracles at the full epochs, and then under the proposed security framework the confidentiality of the proposed scheme can be proven based on the indistinguishability between pseudorandom functions, where the confidentiality can capture forward and post-compromise security.KeywordsUpdatable encryptionHybrid encryptiont-puncturable pseudorandom functionForward securityPost-compromise security

Efficient personalized search over encrypted data for mobile edge-assisted cloud storage

As cloud computing becomes prevalent, more and more data owners are likely to outsource their data to a cloud server. However, to ensure privacy, the data should be encrypted before outsourcing. Symmetric searchable encryption allows users to retrieve keyword over encrypted data without decrypting the data. Many existing schemes that are based on symmetric searchable encryption only support single keyword search, conjunctive keywords search, multiple keywords search, or single phrase search. However, some schemes, i.e., static schemes, only search one phrase in a query request. In this paper, we propose a multi-phrase ranked search over encrypted cloud data, which also supports dynamic update operations, such as adding or deleting files. We used an inverted index to record the locations of keywords and to judge whether the phrase appears. This index can search for keywords efficiently. In order to rank the results and protect the privacy of relevance score, the relevance score evaluation model is used in searching process on client-side. Also, the special construction of the index makes the scheme dynamic. The data owner can update the cloud data at very little cost. Security analyses and extensive experiments were conducted to demonstrate the safety and efficiency of the proposed scheme.