A Survey on Data Confidentiality and Privacy in Cloud Computing <s> RESEARCH GAPS AND FUGURE RESEARCH AVENUES <s> Cloud computing has emerged over the last years as a new model of delivering computation to consumers. Due to the nature of the cloud, where the data and the computation are beyond the control of the user, data privacy and security becomes a vital factor in this new paradigm. Several research studies reported that security and privacy is cited as the biggest concern in adopting cloud computing. In this paper, we present HPISecure, a software prototype designed to facilitate the process of securing data stored on the cloud. HPISecure allows the user to store an encrypted version of his data on the cloud without breaking the functionality of the application. HPISecure intercepts the HTTP request/response objects, encrypt data before transmitting to the cloud, and decrypt data received back from the server. We have successfully tested HPISecure with Google Docs and Google Calender. Future work includes extending HPISecure to work with enterprise applications. <s> BIB001 </s> A Survey on Data Confidentiality and Privacy in Cloud Computing <s> RESEARCH GAPS AND FUGURE RESEARCH AVENUES <s> The ability to enforce robust and dynamic access controls on cloud-hosted data while simultaneously ensuring confidentiality with respect to the cloud itself is a clear goal for many users and organizations. To this end, there has been much cryptographic research proposing the use of (hierarchical) identity-based encryption, attribute-based encryption, predicate encryption, functional encryption, and related technologies to perform robust and private access control on untrusted cloud providers. However, the vast majority of this work studies static models in which the access control policies being enforced do not change over time. This is contrary to the needs of most practical applications, which leverage dynamic data and/or policies. In this paper, we show that the cryptographic enforcement of dynamic access controls on untrusted platforms incurs computational costs that are likely prohibitive in practice. Specifically, we develop lightweight constructions for enforcing role-based access controls (i.e., RBAC0) over cloud-hosted files using identity-based and traditional public-key cryptography. This is done under a threat model as close as possible to the one assumed in the cryptographic literature. We prove the correctness of these constructions, and leverage real-world RBAC datasets and recent techniques developed by the access control community to experimentally analyze, via simulation, their associated computational costs. This analysis shows that supporting revocation, file updates, and other state change functionality is likely to incur prohibitive overheads in even minimally-dynamic, realistic scenarios. We identify a number of bottlenecks in such systems, and fruitful areas for future work that will lead to more natural and efficient constructions for the cryptographic enforcement of dynamic access controls. Our findings naturally extend to the use of more expressive cryptographic primitives (e.g., HIBE or ABE) and richer access control models (e.g., RBAC1 or ABAC). <s> BIB002
Two of the serious limitations of the solutions discussed in the paper are restricting users to a certain machine with special software and the availability of a removable hardware token to access their data on the Cloud. These restrictions are due the inclusion of the new software or configurations on the client side. Such restrictions contradict with the concept of availability and interoperability of Cloud systems, i.e., a user can access the data anywhere from any device. A software prototype is presented by Saleh and Meinel BIB001 , which facilitates secure data storage on the Cloud without interfering with the Cloud operation. The application intercepts communications, encrypts data before transmission to the Cloud and decrypts data when downloaded. The vast majority of the data confidentiality solutions in the Cloud provide static data storage policies and do not discuss the revocation or modification of these policies. To overcome this problem in the existing systems, when downloading original data, decrypting it, new policies are enforced for encryption before data is uploaded again. However, this is a costly process, especially for the large data sizes. Garrison et al. BIB002 described this issue, conducted in-depth analyses, and provided the evidence that the cryptographic techniques for securing data by static policies enforcement are likely to bring excessive costs in existing systems. Future work is required to accommodate the above mentioned issues, in order to provide a comprehensive solution without requiring major modifications to existing Cloud facilities.