A survey on security issues and solutions at different layers of Cloud computing <s> Data storage level security issues <s> A significant barrier to the adoption of cloud services is that users fear data leakage and loss of privacy if their sensitive data is processed in the cloud. In this paper, we describe a client-based privacy manager that helps reduce this risk, and that provides additional privacy-related benefits. We assess its usage within a variety of cloud computing scenarios. We have built a proof-of-concept demo that shows how privacy may be protected via reducing the amount of sensitive information sent to the cloud. <s> BIB001 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Data storage level security issues <s> Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. While cloud computing is expanding rapidly and used by many individuals and organizations internationally, data protection issues in the cloud have not been carefully addressed at current stage. In the cloud, users' data is usually processed remotely in unknown machines that users do not own or operate. Hence, users' fear of confidential data (particularly financial and health data) leakage and loss of privacy in the cloud becomes a significant barrier to the wide adoption of cloud services. To allay users' concerns of their data privacy, in this paper, we propose a novel data protection framework which addresses challenges during the life cycle of a cloud service. The framework consists of three key components: policy ranking, policy integration and policy enforcement. For each component, we present various models and analyze their properties. Our goal is to provide a new vision toward addressing the issues of the data protection in the cloud rather than detailed techniques of each component. To this extent, the paper includes a discussion of a set of general guidelines for evaluating systems designed based on such a framework. <s> BIB002 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Data storage level security issues <s> Cloud computing is a new computing paradigm in which dynamically scalable resources are provided as a service over the Internet. One central concern in cloud computing is the privacy and integrity of data processed at the cloud. In this paper, we propose blind processing service using trusted computing mechanisms to provide improved privacy and integrity to potential users. Utilizing blind communication and execution services, a user exchanges his/her sensitive information with a cloud system via isolated processes whose execution environment and data is shielded from the rest of the system after ensuring the system has correct hardware, trusted computing base, correct credentials, and trustworthy state. <s> BIB003 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Data storage level security issues <s> The main target of this paper is to propose an algorithm to implement data hiding in DNA sequences to increase the confidentiality and complexity by using software point of view in cloud computing environments. By utilizing some interesting features of DNA sequences, the implementation of a data hiding is applied in cloud. The algorithm which has been proposed here is based on binary coding and complementary pair rules. Therefore, DNA reference sequence is chosen and a secret data M is hidden into it as well. As result of applying some steps, M´´´ is come out to upload to cloud environments. The process of identifying and extracting the original data M, hidden in DNA reference sequence begins once clients decide to use data. Furthermore, security issues are demonstrated to inspect the complexity of the algorithm. <s> BIB004 </s> A survey on security issues and solutions at different layers of Cloud computing <s> Data storage level security issues <s> Cloud computing promises to significantly change the way we use computers and access and store our personal and business information. With these new computing and communications paradigms arise new data security challenges. Existing data protection mechanisms such as encryption have failed in preventing data theft attacks, especially those perpetrated by an insider to the cloud provider. We propose a different approach for securing data in the cloud using offensive decoy technology. We monitor data access in the cloud and detect abnormal data access patterns. When unauthorized access is suspected and then verified using challenge questions, we launch a disinformation attack by returning large amounts of decoy information to the attacker. This protects against the misuse of the user's real data. Experiments conducted in a local file setting provide evidence that this approach may provide unprecedented levels of user data security in a Cloud environment. <s> BIB005
The following aspects of data security are still open challenges: data-in-transit, dataat-rest, data lineage, data remanence, data provenance, data recovery, data location, data breaches, and investigative support. In case of data-in-transit, adversary in network affects the confidentiality and integrity of data. The biggest risks for data-in-transit include poor encryption technology and network protocols. Simply going for an encryption technology does not serve the purpose. Data at rest (stored in Cloud storage) needs physical, logical, and personnel access control policies. Some examples related to Cloud failures on data security are: Data center of Hosting.com at New Jersey went down for few hours due to software bug in a Cisco switch  (June 2010). Amazon's EC2 and RDS services have experienced an outage for 4 days (April 2011). Amazon reported that its Elastic Block Store (EBS) volumes are trapped, which affected the EC2 instances trying to use affected volumes  . Data at rest (stored in Cloud storage) is generally commingled with other users' data. Even after using techniques to prevent unauthorized access, data at rest can be compromised through exploitation of application vulnerabilities. The main problem with data-at-rest in the cloud is loss of control, if a non-authorized user accesses the data in a shared environment. Storage devices with in-built encryption techniques failed to prevent unauthorized access since the encryption and decryption keys can be compromised by a malicious user. A lockbox approach, wherein the actual keys are stored in a lockbox and there is a separate key to access that lockbox can be used in the above mentioned case. However, again there is a need for security of a lockbox key. This poses key management challenges. Tracing the data path is known as data lineage and it is important for auditing purposes in the cloud. It is a challenging task to provide data lineage. Since the data flow is no longer linear in a virtualized environment within the Cloud, it complicates the process of mapping the data flow to ensure integrity of the data. Due to the shared environment, maintaining the integrity of data is the most challenging task in the Cloud. Data-Remanence refers to the data left out in case of data transfer or data removal. It causes minimal security threats viz; disclosure of sensitive information, data sold to others, etc. Data recovery is one of the most challenging problems. Data can be lost due to accidental damage or natural disaster to storage. It poses a risk to data availability for users. Data location. Tracing location of data is difficult in the Cloud since user's data are dynamically migrated from one region (or country) to another region (or country). It increases risk of data privacy and security since data owner loses the control over his/her data. Data breaches and investigative support: It is difficult to investigate inappropriate or illegal activity, because logging and data for multiple customers are co-located and may also be spread across an ever-changing set of hosts and data centers. Lin et al. BIB002 proposed a data protection framework that is composed of three modules named policy ranking, policy integration, and policy enforcement. Policy ranking module is used to find satisfying users' privacy policy requirements. For a policy ranking module, there are three models recommended: (i) User-oriented ranking model; (ii) Service-provider-oriented ranking model; and (iii) Broker based ranking model. After finding the best service provider, the proposed centralized model (for policy integration module) creates policies to be agreed by involving parties. Finally, the policy enforcement module (uses either tight coupling or loose coupling) examines whether the confidentiality of data and policies are guaranteed at any time and at any location or not. Mowbray et al. BIB001 proposed a client based privacy manager, incorporated features like obfuscation, preference settings, data access, feedback, and personae. Obfuscation is used to modify some data fields of database before sending it to Cloud for processing. So, an attacker using the same application would be unable to reveal those data. Only owners of those data can de-obfuscate those data. Using preference settings, set of policy can be incorporated for those data. Policies and data are shared with sender and receiver using cryptographic techniques. Data access will allow users to access personal information for checking accuracy or any violation of privacy. Feedback module monitors personal data transferring from the platform and manages feedback including usage of personal data in the Cloud. Personae module offers a choice for revealing or not revealing different data fields. Data privacy is fully dependent on data owner. Naruchitparames et al. BIB003 proposed a blind processing service using the trusted computing mechanism to provide improved privacy and integrity for the user's data. Blind processing is used to create a secure channel between dedicated processes that are concealed from the rest of the system including root processes, system administrators, and end-users. This approach provides several layers of abstraction in which a remote system is ensured to have the correct hardware, a trusted computing base, correct credentials, and a trustworthy state. However, it requires more hardware for processing. Practical analysis of this approach is not reported. Abbasy et al. BIB004 proposed an approach that hides sensitive data using DNA reference sequences. In this approach, first data are converted from binary to DNA Nucleotide sequences for encrypting the data. Then complementary rules on encrypted data are applied. After that index of each couple of Nucleotides in DNA reference sequence are found. These sequences contain encrypted data. For decrypting these data, the same procedure is followed in a bottom-up manner. This approach provides security and privacy of user's data in the resource sharing environment. However, if the DNA sequence is altered or modified, it is difficult to retrieve original data. Stolfo et al. BIB005 proposed an approach that uses user behavior and decoy information to mitigate insider data theft. In this approach, data access patterns are monitored by profiling the user behavior. Decoy documents that are stored in the Cloud along with the user's real data act as sensors to detect illegitimate access. When unauthorized access is found, it is verified using challenge questions.