A Survey of Cloud Storage Security Research. Mar Kheng Kok Nanyang Polytechnic

Transcription

1 A Survey of Cloud Storage Security Research Mar Kheng Kok Nanyang Polytechnic

2 Presentation Outline Security concerns of cloud storage Data confidentiality in the cloud Data availability/integrity in the cloud

3 A New Computing Paradigm? Emergence of Cloud Computing Utility + On-demand computing models Pay-per per-use, lower IT cost, elasticity Worldwide IT spending on cloud services will grow almost threefold by 2013 (IDC 2010) Top 5 Software companies (by sales revenue) all have major cloud offerings

4 Security Concerns Main hurdle of adoption is information security concern CIOs cite security and loss of control as their major concerns Information theft both from outside and inside the cloud Despite SLA and security policies Only less sensitive data are put in the cloud

5 Security Concerns Are these concerns new? Remember the term outsourcing? Essentially old problems in new settings Maybe more acute more global and distributed regulatory and governance implications

6 Cloud Security Incidents Google Doc sharing problem (Mar 2009)

7 Cloud Security Incidents Amazon S3 Down Several Hours Feb 2008 and again in Jul 2008

8 Cloud Security Incidents Loss of customer data by online storage company The Linkup Source: Network World Inc.

9 Cloud Service/Deployment Model Cloud Service/Deployment Model Private Software as a Service (SaaS) Hybrid Public Platform as a Service (PaaS) Service Model Service Model Deployment Deployment Model Model Infrastructure as a Service (IaaS)

10 Cloud Storage - Confidentiality Simple solution to confidentiality concern Encryption Encryption of data is possible in IaaS E.g. Amazon S3, or Azure Storage Service How about PaaS or SaaS? Not always possible

11 Encryption Trade-off between functionality and confidentiality Loss of ability to process data in a meaningful way e.g. To search encrypted data, you either : Store index locally OR Download the encrypted data, decrypt and search locally Is there a better way?

12 Searchable Encryption Searchable Encryption Allows searches over encrypted data Reveals nothing about the files or the keywords, except that the file contains a keyword being searched. Symmetric searchable encryption Single writer/many writer Asymmetric Searchable Encryption Many writer/single reader

13 Symmetric Searchable Encryption Secure Secure Index Index Keyword Keyword

14 Symmetric Searchable Encryption Other related work Song, et al allows a user, given a trapdoor for a word, to test if a ciphertext block contains the word Curtmola, et al search time for server is optimal but updates to index are inefficient as compared to GOH

15 Symmetric Searchable Encryption Security Guarantee Without any trapdoor, the server learns nothing about the data except its length Given a trapdoor for keyword w,, the server learns which (encrypted) documents contain w without learning w

16 Asymmetric Searchable Encryption Sender w pk PEKS Key Generation Gateway sk Trapdoor w Receiver C Test T w YES (1) / NO (0)

17 Asymmetric Searchable Encryption Security Guarantee Without any trapdoor the server learns nothing about the data except its length Given a trapdoor for a keyword w, the server learns which (encrypted) Weaker documents contain w Guarantee Byun et al shows that server can mount a dictionary attack to figure out which keyword the client is searching for

18 Attribute-based based Encryption Scenario: An informant needs to encrypt a message for anyone who is internal affairs office or undercover and in central office Attribute-based based Encryption Allows a decryption policy to be associated with a ciphertext Related work: B. Waters, et al (05,06,07) M. Chase, et al (07,09)

19 Attribute-based based Encryption = OR Int. Affairs AND Undercover Central MSK PK OR AND Int. Affairs Undercover Central SK Undercover Central SK Undercover Valley

20 Collusion Attack 20 Important potential attack Users should not be able to combine keys preventing collusion AND? A B SK Sarah : A, C SK Kevin : B, D

21 Fully-Homomorphic Encryption

22 What is Homomorphism "Homomorphism" property of an encryption scheme which refers to its ability to perform computations on the ciphertext without decryption first Example: E(x + y) = E(x) + E(y) E(x * y) = E(x) * E(y)

23 An Analogy: Alice s s Jewelry Store Alice s s workers need to assemble raw materials into jewelry But Alice is worried about theft How can the workers process the raw materials without having access to them?

24 An Analogy: Alice s s Jewelry Store Alice puts materials in locked glove box (only she has the key) Workers assemble jewelry in the box using a pair of gloves Alice unlocks box to get results

25 An Analogy: Alice s s Jewelry Store

26 Homomorphism Somewhat homomorphic schemes RSA, ElGamal work for MULT mod N GoMi, Paillier work for XOR, ADD BGN05 works for quadratic formulas Fully homomorphic scheme No limitations on what manipulations can be performed Recent breakthrough by Gentry of IBM in 2009

27 Availability and Integrity Users are at mercy of their CSP for availability and integrity of their data Dynamic feature of data update makes traditional integrity insurance technique useless. Verification of correct data storage in the cloud must be done without explicit knowledge of the whole data Too expensive to move data in-and and-out

28 Transitive Nature of Cloud Mr. Lim Amazing Corporation (some where in CBP) Peer-to-peer network Mr.Tan (an Entrepreneur running a hosting business in a rented HDB flat) MyHost.com (a shop house somewhere in Tanjong Pagar)

29 Service Degradation/Retrievability CSP can be self-serving, serving, untrusted and possibly malicious Move data to lower-tiered storage than agreed-upon (for economic reason) Throws away portion of files to save space Most users don t t retrieve their backup files anyway Hides data loss incident due to management errors, Byzantine failure, etc.

30 Proofs of Retrievability Why do we need POR? Provides some guarantee that a file F is available without actually retrieving Some SLA guarantee (time to download, etc.) A simple approach Computes hash value r before storing Periodically downloads F and checks the hash This is resource-intensive!

31 Proofs of Retrievability

32 ECC + MAC - Preparation Better approach Spot-checking (Juels( Juels- Kaliski 07) Archive F f 2 f 1 f 3 MAC k [f 1 ] parity bits c 2 c 1 c 3 k

33 ECC + MAC - Verification Archive F f 2 f 1 f 3 parity bits c 2 c 1 c 3 k

34 Proofs of Retrievability Other Related Work Proofs of Data Possession (PDPs) Ateniese et al Enables detection of large corruption of file Compact Proofs of Retrievability Shacham-Waters, 2008 Unlimited queries using homomorphic MACs

35 Beyond Encryption Research shows that 40% of organizations do not use encryption Key management issue How about Dispersed Storage? Makes use of information dispersal (threshold cryptography) approach to slice files into multiple unrecognizable pieces and store in multiple storage nodes

36 Dispersed Storage F Disperse F * F * F * Reconstruct F F *

37 Dispersed Storage Pros No master key to manage Individual pieces are of less value than the whole Minimum threshold no. of pieces required to re- assemble the whole Better availability/security than replication Compared to replication, each replicated file represents additional risk exposure More efficient in terms of storage Cons Slower to retrieve

38