PAPER

RESEARCH OF KEY MANAGEMENT TECHNOLOGY ON CLOUD STORAGE

Research of Key Management Technology on

Cloud Storage
http://dx.doi.org/10.3991/ijoe.v9i6.3311

Ningning Song, Zhiwei Wei, Xianwei Xhou and Qian Liu

School of Computer & Communication Engineering,
University of Science & Technology Beijing, Beijing 100083, China

Abstract—Since the cloud storage technology has management scheme. Centralized key management
distribution, isolation and sharing characteristics, key scheme is defined by the key distribution center (KDC) or
management has become more and more difficulty. As a a group of a hierarchy of nodes responsible for key
consequence, the research of key management technology generation and assigned to the communication parties.
has become a hot topic in recent years. In order to solve the Distributed key distribution scheme refers to the various
untrustworthiness of cloud storage server provider, the communication network communications side has the
complexity, security of key and some other issues under same status as key distribution between them depends on
cloud storage environment, this paper proposed negotiation between them, without any restrictions on any
a (n + 1, s + 1) key management technology on the basis other party (step further, you can put the key dispersed
of Shamir (n, s) and then this technology was used in cloud distribution center all communication parties, that is, each
communication party is also a key distribution center).
storage system. The main idea of the technology is that the Hybrid key management scheme mainly mixing the above
whole key spited into n+1 parts and distributed to the
two programs: the upper (host) using a distributed key
different cloud storage service providers and data owner to
distribution scheme, while the lower terminal or
manage the sub-keys. Through the performance analysis, in
communication subnet it belongs to a centralized key
this technology, the data owner is the core of the
distribution scheme.
management process. The technology is more secure than
the traditional technology and solves the untrustworthiness But the three programs primarily based on symmetric
of cloud storage server provider based on the premise of encryption key management scheme to achieve, difficult
reducing the burden of data owner. to adapt and asymmetric key encryption scheme. For the
current shortcomings of the key management scheme, the
Index Terms—Cloud storage, Key management, Key escrow, paper describes a distributed key management method,
Threshold. which is mainly the user to effectively break down the key
in advance, and then factored different keys entrusted to
other fragment unrelated providers, and then design a
I. INTRODUCTION threshold, when the ISP provides key number is greater
With the rapid development of Internet information, than the threshold [4], the data can be decrypted.
information data net-work has being arises, but how to
store the information data has become a topic of II. THE DIVISION OF KEY MANAGEMENT TECHNOLOGY
increasing concern. In this condition, the modern cloud Threshold key management scheme is based on Shamir
storage technology [1] has ushered in the good key distributed hosting mechanism [5-9], which is mainly
development opportunities, but also huge challenges will the user to effectively break down the key in advance, and
be subject to network information security. The rapid then factored different keys entrusted to other fragment
development of cloud storage technology, people can unrelated providers, cloud storage ISP technology is
basically meet the daily demand for data storage. But isolated from each other, so the keys store to another ISP
when people use data of the storage network, found that is safe, so as to achieve the key confidentiality. Finally, it
the user privacy protection is very important on cloud managed to set a threshold, so by different provider key
storage. In recent years, customer privacy breaches have cross-certification to get the correct key.
occurred, but also to the user caused huge losses.
According to research, data privacy leak is mostly due to A. The Definition of Key Division Management
loss privacy key, how to ensure the security of key user Technology
privacy is an important aspect of the research of cloud
Definition 1: Assume that a full key sK is divided
storage security.
into n parts; each part is a small sub-key, and which are
In key management technology, there are two problems allocated to N different key manager [10]. Therefore,
to solve: [1-3] In order to reduce user burden, improve through a collection of some sub keys to deduce the
efficiency, we must introduce an automatic key complete key sK principle is:
management mechanisms; In order to improve safety, and
it should be possible to reduce the system resides key (1) If the collection is greater than the number of sub-
amount key s, then we can derive the complete key
In order to solve these two problems, there are three (2) If the number is less than the collection of sub-key
types of key scenarios: centralized, distributed, hybrid key s, then the complete key sK cannot be launched

58 http://www.i-joe.org
 PAPER
RESEARCH OF KEY MANAGEMENT TECHNOLOGY ON CLOUD STORAGE

Then, (n, s) is the Key Division Management

! k11a1'' + k12 a2'' + ... + k1s as'' "
Technology s is threshold. # '' '' '' $
Definition 2: Suppose two sets A and B are # k21a1 + k22 a2 + ... + k2 s as $
independent of each other a key manager (two sets of Ei1 Ei 2 ...Eis # ... $
# $ (3)
attributes A ! B = ! ), A is modulo n, B mold is m, and s '' ''
# kn1a1 + kn 2 a2 + ... + kns as $
''

is set as the threshold value (s<n), so that the complete # a1' $

key sK is divided into n + m parts, each of which is % &
assigned to the A and B key manager. = (a1'' , a2'' ,..., as'' , a1' , 0,..., 0)T
(1) If A is greater than or equal to s, the key manager, Elementary matrix X is stored by the cloud storage
and then any one of the B can be derived integrity service, used to derive the matrix M, if the s sub-key and
key sK . user extract from the providers, M can be calculated
(2) There is less than S in the A of key managers, and B according to elementary matrix.
which is not in any of a manager can derive the complete (3)Recovery the complete key
key Sub-key a1'' , a2'' ,..., as'' and user a1' extract from the
Then, (n, s) is the Key Division Management providers, according to the nature of M, we can write the
Technology, s is threshold. We proposed a (n + 1, s + 1) matrix for (a1'' , a2'' ,..., as'' , a1' , 0,..., 0)T .
key management technology on the basis of Shamir (n, s) . Remove from the cloud storage server provider
elementary matrix, and the inverse
B. The Implementation of Key Division Management
matrix Ei!11 Ei!21 ...Eis!1 obtained respectively. Using the
Technology
following equations

(1) The design of the basic parameters
Design a matrix M of n + 1! n is used to represent ! k11a1'' + k12 a2'' + ... + k1s as'' "
divided key: # '' '' '' $
# k21a1 + k22 a2 + ... + k2 s as $
! a11 a12 ... a1n " Ei1 Ei 2 ...Eis # ... $
# $ # $ (4)
# a21 a22 ... a2 n $
'' '' ''
# kn1a1 + kn 2 a2 + ... + kns as $
M = # ... ... ... ... $ (1) # a1' $
# $ % &
# an1 an 2 ... ann $ = (a1'' , a2'' ,..., as'' , a1' , 0,..., 0)T
# a ' a ' ... a ' $
% 11 12 1n & Elementary transformation to (a1'' , a2'' ,..., as'' , a1' , 0,..., 0)T :
Each row of the matrix M as a group represented by
vectors, a1 = (a11 , a12 ,..., a1n ) an = (an1 , an 2 ,..., ann ) , " a1'' #
$ '' %
an = (an1 , an 2 ,..., ann ) . So M can be simplified to $ a2 %
M= (a1 , a2 ,..., an , a1' )T . In this group, each s eigenvectors $ ... %
$ '' %
are linearly independent, but any s +1 vectors are linearly !1 $ s %
a
related, M has a rank of s +1. Eis Eis !1 ...Ei1 $ ' % = Eis!1 Eis!1!1 ...Ei!11 Ei1 Ei 2 ...Eis
!1 !1
(5)
(2)The key distribution $ a1 %
$0 %
The matrix M is a vector composed of n +1, then these $ %
n +1vectors are assigned to the n provider and User. $ ... %
Assuming matrix M vectors (a1'' , a2'' ,..., as'' , ) are linearly $&0 %'
independent, M of the vectors can be expressed by
! k11a1'' + k12 a2'' + ... + k1s as'' " ! a1 "
that (a1'' , a2'' ,..., as'' , ) linear, so the key matrix can be # '' '' '' $ # $
expressed as # k21a1 + k22 a2 + ... + k2 s as $ # a2 $
# ... $ = # ... $ (6)
! a1 " ! k11a1'' + k12 a2'' + ... + k1s as'' " # '' '' ''
$ # $
# $ # '' '' '' $ # kn1a1 + kn 2 a2 + ... + kns as $ # an $
# a2 $ # k21a1 + k22 a2 + ... + k2 s as $ # a1' $ # a' $
% & % 1&
M = # ... $ = # ... $ (2)
# $ # '' '' ''
$
# an $ # kn1a1 + kn 2 a2 + ... + k ns as $
# a' $ # a1' $ III. ANALYSIS AND EVALUATION
% 1& % &
Line on M transform can be simplified as, elementary A. The Correction of Key Division Management
row transformation matrix: Technology
If you want to encrypt the data, then the user can send a
request to the t provider, and then sent to the server out of
their sub-key a1'' , a2'' ,..., as'' , the server joint sub-key,

iJOE ‒ Volume 9, Issue 6, November 2013 59

 PAPER
RESEARCH OF KEY MANAGEMENT TECHNOLOGY ON CLOUD STORAGE

elementary matrix Ei1 Ei 2 ...Eis and the inverse providers more than s key can also be deduced correctly
!1 !1 !1 complete key.
matrix E E ...E calculation:
is is !1 i1 Thus, the threshold-based management program is a
scientific technology.
" a1'' #
$ '' % C. Performance Evaluation
$ a2 %
$ ... % The performance analysis is based on the school cloud
$ '' % storage platform verification, it is mainly from the
!1 $ s %
a traditional (n, s) Encryption efficiency and security
Eis Eis !1 ...Ei1 $ ' % = Eis!1 Eis!1!1 ...Ei!11 Ei1 Ei 2 ...Eis
!1 !1
(7)
a aspects were analyzed.
$ % 1

$0 % Figure 1 with the increase in the number of divided key,

$ % the time it takes to performance graph. It can be found that
$ ... % as the number of division increases, the traditional scheme
$&0 %' (n, s) and the same programs tend to spend time, which
! k11a1'' + k12 a2'' + ... + k1s as'' " ! a1 " indicates that the segmentation of the program is greater
# than a certain number of keys on the basis of the
'' '' '' $ # $
# k21a1 + k22 a2 + ... + k2 s as $ # a2 $ traditional partitioning scheme (n, s) and the same
# ... $ = # ... $ (8) performance as the program.
# $ # $
'' '' ''
# kn1a1 + kn 2 a2 + ... + kns as $ # an $ Next, we use traditional hosting ideas (n, s) and this
# a1' $ # a' $ program was the same probability key crack, split scenario
% & % 1& assuming full key split into n = 30 copies.
Thus as long as the random s sub-key and the user keys,
the full key sK can be deduced.

B. Security of Key Division Management Technology

ISP will devise the key sub-keys into n+1 groups
consisting key matrix M= (a1 , a2 ,..., an , a1' )T , then are
assigned to the n cloud storage service providers and
users. Based on the above analysis, the key matrix of rank
s +1, where vectors (a1'' , a2'' ,..., as'' , ) are linearly
independent, so if extracted less than s sub-keys or the
lack of data owners sub-key, is based on linear algebra
algorithms unable to derive full by linear key, meaning
that if less than s sub-keys and key data owners, or the
lack of key data owners, then the key cannot be restored.
Only greater than or equal to the n-th cloud storage server
providers and data owners sub key, then correctly deduced Figure 1. Traditional (n, s), and the new technology comparison
the complete key. Complete key recovery process will be
three cases: The simulation experiment results are as follows.
(1) Key recovery is less than s a key provider. Suppose (1) When the attacker does not get to the data owner's
there are s-1 provider participate in the key recovery, the key, with the increase in the number of the threshold s, the
complete recovery success probability key is shown in
key matrix (a1'' , a2'' ,..., as'' !1 ) , the data owners sub key a1'
Figure 2.
matrix is finally obtained (a1'' , a2'' ,..., as'' !1 , a1' ) ,but the key
matrix does not exceed s linearly independent, and
complete key matrix M has rank s+1, therefore
a1'' , a2'' ,..., as'' !1 , a1' cannot be a linear representation of the
matrix M, is not able to derive the full key. In summary, if
the provider key is less than s, even if there is a sub-key
data owner, so it cannot launch a complete key.
(2) Lack of key data owners. Extract from a provider
than s sub-keys, but the full key matrix M has rank s+1,
therefore cannot be deduced the correct key.
(3) Data owner password greater than or equal s sub-
key by cloud storage service provider key. Assuming
decryption project has s cloud storage service and data
owners sub-key , which together constitute a
matrix (a1'' , a2'' ,..., as'' , a1' , 0,..., 0)T , and then the server Figure 2. Traditional (n, s) and the new technology (without data
change with a series of rows can be correctly deduced the owner key) graph comparing crack
complete key, obviously, if cloud storage service
From Figure 2, we can see that with the gradual
increase in the threshold, the key is to break the

60 http://www.i-joe.org
 PAPER
RESEARCH OF KEY MANAGEMENT TECHNOLOGY ON CLOUD STORAGE

traditional (n, s) full probability decreases, but the owners and cloud storage service provider. This greatly
probability of this scenario to be cracked is 0, which is reduces the file size of the key data owners, but also a
verified by theoretical analysis above: the good solution to untrusted cloud storage service provider
program (n + 1, s + 1) , if the owner of the key missing data, hidden problems. Because the technology is based on the
threshold to restore the original key, even if part of the
then you must not break out the full key under any cloud storage service provider sub key lost key recovery
circumstances. can also be a complete success, thus enhancing the
(2)When the attacker access to the key, with the robustness of the key, and their correctness and security
increase in the number of both to verify the effectiveness of the technique.
The threshold s, the complete key is the probability of
successful recovery (Figure 3). REFERENCES
From Figure 2, we can see that, compared with the [1] W. Zeng, Y. Zhao, and W. Song, “Research on cloud storage
threshold gradually increased, the two solutions complete architecture and key technologies.” In Proceedings of the 2nd
key is basically the same as the probability of cracking, International Conference on Interaction Sciences: Information
Technology, Culture and Human (pp. 1044-1048). 2009 ACM.
and shows that even in the conditions of access to the key,
[2] E. Laurent, D. Gligor. “A key-management scheme for distributed
two solutions the same security. Further validation of the sensor networks.” Proceedings of the 9th ACM conference on
program inherits the traditional scheme has the security Computer and communications security. ACM, 2002, pp. 41-47.
features [3] T. Landstra, M. Zawodniok, and S. Jagannathan, “Energy-efficient
Through this performance analysis, when the number is hybrid key management protocol for wireless sensor networks.” In
less than a certain number of split keys, the performance Local Computer Networks, 2007. LCN 2007. 32nd IEEE
slightly worse with the traditional; But when the number Conference on (pp. 1009-1016). IEEE.
is greater than the number of split keys, the performance is [4] J. V. Martins, D. Tanré, L. Remer, and Y. Kaufman, “MODIS
cloud screening for remote sensing of aerosols over oceans using
almost identical with the traditional. Meanwhile, the spatial variability.” Geophysical Research Letters,2002, 29(12),
program has strong security, if no sub-key case; regardless 8009. http://dx.doi.org/10.1029/2001GL013252
of what method the attacker cannot break out of the [5] R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining
complete key. Even if the cracks in the access to the data digital signatures and public-key cryptosystems.” Communications
owner sub key case, the program also has the security of a of the ACM, 1978, 21(2), 120-126. http://dx.doi.org/10.1145/
traditional performance. 359340.359342
Thus, we can see that with respect to this program has a [6] M. Burmester, Y. Desmedt, “A secure and efficient conference
key distribution system.” In Advances in Cryptology—
strong tradition of safety, because the cloud storage EUROCRYPT'94 (pp. 275-286). Springer Berlin Heidelberg.
service provider without the user's sub-keys, the key [7] M. Naor, A. Shamir, “Visual cryptography.” In Advances in
cannot derive the full, so this program effectively solves Cryptology—EUROCRYPT'94 (pp.1-12). Springer Berlin
the cloud storage service providers credible problem. Heidelberg.
Relative to the complete key, users’ only need to save a [8] J. Sherman, W. J. Morrison, “Adjustment of an inverse matrix
small a sub-key, so that can be a good drop of data owners corresponding to a change in one element of a given matrix.” The
manage keys burden. Annals of Mathematical Statistics, 1950,21(1), 124-127.
http://dx.doi.org/10.1214/aoms/1177729893
[9] R. N. Calheiros, R. Ranjan, and C. A. De Rose, Cloudsim: “A
novel framework for modeling and simulation of cloud computing
infrastructures and services.” arXiv preprint arXiv:0903.2525,
2009.
[10] E. Roe, M. V. Eeten, “Threshold-based resource management: a
framework for comprehensive ecosystem management.”
Environmental Management, 2001,27(2), 195-214.
http://dx.doi.org/10.1007/s002670010143

AUTHORS
Ningning Song is with University of Science &
Technology Beijing, Beijing 100083, China (e-mail:
[email protected]).
Zhiwei Wei is with University of Science &
Technology Beijing, Beijing 100083, China (e-mail:
Figure 3. Traditional (n, s) and the new technology (data owner key) [email protected]).
graph comparing crack Xianwei Zhou is with University of Science &
Technology Beijing, Beijing 100083, China (e-mail:
[email protected]).
IV. CONCLUSIONS
Qian Liu is with University of Science & Technology
Based on the current key management technology Beijing, Beijing 100083, China (e-mail:
research and analysis for key management unilaterally [email protected]).
research untrusted cloud storage service provider problem,
we propose a key management technology, which is based Submitted 03 October 2013. Published as re-submitted by the authors
on Shamir key mechanism based on a distributed hosting 05 November 2013.
threshold Key split on the use of management techniques
to achieve. The technique involves key managers to data

iJOE ‒ Volume 9, Issue 6, November 2013 61