Cryptographic Solution for Security Problem in Cloud Computing Storage During Global Pandemics

As the cases of COVID-19 increases worldwide, almost all the countries opts for lockdown to counter the spreading speed of the pandemic. But as the time grows companies have been instructing their employees to work from home and as of now many companies already instructed their employees to work from home throughout the year [1]. As employees need to access their applications and infrastructure remotely, cloud computing emerges as a potential solution. In the global world, including India, many companies and organizations want their employee's safety. Along with this, companies also want to achieve the business continuity, for that enablement of teams for WFH is a necessity [2].

To achieve the task of WFH, companies are opting for cloud computing-based solutions. In such a situation's companies are relying entirely on cloud service providers for data storage purposes [3]. Globally cloud was already in the growing phase during the current decade and COVID-19 acts as a catalyst for the demand for cloud-based services [4].

In just around three months of lockdown across the world during COVID-19, the world has become added digitally connected, and in consequence, vulnerability also got increased. In the march first quarter, everything was well placed at various organizations in India, and suddenly COVID-19 cases lead to the lockdown in the country. After few days' organizations start out to think about their work and possible way to resume the work. So, most of the organizations found WFH is the only solution in the current scenario. Organizations started connecting to their employees using different tools and applications such as Zoom, Meet, MS Teams, Cisco Webex, etc. But all these are third party applications and mostly use cloud-based storage and other facilities. These applications don't pose any problem while working for a regular organization, but whenever we talk about the defense organizations, healthcare sector, banking sector, education sector, etc. where information leakage can lead to a bigger problem all together [5]. As we know, one of the barriers while using cloud computing is security, so there is a strong need to secure data communication in such situations [6].

According to the report of McAfee on 28 May 2020, there is a sharp increase in the cyber-attacks on cloud accounts, and its percentage is more than 600 percent in the quarter January-April [7]. During the above-said duration, some of the cloud meeting related applications such as Zoom, Meet, MS Teams, Cisco Webex saw an increase in usage of almost 600 percent, and that's only in the education sector. The report also explained that cyber attackers are now targeting these collaboration tools during the COVID-19 pandemic. Risks go many folds when these applications are accessed through unmanaged and compromised devices. Thus, there is a strong need for security methods that provide data security to cloud users. Some of the most common threats that are growing during this period are given in the upcoming section.

Though we have several security solutions that provide security to cloud storage systems, but due to the COVID-19 pandemic situation is quite different now. The main reason behind this is nowadays not only cloud traditional users, but regular users are also using cloud-based services as most of the organizations asking their more than 50% of workers to work from home. Thus, there is a strong need to secure the important organization data that is to be stored on cloud storage systems. To achieve the desired security features, an approach has been proposed that can provide a solution to security issues raised by the regular users as well as the organizations during this recent pandemic. The approach makes use of cryptography-based methods to overcome the security concerns raised by end-users while storing their data on cloud storage [23]. The proposed approach uses can be visualized by having three entities working simultaneously, and these entities are End User, Cloud Storage, and Security Monitor. The security monitor can be a separate entity, or it can reside at the end user's location. The main aim of the security monitor is to check user data for consistency and unwanted modifications. The working of each entity is explained as:

• End-user selects and uploads their data on cloud storage.

• Cloud storage is used to store the end user's data.

Security monitor checks data for its consistency, integrity, and authenticity.

Out of these available entities, security monitor plays the most crucial role in our system because it periodically monitors the end-user data for any modification by the unauthenticated user, and reports to end user if any such incident happens with their data. The complete working of the proposed approach is shown in the given Figure 1.

The approach not only checks data for its consistency, integrity, and authenticity but also improves the user's trust in cloud storage services. The prime requirement for the success of this approach is that the end user must have an idea of necessary encryption and decryption as some of the essential cryptographic methods will be used at the end user's side itself. If it's not the case, then the security monitor can perform this task on behalf of the end-user. Further, end-user must divide their data into two categories as critical data and non-critical data. The main reason behind the logic is, only critical data will be checked or monitored for inconsistency, as the monitoring scheme will also require its time of computation. There is no use of monitor the data, that is not so important. Also, the operating cost will be added to the overall cost in such condition. Apart from the end user, security monitor plays the dynamic role in the proposed approach, as the security monitor will continuously monitor the end-user data for its correctness.

1.png

Figure 1. Sec HMS hybrid monitoring scheme

At the starting end-user separates the data as normal data and sensitive data. Normal data is stored at the cloud storage system without any transformation or alteration and, encryption is performed on the critical data using the AES algorithm. After the encryption, the data is sent to the cloud storage server. Subsequently, the encrypted data is divided into equal size blocks, and each of the block act as an input for the SHA-512 hash algorithm to produce the hash value corresponding to each of the block. Further, all the hashed blocks are concatenated with each other. Then RSA digital signature algorithm is applied to the concatenated data, the signature algorithm used in this step ensures data authentication. This generated digital signature is then transferred to the security monitor, which security monitor can use at a later stage for verification. Here we can observe that end-user and security monitors closely work together to achieve the designated task of data security.

Additionally, the security monitor also monitors user data for any changes from time to time. The monitoring can be done as per the request of end-user, or it can be triggered in an automated manner as well. In an automated monitoring method, the security monitor must mention the duration at which monitoring needs to be done for data. For example, if the security monitor mentions the term as 1 min, then every 1-minute end-user data will be monitored for its integrity. Using this scheme, the trust factor improves between cloud services and end-user with the help of a security monitor. Whenever a security monitor receives the data from the cloud storage system, the monitor generates the signature using the RSA digital signature again. The new signature produced is then compared with the previous signature stored. If signatures match, then integrity is preserved for end-user data, and if not, the incidence is reported to the end-user by security monitor.

Security approach has been evaluated on the basis of files of different size. We have taken file sizes starting from 100 KB up to 100 MB. Later, the security approach is compared with the already existed traditional approach, and finally, performance is evaluated based on data upload and download time.

5.1 Data upload time

Data upload time is the time that is required to encrypt the desired file as per the user's need. It is the sum of time needed by the user to upload the file to the cloud server (T_u), the time required to encrypt the user's file (T_e), and the request made by the end user's to store their file at the cloud server (T_r). So data upload time (T _Up) can be written as:

$\mathrm{T}_{\mathrm{up}=} \mathrm{T}_{\mathrm{r}}+\mathrm{T}_{\mathrm{e}}+\mathrm{T}_{\mathrm{u}}$ 

5.2 Data download time

Data download time is the time that is required to decrypt the desired file as per the user's need. It is the sum of time needed by the user to download the file from the cloud server (T_re), the time needed to encrypt the user's file (T_d), and the request made by the end user's to store their file at the cloud server (T_r). So data upload time ($\mathrm{T}_{\mathrm{dt}}$) can be written as:

$\mathrm{T}_{\mathrm{dt}}=\mathrm{T}_{\mathrm{r}}+\mathrm{T}_{\mathrm{d}}+\mathrm{T}_{\mathrm{re}}$

In general, almost all the security-related processing is done on the server-side using cryptographic approaches (encryption and decryption) when one wishes to store data on cloud storage systems. These schemes do not provide assurance related to the data integrity and also the element of confidence on the part of the client. In our security monitoring system, the relationship between the security manager and end-user conducts all the security-related transformations at the client level. Because of this, the monitoring scheme offers better control of access, integrity, and improvement of trust for the client. Even if anyone gains access to the data stored in the cloud storage, the original data cannot be accessed as the data is encrypted. Even if somebody gains access to the data stored in the cloud storage, the original data cannot be obtained as data is stored in encrypted format using the cryptographic algorithms. Besides this, the intruder would not be able to make any modifications to the data of the customer, which contributes to the assurance of integrity. In short, we can say that our proposed scheme includes all basic and advanced security features. Apart from all the security features listed, the proposed approach has a monitoring feature, which is monitored by the security manager. The primary aim of monitoring is to increase the trust of end-users in cloud storage systems. The security monitor can monitor the user data stored in cloud storage according to the end user's demand and in an automated way. The paper showed a complete monitoring process and sample results, along with the time taken in respective approach activities. In having multiple security features along with continuous monitoring of user data, we can say that the proposed monitoring solution not only offers data protection but would also improve user trust in cloud storage systems. That is because the security monitor will keep a close eye on the user data for some form of alteration, and the incident will be notified to the end user if change occurs. A few more algorithms can also be explored as a future enhancement to reduce the complexity of time, and end-users can also suggest necessary changes as and when required.