Cloud Security Using Third Party Auditing and

Encryption Service

Dissertation

Submitted in partial fulfillment of the requirements for the degree

of

Master of Technology, (Computer Engineering)by

Swaroop S. HulawaleMIS No: 121022014

under the guidance ofProfessor : S. U.Ghumbre

DEPARTMENT OF COMPUTER ENGINEERING ANDINFORMATION TECHNOLOGY,

COLLEGE OF ENGINEERING, PUNE-5

June, 2013

DEPARTMENT OF COMPUTER ENGINEERING AND

INFORMATION TECHNOLOGY,

COLLEGE OF ENGINEERING, PUNE

CERTIFICATE

This is to certify that the dissertation titled

Cloud Security Using Third Party Auditing

and Encryption Service

has been successfully completed.

By

Swaroop S. Hulawale

(121022014)

SIGNATURE SIGNATURE

Prof. S U. Ghumbre Dr. J V. Aghav

Project Guide, Head of Dept,

Department of Computer Engineering Department of Computer Engineering

and Information Technology, and Information Technology,

College of Engineering Pune, College of Engineering Pune,

Shivajinagar, Pune - 5 Shivajinagar, Pune - 5.

Abstract

Cloud Computing is evolving and considered next generation architecture for computing.

Typically cloud computing is a combination of computing recourses accessible via inter-

net. Historically the client or organisations store data in data centers with firewall and

other security techniques used to protect data against intrudes to access the data. Since

the data was confined to data centers in limits of organisation, the control over the data

was more and well defined procedures could be used for accessing its own data. However

in cloud computing, since the data is stored anywhere across the globe, the client organ-

isation have less control over the stored data. To built the trust for the growth of cloud

computing the cloud providers must protect the user data from unauthorised access and

disclosure. One technique could be encryting the data on client side before storing it in

cloud storage, however this technique has too much burden from client perspective in

terms of key management, maintainence perspective etc. Other way could be this kind

of security service like computing hash of dat and verifying integrity of data, encryp-

tion/decryption service if provided by same cloud storage provider, the data compromise

cannot be ruled out since same provider has access to both storage and security service.

Divide and rule can be one of the techniques, meaning dividing the responsibilities

amongst different cloud services providers can benefit the client. A trusted 3rd party

cloud provider be used to provide security services, while the other cloud provider would

be data storage provider. The trusted 3rd party security service provider would not store

any data at its end, and its only confined to providing security service. The application

or software will provide data integrity verification by using hashing algorithm like SHA-1,

provide encryption/decryption using symmetric algorithm like AES, and defining band

of people who can access the shared data securely can be achieved by defining access list.

The Software is only responsible for encryption/decryption, comput-

ing/verifying the hash of the data and does not store any data in trusted 3rd party

security system server. The encrypted data along and original data hash are stored in

Separate Cloud (Security Cloud), therefore even if the storage cloud system administrator

has access user data, since the data is encrypted it will be difficult for the system adminis-

trator to understand the encrypted data. While the user downloads the data from Storage

Cloud, it is decrypted first and then new hash is calculated which is then compared with

hash of original data stored in Security Cloud. Finally, this software/application provides

the user with the ability to store the encrypted data in Storage cloud and hash and en-

cryption/decryption keys in security cloud service, and no single cloud service provider

has access to both. Other benefit of delegating responsibility to trusted 3rd party is that

it reliefs the client from any kind of key management or over head is maintainance of any

key information related to data on it device, because of which it allows the client to use

any browser enabled devices to access such service.

Keywords - Cloud computing; Hash service; encryption and decryption service; data

protection and integrity.

Contents

List of Figures iii

1 INTRODUCTION 1

1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

1.2 Problem Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

1.3 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2 Literature Survey 4

2.1 Overview of cloud . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2.1.1 Overview of working of cloud . . . . . . . . . . . . . . . . . . . . 5

2.1.2 Cloud Layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.1.3 Cloud Service Models . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.1.4 Cloud Deployment Models . . . . . . . . . . . . . . . . . . . . . . 7

2.1.5 Security issues in cloud . . . . . . . . . . . . . . . . . . . . . . . . 8

2.1.6 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2.2 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

3 System Design 11

3.1 Business Model with separate encryption/decryption and hashing service. 11

3.2 Typical Scenarios In Design . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.2.1 Data Upload Scenario . . . . . . . . . . . . . . . . . . . . . . . . 12

3.2.2 User Data Download Scenario . . . . . . . . . . . . . . . . . . . . 14

3.2.3 Group User Data Download Scenario . . . . . . . . . . . . . . . . 15

3.3 Algorithm selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.3.1 Selection Of AES . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

3.4 Technologies Used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

i

4 Implementation 20

4.1 Outline of the AES Algorithm . . . . . . . . . . . . . . . . . . . . . . . . 20

4.2 Implementation Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

5 Testing and Result 26

5.1 Testinng Result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.2 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

6 Conclusion and Future work 28

6.1 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

6.2 Future Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

List of Figures

2.1 Cloud Layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3.1 System Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

3.2 Use Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

3.3 User Data Upload Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . 14

3.4 User Data Download Scenario . . . . . . . . . . . . . . . . . . . . . . . . 16

3.5 Group User Data Download Scenario . . . . . . . . . . . . . . . . . . . . 17

4.1 ClientApp Login Form . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

4.2 New User Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

4.3 User Uploads Confidential File . . . . . . . . . . . . . . . . . . . . . . . . 23

4.4 User Adds Accessor To Confidential File . . . . . . . . . . . . . . . . . . 24

4.5 Accessor Viewing Confidential File . . . . . . . . . . . . . . . . . . . . . 25

4.6 Owner Viewing Confidential File . . . . . . . . . . . . . . . . . . . . . . 25

5.1 Sample Input . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

5.2 Encrypted Confidential File Stored In Storage Cloud . . . . . . . . . . . 27

iii

Chapter 1

INTRODUCTION

1.1 Motivation

With evolution of computers the life of people became more and more easily. They where

able to keep there data on there devices, and started finding ways to make them acces-

sible to others, for example say by using floppy, writable disks, which was followed by

portable hard-disk, all these where expensive in there own way during there time. The

data was very much private on personal devices like PC,laptops, mobile phones etc, there-

fore sharing data with others was considered to be expensive. As the world of computing

got more advanced the ways for sharing data started becoming cheaper and cheaper. In

recent years a new term has evolved call ”Cloud” which is provided by different provides,

and which is nothing but facility or service of different resources or components like hard-

ware, platform, storage’s, software etc, and it is gaining importance because it frees the

user from maintenance perspective on a investment of some money for the use of these

services provided by cloud service providers.

Now to provide such service to the client, naturally the provider’s must

have and rather can have access to resources which are used by the people/clients. Among

the reasons these access are greatly required are for maintenance perspective. And defi-

nitely since billions of clients will be thinking about using such service, the infrastructure

ought to be capable enough to support them, and these resources ought to be shared

between billions of client’s. Service availability, data syncronization between different

devices, availability of data via any devices which includes browser facility make cloud

more attractive. Now since the info gets shared or stored in providers area, the client

1

gets worried about privacy of its data, although there are certain agreements and SLA

which are agreed by cloud provider and client. Now although client have a platform to

generally share the info, the expense of securing his/her data or in a nutshell making its

data private gets costlier.

The cloud term is of interest not just to the patient clients but to orga-

nizations as well. With organization as a consumer the concern of data security becomes

multifold. Consider a typical example of small scale business that has different depart-

ments like HR, Finance, etc. We will focus on finance department since finance details

of any business/company/organization is considered to be very sensitive and must be

confidential. Therefore if the little scale company thinks of using the cloud services like

storage. Storing all account/finance related information in cloud stored makes it prone to

leakage of sensitive information tell un-authorized users. Therefore securing this finance

data is vital before it gets uploaded to the storage cloud, and just in case the data stored

in cloud storage gets tampered there should be a method to verify the integrity of the

data, moving futher specific band of people should have access to this data which may be

folks from finance deparment of client company or special auditors. Simply speaking the

client must have the ability to store the data securely, verify the integrity of the data,

share the data securely with specific band of people.

1.2 Problem Definition

The clients concern about data security, data integrity, and sharing data with specific

band of men and women must be addressed. You can find multiple means of achieving

this, example encryting data on client machine and then storing the information to cloud

storage server, computing hash of the information on client machine and storing hash of

data in client machine, client trying out the responsibility of sharing the trick key about

encryption with specific band of people. Therefore it becomes more tedious for client to

keep these information and share such information, more over in the event the device

which stores such information is lost or stolen it pose a threat to the total data. Another

way could be same storage cloud provider providing the service for secured sharing, hash-

ing, encryption/decryption, but since administratives can have use of both services for

maintainance, the security service provided by the cloud storage provider, the informa-

tion might be compromised. The aforementioned approches burdens the client by which

2

makes it additionally accountable for securing it data before storing it to the cloud storage.

1.3 Objectives

Our objective is to build a security service which will be provided with a trusted 3rd

party, and would lead to providing only security services and wouldn’t store any data in

its system. Detailing it further.

1. To construct Web service system which would provide data integrity verification,

provide encryption/decryption of the consumer data.

2. Defining access list for sharing data securely with specific band of individuals.

3. To construct thin client application which would call this web service before upload-

ing/downloading the data to and from cloud.

3

Chapter 2

Literature Survey

The analysis behind this topic could be subdivided into 3 different sub- fields:

1. Study of cloud computing and various cloud computing models IaaS, PaaS, SaaS

etc, study of different business models, and study of service level agreements.

2. Study of security issues in cloud.

3. Study of Cryptography.

2.1 Overview of cloud

Cloud computing describes the combination of logical entities like data, software which

are accessible via internet. Client data is generallly stored in banks of servers spread

across the globe.

Historically, each software like a phrase processor or paint brush required

a license to be installed on clients machine. However with this is of workgroup becoming

more highlighting, the client-server model arrived to existence, which provided large

storing capabilities allowing users to host applications with data for workgroup. The

client machine would demand a browser to get into these server functionality, and would

use client CPU and memory for processing.

Cloud computing will vary from traditional client-server model by provid-

ing applications from the server which are executed and managed by a client’s internet

browser, with no installed client version of a credit card application require. Cloud

providers frees the client from software license management etc, since the services are

accessible via internet. Software as a Service (SaaS), given by cloud company, require

4

browser enabled devices like personal computers, laptops, and latest devices like smart-

phone, tablets etc, to access these services once an individual is registered in cloud. For

instance, in case an individual opts for storage service from the cloud provider, then she

or he can upload personal information, code, music, movies, songs, photographs, which

are stored anywhere across the planet in the server bank under cloud company, the ge-

ographic storage location is generally kept unknown to the user. Since only browser

enabled device are sufficient to access these files, different devices could be kept in sync.

2.1.1 Overview of working of cloud

Generally the cloud services are browser based, therefore any browser enabled

device such as for instance laptop, desktop, smartphone, tablets can used to gain access

to these services, the services at providers end may be hosted on any platform, from

windows, linux, etc, which are accessible via internet. As an example consider a regular

income and expenditure application which gives different analysis on expenditure by a

person, this application could be executing on cloud providers server, whilst the client

browser will allow client to feed in the inputs and visualize the analysis prepared for the

inputs provided, these analysis computation is completed at server side. Suppose this

application can futher create documentation on monthly bases which often can be stored

in cloud storage once again relieving the client from storing or processing the file on its

side. Because the cloud services are offered via internet, a significant factors which play a

important role in performance are speed of internet, processing power of the individual.

While the cloud providers have server banks, to boost the processing power, multi-

ple server are often used internally by the cloud service provides. This pooling is invisible

to the client. On another hand if these heavy tasks were to be executed on client side,

it would require investment in hardware, time. Due to cloud, it frees the client from

buying expensive hardware and investing his/her valuable time, since time is money.

Having studied the overview of working cloud, let’s now understand some of the essential

characteristics

• On-the-fly service

A consumer can require more capabilities at any movement of time, example pro-

cessing power for huge task, and these requirement must of fulfilled without human

5

intervention and be invisible to client [4].

• Wide Accessibility

Generally the cloud service are available via standard network protocols, it promotes

different types of clients platforms (like, smart phones, laptops etc) for accessing

these services [4].

• Pooling Of Resources

The pooling of the resources at cloud providers end is invisible to the end client,

and resource assignment is done dynamically depending the need of the client [4].

• Measured service

Cloud has enough resources, and amount used by each client is measured by metering

capability, and controlled at some level, for optimized resource usage, (like storage)

[4].

2.1.2 Cloud Layers

At high level, cloud computing architecture can be partitioned into

1. Client or front end platform (thin or thick client).

2. Back-end platform (storage server etc).

3. The network (Internet etc)

These client platforms communicate with the cloud data storage via an application

(hosted on middleware), accessible via a browser.

2.1.3 Cloud Service Models

In this section let’s understand different service models of cloud.

• SaaS

Software as a Service (SaaS) also known as “on-demand software”, as it name says

allows client to use software services supplied by cloud provider via web browser.

The management of server, internal cloud network, operating system, application

configuration on middleware are responsibilities of cloud provider. SalesForce is

among SaaS company which supplies different software services.

6

Figure 2.1: Cloud Layers

• PaaS

Platform as a Service (PaaS) as the names suggests, cloud provider provides plat-

form for deployment of user application, but doesn’t give control of underlying

hardware or infrastructure (storage, network).

• IaaS

Infrastructure as a Service (IaaS) wherein limited accessibility for group of infras-

tructure is provided to the client for storage, network, processing etc. The client can

deploy and execute is application using these infrastructure, the key advantage is

frees the client on buys or purchasing top end servers, softwares, data-center space,

network infrastructure etc. The clients are charged on per-use basis [4].

2.1.4 Cloud Deployment Models

In this section we focus our attention to some of the primary cloud models

• Public Cloud

Public cloud is a couple of resources such as for instance storage or application, are

made available to the general public online by the cloud provider. The client is is

billed based on the usage or the service may be free.

• Community Cloud

7

Community cloud share the underlying infrastructure with other organization which

share common interest like security etc. It’s not completely public and the fee is

shared by community members. Neither it is totally public not fully private.

• Private Cloud

Private cloud as it name says, is internal to an organization. It can either be

managed internally or by trusted 3rd party. The cloud is only accessible to internal

organization or say designated employee of the organization.

2.1.5 Security issues in cloud

Every coin has 2 side, and cloud computing is no exception. There is criticism about

privacy in cloud model, because of the fact that administrator have access to data stored

in the cloud. They can unintentionally or intentionally access the client data. Traditional

security or protection techniques need a reconsideration for cloud. Except for private

cloud where organization does not have control over the equipment, the progress of cloud

is seems little slow, because organizations think instead of compromising on the security

of the data, they are still willing to invest in buying private equipment to setup there

own infrastructure. Security issues which are of concern to the client can be classified

into sensitive data access, data segregation, bug exploitation, recovery, accountability,

malicious insiders, account control issues.

Like different disease have different medicines, different cloud security issues have different

solutions, like cryptography, use of more than one cloud provider, strong service level

agreement between client and cloud service provider. Heavy investment is needed to

secure the compromising data in cloud. Cloud can grow only if it is possible to build

a trust in client, and which can be built only if security concerns are being addressed.

Following are some of the concerns,

1. System Complexity

Compared to traditional data center the cloud architecture is much more complex.

Therefore while considering security, security of all these components and interaction

of these components with each other needs to be addressed [13].

2. Shared Multi-tenant Environment

Since the cloud need to provide service to millions of client, a logical separation

of data is done at different level of the application stack [13]. Because of which a

8

attacker in the face off client can exploit the bugs gaining access to data from other

organizations [13].

3. Internet-facing Services

The cloud service which is accessed over the internet via browser, the quality of

service delivered on the network is another concern [13].

4. Loss of control

As the data of client is stored anywhere across the world control loss over physical,

logical of system,and alternative control to clients assets, mis-management of assets

are some additional concerns [13].

2.1.6 Cryptography

Cryptography is a field of computer science & mathematics which deals with information

security and related issues, in particular encryption and authentication. In greek the word

kryptos mean ”hidden” while the word graphein mean ”to write”. During encryption a

plain-text is converted into cipher text, while the reverse process termed as decryption

converts the cipher text into plain-text. The cipher is in unreadable format.

• AES

The Advanced Encryption Standard (AES) is a symmetric key encryption/decryption

algorithm for converting plain-text to cipher text and vice-versa. Since the same

key or master key is used, the must be kept secret or with trusted 3rd party, because

compromise of this key would mean compromise to the data.

• Deffie Hellman

Diffie Hellman key exchange is a technique to exchange cryptographic keys between

2 parties with no prior knowledge of each other. It allows the 2 parties to establish

a secret key which can be used for further secured communication.

• SHA-1

SHA stands for ”Secure Hash Algorithm”, SHA-1 is a cryptographic hash function

technique where hash of data is computed. As compared to SHA-0, SHA-1 is widely

used because it corrects errors in SHA hash specification, which led to weakness.

9

2.2 Summary

The literature survey helped us gain a better insight with reference to cloud computing,

different models of cloud computing, current security issue. Understanding different

encryption/decryption algorithms like AES, SHA-1, Deffie Hellman. During the survey

it is noted that lot of research is going on in cloud computing security issues and how to

overcome the security issues and to gain cloud users confidence.

10

Chapter 3

System Design

In the proposed design, a hash service data integrity verification, encryption/decryption

service, and provision for defining list of people which can access data securely, is provided

by a trusted 3rd party which is separate from the storage cloud provider.

3.1 Business Model with separate encryption/decryption and

hashing service.

The system provides hash, accessl list, encryption/decryption by a trusted 3rd party over

the network in the form of ”Software as a Service” (SaaS)[1]. The system has a separate

storage service which is also provided as a SaaS. The data storage for each client is done

in database in the form of ”BLOB”. The trusted 3rd party which provides these securty

services does not store any data at its ends, and stores only master key for each client for

data encryption and decryption, and hash of the data which is calculated on client side.

To enhance the security, the communication between client and security server is secured

using Diffie Hellmen key, which is used as a input for AES. This division of responsibility

has big effect, as no single provider has access to other data and security key, hash at the

same time.

Figure 3.1. is an overview of the architecture where storage and encryption/decryption/hash

services (security services) are separated. For example (as described in chapter 1, Moti-

vation) a small or medium scale business who wish to store all its account related data in

cloud storage, will first calculate the hash of the data, encrypt the data using encryption

11

Figure 3.1: System Architecture

service and then store the data in storage provided by separate provider. The system also

provides functionality where other users from small scale business Company will be able

to access data which is stored in cloud storage. The sessions between client and security

server is secured using Diffie Hellmen Key and AES as the encryption algorithm. SHA-1

is used for calculating the hash of the data, and AES is used a encryption/decryption

algorithm for computing cipher at security server end. Figure 3.2 show the use case

diagram of the system.

3.2 Typical Scenarios In Design

Typical 3 basic scenarios are, user data upload, user data download, group user access.

In this section we discuss the each of these scenarios.

3.2.1 Data Upload Scenario

1. The end user login to the system with his/her username & password.

12

Figure 3.2: Use Case

2. Once the user is authenticated, the Deffie Hellman key is exchanged for the session.

3. Now a user can select the files which he/she wants to upload it to storage cloud.

4. The user can also select is he/she wants to share the file with specific users.

5. The hash of the data in file is calculated, using SHA-1 ( original hash ).

6. The data in file is now encrypted using DH keys.

7. The complete encrypted file and original hash of file data, are now transferred to

Security Cloud.

8. At Security Cloud, encrypted files is decrypted back using DH key, while the hash

is sorted in security cloud database.

9. The decrypted file is now encrypted with Symmetric Algorithm namely AES, using

the Master Key generated for each user during user creation.

10. File ID, original hash ( file/data hash ), master key for each user are stored in

Security Cloud database.

13

11. The Security Cloud now discards any contents of the files from its system, and does

not store any file contents in its system.

12. The Encrypted file is sent back to user, to be uploaded to Storage Cloud.

13. The user now can upload the encrypted file to Storage Cloud.

Figure 3.3: User Data Upload Scenario

3.2.2 User Data Download Scenario

1. The end user login to the system with his/her username & password.

2. Once the user is authenticated, the Deffie Hellman key is exchanged for the session.

3. Now a user can select the files which he/she wants to download it from storage

cloud.

14

4. The encrypted file is now downloaded from storage cloud to users mach in.

5. The complete encrypted file is now transferred to Security Cloud.

6. The data in file is now encrypted using DH keys.

7. The complete encrypted file and original hash of file data, are now transferred to

Security Cloud.

8. At Security Cloud, decrypted files with Symmetric Algorithm namely AES using

Master Key stored in security cloud database for each user.

9. The decrypted file is now encrypted with DH key.

10. The DH encrypted file and hash of the corresponding file is now passed to the users.

11. At user end, on receiving the encrypted file, it is decrypted with DH keys.

12. The hash of decrypted file is calculated using SHA-1 and original hash are now com-

pared to see if they match, and accordingly appropriate message like, File tampered

or File is intact are flashed on user screen. Thus the integrity of the data is verified.

3.2.3 Group User Data Download Scenario

1. The end user login to the system with his/her username & password.

2. Once the user is authenticated, the Deffie Hellman key is exchanged for the session.

3. Now a user can select the files which are shared by other user.

4. The encrypted file is now downloaded from storage cloud to users machine.

5. The complete encrypted file is now transferred to Security Cloud.

6. At Security Cloud, decrypted files with Symmetric Algorithm namely AES using

Master Key stored in security cloud database for each user.

7. The decrypted file is now encrypted with DH key.

8. The DH encrypted file is now passed to the group users.

9. At user end, on receiving the encrypted file, it is decrypted with DH key.

15

Figure 3.4: User Data Download Scenario

10. The group user can now view the file; & the data integrity is also verified at group

users end.

Since the responsibility is divided between 2 providers, Storage Cloud

provider and Security Cloud provider are different, the Storage Cloud provider although

has access to file/data, it is in encrypted format, and it has no access to any kind of

encryption/decryption keys. Second, as the Security Cloud only stores users master key

and encrypted data hash, and does not store any data/file, therefore it has no use of the

keys. In case the data/file is tampered anywhere it will be caught during the integrity

verification. Third, while the session keys are established during the user login, all the

cascading data transfer is secured. This allows the user to access its data from any

machine, which is one of the definite of cloud services. Thus the user data transferred

16

Figure 3.5: Group User Data Download Scenario

and stored in secured manner in storage cloud. Fourth it is possible to share data with

preferred band of people securely.

3.3 Algorithm selection

In this section we discuss some of the advantages of selection of particular algorithms

over the other. We begin with discussion of AES.

3.3.1 Selection Of AES

Broadly speaking the encryption/decryption can be done via symmetric key or asym-

metric key.In symmetric algorithms, both parties share the secret key for both encryp-

tion/decryption, and from privacy perceptive it is important that this key is not compro-

mised, because cascading data will then be compromised. Symmetric encryption/decryption

require less power for computation. On the other hand asymmetric algorithms use pairs

of keys, of which one key is used for encryption while other key is used for decryption.

17

Generally the private key is kept secret and generally held with the owner of data or

trusted 3rd party for the data, while the public key can be distributed to others for

encryption. The secret key can’t be obtained from the public key. In our case since

the encryption/decryption is performed on trusted 3rd party server, symmetric key is

used, and it delegates the burden of key management to the trusted 3rd party. If key

management where to be done at clients end it would mean,

1. either they have to remember the big key

2. store the key in all devices/machine which will be used to access the cloud services,

which make user device a bottleneck.

3. individual owner has to take the responsibility of sharing the key with specific

authorized group of user which he/she define.

While on the other hand using symmetric key encryption the master key or private key

usage which would be stored in security cloud provider per user gives the client the

advantage like,

1. freedom from remembering any key.

2. Client can use any device/machine to access the data stored in cloud.

3. the client need not worry as to how the data will be shared securely, the client just

need to define the individual whom he/she wants to share the data with.

3.4 Technologies Used

In order to implement a cloud architecture or a Software As A Service (SaaS architecture)

we need

1. WebService – Need to implement a web service.

2. GlassFish Server – to host web service

3. SOAP API – to be able to call web service at client side we need to use SOAP API

or even XML. version 3.2.

4. Java 1.6.

18

5. Operating System Windows 7.

6. MySQL 5.2.

19

Chapter 4

Implementation

In previous sections we have discussed about the system architecture, different scenarios

and algorithms that we will be using to implement them.

4.1 Outline of the AES Algorithm

Constants: int Nb = 4; // but it might change someday

int Nr = 10, 12, or 14; // rounds, for Nk = 4, 6, or 8

Inputs: array in of 4*Nb bytes // input plaintext

array out of 4*Nb bytes // output ciphertext

array w of 4*Nb*(Nr+1) bytes // expanded key

Internal work array: state, 2-dim array of 4*Nb bytes, 4 rows and Nb cols

Algorithm:

void Cipher(byte[ ] in, byte[ ] out, byte[ ] w) {

byte[ ][ ] state = new byte[4][Nb];

state = in; // actual component-wise copy

AddRoundKey(state, w, 0, Nb - 1); // see Section 4 below

for (int round = 1; round ¡ Nr; round++) {

SubBytes(state); // see Section 3 below

ShiftRows(state); // see Section 5 below

MixColumns(state); // see Section 5 below

AddRoundKey(state, w, round*Nb, (round+1)*Nb - 1); // Section 4

} SubBytes(state); // see Section 3 below

ShiftRows(state); // see Section 5 below

20

AddRoundKey(state, w, Nr*Nb, (Nr+1)*Nb - 1); // Section 4

out = state; // component-wise copy

}

4.2 Implementation Details

In this section we discuss some the important implementation details. The overall project

was divided into 2 components, namely, ClientApp,Encryption/Decryption Service, Stor-

age Service

ClientApp

The ClientApp is java web startup application. The Client Login Form is shown in Figure

4.1.

Figure 4.1: ClientApp Login Form

21

Web Start has an advantage over applets in that it overcomes many compatibility prob-

lems with browsers’ Java plugins and different JVM versions. On the other hand, Web

Start programs are no longer part of the web page. They are independent applications

that run in a separate frame For a new user, the client/user has to register, by click on

”Register” in Login Form, and then login with its own user, as shown in Figure 4.2.

Figure 4.2: New User Registration

Let us re-visit the example discussed in chapter 1. The head of the account department

finalizes the ”YDT Summary” report for the small scale business. He/She then wants to

upload the document to cloud storage. The user click’s on ”Upload Data” button, it then

click’s on ”Upload File”, and selects the file to be uploaded from its device/machine. The

user now select if he/she wants to make the file as private which will be only accessible

to itself or it wants to make it shared with others as well, suppose it make its shared and

click’s on ”UPLOAD”, while uploading the file it shows appropriate messages wherever

necessary.

22

Figure 4.3: User Uploads Confidential File

Since the user has select shared, it now needs to define the list of people who will be able

to access the file, for this it click’s on ”Access List” button, followed by ”Add Accessor”

button, and search for the person who will be able to access the data, and click on

”DONE”, Figure 4.4.

This accessor list is defined in accesslist table defined at storage cloud. The accessor

will now be able to view this file securedly. One more advantage is, when the accessor

downloads the file by click on ”View Other’S DATA”, the accessor can see list of all

people and the data shared by these people with him/her, it verifies the integrity of the

data on selection of particular data for view, and can report to the head of department

if the data is tampered, Figure 4.5.

23

Figure 4.4: User Adds Accessor To Confidential File

Other Scenario will be the user want to download or view the data/file, for this he/she

clicks on ”Download Data”, followed by ”FETCH FILE LIST”, and selects the file to be

download it, click’s on ”Save File As”, and finally click’s on ”Download”, Figure 4.6

24

Figure 4.5: Accessor Viewing Confidential File

Figure 4.6: Owner Viewing Confidential File

25

Chapter 5

Testing and Result

Till now we have seen the system architecture, its implementation using AES, SHA-1

Deffie Hellman algorithms. This section gives the results of working model.

5.1 Testing Result

Lets use now take the example of ”Yearly Tax Deduction” Excel File which we provide

as a input to the system.

Figure 5.1: Sample Input

1. The file is exactly stored in encrypted format. The ”userdata” in storage cloud is

26

the table which stores the data for each user, Figure 5.2 shows the encrypted file

which was stored by a user.

Figure 5.2: Encrypted Confidential File Stored In Storage Cloud

2. Secondly, the keys, hash of data are stored in security cloud server in ”userkey”

table,while the hash of corresponding data is stored in ”filehash” table.

5.2 Summary

We have seen how the security service which is provided by trusted third party helps in

securing data, it provides the facility of data verification and allows data to be shared

between designated group of people.

27

Chapter 6

Conclusion and Future work

6.1 Conclusion

We have seen how delegation of responsibility trusted 3rd party which provides security

services secures user data. It reliefs the client from maintaining any kind of key infor-

mation and allowing the client for using any browser enabled device to access the cloud

services. It allows the client to verify the integrity of the data stored on download or

retrieval of its own stored data in cloud. The client can share the data securely with

specific band of people without any overhead of key distribution.

6.2 Future Work

1. To enhance the security more, a mechanism to secure the keys in security cloud can

be a area of research.

2. To reduce the overhead of network traffic can be another area of research.

28

Bibliography

[1] Jing-Jang Hwang, Hung-Kai Chuang,Yi-Chang Hsu, Chien-Hsing Wu, ”A Business

Model for Cloud Computing Based on a Separate Encryption and Decryption Ser-

vice,” Proceedings of the 2011 International Conference on Information Science and

Application, April 2011.

[2] Qian Wang ,Cong Wang ,Kui Ren ,Wenjing Lou ,Jin Li, ”Enabling Public Au-

ditability and Data Dynamics for Storage Security in Cloud Computing”, IEEE

TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 22,

NO. 5, MAY 2011.

[3] Balachandra Reddy Kandukuri, Ramakrishna Paturi V, Dr. Atanu Rakshit, ”Cloud

Security Issues”, IEEE International Conference on Services Computing, pp. 517-

520, September 2009.

[4] Peter Mell, Timothy Grance, ”The NIST Definition of Cloud Computing”, NIST

Special Publication 800-145

[5] Ling Li, Lin Xu, Jing Li, Changchun Zhang,”Study on the Third-party Audit in

Cloud Storage Service”, 2011 International Conference on Cloud and Service Com-

puting

[6] L. M. Vaquero,L. Rodero-Merino,J. Caceres, and M. Lindner, ”A break in the

clouds: towards a cloud definition”, ACM SIGCOMM Computer Communication

Review, vol. 39, no. 1, pp. 50-55, January 2009.

[7] A. Parakh and S. Kak, ”Online data storage using implicit security”, Information

Sciences, vol. 179, issue 19, pp. 3323-3333 ,September 2009.

[8] C. Weinhardt, A. Anandasivam, B. Blau, N. Borissov, T. Meinl, W.Michalk, and

J. Stober, ”Cloud computing ? a classification, business models, and research di-

29

rections”, Business & Information Systems Engineering (BISE), vol. 1, no. 5, pp.

391-399, 2009.

[9] L. Lamport, ”Password authentication with insecure communication”, Communi-

cations of the ACM, vol. 24, no. 11, pp. 770-772, 1981.

[10] ”Announcing the ADVANCED ENCRYPTION STANDARD (AES)”, Federal In-

formation Processing Standards Publication 197. United States National Institute of

Standards and Technology (NIST). November 26, 2001. Retrieved October 2, 2012.

[11] William Stallings, ”Cryptography and Network Security”, 2009.

[12] Salesforce.com, Inc., ”Force.com platform”, Retrieved Dec. 2009, from

http://www.salesforce.com/tw/.

[13] http://www.cs.utsa.edu/ wagner/laws/AESintro.html

30