A survey on security issues and solutions at different layers of Cloud computing <s> Encryption and key management algorithms <s> In several distributed systems a user should only be able to access data if a user posses a certain set of credentials or attributes. Currently, the only method for enforcing such policies is to employ a trusted server to store the data and mediate access control. However, if any server storing the data is compromised, then the confidentiality of the data will be compromised. In this paper we present a system for realizing complex access control on encrypted data that we call ciphertext-policy attribute-based encryption. By using our techniques encrypted data can be kept confidential even if the storage server is untrusted; moreover, our methods are secure against collusion attacks. Previous attribute-based encryption systems used attributes to describe the encrypted data and built policies into user's keys; while in our system attributes are used to describe a user's credentials, and a party encrypting data determines a policy for who can decrypt. Thus, our methods are conceptually closer to traditional access control methods such as role-based access control (RBAC). In addition, we provide an implementation of our system and give performance measurements. <s> BIB001 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Encryption and key management algorithms <s> Providing secure and efficient access to large scale outsourced data is an important component of cloud computing. In this paper, we propose a mechanism to solve this problem in owner-write-users-read applications. We propose to encrypt every data block with a different key so that flexible cryptography-based access control can be achieved. Through the adoption of key derivation methods, the owner needs to maintain only a few secrets. Analysis shows that the key derivation procedure using hash functions will introduce very limited computation overhead. We propose to use over-encryption and/or lazy revocation to prevent revoked users from getting access to updated data blocks. We design mechanisms to handle both updates to outsourced data and changes in user access rights. We investigate the overhead and safety of the proposed approach, and study mechanisms to improve data access efficiency. <s> BIB002 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Encryption and key management algorithms <s> Data security and access control is one of the most challenging ongoing research work in cloud computing, because of users outsourcing their sensitive data to cloud providers. Existing solutions that use pure cryptographic techniques to mitigate these security and access control problems suffer from heavy computational overhead on the data owner as well as the cloud service provider for key distribution and management. This paper addresses this challenging open problem using capability based access control technique that ensures only valid users will access the outsourced data. This work also proposes a modified Diffie-Hellman key exchange protocol between cloud service provider and the user for secretly sharing a symmetric key for secure data access that alleviates the problem of key distribution and management at cloud service provider. The simulation run and analysis shows that the proposed approach is highly efficient and secure under existing security models. <s> BIB003
An unknown physical location of data in the Cloud and different laws enforced by nations to manage data make encryption and key management complex. If encryption is applied, it needs to be performed at multiple locations, within the data center, in between the data centers, or between public and private Clouds, etc. There is a strong need of improved solutions involving the users for controlling the use of their data. In BIB002 , the authors propose the use of the symmetric key encryption mechanism for data security in Cloud framework. In BIB003 , the authors propose the use of Public Key Infrastructure for the Cloud framework. However, these approaches do not provide an efficient solution for key management due to its complexity. An identity based approach has to overcome the key management limitation. However, there is a need for more robust approaches in this context, which could extend traditional approaches like Cipher text Policy Attribute based encryption (CPABE) BIB001 , Key Policy Attribute based encryption (KPABE), etc. to Cloud computing.