- Cloud computing has emerged as a new computing paradigm where all IT infrastructure can be outsourced and working as on premise. It offers numerous advantages both for customers and providers and especially at the cost level that is typically low compared to buying your own resources, configuring and managing them. One of the tremendous services is the data sharing and the data storage. Customers can outsource a huge number of data in cloud without having to worry about the capacity of memory or the size of data as cloud system manage the scalability of servers needed to contains your data. Cloud is flexible, scalable and dynamic so don't worry about capacities. But, one of the predominant concerns encountered in cloud and that can change your mind about this nice view, is security. As more and more sensitive data and personal information placed in the cloud, security concerns grow up. Building trust in providers it is not an easy task with an amount of outages and threats declared since adoption of cloud computing. In this paper, we give a new approach to enhance the security of data outsourced in cloud environment. The approach is based on Cipher Policy- Attribute Based Encryption (CP-ABE) scheme. It consists of encrypting data before outsourcing it and controlling the access to it by encryption. Our method offers scalability, flexibility and fine grained access control of data in cloud. Also, it provides an efficient manner to share confidential data on cloud servers.
Over the last decades, computing world has seen considerable changes. The combination of many technologies like virtualization, utility computing, web, clustering, networks and others make the computing environment suitable to create new paradigms to encourage the use of technology and enhance its efficiency. Also, the advent of various internetconnected devices and the high level of internet consumption over the world lead IT experts to wonder: why not open up the world of computing to a wider variety of applications and enjoy its numerous goods and services by giving access through any internet connection. So, we can imagine a delivery of computing as a service rather than as a product. When we use the word computing, it includes the cost of CPU, the memory, the storage, network and other software required to create the ecosystem needed by an IT infrastructure. So they try to bring together several existent technologies to come out with a new complex computing concept called cloud computing. Cloud computing gives the client cost efficiency, unlimited storage, scalability, mobility, accessibility and several other advantages to ensure that the work is done correctly and safely. The mechanism consists of a migration from owned resources to shared resources in which client users receive information technology services, on demand, from third-party service providers via the Internet.
This said, it is true that cloud computing offers potential
benefits but that should not blind cloud consumers to its main
risk and disadvantage which is security and privacy. Moving
sensitive and personal data in public cloud may be a bad deal,
unless having a great trust in all parties interacting in cloud
environment. The entire IT infrastructure is under the control
of the cloud provider. Also, it must not be forgotten that when
this infrastructure is created, it inherits all security concerns
that the distributed systems and virtual resources encounter in
different levels like: data leakage, data remanence, hypervisor
security issues [
Additionally, the centralization of resources and the shared data environment make the cloud provider a very tempting target. Hackers, malicious insiders and malicious tenants can be source of various man-made threats. So, the menace of accessing user’s sensitive information stored in cloud system is very high.
Access control is a fundamental feature of information security, since it consists of granting users authorization to access different resources. Improper or malicious operation can cause very potential damage to an individual or organization. Guarantying good access control mechanism in cloud can have a hugely positive impact on secrecy, integrity and availability of data and then on cloud environment security [2, 3, and 4]. Surely there are many kinds of Access control models and schemes which have demonstrated their effectiveness, but with the particularity of cloud infrastructure, it has become necessary to strengthen earlier models and explore new approaches to meet changes introduced by cloud computing in organizations’ infrastructure.
In this paper we will propose a new cryptographic access control approach for cloud storage. It is based on Ciphertext Policy - Attribute Based Encryption scheme. We propose a new method of applying CP-ABE scheme in cloud architecture with the target of improving security of shared data in cloud area.
The paper is structured as follows: section II introduces many cryptographic access control techniques used to secure data in outsourced servers. Section III presents cloud security needs in term of data sharing and access control and exposes our approach. Finally, Section IV discusses the conclusion and perspectives.
Since cloud storage is full with personal and sensitive data shared by consumers, the higher complex that obsesses cloud users is how to keep data confidential and accord access only to authorized individual or group. Ensuring data confidentiality and a fine grained, scalable and flexible access control system still a preeminent concern in cloud area, what makes researchers looking continuously of new methods to secure data sharing and data access over cloud computing. Confidentiality can be reached by encrypting data before outsourcing it. And to secure access control, there are many encryption schemes for access control that are proposed to access encrypted data in untrusted servers. In this section we will expose some of them that can be helpful to ensure security in cloud.
Starting with traditional public key encryption (PKE) and
why it is in some situations qualified as outdated. Applying
PKE in cloud can be an acceptable manner to strengthen
confidentiality of data but the scalability of cloud and a huge
number of users make this technique impractical. In PKE
process, the data owner needs one public key for each user to
encrypt data what makes handling keys difficult and it impacts
storage computation capacity [6]. Moreover the loss of private
key or its theft can be a big dilemma [
Consequently, researchers shift their attention towards
other techniques like Attribute Based Encryption (ABE).
First researches about attribute-based encryption were
presented by Sahai and Waters in [
What was a wake-up call for researchers to extend it and produce other concepts based on it such as KP-ABE, CP-ABE, HABE, HASBE and MAABE. Here we give a little description of each one of these listed schemes.
The Key-Policy Attribute Based Encryption (KP-ABE)
scheme was proposed in 2006 by Goyal et al based on ABE
[
Ciphertext- Policy Attribute Based Encryption (CP-ABE)
was proposed by Bethencourt et al based on ABE and KP-ABE
[
In 2011, Wang et al. proposed a hierarchical
attributebased encryption scheme composed of a hierarchical
identitybased encryption scheme (HIBE) and a ciphertext-policy
attribute-based encryption scheme [
Zhiguo Wan et al proposed HASBE scheme in [
Multi-authority ABE system was proposed by Chase. It consists of many attributes authorities and many users [13]. There are also a set of system wide public parameters available to everyone (either created by a trusted party, or by a distributed protocol between the authorities). A user can choose to go to an attribute authority, prove that it is entitled to some of the attributes handled by that authority, and request the corresponding decryption keys. The authority will run the attribute key generation algorithm, and return the result to the user. Any party can also choose to encrypt a message, in which case he uses the public parameters together with an attribute set of his choice to form the ciphertext. Any user who has decryption keys corresponding to an appropriate attribute set can use them for decryption.
III. PROPOSED APPROACH
In cloud computing, there are many different issues related to the security of data. When we outsource our data to untrusted servers managed by a third party, it is very recommended to encrypt it before, and having a control to who can access to it. The existing systems don’t usually provide an efficient mode of security that can resist against possible attack of clouds like collusion attack, DDOS attack and others that can lead our data to be stolen or lost. Furthermore, designing a useful and effective manner of securing the data shared in cloud is based on applying a number of instructions that suit with the cloud distinction. We try here to give some of them that we will take in consideration in our system architecture. Then we give the scenario of our model.
The data owner should to encrypt its data before outsourcing it and identifying who can access the ciphertext.
This instruction can be realized by incorporating CP-ABE in our model. The owner will create the ciphertext by combining data, public key and the access control structure where he defines the correspondent user. 2. Separate the entity distributing keys from the cloud provider.
The owner must choose a third party entity (authority) to manage the publication of security keys that is different from the cloud provider. It is recommended to be sure that there are no communication between cloud provider and the authority who manage keys.
number of users increases. 5. The system should manage the user accountability.
the access accorded to him must be denied.
Our model consists of applying the CP-ABE scheme in cloud computing by introducing a third party that manages keys distribution independently from the cloud provider.
As represented in figure 3, the data owner first asks the authority to generate the master key and the public key by which he will encrypt its data. Then he encrypts data using the public key combined with the access policy that he wants to put on data to specify who can access it and so who can decrypt it. After that he sends encrypted data to cloud for storing it. When a user asks for data, he receives encrypted one. To decrypt it he must send its access attributes to the third party, which generates a private key according to the master key of data and the user’s attributes and sends it to user. If private key contains access attributes that matches the access policy incorporated in cipher data then data will be decrypted. Otherwise, user can’t see it and the operation fails.
On this paper we present a new approach to enhance security when sharing data over cloud computing that consists of using Ciphertext Policy Attribute Based Encryption scheme to ensure fine grained and flexible access control system. We give the architecture of our model with the aim to design it and construct a specific security model based on mathematical modules in future. Our model represents an extension of the use of CP-ABE scheme in cloud storage. In our future work we tend to detail more our architecture, construct a more expressive security scheme and try to handle many CP-ABE limits like user revocation and full delegation with the purpose to provide an efficient encryption scheme designed to cloud environment.