Privacy and Security in Mobile Cloud Computing: Review: Sapna Malik MM Chaturvedi
Privacy and Security in Mobile Cloud Computing: Review: Sapna Malik MM Chaturvedi
Privacy and Security in Mobile Cloud Computing: Review: Sapna Malik MM Chaturvedi
20
International Journal of Computer Applications (0975 – 8887)
Volume 80 – No 11, October 2013
21
International Journal of Computer Applications (0975 – 8887)
Volume 80 – No 11, October 2013
3.4.4 Image processing: We can give more features to 4.2 Literature Review
Smartphone in gesture recognition, like image process Security and privacy issues of MCC have been discussed by
applications through Mobile Cloud Computing by processing many researchers. J. Oberheide et al. [10] proposed Cloud AV
their data through cloud. platform, malware detection system. In this architecture,
mobile agent first analyses the malicious file. If its signature
3.4.5 Speech recognition and synthesis: Speech is not matched with the cached database, it is sent to the
Recognition application like language translator can help network service for analysis with the help of multiple
mobile user to feel comfortable in a country where language is detection engines running parallel on host machines with the
not known or understood by the mobile user. help of virtualization technique. These techniques have the
advantage of better detection of malicious software, reduced
3.4.6 Mobile Banking: Now a day’s mobile banking is
on device software complexity and power consumption but
gaining more popularity than e-banking because of more
suffer from limitations of disconnected operation and
mobile users than internet users
accidental privacy hazard.
3.4.7 Social Networking: Social networking like face S Zhang et al. [11] presents security framework which adapts
book, what’s up help in staying connected with people with mobile device with changing workloads, performance goals
Mobile Cloud Computing. and network latency by migrating processing weblets between
cloud and mobile device. They enhance this model by
3.4.8 Mobile Gaming: As we know games demand trustworthy weblets container, Authentication and secure
more processing and graphic hardware, with Mobile Cloud
session management, Authorization and access control of
Computing it is possible to use high end gaming application
weblets, Logging and auditing behaviour of weblets to make
on mobile phone.
more secure framework. Although security during weblets
3.4.9 Mobile Security: Mobile cloud computing can migration can be improved by other security techniques and
provide more security to the mobile device by proving cloud environment can be made more trustworthy.
security through cloud. Xiao and Gong [12]proposed lightweight algorithm for
ensuring authorization in mobile cloud environment by
4. SECURITY AND PRIVACY IN generating automatic dynamic credential information with
MOBILE CLOUD COMPUTING mutual coordination of mobile device and cloud so frequently
that it is difficult for hackers to hack credential information of
4.1 Security and privacy risk in Mobile users. However frequent updation of secret information of
Cloud Computing user increases processing burden and energy consumption on
As Mobile Cloud Computing is combination of mobile mobile device and communication overhead between mobile
computing and cloud computing, security risk in mobile and cloud.
computing is inherited from cloud computing. Mobile Cloud
Computing suffers from following risk. Wang and Wang [13]have proposed framework that uses
cloud for providing number of live users in region based on
In mobile cloud computing, user does not know where historical data saved in cloud which helped in minimization of
his data is stored, so user has little or no control over the processing and communication overhead in cloud but doing
location of data. spatial cloaking based on historical data can lead to privacy
loss. The cloaking in mobile device increased processing
Because of physical damage of cloud server, loss of overhead and energy consumption.
encoding key or due to malicious insider, risk of data loss
may arise. Huang et al. [14]presents framework – MobiCloud in which
the secure computation is done with three domains (a) cloud
A customer with ill intent may plant virus of phishing mobile and sensing domain (b) cloud trusted domain and (c)
attack in to cloud server which may compromise data of cloud public service and storage domain. Security to critical
other customers and cloud provider may not be able to data is provided by isolating public cloud and trusted cloud. In
track it because of privacy policy of the company. this scheme client uses the services of two cloud service
providers so it increases the communication cost and network
A gap in security of application interface of cloud latency.
services can lead to attacks like bypass attack of API
attack. G. Portokalidis et al. [15] proposed scheme for threat
detection in a smart phone based on CloudAV research by
When cloud provider services a number of users, flaw in Oberheide et al. [9]. In cloud we have multiple replica of
encryption algorithm can lead to unauthorized access to Smartphone which can detect different types of attacks in
one’s data. parallel. The proposed scheme reduced the transmission
As per regulatory compliance cloud provider has to overhead below 2.5KiBps and reduced energy consumption
maintain required security level 30%. In this technique cloud is considered fully trusted which
needs to be given second thought.
In IaaS security risk may arise due to lack of isolation in
virtualization when number of virtual machines are H.Zhang and X Mingjun [16] proposed distributed spatial
hosted on a single server. cloaking in which distributed anonymity having location
information for cloaking. Distributed anonymity can handle
Mobile user stores and transfers critical personal and frequent requests from users without being bottlenecked.
corporate information while using mobile applications
P.Zou et al. [17] proposes Phosphor in which interaction
like online payment, social networking etc, that can be an
between Sim card and Digital Rights Management Agent has
attacker’s new target.
been protected by the License Status Word protocol.
22
International Journal of Computer Applications (0975 – 8887)
Volume 80 – No 11, October 2013
R.Chow et al. [18] present authentication platform in which Niroshinie Fernando et al. [4] proposed generic architecture
behavioural authentication is used based on client personal for implementing a mobile cloud with locally available mobile
data. The cloud authentication platform responds to the client devices. This architecture has components: 1) Resource
access request based on decision obtained by processing Handler 2) Cost manager 3) Job handler 4) Privacy and
behavioural data of the authenticated client, however, passing Security Manager 5) Context Manager. Resource manager
the personal information of the client to cloud can affect the manages resources like searching and connecting other mobile
user privacy. devices. Cost manager takes the decision of offloading
according to user’s priorities like battery conservation, fast
Itani et al. [19] proposed a cloud based energy efficient execution, monetary gain etc. Job handler partitions the job
framework to ensure integrity of mobile users. In this for offloading and maintains job pool. Privacy and security
approach there are three main components (a) mobile client manager maintain the security while interfacing with other
(b) cloud service provider (c) trusted third party. Cloud devices. Context manager helps job handler in resource
service provider provides storage resources. The security is monitoring and to manage mobility inside the cloud.
provided by trusted third party. The framework shows 90%
saving in processing and energy but suffers from limitation of Saman Zonouz et. al. [27] proposed Secloud; a cloud based
data security in public cloud and less scalability of trusted comprehensive and lightweight security for smartphones.
third party. Secloud runs the emulators of Smartphones in cloud which
provide security to mobile device by security analysis of data
Jia et al. [20] presents framework for secure data service with in mobile device. In this architecture cloud assumes to be
proxy re-encryption (PRE) scheme and identity based fully trusted which needs to be reconsidered .The personal
encryption (IDE) scheme . In this scheme, privacy of user is data of users accessed to the cloud can affect the privacy
secured as the cryptography of data is done by user but it issues.
increases the energy and processing requirement of mobile
device. Table 1 summarizes the features of the various approaches
described above.
Huangs et al. [21] proposed framework for authentication on
MobiCloud, to achieve secure data processing. 5. OPEN ISSUES IN MOBILE CLOUD
.Hsueh et al [22] proposed authentication mechanism in which COMPUTING
mobile device encrypts the credential information file and To develop efficient cloudlet design with minimum
stores it on cloud but infected cloud server can steal the user cloudlet installation cost and more computing power and
credential information by decrypting user’s files. less network latency.[3]
Yang et al. [23] presents public provable data possession To develop efficient security and privacy algorithm for
scheme for mobile cloud computing. Client’s mobile device ensuring confidentiality, integrity, authenticity and
embedded with trusted platform model (TPM) chip ensures privacy of user data [23].
authenticity of client and generates secret key for secure data
transmission between client and trusted third agent. The To develop efficient task portioning algorithm for
secure data transfer between TPA and client is done with ensuring less communication cost and less energy
Diffie Hellman Key Exchange. TPA does all the heavy work requirement on mobile device [28][11].
of encryption, decryption and authentication on behalf of
To provide software libraries with clearly defined API
mobile device. Proposed framework uses Bilinear mapping
support for mobile cloud application developer.[29]
and merble hash tree for integrity. This scheme ensures
privacy, confidentiality and integrity of user data stored on To design platform independent security algorithm [30].
cloud but leads to degradation of performance with the
increase of users in TPA. Cost also increases due to two cloud To reduce the cost of security framework by removing
service providers. trusted party agent between cloud and client [13][17].
23
International Journal of Computer Applications (0975 – 8887)
Volume 80 – No 11, October 2013
Table1. Comparisons between Researches in Privacy and Security Issues in Mobile Cloud Computing.
Xiao and 2010 Lightweight Semi trusted Authorization No Automatic Dynamic More processing
Gong [12] algorithm of user’s data updation of and energy burden
in cloud credential on mobile device
information
Wang and 2010 Top down Distrusted Privacy No Reduced More energy
Wang [13] spatial preserving communication cost consumption and
cloaking framework in by doing spatial processing burden
location based cloaking based on on mobile device
Scheme the historical data in
cloud.
Huang et al. 2010 MobiCloud distrusted Security in Yes Secured data while Increased cost due
[14] Storage as a using Public Cloud to two cloud
Service in providers
MANET
G. 2010 Threat Fully trusted Security as a No Reduced More Cloud usage
Portokalidis detection in Service transmission cost.
et al. [15] Smartphone overhead and
based on energy consumption
CloudAV
R.Chow et 2010 Policy based Fully trusted Authentication No Authentication Privacy threat
al. [18] cloud of user. based on
authenticatio behavioural data of
n platform user
Jia et al. 2011 Proxy re- Semi trusted Secure data No Reduced cost of More processing
[20] encryption Service updating of access and energy burden
(PRE) policy and on mobile device
scheme and communication cost for encrypting the
Identity based secret information
encryption saved on cloud.
(IDE) scheme
Yang et al. 2011 extended the Distrusted ensures Yes Reduced energy and Degradation of
[23] public privacy, processing performance with
provable data confidentiality requirement on the increase in no.
possession and integrity of mobile device of users in Trusted
scheme user data Party Agent (TPA).
stored on cloud Cost also increases
due to two cloud
service providers.
Saman 2013 Secloud for Trusted cloud based No Reduced energy and Cloud assumes to
Zonouz et smartphones comprehensive processing be fully trusted
al. [27] and lightweight requirement on which needs to be
security for mobile device for reconsidered .The
smart phones providing security personal data of
in mobile device users accessed to
the cloud can affect
the privacy issues.
24
International Journal of Computer Applications (0975 – 8887)
Volume 80 – No 11, October 2013
[4] Niroshinie Fernando , Seng W, Loke Wenny, Rahayu. [17] P. Zou, C. Wang, Z. Liu , and D. Bao, “ Phosphor: A
“Mobile Cloud Computing: A Survey,” published in Cloud Based DRM Scheme with Sim Card,” in
Journal of Future Generation System ,Vol 29,issue Proceedings of the 12th International Asia-Pacific on
1,2013,January,2013,pp.84-106 Web Conference (APWEB), June 2010,pp. 459.
[5] Daniela POPA ,Marcel Cremene ,Monika Borda,Karima [18] R. Chow, M. Jakobsson, R. Masuoka, J. Molina, Y. Niu,
Boudaoud ,” A Security Framework for Mobile Cloud E. Shi and Z. Song,” Authentication in the clouds: a
Applications,” published in IEEE 11th Roedunet framework and its application to mobile users,” in
International Conference,2013,pp. 1-4. Proceeding ACM Cloud Computing Security Workshop,
CCSW ’10, Chicago, USA,Oct. 2010.
[6] India Knowledge@Wharton (2013,june 13) Mobile's
Dramatic Growth in India Spurs a New Era of E- [19] W. Itani, A. Kayssi, and A. Chehab,” Energy-efficient
commerce,[Online],Available: http://knowledge.wharton. incremental integrity for securing storage in mobile
upenn.edu/india/article.cfm?articleid=4739.l cloud computing,” in Proceeding International
Conference on Energy Aware Computing, ICEAC ’10,
[7] K. Raghu (2008, Sept 24).IBM’s India Lab to Innovate Cairo, Egypt, Dec. 2010.
Cloud Computing Solutions, [Online] Available:
www.livemint.com/2008/09/24222631/IBM8217s-India- [20] W. Jia, H. Zhu, Z. Cao, L. Wei and X. Lin,” SDSM: a
lab-to-innov.html. secure data service mechanism in mobile cloud
computing,” in Proceeding IEEE Conference on
[8] Nir ksshetri ,” Cloud Computing in India” published in Computer Communications Workshops, INFOCOM
IEEE Computer Society,2012 WKSHPS, Shanghai, China, Apr. 2011.
[9] Times of India, C. Gopalakrishnan (2011,29 Sept).How [21] D. Huang, Z. Zhou, L. Xu, T. Xing and Y. Zhong,”
Cloud Technology Can Help You Spot Fake Secure data processing framework for mobilecloud
Drugs,[Online],Available : computing,” in Proceeding IEEE INFOCOM Workshop
http://timesofindia.indiatimes.com/tech/personal- on Cloud Computing, INFOCOM ’11, Shanghai, China,
tech/computing/How-cloud-technologycan-help-you- June 2011.
spot-fake-drugs/articleshow/10168266.cms
[22] S.C. Hsueh, J.Y. Lin and M.Y. Lin,” Secure cloud
[10] Oberheide, J., Veeraraghavan, K., Cooke, E. and storage for conventional data archive of smart phones “
Jahanian, F.2008,Virtualized in-cloud security services in Proceeding 15th IEEE International Symposium on
for mobile devices. In Proceedings of the 1st Workshop Consumer Electronics ,ISCE ’11, Singapore, June 2011.
on Virtualization in Mobile Computing (MobiVirt),31-
35. [23] J. Yang, H. Wang, J. Wang, C. Tan and D. Yu1,
“Provable data possession of resource constrained
[11] Zhang, X., Schiffman, J.,. Gibbs S, Kunjithapatham, A., mobile devices in cloud computing,” Journal of
and Jeong S.2009,Securing elastic applications on mobile Networks ,2011,pp. 1033–1040.
devices for cloud computing.In Proceeding ACM
workshop on Cloud computing security, CCSW ’09, [24] Y.J. Chen and L.C. Wang,” A security framework of
Chicago, IL, USA. group location-based mobile applications in cloud
computing,” in Proceeding. International Conference on
[12] Xiao, S. and Gong ,W.,2010. Mobility can help: protect Parallel Processing Workshops, ICPPW ’11, Taipei,
user identity with dynamic credential.In Proceeding 11th Taiwan, Sep. 2011
International Conference on Mobile Data Management,
MDM ’10, Missouri, USA, May 2010. [25] W. Ren, L. Yu, R. Gao and F. Xiong,” Lightweight and
compromise resilient storage outsourcing with
[13] Wang, S .and S. Wang X.,” In-device spatial cloaking for distributed secure accessibility in mobile cloud
mobile user privacy assisted by the cloud”, in computing,” Journal of Tsinghua Science and
Proceeding 11th Interantional Conference on Mobile Technology,2011,pp. 520–528.
Data Management,MDM ’10, Missouri, USA, May
2010. [26] Z. Zhou and D. Huang,” Efficient and secure data storage
operations for mobile cloud computing,” IACR
[14] D. Huang, X. Zhang, M. Kang and J. Luo,” MobiCloud: Cryptology, 2011,ePrint Archive: 185.
building secure cloud framework for mobile computing
and communication,” in Proceeding 5th IEEE [27] Saman Zonouz, Amir Houmansadr, Robin barthier,
Nikita Borisov,William Sanders,”Secloud:A cloud based
25
International Journal of Computer Applications (0975 – 8887)
Volume 80 – No 11, October 2013
comprehensive and lightweight security solution for Computing,” in preceding of the third ACM workshop
smartphones,” published in Science Direct journal of on Mobile cloud computing and services, New
Computers and security ,Volume 37, 2013, pp. 215-227. York,USA,2012,pp.21-28
[28] Han Qi and Addullah Gani,” Research on mobile Cloud [30] Wei Tang, Jun-hyung Lee, Biao Song,Motaharul
Computing:review,trend and Perspectives” in preceding Islam,Sangho Na,Eui-Nam Huh,”Multi-Platform Mobile
of IEEE second international Conference on Digital Thin Client Architecture in Cloud Environment” in
information Technology & its application,2012,pp.195- Precedia Environmental Science, Volume 11,Part
201. A,2011,pp.499-504
[29] Paramvir Bahl,Richard Y.Han,Li Erran Li,Mahadev
Satyanarayanan,”Advacing the state of Mobile Cloud
IJCATM : www.ijcaonline.org 26