Keywords

1 Introduction

Cloud storage mainly maintains user’s data on an off-site cloud storage system that is maintained by third-party CSP. Nowadays, owner prefers to store their data on cloud due to facilities provided by cloud vendors instead of storing data on users’ system hard disk or other memory devices at their own premises. After storing the owner data on a remote database, it will be accessible later through just an internet link between user and cloud databases. In cloud model, customers are associated with cloud through an internet link to access cloud information and resources are priced and provided, on-demand. Mainly, cloud resources are shared among multiple users as office, apartments or storage places as shared among tenants. The cloud facilities are primarily delivered through an internet link, thus the cloud user is free from the worry of maintaining own data center or servers (as shown in Fig. 1). Nowadays, mostly adopted cloud computing services are offered and maintained by big IT giants Amazon and Google for the startup companies.

Fig. 1
figure 1

The cloud

Full size image

There are mainly three components of cloud computing model as listed below.

Cloud service provider (CSP)—The third-party vendor which manages all the cloud services, i.e., infrastructure, platform, and the software’s offered to cloud users with his technical team. He is completely responsible for providing safe and uninterrupted services to the cloud users.

Client/Owner: An entity, which is generally, an individual or startup organizations, who want to store their large data files either at own premises or in the cloud.

User: An entity enrolled with the data owner and access owners’ cloud data after proper authentication from CSP.

Since data is one of the crucial outsourced entity in cloud computing, thus it may suffer from various threats or attacks by exploring the vulnerabilities present in the outsourcing cloud module. The attackers can be an Insider (CSP or CSP employee itself) or Outsider (some mischievous hacker) who desires to access the owner data, which can be utilized for some gain thereafter.

As the data is one of the most critical assets for any company or data owner, thus, whatever sort of threats to the security and integrity of data can lead to horrific consequences for organizations. So as discussed, cloud data security is the main hurdle in adopting cloud services for most of the organizations. If the data security, integrity issues will be properly addressed and audited, more data owners, and organizations will switch to cloud storage. One more issue which is to properly address is, resource sharing, such as storage, with other cloud users and CSP (Cloud Service Provider). Thus, if the rival cloud users are sharing the same cloud storage space from same CSP, then their data may be under threat from each other. Thus, it is also the CSP responsibility to isolate one users’ data from some other.

The proposed hybrid model comprises of different well-known cryptographic techniques and applying them together to achieve cloud data protection. The paper’s propose a hybrid algorithm comprising of three different encryption techniques which efficiently protect the three categories of data throughout the data life cycle, i.e., from the owner to the cloud and then to the end cloud user. As the cloud is combinations of dissimilar resources placed together to offer the services, and so a bunch of vulnerabilities may exist in cloud setup, whose exploration may be horrific for the cloud data storage. The proposed hybrid algorithm uses encryption as a primary security policy. Encoding is the technique for alteration of plain text data in an encrypted form called cipher text that can be deciphered and read by the legitimate person having a valid decryption key only. The illegitimate or mischievous person cannot easily decrypt and interpret the ciphertext in the absence of the decryption key.

This rest of the paper is designed as follows: Sect. 2 highlights the various authors’ related work regarding cloud data protection in the last years. In Sect. 3, effective hybrid model is designed to address and solve cloud data storage security issue effectively. Section 4 provides the proposed algorithm. Section 5 provides the security investigation of the proposed hybrid model against various identified attacks so far. Section 6 provides the conclusion and future scope of this paper.

2 Related Work

We have gone through some research papers to identify security issues with existing cloud data storage models and the presented solutions so far. Among them, few research efforts are handled directly with the topics of security and privacy-aware data stored in cloud computing.

The Cloud Security Alliance (CSA) [1] and Louai et al. [2] has risen seven security threats to cloud data storage, those are, exploitation of cloud Computing, vulnerable Application Programming Interfaces (APIs), malicious entity insider, shared technology security issues, information leakage, account or service accessing by an illegitimate user, etc.

Louai et al. [2], Singh et al. [3] and Yu et al. [4] has identified many issues, loopholes and attacks to data’s security, integrity, and confidentially over the cloud data storage. The attacks studied include Denial of Service (DOS) attack, cloud malware injection attack, side channel attacks due to shared infrastructure, authentication attack, and man-in-the-middle attack. Yu et al. [4] have concluded that data integrity can be ascertained by the simply SSL protocol during transmission.

Karthik et al. [5] have suggested a new hybrid algorithm using some well-known cryptographic algorithms in a definite array, to enhance and optimize cloud data protection.

Li et al. [6] have presented a hybrid encryption algorithm contains a simple encryption algorithm, which improved to the Vigenere encryption algorithm; and finally, came out with a hybrid encryption algorithm with a Base64 encoding algorithm. The proposed hybrid encryption algorithm significantly improved the data protection.

Tweney et al. [7] have mentioned an incident, back in 2007, from the end of CSP Salesforce.com which sent a letter to all its millions of subscribers demonstrating about how the customer emails, addresses, and rest particulars had been stolen by cybercriminals.

Tang et al. [8], Rong et al. [9], Grobauer et al. [10], Waleed et al. [11], Lin [12] have highlighted the vulnerability of the data security in the cloud, one of the important factors restricting the growth of cloud computing and reviewed the threats to security and privacy of cloud data warehousing.

Divya et al. [13] have proposed a secure cloud storage algorithm using elliptic curve cryptography. The proposed work also concentrates on Online Alert methodology which shows the data owner when an aggressor attempts to alter the data or any malpractice happens during data forwarding.

Kumar et al. [14] have researched elliptic curve cryptography (ECC) encryption technique in particular used for protecting cloud data files which authenticate the legitimate user and refuse the data accessing by mischievous hacker or cloud storage provider.

Fu et al. [15] have focused on safe data deletion on the file systems. The report proposed a file system which supports secure deletion of data. This paper proposed the idea of secret code text-policy trait-based encryption technique (CP-ABE) which supports fine-grained access policy to encrypt files.

Tan et al. [16] have proposed a cloud data security algorithm using fully homomorphic encryption to ensure data protection during both during transmission and storage. The full homomorphic encryption algorithm can process the encrypted data as well.

Sinha et al. [17] has compared the functioning of two asymmetric key encryption algorithm between RSA and ECC experimentally; and concluded that ECC performs better in many respects required key sizes, bandwidth saving, encryption time, small device’s efficiency, as well as security as compared to RSA algorithm.

Abdul et al. [18], Pavithra et al. [19] have implemented six most used symmetric key encryption algorithms: DES, 3DES, AES (Rijndael), Blowfish, RC2, and RC6 and comparison was conducted based on several parameters. The report concluded that the AES algorithm is competitive with the rest of algorithm on being fast and flexible.

Marshall et al. [20] have designed a hybrid encryption model by using RSA and AES algorithms to ensure cloud data protection. Since the private key is exclusively in user hold and therefore the user’s most sensitive will not be useful to anyone except the legitimate user not even the CSP.

Tripathi et al. [21] have given a comparative work between two well-known asymmetric encryption algorithms between elliptic curve cryptography and the RSA cryptography algorithm in respect of the cloud data security parameter. The paper flared up with experimental results which prove the superiority of elliptic curve-based public key cryptography compared to RSA public key cryptography.

Mohamed et al. [22] have suggested Amazon EC2 cloud users, to must use an AES symmetric algorithm which ensures the highest security with minimum time to code.

Dinadayalan1 et al. [23] have proposed all the principal data security issues and their solutions.

3 Proposed Model

The main focus of this algorithm is to maximize the data owner’s control of data during transit as well as storing. Since more locks, we will apply the more time it will take to fetch the data back. So it would be better to categorize the data first. Since all data is not of the same importance, so we can categorize the data initially on the basis of their sensitivity and importance. To achieve the above-defined objective, the data is split into three different protection layers for each privacy categorized data that has different privacy aspects according to the need of sensitive data. For this, a Three-Tier Privacy-Aware Cloud Computing Model is proposed for the three categories of the data described as below

  • No Privacy (NP)

  • Privacy with Trusted Provider (PTP)

  • Privacy with non-trusted provider (PNTP)

There are no encryption and decryption used for the storage and accessing of No Privacy (NP) category data, whereas in Privacy with trusted provider (PTP) security scheme the CSP is responsible and trusted to maintain the data security. CSP uses the AES encryption and decryption technique which automatically generate the public key which is known to everyone. Now in the third case, i.e., Privacy with non-trusted provider (PNTP) for the most sensitive data to work upon, a security scheme is proposed. In this security scheme, both data owners (user) and CSP are responsible to ensure cloud data protection. User encrypts the information using AES algorithm before sending to CSP, then CSP again uses the ECC encryption and decryption technique for complete data protection. In this paper, we have described a security scheme for PNTP module only.

The proposed hybrid algorithm comprises of different coding techniques such as AES (Symmetric Cryptography technique), SHA-1 (Hashing technique), and ECC (Elliptic curve Cryptography, Asymmetric Cryptography technique) for the categorized sensitive data.

The proposed hybrid algorithm is designed to offer complete data security to the data throughout the data life cycle, such as to data in transit, data in storage, etc. To reach this level of assurance, multiple combinations of the encryption techniques are taken to protect vital and sensitive data from mischievous users. The proposed algorithm is categorized into five phases. The data owner who wants to store data in the cloud is first registered with CSP in the first phase of the algorithm. The data is categorized on the basis of its sensitivity and stored in cloud storage in the second phase. The user who wants to recover the data from cloud undergoes the authentication process in the third phase. The auditors at CSP can verify the data integrity of cloud data in the fourth phase. It is required for SLA assurance and archived information. After passing valid authentication process, the user is allowed to retrieve the cloud data and verify the integrity of the fetched data, to provide proper feedback to the CSP about fetching data in the fifth phase.

3.1 Phase 1 (Registration of Data Owner to CSP)

Foremost of all, the user who wants to get the services of cloud storage, will have to register with the cloud service provider. The user requires to enter his particulars, valid username, password, and mobile number. The particulars and username are stored as such at CSP end. But the password is concatenated by the SALT, which increases password security by concatenating a random string to the password entered by the registered users. After Salting password is hashed using SHA–1 hashing technique and output hash code (512 bits) will be sent to the CSP. The concatenation of the SALT will prevent the dictionary attacks, SQL injection attacks and hash code of the salted password will prevent the CSP or unauthorized individual to steal user credentials from cloud storage (as shown in Fig. 2) .

Fig. 2
figure 2

Registration of cloud user to cloud service provider

Full size image

After verifying user’s credentials and password, the CSP generates an OTP and send it to the user registered mobile number supplied during the registration procedure. The user is supposed to enter sent OTP to the CSP for completing the certification process; CSP matches it with the OTP generated and thus verify the mobile number if matched else refuse the registration procedure.

3.2 Phase 2 (Storing of Data in Cloud Storage)

After successfully completing the registration process, the data is categorized on the basis of its importance and sensitivity. The data are transmitted to the CSP through various steps in a data storing process described in subsections from 3.2.1 to 3.2.4 which provide a stepwise description of all activities done on the data (as shown in Fig. 3).

Fig. 3
figure 3

Storing of data in cloud storage

Full size image

3.2.1 Encryption at Cloud User (Owner) End

As soon as the user is registered with CSP, he is allowed to store the data in cloud storage. Only instead of sending plain text of PNTP category data directly to CSP, it is first encrypted with a symmetric encryption algorithm AES (advanced encryption algorithm) to avoid the man-in-the-middle attack, insider job attack, etc. The single key generated by AES algorithm is kept in the data owner’s database for the future decryption. Thus, the plain text is first encrypted into cipher text 1, for storage to the CSP. The AES algorithm is secure enough in the today scenario because there is no known attack on the AES algorithm till date.

3.2.2 Hash Key Generation at Cloud User’s End

The data integrity assurance is another required feature of the proposed algorithm. Thus to ensure user’s data integrity, a hash code is generated at the user’s end using a SHA-1 hashing algorithm. The hash code generated is kept up at the user’s end database for integrity verification later on. The SHA-1 algorithm is a unidirectional cryptographic technique, which gets a hash code which will be changed even after a minor change in the data and then it will be used to verify the integrity of the information. Then the user will be ascertained that neither CSP nor any unauthorized individual has altered the data stored in cloud storage.

3.2.3 Encryption at CSP End

On receiving the cipher text 1 from the user, the CSP applies another very strong asymmetric key cryptographic technique ECC (Elliptic Curve cryptography). In this cryptographic asymmetric algorithm, a pair of public and private key is generated.

The received cipher text 1 is again encrypted with the generated public key and the paired private key is sent back to the legitimate user by encrypting it with the AES encryption algorithm through initially shared a key which is maintained by the user in its database in a secured way. That’s how the data can be only unlocked by the authenticated user with the appropriate private key.

Since the information stored is encrypted two times back to back with strong algorithms which eliminate the loopholes of the past researchers’ proposals. The double encryption is must since the data are always vulnerable to the unethical CSPs.

3.2.4 Hash Key Generation at CSP End

To maintain the integrity of the user’s data, the CSP also generates a hash code at the CSP end using a SHA-1 hashing algorithm and maintain it in its database. Thus, it can be used later during routine auditing at the CSP end by matching the generated hash code. Then that user will be ascertained that neither CSP nor any unauthorized individual has altered the data in cloud storage stored for a long time.

3.3 Phase 3 (User Authentication on Data Retrieval Request)

This phase deal with the user authentication process for data retrieval from cloud storage. The user enters his login ID and password to CSP who in turn verify the entered credentials. After verifying the user credentials and password, the CSP generates an OTP, and send it to the user registered mobile number supplied during the enrollment procedure. The user is supposed to enter sent OTP to the CSP for completing the certification process; CSP matches it with the OTP generated, and thus verify the mobile number if matched else refuse the data recovery requests (as indicated in Fig. 4).

Fig. 4
figure 4

User’s authentication on data retrieval request

Full size image

3.4 Phase 4 (Auditing at Cloud End)

This phase is mainly concerned with the auditing at the CSP end. Since the information stored by the user may not be required of him for a long time, so that to avoid the tempering of the data, one hash code of cipher text 2 is also maintained at the CSP end by SHA–1 hash algorithm. So that during regular auditing the CSP end, the tempering of the data can be distinguished and the proper message will be given to cloud user or data owner. This phase also ensures the SLA (service level agreement) between user and CSP.

3.5 Phase 5 (Retrieval of Data and Integrity Verification)

In this phase, the authenticated user retrieves, convert to plain text, and verify the integrity of data. As shortly as the user is authenticated, he is permitted to access the cloud storage and brings in the required data present in cipher text 2 forms and carries it to its own premises to convert plain text mode (as indicated in Fig. 5).

Fig. 5
figure 5

Retrieval of data and integrity verification

Full size image

This phase is further categorized into three Sects. 3.5.1 to 3.5.3 providing stepwise actions performed on data. Since all these steps performed on user’s premises, then there will be no security breaches.

3.5.1 Private Key Decryption

First, the cipher text 2 is decrypted with the private key generated by ECC algorithm and stored in the user database to convert the retrieved data in cipher text 1 form.

3.5.2 Public Key Decryption

Second, the received cipher text 1 is further decrypted with the public key of the AES algorithm stored in the user database to change the data from cipher text 1 form in plain text configuration.

3.5.3 Hash Code Verification

To verify the integrity of the retrieved data, the user again generates a hash code for the transformed plain text using the SHA-1 algorithm. The generated hash key will be compared with the hash value stored in the database at owner end. If matches the integrity of the information is verified else the problem is reported to be CSP which can result into and legal process against CSP. That’s how the user will be ascertained that neither CSP nor any unauthorized individual has altered the data stored in cloud storage.

4 Algorithm

5 Security Analysis of Proposed Model

Designed and implemented algorithm is secure enough against most of the identified attacks, so that the data owner or organizations can store their data to the cloud storage with no worries at all. The proposed hybrid solution can prevent all these attacks described as:

5.1 Brute Force Attack

This attack is mainly concerned about using every possible combination of the key to crack the actual key.

In the proposed algorithm, the introduction of the AES encryption algorithm will fail this attack because only the cracking of AES—256 require about 2255 combination, which is not feasible in real time even by using fastest super computer available in today’s scenario.

5.2 Authentication Attacks

This attack is mainly concerned about using the credentials of the authorized user to log into his cloud account.

In the proposed algorithm the introduction of the OTP (one-time password) will fail this attack because only the user with credentials and registered mobile number can access the cloud account.

5.3 Dictionary Attacks

This attack is mainly concerned about using all the possible dictionary words to crack the password of the authorized user to log into his cloud account.

In the proposed algorithm the introduction of the saltiest, the concatenation of an arbitrary string in the user password secures it from being error-prone to a dictionary attack.

5.4 Man-in-the-Middle Attack

This attack is mainly concerned about being a forged authenticated user for the data retrieval from cloud storage.

In the proposed algorithm even if an unauthorized user will be able to retrieve the data from cloud storage, it will be in the form of cipher text 2, which will be of no use in the absence of the private key and public key stored within the authorized user’s secure premises.

5.5 Cloud Malware Injection

This attack is mainly concerned with introduction of a suspicious malware in the cloud itself so that cloud data can be retrieved from cloud storage without the permission of cloud user and CSP.

In the proposed algorithm even if an unauthorized user will be able to retrieve the data from cloud storage, it will be in the form of cipher text 2, which will be of no use in the absence of the private key and public key stored within the authorized user’s secure premises.

5.6 Side Channel Attack

Since the data from various users share same cloud storage in an isolated environment. This attack is mainly concerned of intentional crossing the boundaries of the own cloud storage to penetrate into some other cloud storage.

In the proposed algorithm even if an unauthorized user will be able to retrieve the data from side cloud storage, it will be in the form of cipher text 2, which will be of no use in the absence of the private key and public key stored within the authorized user’s secure premises.

5.7 Inside-Job Attack

Since the data is stored in cloud storage in cloud owner control. This attack is mainly concerned of intentional stealing the user’s information by CSPs itself for some more profit making purpose.

In the proposed algorithm even if CSP will steal the data from cloud storage, it will be in the form of at least cipher text 1, which will be of no use in the absence of the public key stored within the authorized user’s secure premises.

5.8 SQL Injection Attack

This attack is one of the many web attack mechanisms used by hackers to steal data from organizations by using simple SQL commands.

In the proposed algorithm, salting to the password and adding hashing to the salt as well as the OTP concept makes SQL injection attack nearly impossible.

So the proposed algorithm is enough to secure to handle all the main concerned of a cloud user. So the cloud user now can submit its data to the cloud storage with no issues.

6 Conclusion and Future Scope

As discussed earlier, a lot of the startup organizations are adopting cloud eagerly due to huge cloud facilities with minimal investment. Apart from it, cloud data security is one of the main concerns of the organizations, before adopting cloud.

This paper designed and implemented a new hybrid algorithm for securing cloud data using three different security policies for three different types of sensitive data to maximize control of data owner on storing, processing and accessing on it. The proposed hybrid algorithm is found to be highly secure for all types of sensitive data cloud environment.

In future, the algorithm can be tested against the various security attacks practically, the concept can be checked for efficiency and work can be extended to minimize the required time for all processing, even the concept can be combined with biometric traits those can be used for generating keys for encryption and decryption processes to gain an edge in the field of cloud storage.