See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/319980773

A Review on Data Security in Cloud Computing

Article  in  International Journal of Computer Applications · March 2014

DOI: 10.5120/16338-5625

CITATIONS READS

21 3,042

3 authors, including:

Aized Amin Soofi Fazal-e- Amin

University of Sargodha, Lyallpur Campus, Faisalabad King Saud University
7 PUBLICATIONS   112 CITATIONS    49 PUBLICATIONS   534 CITATIONS   

SEE PROFILE SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Usability Evaluation of Smartphone Web Browsers View project

Cooperative Spectrum Sensing for Cognitive Radio Networks View project

All content following this page was uploaded by Aized Amin Soofi on 25 September 2017.

The user has requested enhancement of the downloaded file.

 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

A Review on Data Security in Cloud Computing

Aized Amin Soofi, M. Irfan Khan Fazal-e-Amin

College of Computer Science and Information Department of Software Engineering
studies College of Computer and Information Sciences
Government College University King Saud University, Riyadh, KSA
Faisalabad, Pakistan

ABSTRACT principles and mechanisms to eliminate users concerns. Most

Cloud computing is an Internet-based computing and next of the cloud services users have concerns about their private
stage in evolution of the internet. It has received significant data that it may be used for other purposes or sent to other
attention in recent years but security issue is one of the major cloud service providers [6]. The user data that need to be
inhibitor in decreasing the growth of cloud computing. It protected includes four parts [7] which are: (i) usage data;
essentially shifts the user data and application software to information collected from computer devices (ii) sensitive
large datacenters i.e, cloud, which is remotely located, at information; information on health, bank account etc. (iii)
which user does not have any control and the management of Personally identifiable information; information that could be
data may not be completely secure. However, this sole feature used to identify the individual (iv) Unique device identities;
of the cloud computing introduce many security challenges information that might be uniquely traceable e.g. IP addresses,
which need to be resolved and understood clearly. One of the unique hardware identities etc.
most important and leading is security issue that needs to be
addressed. Data Security concerns arising because both user The European Network and Information Security Agency
data and program are located in provider premises. In this (ENISA) identified thirty-five risks and these risks are divided
study, an attempt is made to review the research in this field. into four categories: legal risk, policy and organizational
The results of review are categorized on the basis of type of risks, technical risks and risks that are not specific to cloud
approach and the type of validation used to validate the [8]. From these risks, the ENISA identified eight most
approach. important risks. Out of which five risks concerns directly or
indirectly related to the data confidentiality. These risks
include isolation failure, data protection, management
Keywords interface compromise, insecure data deletion and malicious
Data security, cloud data concealment, cloud security, review insider. Similarly, The Cloud Security Alliance (CSA)
identifies the thirteen kind of risks related to the cloud
1. INTRODUCTION computing [9]. Out of these thirteen risks CSA declares seven
Cloud computing is an emerging technology which recently most important risks [10]. Five of these seven risks are
has drawn significant attention from both industry and directly or indirectly related to the data confidentiality which
academia. It provides services over the internet, by using includes: account service, traffic hijacking, insecure
cloud computing user can utilize the online services of application programming interfaces, data loss/leakage and
different software instead of purchasing or installing them on malicious insiders.
their own computers. According to the National Institute of
Standard and Technology (NIST) definition, cloud computing Different countries, IT companies, and the relevant
can be defined as a paradigm for enabling useful, on-demand departments have carried out the research on cloud computing
network access to a shared pool of configurable computing security technology to expand the security standards of cloud
resources [1]. According to Gartner [2] cloud computing can computing. Existing security technology reflected in six
be defined as a style of computing that delivered IT aspects[11,12] which include: data privacy protection, trusted
capabilities ‘as a service’ to end users through internet. access control, cloud resource access control, retrieve and
process of cipher text, proof of existence and usability of data
According to recent survey by International Data Group and trusted cloud computing. To enhance the data security the
(IDG) enterprise, the top three challenges to implementing a data can be converted into cipher text but this may cause to
successful cloud strategy in enterprise vary significantly lose many features when data is converted into cipher text.
between IT and line-of-business (LOB). For IT, concerns
regarding security is (66%) and 42% of cloud-based projects There are two widely used methods to retrieve the cipher text.
are eventually brought back in-house, with security concerns First, there is a safety index-based approach which establishes
(65%) [3]. A survey conducted by International Data a secure cipher text key words indexed by checking the
Corporation (IDC) in 2011 declares that 47% IT executives existence of key words [13]. Second, there is a cipher text
were concerned about a security threats in cloud computing scanning-based approach which confirms the existence of key
[4]. In survey conducted by Cisco’s CloudWatch 2011 report words by matching each word in cipher text [14]. [15] Lists
for the U.K. (research conducted by Loudhouse) 76% of the top ten obstacles in the popularity of cloud computing.
respondents cited security and privacy a top obstacle to cloud The data security and storage issues is discussed in this article
adoption [5]. and it also analyzes the main reasons of data security issue,
possible solutions of this issues and some future development
Data security is a major concern for users who want to use of cloud computing are also discussed. [16] Explains the
cloud computing. This technology needs proper security seven phase of data life cycle in cloud computing that also

12
 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

need security to get user trust these phase include; generation, that is owned or rented by an organization (3) community
transfer, use, share, storage, archival and destruction. The aim cloud, that is similar to private cloud but cloud resources is
of cloud computing is to provide better consumption of shared among number of closed community (4) hybrid cloud,
resources and reduce the work load from user end but it exhibits the property of two or more deployment models [19].
suffers with security threats [17]. The complexity of security Figure 2 shows the NIST definition framework for cloud
in complete cloud computing environment is shown in fig 1. computing.

In figure 1the lower layer indicates the deployment models of

cloud computing namely private cloud, community cloud,
public cloud and hybrid cloud. The layer just above the
deployment model represents the services delivery model of
cloud computing. These service delivery models exhibit the
certain characteristics that are shown in the top layer. These
fundamental elements need security with respect to the
characteristics of selected deployment model. Some of
fundamental security challenges are shown in the vertical
layer given in figure 1.

Ubiquito Rapid Measure Security

us Elasticity d related to
Network Service Third
Party
Multi Resource
On-
demand Tenanc s
self y
service
Fig2: NIST cloud definition Frame work [20]
Resource pooling
Applicati In this research work we focused on the data security issue in
on cloud computing environment. Public cloud deployment
Security model mostly suffers from the risk of data security. On the
other hand, in SaaS delivery model client is dependent on
Software Platform Infrastructu service provider for proper security measures. The provider
as a as a re as a must implement some strict security measures to keep
Service Service Service
multiple users from seeing each other’s data and gain the trust
Data of users. Recent reviews on security issues in cloud
Transmis computing are presented in [21, 22, 23] but these reviews are
Private Communit sion limited and not focused on detail study of data security issue.
Cloud y Cloud Security Neither of them adopts a proper literature review process. In
our study we focused in details study on data security issue by
adopting a proper systematic literature review process.
Data
Hybrid Public
Cloud Cloud
Storage 3. METHODOLOGY
Security Empirical studies are now being undertaken more frequently,
as a means of examining a broad range of phenomenon in
computer field. A systematic literature review presented in
Fig.1 Complexity of security in cloud environment [21] [24] is followed in this research work to conduct the review.
The review process is shown in figure 3. A systematic
2. CLASSIFICATION OF CLOUD literature review endeavor to provide a comprehensive review
of current literature relevant to a specified research questions.
COMPUTING
The main attributes of cloud computing are Multi-tenancy,
Many researchers contribute their efforts in the field of
massive scalability, elasticity, pay as you go and self-
software engineering/computer science by adopting [24]
provisioning of resources [18]. The services model of cloud
systematic literature review process such as in [25, 26]
computing is divided into three categories (1) IaaS
systematic literature review process is adopted for the review
(infrastructure as a service) provides the use of virtual
of aspect oriented implementation of software product lines
computer infrastructure environment, online storage,
components and software component reusability assessment
hardware, servers and networking components; (2) PaaS (plat
approaches.
form as a service) provides platform for developing
applications by using different programming languages; (3)
SaaS (software as a service) enables the user to access online
applications and software that are hosted by the service
providers. The deployment model of cloud computing include
(1) public cloud, that owned by service provider and its
resources are rented or sold to the public (2) private cloud,

13
 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

required data was extracted from the papers to answer the

questions posed above.
Phase 1: Plan Review

1- Specify research questions Another step in the search process was performed by
2- Develop a review protocol searching the related work area of the selected papers to boost
3- Validate review protocol the review strength by confirming that no valuable reference
is missed during the search process. The collected data was
synthesized to exhibit complete results. Finally, in the third
phase of the review process, the review report was written and
Phase 2: conduct Review validated.

4- Identify relevant research

5- Select primary studies 4. RESULTS
6- Assess study quality The results of the review are presented in this section. A year
7- Extract required data wise result representation is presented in Table 2 and
8- Synthesize data frequency of papers with respect to sources is shown in Fig 4.
The results are characterized with respect to the questions
Phase 3: Document review posed earlier.

9- Write a review report Table 2 year wise search results

10- Validate report Year No. of papers
2007 0
Fig 3: Adapted review process from [24]
2008 1
2009 1
The review process has three phases that consist of ten sub
activities. In first phase of review the following questions are 2010 5
posed: 2011 5
2012 8
Question 1: What approaches have been introduced to ensure
data security in cloud computing? 2013 9
2014 2
Question 2: How the approaches have been validated? Total 31

The questions are formulated during the first sub activity of

phase 1, a review protocol was developed. The review
protocol includes the sources, time period under review and
key words used. This protocol is reviewed and validated after
making some changes by researchers.

The final review protocol is shown in table 1. The sources

used for this review include science direct, IEEE xplorer,
Google scholar, Scopus, ACM portal digital library.
Additionally we have looked at JCMS, IJSI journals. The
research focuses on the year’s 2007 to 2014.

Table 1. Review protocol

Year sources Key words

2007-2014 IEEE Xplore, Cloud computing,

science direct, cloud computing
Scopus, Google security, data
scholar, ACM security/data
portal digital concealment, cloud
library, IJERA, data security, cloud
Fig4: Frequency of papers w.r.t to sources
IJSI data storage

In the second phase of review, the search is performed by 5. QUESTION-1: WHAT APPROACHES
using different queries related to data security in cloud HAVE BEEN INTRODUCED TO
computing environment. The initial collection of research
papers was based on the key words in Table 1 in the papers ENSURE DATA SECURITY IN
keywords and abstract. The quality criteria set to assess the CLOUD COMPUTING?
studies was to include papers in the review if it contains a
The result of review (figure 5) show the proposed approaches
model, an experiment, a framework, or a guideline. The
for the data security in cloud computing. These results are
categorized into: (1) Encryption, where the plain text is

14
 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

converted into cipher text by using some encryption produce the digital signature. Digital signature will be
algorithms; (2) Homomorphic token. A technique ensures that decrypted into message digest by the software with own
we do not need to decrypt the key for data checking instead private key and public key of sender.
we can directly compare with encrypted token; (3) Guidelines.
In [28] playfair and vigenere cipher techniques were merged
Some of the studies have outlined some guidelines to ensure with structural aspects of Simplified Data Encryption
the data security in cloud; (4) Harmonizing scheme. Building Standard (SDES) and Data Encryption Standard (DES). In
a data repository; (5) data concealment component; (6) token; which 64 bit block size of plain text is taken which is fixed
(7) Framework; (8) stripping algorithm. and this 64 bit plain text is divided into two halves by using
the “black box” the right half have 2 bits whereas left half has
The categories wise results are summarized in Table 3. 6 bits, then these 6 bits are feed into “superior function” block
where these 6 bits are further separated in two halves where
Table 3 category wise results of question1 first two bits represent the rows and last four bits represent the
column by identifying the rows and column the corresponding
Question category No. of papers value can be selected. Then this function is apllied to all 8
octets of the output of vigenere block the resultant of black
What approaches Encryption 14 box is again of 64 bits then these bits are further divided into
have been 4 new octants similarly right 4 bits are unified to formulate
introduced to ensure Homomorphic token 2 right halves. Finally left and right halves are XOR-ed to
data security in obtain left half of this arrangement. This process is repeated
cloud computing? Sobol sequence 1 three times.
Guideline 6
In [29] RSA algorithm used to encrypt the data and Bilinear
Harmonizing scheme 1 Diffie-Hellman to insure the security while exchanging the
keys. In proposed method a message header is added in front
Data concealment of each data packet for direct and safe communication
component 1 between client and cloud without any third party server. When
user sends the request to the cloud server for data storage then
Framework 5 cloud server creates the user public key, private key and user
Stripping algorithm 1
identification in certain server. Two tasks performed at user
end before sending the file to cloud, first add message header
Total 31 to the data and secondly encrypt data including message
header by using secret key. When user request for data to the
cloud server then it will check the message header of received
data and pick up the Unique Identification for Server in cloud
Stripping Data (SID) information. If SID information is found it will respond
Harmonizi the user request otherwise request will be discarded.
algorithm concealme
Sobol ng 3% nt In [30], a technique is introduced to ensure the availability,
sequence 3% componen integrity and confidentiality of data in cloud by using Secure
4% t Socket Layer (SSL) 128 bit encryption that can also be raised
3% to 256 bit encryption. The user who wishes to access the data
Homomor
from cloud is strictly required to provide valid user identity
phic token and password before access is given to the encrypted data. In
7% [31], user send the data to the cloud then cloud service
Encryption provider generate a key and encrypts the user data by using
Framewor 45% RSA algorithm and stored the data into its data centre. When
user request the data from cloud then cloud service provider
k verify the authenticity of the user and give the encrypted data
16% to the user that can be decrypted by calculating the private
Guidelines key.
21%
In [32], a three layered data security model is presented in
which each layer performs different task to make the data
secure in cloud. First layer is responsible for authentication,
Fig 5: Proposed approaches to ensure data second layer performs the duty of data encryption and third
security layer performs the functionality of data recovery. In [33], RC5
algorithm is implemented to secure the data in cloud. An
encrypted data is transmitted even if the data is stolen there
5.1 Encryption will be no corresponding key to decrypt the data. In [34] Role
The results show that most common approach was encryption Base Encryption (RBE) technique is proposed to secure the
(45%) to assure the data security in cloud. In [27] a digital data in cloud and role base access control (RBAC) cloud
signature with RSA algorithm scheme is proposed to ensure architecture was also proposed which allows organizations to
the data security in cloud. In which software used to crunch store data securely in public cloud, while maintaining the
down the data documents into few lines by using “hashing secret information of organization’s structure in private cloud.
algorithm”. These lines are called message digest then
software encrypts the message digest with his private key to

15
 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

In [35], four authorities are defined i.e, data owner, data probabilistic sampling procedures. In [46], proposed
consumer, cloud server and N attribute authorities where framework is consist of three steps, in first step precaution is
attribute authorities sets was divided into N disjoint sets with made against semi-honest cloud service provider by indexing
respect to the category. The data owner gets the public key data and its metadata to ensure complete data privacy. In
from any one of the authority and encrypt the data before second step multi user private keyword searchable encryption
sending it to the cloud server. When data is requested the is performed on encrypted data to keep searches and resulting
authorities will create private key and send it to the data files secrecy from cloud service provider. Final step make the
consumer and consumer will be able to download the file only use of policy in order to support data sharing between users
if he get verified by cloud server. In [36], two types of secure by using metadata and encryption scheme.
cloud computing are proposed one require trusted third party
and other does not. These types use Elliptic Curve Diffie- 5.4 Homomorphic Token
Hellman (ECDH) and symmetric bivariate polynomial based
The homomorphic token scheme represents the 7% of the
secret sharing to ensure the data security in cloud
results. In [47], homomorphic token scheme is introduced to
environment.
ensure the data security. The proposed scheme utilizes
homomorphic token with distributed verification of erasure-
In [37], location based encryption technique by using user
coded data. It supports secure and efficient dynamic operation
location and geographical position was introduced. In which a
on data block including data delete, update and append. A
geo encryption algorithm was implemented on the cloud and
model proposed in [48] by utilizing homomorphic token
user computer and the data was labeled with the company
scheme with token pre- computation algorithm to achieves the
name or person who work in the company. When the data is
integration of storage correctness insurance and identification
required then in the cloud similar label will be searched and
of misbehaving server(s).
retrieved and the information corresponding to the label will
be retrieved. In [38], a technique is proposed by using digital
signature and Diffie Hellman key exchange in combination 5.5 Stripping algorithm, data concealment
with Advanced Encryption Standard encryption algorithm to component, harmonizing and token
protect the confidentiality of data stored in cloud. This scheme
is referred as three way mechanism because it provides
scheme
Stripping algorithm, data concealment component, and
authentication, data security and verification at the same time.
harmonizing and token scheme each represent 3% of the
5.2 Guidelines results. In [49], stripping algorithm is used to secure the
The result of our review shows that 21% of studies use picture data in cloud, the approach is consist of three modules
guidelines to ensure the security of data in cloud. In [39], which are image analysis, data separation and data
guidelines are provided for data security in cloud by distribution. [50] Proposed a design of data concealment
introducing new cloud system architecture approach which component that composed of three sub components: the
has three features i.e., separation of software service providers prediction component, data generator and data marking to
and infrastructure service providers, hiding information about secure the data in cloud. The Evaluation of this component
owner of data and data obfuscation. In [40], agents method is shows the successful conceal data of legitimate users and
introduce to ensure the data security in cloud architecture. In protect them against potential attacks.
which three agents namely file agent, authentication agent and
key managing agent was used for data security. A privacy preserving repository presented in [51], this
repository was basically concentrated on the harmonizing
In [41], guidelines about six key data technologies are operations to achieve data confidentiality while still keeping
provided which are: data privacy protection, proof of the harmonizing relations intact in the cloud. This proposed
existence and usability of data, trusted access control, retrieve scheme make data owner enables to assign most of
and process of cipher text, cloud resource access control and computation intensive tasks to cloud servers without
trusted cloud computing. In [42], guidelines are provided by disclosing data contents. [52] Proposed an effective and
giving the meta analysis of four different encryption flexible distribution verification protocol to address data
algorithms that are also helpful to selecting the best security in cloud computing. This protocol utilizes token pre-
algorithms according to need. computation using sobol sequence to verify the integrity of
erasure coded data instead of pseudorandom data. The
proposed model consist of three phases that are: file
5.3 Framework distribution, token pre-computation and challenge response
The framework approach represents 14% of the results. In protocol.
[43], a framework is provided; known as TrustCloud, in
which data centric and detective approach is propose to
increase the security of data with the objectives to encourage 6. QUESTION-2: HOW THE
the adoption of file-centric and data- centric logging APPROACHES HAVE BEEN
mechanism to increase the security and confidentiality of data VALIDATED?
in cloud computing. In [44], a framework is provided by The results related to the second question are presented here.
building a multi-tenant system. In which developed solution is Figure 6 shows the result of review regarding the procedures
divided into three layers i.e. presentation layer, business logic adopted for validation. The categories are: (1) Experiment,
layer and data access layer. These layers provide very high where an experiment is carried out to validate the results; (2)
security to user data. Comparative analysis, where the results of proposed scheme
is compared to other schemes to validate the results; (3) Test
In [45], a framework is provided that consists of protocol bed is used to validate the proposed approach; (4) Statistical
named SecCloud, which is a first protocol spanning secure analysis, where the results are analyzed by using some
storage and secure computation in cloud environment by statistical technique; (5) Meta analysis is used to validate the
designated verifier signature, batch authentication and

16
 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

results; (6) Performance analysis, where the performance of in cloud environment to validate the results obtaining by the
proposed approach is analyzed by different methods; (7) implementation of RC5 algorithm and then compare these
Some of the proposed approaches have not performed any results with Amazon S3 service. Aneka allows building and
validation. The category wise detail is presented in table IV managing an interconnected network by using Microsoft
and fig 6 shows the type of validation in percentage. Let us .NET frameworks on these networks.
explain the term validation. It refers to any kind of empirical
method used as a proof, apart from the demonstration/ In [34] proposed architecture is implemented in Java and
application of the proposed approach. results show that cipher text size is linearly proportional to the
size of the plaintext and the efficiency of encryption and
Table 4 categories wise results of question 2 decryption is very good. Results also show that the size of the
Question category No. of papers decryption key is 48 bytes which is convenient for the users.
In [39] cloud service is implemented using C# Microsoft
How the approaches Experiment 10 .NET framework for collaborative online documentation. The
have been validated? experimental results shows that service response time
No Validation 13 increases linearly as the size of the input text increases and
data obfus-cation and de-obfuscation do not cause much
Comparative 3
overhead, hence proposed approach showed realistic
Analysis
1 performance. In [50] PHP language was used for the
Meta Analysis experiment in which performance test is conducted for three
1 phases that are data generation, data marking and data
Test Bed extraction. During the performance test impact of component
1 on data generation was also observed.
Statistical Analysis
2
Performance 6.2 Comparative Analysis
Analysis 31 Comparative analysis as the form of validation is employed in
10% of the selected studies in which results of proposed
Total scheme is compared to other schemes to validate the results.
In [53] comparative analysis is conducted to validate the
results by considering following variables granularity, key
management, meta data management, level of concealment,
degree of distribution and level of implementation. In [36]
comparative analysis is made between data Privacy by
Authentication and Secret Sharing (PASS) and proposed
technique that used trusted third party and non trusted third
party. In [28], the proposed encryption technique is compared
with DES, SDES, Playfair and Vigenere encryption technique
to validate the proposed approach results.

6.3 Performance Analysis

Performance analysis is used to validate the proposed
approach in 7% of selected papers. In [47], performance
analysis is performed in terms of security and efficiency to
show that the results are validated and proposed scheme is
highly efficient and flexible against Byzantine failure and
malicious data modification attacks.

6.4 Statistical Analysis

Statistical analysis, meta analysis and test bed as the form of
validation are employed in 3% of the selected studies. In [32]
NIST statistical test are used to validate the results by
Fig 6: Type of validation selecting eight modern encryption algorithms. In [42], meta
analysis of four different security algorithms which are; AES,
The results of the question regarding validation of proposed RSA, Blow fish and DES are presented in term of platform,
approaches show that 47% of the selected papers proposed key size, key used, scalability, initial vector size, security,
approach to secure data in the cloud environment but provide data encryption capacity, authentication type, memory usage
no validation of the proposed approach. and execution time to validate the results. In [45], test bed is
developed and tested for the validation of results.
6.1 Experimental Approach
Experiments are used to validate the proposed approach in 7. CONCLUSIONS AND FUTURE
32% of the selected papers. In [30], experiment was
performed to test the validity of proposed model by using
DIRECTIONS
There are many benefits of using cloud computing such as
cloud simulator named Hadoop. It shows the status of security
cost efficiency, quick deployment, improved accessibility etc.
after implementing three security parameters which are;
However, there are yet many practical problems which have
Message Authentication Code, classification of data, index
to be solved. The data confidentiality is one of them. Many
and encryption technique. In [33] Aneka 2.0 software is used

17
 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

researchers contributed their efforts to minimize the data CLOUD’09, May 23, 2009, Vancouver, Canada,
security issue in this domain with different solutions that pp. 44-52.
described in this work. A literature review of the works in the
area of cloud computing data security is conducted and the [8] European Network and Information Security
results of review are presented in this paper. The results show Agency (ENISA)“Benefits, risks and
that the majority of approaches are based on encryption (45%) recommendations for information security”[online]
out of which 71% encryption techniques results are validated. http://www.enisa.europa.eu/activities/riskmanageme
67% of encryption techniques used experimentation to nt/files/ deliverables/cloud-computing- risk-
validate the results. These results point towards the fact that assessment. (Accessed: 28.December 2013).
most of researchers show their interest in encryption [9] Cloud Security Alliance, “Security Guidance for
technique to enhance the security of data in cloud computing Critical Areas of Focus in Cloud
environment. The results also reveals the fact of lack of Computing”[online]
validation in proposed approaches as 42% of the studies https://cloudsecurityalliance.org/csaguide.pdf
provide no validation of the results out of which 67% are (Accessed 26 December2013)
guidelines. Only few studies have used statistical analysis for
validation. This area (validation) needs the attention of the [10] J. Archer et al., “Top Threats to Cloud Computing,”
research community to gain the trust and confidence of cloud in Cloud Security Alliance [online]
computing users. https://cloudsecurityalliance.org/topthreats/csathreat
s.v1.0.pdf (Accessed: 26 December 2013).
Although our review has explored the field, further studies are
needed to confirm the obtained results. Future work includes [11] Crampton, J., Martin, K., & Wild, P. (2006, 0-0 0).
the extension of this review by including more sources On key assignment for hierarchical access control.
(conferences, journals and workshops) and questions. A future Paper presented at the Computer Security
plan is to explore the other security issues in the cloud Foundations Workshop, 2006. 19th IEEE.
computing environment and we are also aiming to design a
security model using some encryption techniques for data [12] D.Feng, et al. "Study on cloud computing security."
concealment in cloud computing. Journal of Software 22.1 (2011): pp.71-83.
[13] R. Chow, et al., "Controlling data in the cloud:
8. REFERENCES Outsourcing computation without outsourcing
[1] NIST SP 800-145, “A NIST definition of cloud control," presented at the Proceedings of the 2009
computing”, [online] 2012, ACM workshop on Cloud computing security,
http://csrc.nist.gov/publications/drafts/800- Chicago, Illinois, USA, 2009.
145/Draft-SP- 800-145_cloud-definition.pdf [14] S. Dawn Xiaoding, et al., "Practical techniques for
(Accessed: 23 December 2013). searches on encrypted data," in Security and
[2] Gartner,”What you need to know about cloud Privacy, 2000. S&P 2000. Proceedings. 2000 IEEE
computing security and compliance”(Heiser J), Symposium on, 2000, pp. 44-55.
[online] 2009, [15] Michael Annbrust etc.,Above the Clouds: A
https://www.gartner.com/doc/1071415/need-know- Berkeley View of Cloud Computing, http:
cloud- computing- Security (Accessed 23 December //eecs.berkeley.edu/Pubs/TechRpts/2009 /EECS
2013). 2009-28.pdf:2009.2 .
[3] IDG Cloud Computing Survey: “Security, [16] Deyan, C., & Hong, Z. (2012, 23-25 March 2012).
Integration Challenge Growth”, [online] Data Security and Privacy Protection Issues in
http://www.forbes.com/sites/louiscolumbus/2013/08 Cloud Computing. Paper presented at the Computer
/13/idg- cloud-computing-survey- (Accessed: 28 Science and Electronics Engineering (ICCSEE),
December 2013). 2012 International Conference on.
[4] Ricadela, “Cloud security is looking [17] Seccombe, A., Hutton, A., Meisel, A., Windel, A.,
overcast”[online] Mohammed, A., & Licciardi, A. (2009). Security
http://www.businessweek.com/magazine/cloud- guidance for critical areas of focus in cloud
security- is-lookin g-overcast-09012011.html. computing, v2. 1. Cloud Security Alliance.
(Accessd: 29December 2013).
[18] T. Mather and S. Latif, “Cloud Security and
[5] Nguyen, “Only seven percent of UK it services in Privacy,[online] 2009,
the cloud, says survey,Computerworld”[online] http://www.slideshare.net/USFstudent1980/cloud-
http://www.itworld.com/ cloud- computing security-concerns (Accessed: 4
computing/200657/only- seven-percent-uk-it- September 2013)
services-cloud-says- surveyS. (Accessed: 29
December 2013). [19] IBM, “what is cloud computing” [online]
http://www.ibm.com/cloud- computing/in/en/what-
[6] Elahi, T., & Pearson, S. (2007). Privacy Assurance: is-cloud-computing.html (Accessed: 14 December
Bridging the Gap Between Preference and Practice. 2013)
In C. Lambrinoudakis, G. Pernul & A. Tjoa (Eds.),
Trust, Privacy and Security in Digital Business [20] Mell Peter and Grance Tim, “Effectively and
(Vol. 4657, pp. 65-74): Springer Berlin Heidelberg. securely using the cloud computing paradigm”
[online] 2011, http://csrc.nist.gov/groups/SNS/cloud
[7] Siani Pearson, “Taking Account of Privacy when computing/cloudcomputing-v26.ppt (Accessed 18
Designing Cloud Computing Services,” August 2013).

18
 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

[21] Subashini, S., & Kavitha, V. (2011). A survey on [34] Lan, Z., Varadharajan, V., & Hitchens, M. (2013).
security issues in service delivery models of cloud Achieving Secure Role-Based Access Control on
computing. Journal of Network and Computer Encrypted Data in Cloud Storage. Information
Applications, 34(1), 1- 11. Forensics and Security, IEEE Transactions on,
8(12), 1947-1960.
[22] Sarwar, A., & Khan, M. N. (2013). A Review of
Trust Aspects in Cloud Computing Security. [35] Taeho, J., Xiang-Yang, L., Zhiguo, W., & Meng,
International Journal of Cloud Computing and W. (2013, 14-19 April 2013). Privacy preserving
Services Science (IJ-CLOSER), 2(2), 116-122. cloud data access with multi-authorities. Paper
presented at the INFOCOM, 2013 Proceedings
[23] Sun, D., Chang, G., Sun, L., & Wang, X. (2011). IEEE.
Surveying and Analyzing Security, Privacy and
Trust Issues in Cloud Computing Environments. [36] Ching-Nung, Y., & Jia-Bin, L. (2013, 2-5 July
Procedia Engineering, 15(0), 2852-2856. 2013). Protecting Data Privacy and Security for
Cloud Computing Based on Secret Sharing. Paper
[24] Brereton, P., Kitchenham, B. A., Budgen, D., presented at the Biometrics and Security
Turner, M., & Khalil, M. (2007). Lessons from Technologies (ISBAST), 2013 International
applying the systematic literature review process Symposium on.
within the software engineering domain. Journal of
Systems and Software, 80(4), 571-583. [37] Abolghasemi, M. S., Sefidab, M. M., & Atani, R. E.
(2013, 22-25 Aug. 2013). Using location based
[25] Fazal-e-Amin, A. K. M., & Oxley, A. (2010). A encryption to improve the security of data access in
review on aspect oriented implementation of cloud computing. Paper presented at the Advances
software product lines components. Information in Computing, Communications and Informatics
Technology Journal, 9(6), 1262-1269. (ICACCI), 2013 International Conference on.
[26] Fazal-e-Amin, A. K. M., & Oxley, A. (2011). A [38] Rewagad, P., & Pawar, Y. (2013, 6-8 April 2013).
Review of Software Component Reusability Use of digital Signature with Diffie Hellman Key
Assessment Approaches. Research Journal of Exchange and AES Encryption Algorithm to
Information Technology, 3(1), 1-11. Enhance Data Security in Cloud Computing. Paper
[27] Somani, U., Lakhani, K., & Mundra, M. (2010, 28- presented at the Communication Systems and
30 Oct. 2010). Implementing digital signature with Network Technologies CSNT), 2013 International
RSA ncryption algorithm to enhance the Data Conference on.
Security of cloud in Cloud Computing. Paper [39] Yau, S. S., & An, H. G. (2010). Protection of users'
presented at the Parallel Distributed and Grid data confidentiality in cloud computing. Paper
Computing (PDGC), 2010 1st International presented at the Proceedings of the Second Asia-
Conference on. Pacific Symposium on Internetware.
[28] Vamsee k and sriram r,(2011) “Data Security in [40] Feng-qing, Z., & Dian-Yuan, H. (2012, 24-26 Aug.
Cloud Computing,”in Journal of Computer and 2012). Applying agents to the data security in cloud
Mathematical Sciences Vol. 2, pp.1-169. computing. Paper presented at the Computer
[29] Shuai, H., & Jianchuan, X. (2011, 15-17 Sept. Science and Information Processing (CSIP), 2012
2011). Ensuring data storage security through a International Conference on.
novel third party auditor scheme in cloud [41] Zhongbin, T., Xiaoling, W., Li, J., Xin, Z., &
computing. Paper presented at the Cloud Computing Wenhui, M. (2012, 27-30 May 2012). Study on
and Intelligence Systems (CCIS), 2011 IEEE Data Security of Cloud Computing. Paper presented
International Conference on. at the Engineering and Technology (S-CET), 2012
[30] Sood, S. K. (2012). A combined approach to ensure Spring Congress on.
data security in cloud computing. Journal of [42] Rachna, A., and Anshu, P.(Jul-Aug 2013). Secure
Network and Computer Applications, 35(6), 1831- User Data in Cloud Computing Using Encryption
1838. Algorithms in International Journal of Engineering
[31] Parsi Kalpana & Sudha Singaraju (2012).Data Research and Applications (IJERA), 3(4),1922-
Security in Cloud Computing using RSA Algorithm. 1926.
International Journal of Research in Computer and [43] Ko, R. K. L., Kirchberg, M., & Bu Sung, L. (2011,
Communication technology( IJRCCT), vol 1, Issue 3-5 Aug. 2011). From system-centric to data-centric
4. logging Accountability, trust & security in
[32] Mohamed, E. M., Abdelkader, H. S., & El-Etriby, S. cloud computing. Paper presented at the Defense
(2012,14-16 May 2012). Enhanced data security Science Research Conference and Expo (DSR),
model for cloud computing. Paper presented at the 2011.
Informatics and Systems (INFOS), 2012 8th [44] Gawali, M. B., & Wagh, R. B. (2012, 6-8 Dec.
International Conference on. 2012). Enhancement for data security in cloud
[33] Singh, J., Kumar, B., & Khatri, A. (2012, 6-8 Dec. computing environment. Paper presented at the
2012). Improving stored data security in Cloud Engineering (NUiCONE), 2012 Nirma University
using Rc5 algorithm. Paper presented at the International Conference on.
Engineering (NUiCONE), 2012 Nirma University [45] Wei, L., Zhu, H., Cao, Z., Dong, X., Jia, W., Chen,
International Conference on. Y., et al. (2014). Security and privacy for storage

19
 International Journal of Computer Applications (0975 – 8887)
Volume 94 – No 5, May 2014

and computation in cloud computing. Information Applications Workshops (WAINA), 2013 27th
Sciences, 258(0), 371-386. International Conference on.
[46] Rashid, F., Miri, A., & Woungang, I. (2013, June 28 [50] Delettre, C., Boudaoud, K., & Riveill, M. (2011,
2013-July 3 2013). Secure Enterprise Data June 28 2011-July 1 2011). Cloud computing,
Deduplication in the Cloud. Paper presented at the security and data concealment. Paper presented at
Cloud Computing (CLOUD), 2013 IEEE Sixth the Computers and Communications (ISCC), 2011
International Conference on. IEEE Symposium on.
[47] Cong, W., Qian, W., Kui, R., & Wenjing, L. (2009, [51] Mishra, R., Dash, S. K., Mishra, D. P., & Tripathy,
13-15 July 2009). Ensuring data storage security in A. (2011, 8-10 April 2011). A privacy preserving
Cloud Computing. Paper presented at the Quality of repository for securing data across the cloud. Paper
Service, 2009. IWQoS. 17th International presented at the Electronics Computer Technology
Workshop on. (ICECT), 2011 3rd International Conference on.
[48] Tribhuwan, M. R., Bhuyar, V. A., & Pirzade, S. [52] Syam Kumar, P., Subramanian, R., & Thamizh
(2010, 16-17 Oct. 2010). Ensuring Data Storage Selvam, D. (2010, 28-30 Oct. 2010). Ensuring data
Security in Cloud Computing through Two-Way storage security in cloud computing using Sobol
Handshake Based on Token Management. Paper Sequence. Paper presented at the Parallel
presented at the Advances in Recent Technologies Distributed and Grid Computing (PDGC), 2010 1st
in Communication and Computing (ARTCom), International Conference on.
2010 International Conference on.
[53] Anane, R., Dhillon, S., & Bordbar, B. (2008).
[49] Leistikow, R., & Tavangarian, D. (2013, 25-28 Stateless data concealment for distributed systems.
March 2013). Secure Picture Data Partitioning for Journal of Computer and System Sciences, 74(2),
Cloud Computing Services. Paper presented at the 243-254.
Advanced Information Networking and

20
IJCATM : www.ijcaonline.org

View publication stats