Oblivious access control policies for cloud based data sharing systems
ComputingPublished 20 August 2012
Zeeshan Pervez, Asad Masood Khattak, Sungyoung Lee, Young-Koo Lee, Eui‐Nam Huh
Citations7
SJR quartileQ1
SJR score0.88
SNIP1.37
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
O-ACE is a data sharing system, which obliviously evaluates access control policy on a cloud server and provisions access to the outsourced data, and it has been observed that computational complexity to compromise privacy of the outsourcing data is same as reverting asymmetric encryption without valid key pair.
Abstract
Conventional procedures to ensure authorized data access by using access control policies are not suitable for cloud storage systems as these procedures can reveal valid access parameters to a cloud service provider. In this paper, we have proposed oblivious access control policy evaluation (O-ACE); a data sharing system, which obliviously evaluates access control policy on a cloud server and provisions access to the outsourced data. O-ACE reveals no useful information about the access control policy neither to the cloud service provider nor to the unauthorized users. Through the security analysis of O-ACE it has been observed that computational complexity to compromise privacy of the outsourced data is same as reverting asymmetric encryption without valid key pair. We have realized O-ACE for Google Cloud. Our evaluation results show the fact that O-ACE CPU utilization cost is 0.01–0.30 dollar per 1,000 requests.
Keywords
Computer Science
Communications of the ACMA view of cloud computing
8,997 Citations2010Michael Armbrust, Armando Fox +9 more
The clouds are clearing the clouds away from the true potential and obstacles posed by this computing capability.
Lecture notes in computer sciencePublic-Key Cryptosystems Based on Composite Degree Residuosity Classes
7,186 Citations2007Pascal Paillier
A new trapdoor mechanism is proposed and three encryption schemes are derived : a trapdoor permutation and two homomorphic probabilistic encryption schemes computationally comparable to RSA, which are provably secure under appropriate assumptions in the standard model.
Future Generation Computer SystemsCloud computing and emerging IT platforms: Vision, hype, and reality for delivering computing as the 5th utility
5,870 Citations2008Rajkumar Buyya, Chee Shin Yeo +3 more
This paper defines Cloud computing and provides the architecture for creating Clouds with market-oriented resource allocation by leveraging technologies such as Virtual Machines (VMs), and provides insights on market-based resource management strategies that encompass both customer-driven service management and computational risk management to sustain Service Level Agreement (SLA)-oriented resource allocation.
Attribute-based encryption for fine-grained access control of encrypted data
4,941 Citations2006Vipul Goyal, Omkant Pandey +2 more
This work develops a new cryptosystem for fine-grained sharing of encrypted data that is compatible with Hierarchical Identity-Based Encryption (HIBE), and demonstrates the applicability of the construction to sharing of audit-log information and broadcast encryption.
Hey, you, get off of my cloud
2,015 Citations2009Thomas Ristenpart, Eran Tromer +2 more
Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile
1,311 Citations2002R. Housley, William T. Polk +2 more
The X.509 v3 certificate format is described in detail, with additional information regarding the format and semantics of Internet name forms, and standard certificate extensions are described and two Internet-specific extensions are defined.
Lecture notes in computer scienceEfficient Private Matching and Set Intersection
1,254 Citations2004Michael J. Freedman, Kobbi Nissim +1 more
This work considers the problem of computing the intersection of private datasets of two parties, where the datasets contain lists of elements taken from a large domain, and presents protocols, based on the use of homomorphic encryption and balanced hashing, for both semi-honest and malicious environments.
Market-Oriented Cloud Computing: Vision, Hype, and Reality for Delivering IT Services as Computing Utilities
1,139 Citations2008Rajkumar Buyya, Chee Shin Yeo +1 more
The need for convergence of competing IT paradigms for delivering the 21st century vision of computing is concluded.
Lecture notes in computer scienceCryptographic Cloud Storage
1,062 Citations2010Seny Kamara, Kristin Lauter
This work considers the problem of building a secure cloud storage service on top of a public cloud infrastructure where the service provider is not completely trusted by the customer and describes several architectures that combine recent and non-standard cryptographic primitives to achieve this goal.
IEEE Security & PrivacyData Security in the World of Cloud Computing
773 Citations2009Lori M. Kaufman
To ensure that decisions are informed and appropriate for the cloud computing environment, the industry itself should establish coherent and effective policy and governance to identify and implement proper security methods.
SPKI Certificate Theory
753 Citations1999Carl Ellison, Bill Frantz +4 more
A mechanism for deriving authorization decisions from a mixture of certificate types was developed and is presented in this document and a canonical form for those S-expressions is defined.
Design of a role-based trust-management framework
752 Citations2005Ninghui Li, John C. Mitchell +1 more
The RT framework, a family of role-based trust management languages for representing policies and credentials in distributed authorization, is introduced, and the semantics of credentials are defined by presenting a translation from credentials to Datalog rules.
Plutus: Scalable Secure File Sharing on Untrusted Storage
607 Citations2003Mahesh Kallahalla, Erik Riedel +3 more
The mechanisms in Plutus to reduce the number of cryptographic keys exchanged between users by using filegroups, distinguish file read and write access, handle user revocation efficiently, and allow an untrusted server to authorize file writes are explained.
Taking account of privacy when designing cloud computing services
546 Citations2009Siani Pearson
The privacy challenges that software engineers face when targeting the cloud as their production environment to offer services are assessed, and key design principles to address these are suggested.
SiRiUS: Securing Remote Untrusted Storage.
451 Citations2003Eu-Jin Goh, Hovav Shacham +2 more
This paper presents SiRiUS, a secure file system designed to be layered over insecure network and P2P file systems such as NFS, CIFS, OceanStore, and Yahoo! Briefcase that contains a novel method of performing file random access in a cryptographic file system without the use of a block server.
Access Control Policies, Models, and Mechanisms
421 Citations2011Sabrina De Capitani di Vimercati
Very Large Data BasesOver-encryption: management of access control evolution on outsourced data
373 Citations2007Sabrina De Capitani di Vimercati, Sara Foresti +3 more
A novel solution to the enforcement of access control and the management of its evolution is presented, based on the application of selective encryption as a means to enforce authorizations.
Secure and efficient access to outsourced data
240 Citations2009Weichao Wang, Zhiwei Li +2 more
This paper proposes to encrypt every data block with a different key so that flexible cryptography-based access control can be achieved, and investigates the overhead and safety of the proposed approach, and study mechanisms to improve data access efficiency.
Hidden Credentials
161 Citations2003Jason E. Holt, Robert Bradshaw +2 more
Transactions which depend on fulfillment of policies described by monotonic boolean formulae can take place in a single round of messages and credentials that are never revealed can be used to retrieve sensitive resources.
Lecture notes of the Institute for Computer Sciences, Social Informatics and Telecommunications EngineeringFADE: Secure Overlay Cloud Storage with File Assured Deletion
146 Citations2010Yang Tang, Patrick P. C. Lee +2 more
FADE, a practical, implementable, and readily deployable cloud storage system that focuses on protecting deleted data with policy-based file assured deletion, is designed and implemented, and insights are provided of how to incorporate value-added security features into current data outsourcing applications.
IEEE Transactions on ComputersAttribute-Based Access Control with Hidden Policies and Hidden Credentials
130 Citations2006Keith B. Frikken, Mikhail J. Atallah +1 more
IEEE Transactions on Dependable and Secure ComputingOACerts: Oblivious Attribute Certificates
100 Citations2006Jiangtao Li, Ninghui Li
The proposed oblivious attribute certificates (OACerts) are an attribute certificate scheme in which a certificate holder can select which attributes to use and how to use them, and provably secure and efficient OCBE protocols for the Pedersen commitment scheme and comparison predicates are developed.
TrustStore: Making Amazon S3 Trustworthy with Services Composition
73 Citations2010Jinhui Yao, Shiping Chen +3 more
A virtual file system, called Trust Store, is prototyped, which allows users to utilize untrusted storage service provider with confidentiality and integrity of the data preserved and is deployed with Amazon S3 to evaluate its performance.
A Privacy-Preserving Scheme for Online Social Networks with Efficient Revocation
70 Citations2010Jinyuan Sun, Xiaoyan Zhu +1 more
A privacy-preserving scheme for data sharing in OSNs, with efficient revocation for deterring a contact's access right to the private data once the contact is removed from the social group is proposed.
CS2: A Searchable Cryptographic Cloud Storage System
66 Citations2011Seny Kamara, Charalampos Papamanthou +1 more
The CS2 system is presented, a cryptographic cloud storage system that guarantees confidentiality, integrity and verifiability without sacrificing utility, and two cryptographic protocols for cloud storage are proposed which prove secure in the ideal/real-world paradigm.
Lecture notes in computer scienceTrapdooring Discrete Logarithms on Elliptic Curves over Rings
57 Citations2000Pascal Paillier
Three new probabilistic encryption schemes using elliptic curves over rings based on three specific trapdoor mechanisms allowing the recipient to recover discrete logarithms on different types of curves are introduced.
Sharoes: A Data Sharing Platform for Outsourced Enterprise Storage Environments
47 Citations2008Aameek Singh, Ling Liu
CRUST: Cryptographic Remote Untrusted Storage without Public Keys
19 Citations2007Erel Geron, Avishai Wool
ACM Transactions on Information and System SecurityAccess controls for oblivious and anonymous systems
14 Citations2011Scott E. Coull, Matthew Green +1 more
A stateful anonymous credential system that allows the provider to implement nontrivial, real-world access controls on oblivious protocols conducted with anonymous users and combines its credential system with an adaptive oblivious transfer scheme to create a privacy-friendly oblivious database with strong access controls.
International Journal of Information SecurityCRUST: cryptographic remote untrusted storage without public keys
14 Citations2009Erel Geron, Avishai Wool
This paper presents CRUST, a stackable file system layer designed to provide secure file sharing over remote untrusted storage systems, and implemented CRUST as a Linux file system and shown that it performs comparably with typical underlying file systems, while providing significantly stronger security.