Electrical Engineering & Computer Science Electrical Engineering & Computer Science

Faculty Works

2014

Survey on securing data storage in the cloud

Lei Huang
Loyola Marymount University

Follow this and additional works at: https://digitalcommons.lmu.edu/cs_fac

Part of the Electrical and Computer Engineering Commons

Recommended Citation
Huang, C., Huang, L., Qin, Z., Yuan, H., Zhou, L., Varadharajan, V., & Kuo, C. (2014). Survey on securing data
storage in the cloud. APSIPA Transactions on Signal and Information Processing, 3, E7.

This Article is brought to you for free and open access by the Electrical Engineering & Computer Science at Digital
Commons @ Loyola Marymount University and Loyola Law School. It has been accepted for inclusion in Electrical
Engineering & Computer Science Faculty Works by an authorized administrator of Digital Commons@Loyola
Marymount University and Loyola Law School. For more information, please contact [email protected].
SIP (2014), vol. 3, e7, page 1 of 17 © The Authors, 2014.
The online version of this article is published within an Open Access environment subject to the conditions of the Creative Commons Attribution licence
http://creativecommons.org/licenses/by/3.0/
doi:10.1017/ATSIP.2014.6

overview paper

Survey on securing data storage in the cloud

chun-ting huang1 , lei huang2 , zhongyuan qin3 , hang yuan1 , lan zhou4 ,
vijay varadharajan4 and c.-c. jay kuo1

Cloud Computing has become a well-known primitive nowadays; many researchers and companies are embracing this fasci-
nating technology with feverish haste. In the meantime, security and privacy challenges are brought forward while the number
of cloud storage user increases expeditiously. In this work, we conduct an in-depth survey on recent research activities of cloud
storage security in association with cloud computing. After an overview of the cloud storage system and its security problem,
we focus on the key security requirement triad, i.e., data integrity, data confidentiality, and availability. For each of the three
security objectives, we discuss the new unique challenges faced by the cloud storage services, summarize key issues discussed
in the current literature, examine, and compare the existing and emerging approaches proposed to meet those new challenges,
and point out possible extensions and futuristic research opportunities. The goal of our paper is to provide a state-of-the-art
knowledge to new researchers who would like to join this exciting new field.

Keywords: Cloud computing, Data security, Data integrity, Confidentiality, Access control, Searchable encryptions, Data availability

Received 16 September 2013; Revised 20 March 2014; Accepted 24 March 2014

I. INTRODUCTION broadband network connections. This new IT service provi-

sioning model offers users seemingly unlimited computing
Rapid advances in broadband communication and high- resources without up-front acquisition and/or sustaining
speed packet switching networks have made large file maintenance costs. Moreover, it offers on-demand elastic-
sharing much more effective during the past two decades. ity and flexibility in using computing resources. The utility
Consequently, the demand for rich media applications, pricing model allows users to pay for their actual usage only.
such as multimedia mails, orchestrated presentations, high- Storage, as one of the most influential and demanding
quality audio and video sharing, and collaborative docu- computing resources in current digital era, is among the
ments, has grown tremendously. The amount of data and first being moved into the cloud. This type of cloud comput-
computing resources being used by those applications have ing services, known as cloud storage, represents a business
also grown exponentially. As a result, the costs of IT ser- model in which the service provider rent spaces in their
vice and support, such as investment in new hardware and large-scale storage infrastructure to organizations and indi-
software, staffing for installation and maintenance are ris- viduals. It has always been one of the most prevalent services
ing consistently for both enterprises and individual users. in cloud computing industry. As an extension of tradi-
Therefore, cloud computing has become an appealing new tional data center or file hosting service into cloud, cloud
model of IT service provisioning and support driven by storage has distinct characteristics including on-demand
economic and productivity advantages. Instead of invest- self-service, broadband network access, resource multiplex-
ing in new hardware and software, as well as maintaining ing, rapid elasticity and measured usage for utility billing.
those resources, users can use applications, infrastructures, Besides the key advantages of cost saving, cloud storage
servers, storage, network, and other computing resources can facilitate information sharing and task collaborating,
that are available in the ‘cloud’, which is a shared pool of promote portability and universal accessibility of data, as
computing resources that can be easily accessed through well as provide easy and convenient solutions to some other
problems. For example, for disaster recovery purpose, orga-
1
Ming Hsieh Department of Electrical Engineering, University of Southern Califor- nizations should maintain secondary off-premise data back-
nia, Los Angeles, CA, USA
2
Loyola Marymount University, Los Angeles, CA, USA ups. Storage of sensitive data, such as financial, personal,
3
Information Science and Engineering School, Southeast University, Nanjing, Jiangsu, or medical data are subject to more and more regulations
China and legal constraints. Cloud storage offered by a regulation-
4
Information and Networked Systems Security Research, Macquarie University,
North Ryde, Australia complied service provider can relieve data owners from the
complicated process.
Corresponding author: However, the promising new paradigm of cloud com-
Lei Huang puting brings up unique challenges in terms of perfor-
Email: [email protected]
mance, availability, security, and scalability (known as

1
2 chun-ting huang et al.

PASS). Among these challenges, security issues have been architecture model of the cloud storage is also proposed
reported as the biggest concern preventing enterprises and to address security issues in different layers. In Section
organizations from adopting cloud services according to III, recent researches on data integrity protection such as
recent researches [1]. Therefore, it is imperative to provide proofs of retrievability (POR) and third party audition are
security strategies, tools, and mechanisms that meet user’s reviewed and compared. In Section IV, data confidential-
requirements in the cloud. Security in cloud computing ity and its related research work are discussed. A promising
is a complex issue spanning across many aspects includ- new encryption technique, fully homomorphic encryption
ing physical security, infrastructure (distributed computers, (FHE), which allows algebraic operations performed on
servers and other hardware) security, data security, network encrypted data, is examined in detail first, followed by
security, and software security. Moreover, it involves shared discussion on access control and searchable encryption.
responsibilities and obligations among the constituents of In Section V, we probe methods for ensuring data avail-
the cloud service. Security enforcement would not be suc- ability in distributed cloud storage systems, such as data
cessful without agreement, trust, regulations, and coordina- synchronization, data recovery, and information disper-
tion among service providers and cloud users. sal algorithms. At last, concluding remarks are given in
Since storage is one of the necessary core infrastruc- Section VI.
ture in clouds, security of data in storage is one of the
key concerns of any cloud computing systems, particu-
larly in cloud storage services. The consequences of secu- II. OVERVIEW OF SECURITY IN
rity breaches in cloud storage could be seriously damaging CLOUD STORAGE
to both service providers and users. Without trust from
users, the service provider could lose their customers. On The scope and requirements for cloud security vary signif-
the other hand, users whose valuable data lost, or sen- icantly with different cloud deployment models. National
sitive information hacked could experience irrecoverable Institution of Standards and Technology (NIST) has defined
loss or damage. There have been many cases reported [3] four deployment models of cloud computing. Private
as threats of cloud storage security. Many leading ser- cloud is provisioned for exclusive use by a single orga-
vice providers, including Amazon, Window and Google, nization comprising multiple users. Community cloud is
encountered disconnections of their web-based cloud ser- provisioned for exclusive use by a specific community of
vices due to different reasons such as power failure, hard- users from multiple organizations that have shared con-
ware, and software failures. For instance, Amazon Web cerns. Public cloud is provisioned for open use by the general
Service’s server was hit by lightning, causing destruction public. Hybrid cloud is a combination of at least two of the
on power generator. Although Amazon successfully trans- above three. Apparently, the price of deployment decreases
ferred data to a backup server, the service still stopped from private cloud to public cloud at the cost of increasing
after their uninterruptible power supply (UPS) went out. security concerns.
There was bulk email deletions in Gmail happened in Cloud storage can be deployed in any of the four deploy-
2006; numerous users found that they lost their emails ment models. Internet-based public cloud storage services
and contact information without further notification from are rapidly growing because they are able to provide users
Google. Google was unable to restore the accounts after with biggest cost saving and most elasticity. Numerous
users responded the problem. Another incident happened storage service providers (SSPs), including Amazon, IBM,
recently in July, 2012. Because of a security loophole on Google, Microsoft, EMC, HP, Symantec, Rackspace, to
the access control, Dropbox, a popular cloud storage ser- name just a few, are competing in this enormous market.
vice, was attacked by hackers. Some users reported that they However, these public cloud storage services also face high-
received tons of spam emails, and some users’ passwords est potential risks of security breaches because the shared
were even leaked. infrastructure is open to the public. As a matter of fact,
Although the security requirements for cloud storage cloud storage systems deployed in other forms of multi-
vary with different applications and users, they share the tenancy clouds, including hybrid clouds and community
same three basic objectives as any computer information clouds, are also exposed to higher risks than private cloud.
systems [2]: integrity, confidentiality and availability. Many Even in the private cloud, it is highly likely that cloud
different tools have been developed to achieve these objec- storage is managed and operated by a service provider off
tives, such as authentication, access control, encryption, premises, in order to take the most advantage of the cloud
certification, audition, and digital signature. This paper computing. In fact, the cloud storage usage, such as disas-
aims at providing a thorough study on recent data secu- ter recovery backup, requires off-premises storage. When
rity mechanisms developed for the cloud storage. Based on data are no longer stored and managed by the data owner
the results of the study, we give our insights and suggestions on its own premises, the data owner has less control over
on the future research directions in achieving each security their data. Therefore, cloud storage security is challenging
objectives. if the service providers are not trusted, regardless of the
The rest of this paper is organized as follow: the models of deployment model.
cloud storage systems and related security implications are NIST has also defined three primary cloud service
firstly introduced in Section II. A general conceptual system models. Software as a Service (SaaS) implies consumers
 survey on securing data storage in the cloud 3

utilize service provider’s application running on cloud

infrastructure, such as SalesForce CRM, YouTube, and
Google Apps (Gmail, Google Document). Platform as
a Service (PaaS), means the service provider builds an
environment for consumers to establish acquired appli-
cations with programming languages, libraries, and tools
that are already supported in the platform. Famous PaaS
includes Google App Engine, Microsoft Azure, and Cloud
Foundry from VMware. Infrastructure as a Service (IaaS),
represents consumers can deploy and manage applica-
tion, operating system with provided network, and storage
devices. Amazon’s Elastic Compute Cloud (EC2) is a lead-
ing example, with other offerings such as Rackspaces Mosso
and GoGrid’s ServePath [3]. From SaaS to PaaS, and to
IaaS, users have progressively deeper control over the stack Fig. 1. Cloud storage architecture [5].
of cloud architecture, thus share more responsibility on
security enforcement. Since different layers have different functionalities, the
Basic cloud storage services are categorized as IaaS ser- security concerns in each layer have different empha-
vice model, although many cloud storage providers are sis. The physical storage infrastructure layer deals with
offering value-added PaaS and SaaS services built upon physical and hardware security. The storage management
their baseline IaaS services. As an IaaS, cloud storage allows layer should efficiently control the resource allocation and
users to strengthen the security measure using their own reliably perform data management. In the service interface
security protection mechanisms. For example, users can layer, how to avoid the encroachment on rights of both
encrypt their data before moving them into the cloud stor- clients and service providers using secure interfaces and
age using a private key managed by themselves. In this case, APIs has been extensively discussed. In every layer, there
even if the data were accessed by unauthorized parties, the could be risks, intrusions, and attacks against data integrity,
sensitive information would not be revealed without obtain- confidentiality and/or availability. Therefore, storage secu-
ing the key. However, users of SaaS services can only rely on rity protection mechanisms should be integrated into every
the service provider’s security measures. layer, and the security objectives cannot be achieved without
The basic architecture of a cloud storage system is com- the collaborated efforts across all three layers. For exam-
posed of a storage resource pool, including the distributed ple, to ensure data availability under any circumstances such
file system, the Service Level Agreements (SLA), and service as hardware failure or disasters, the physical storage infras-
interfaces [4, 5]. In order to conceptually understand the tructure layer usually have duplicated data stored at differ-
cloud storage systems, and how security protection mech- ent locations. In case data stored in one location was lost,
anisms could be integrated and implemented in the system, the storage management layer should be able to locate the
we decompose the system architecture into a three-layer ref- available data in another location and route it to the users
erence model based on the logical function boundaries as upon their request. The service interface layer should be
shown in Fig. 1. able to effectively receive incoming requests from anywhere
In physical storage infrastructure layer, there are dis- and provide reliable access method to legitimate users.
tributed wired and wireless networks connecting a dis- Given the architecture overview of cloud storage and its
tributed storage device network. The second layer is storage security implications, we will discuss recent research efforts
management layer, which processes necessary operations, in achieving the three main security objectives, namely, data
such as data placement, replication, and reduction, on the integrity, data confidentiality, and data availability, in the
stored data in the first layer. By means of virtualization tech- following three sections, respectively.
nology, this layer becomes the intelligent abstraction layer,
which hides the complexity of the underlying layer. The ser- III. DATA INTEGRITY
vice interface layer provides the interface for users to access
their data stored in the cloud storage. Basic cloud storage Data integrity refers to the property that data have not been
systems mostly provides either a client-side software or a altered or destroyed in an unauthorized manner [6]. In
web browser interface, or sometimes both. Client-side soft- cloud storage, since users no longer possess the physical
ware has to be installed on the user’s devices used to access storage of their data, how to efficiently verify the correct-
the data, whereas a web browser interface allows access ness of out-sourced data stored in cloud server has become
of data from any place without local installations. Some a challenging as well as a promising research topic for data
advanced cloud storage systems also provide an Application storage security.
Programming Interface (API), which can be used to directly In traditional data communication networks, data
integrate access of stored data into other applications. Most integrity is usually threatened by malicious attackers only.
of those applications belong to PaaS or SaaS based on the Both the sender and the receiver of data are trusted and
cloud storage infrastructure. collaborated in detecting and protecting data integrity.
4 chun-ting huang et al.

However, in cloud storage, the cloud storage servers (CSSs)

are not always trusted. The cloud SSP has motivations to
elude the service users on stored data status. For instance,
A service provider may remove the rarely accessed data in
order to economize the storage usage, or hide the data loss
incidents for maintaining its reputation. Moreover, a mali-
cious server may change or replace the stored data. In order
to prevent the above instances, it is more valuable to have
data integrity verification process in place and regularly
query the correctness of data in storage servers. An effec-
tive verification mechanism can also allow the user to detect
the threats of data integrity in cloud storage sooner, and
take necessary actions to minimize the damage or recover
the lost caused.
There are three basic requirements for data integrity ver-
ification process, namely, efficiency, unbounded use, and
self-protect mechanism. Efficiency implies minimal net- Fig. 2. Schematic of a POR system [9].
work bandwidth and client storage capacity are needed for
the verification process. The client does not need to access In the following subsections, we will first introduce POR
the entire data for verification purpose. Unbounded use rep- and PDP, followed by their developments to improve effi-
resents verification process should support unlimited num- ciency, dynamic data support, and public verifiability.
ber of queries. Self-protect mechanism means the process
itself should be secure against malicious server that passes
A) Introduction to POR and PDP
the integrity test without accessing the data. As s widely studied mechanism to ensure data integrity,
A number of different techniques and mechanisms have POR was firstly proposed by Juels and Kaliski in 2007 [9].
been proposed and designed for cloud data integrity ver- Figure 2 depicts the general schematic of the proposed POR
ification process. The mainstream of research in this field system, which ensures the server (prover) to a client (ver-
belongs to POR and Provable Data Possession (PDP), both ifier) that the stored data are intact during the storing and
were designed to the above three requirements. The two retrieving process of the client. The client first encode a raw
methods originally emerged with a similar concept but dif- file F through an encoding algorithm into an encoded file F’
ferent approaches. Since then, each one had gone through and then stores it in the prover. A key generation algorithm
further development along different directions such as produces a key K stored in the verifier, and it is used to
dynamic data support, public verifiability, and privacy encode. For the checking process, the verifier can perform
against verifiers. Dynamic data support allows a client to challenge–response process with prover in order to check if
dynamically update their data partially after uploading the F can be retrieved.
data. Public verifiability enables everyone, not just data The first POR scheme introduced by Juels and Kaliski
owner or verifier, to perform verification process. Privacy employed a sentinel scheme. POR protocol encrypts F and
against verifiers ensures that the verification process does inserts randomly several sentinels into the other file data
not contain any private information of data owner. POR and blocks after encryption. These sentinels play an crucial role
PDP schemes with their developments will be discussed and for verification. The verifier can challenge the prover by
compared in more detail later in this section. pointing out the positions of a collection of sentinels, and
Besides those two approaches, there are several methods the prover should return the values of the sentinels. If the
studied to address the storage data integrity issue resulted values are different from the verifier’s data, then it shows
from data insertion, modification, and deletion at the block that prover has deleted or modified F. POR also includes
level. In 2010, Proof of Erasability (POE) scheme was pro- error-correcting code to recover a small portion F if cor-
posed by Paul and Saxena [7]. POE addresses clients’ need rupted. However, this scheme requires pre-processing and
to ensure a comprehensive destruction of the stored data in encoding of F prior to store into the data storage, and it is
the storage when they withdraw the data and disassociate bounded use – number of sentinels can be used up for lim-
with the storage provider. This model plays a role as prob- ited queries. Therefore, Juels and Kaliski proposed another
ing engineering or destructor, which can ensure the stored technique from Lillibridge et al. [10], Naor and Rothblum
data are shredded partially or fully based on the rules of [11]. It stores the redundantly encoded data blocks with mes-
data store. Nevertheless, this scheme only allows the data sage authentication code (MAC) to replace sentinels, and
owner knowing the data are being destroyed. Another par- the MACs are stored together with data blocks. In this
allel scheme called Proofs of Secure Erasure (PoSE-s) also has case, verification algorithm can examine the data integrity
a similar function on remote attestation [8]. Even though and ensures retrievability by requesting random number of
this scheme was proposed to replace hardware-based attes- block positions with their MACs. This approach resolves
tation, it is suitable for updating secure code and secure bounded use problem of the previous scheme, but at the cost
storage erasure for cloud. of higher communication complexity of the audit.
 survey on securing data storage in the cloud 5

complexity from O(t) to O(1), where t is the number of

block positions. However, this scheme still works on static
data only, without support of dynamic data update. Besides,
the security parameter relies on Random Oracles, which
means the client’s challenge size grows up to O(t 2 ).
A new system model, as depicted in Fig. 4, which aimed
at establishing a trustable mechanism between client and
CSS by introducing a Third Party Auditor (TPA), was pro-
posed in 2009 [18]. By using a privacy-preserving third-
party auditing protocol, the TPA is trusted to monitor the
stored data in cloud and transactions between the client and
CSS, as well as assess and expose risks of the cloud ser-
vices. This new scheme has been further developed based
upon existing PORs and newly developed cryptographic
primitives [17, 19–22].
Fig. 3. Schematic of a PDP system. TPA typically adopts a public-key-based homomorphic
On the other hand, PDP came out concurrently with authenticator with random masking to perform traffic
Juels–Kaliski’s scheme. It was proposed by Ateniese et al. auditing without a local copy of the data for integrity check.
[12] and constructed based on symmetric key cryptography. This public audit system can be constructed from the setup
PDP firstly chose RSA-based homomorphic verifiable tags stage, which allows a user to initialize the secret parame-
[13] to combine multiple file blocks into a single value. A ters of the system, send the verification metadata to TPA,
similar approach was also adopted later by Shacham and and audit the corresponding result. In this process, TPA
Waters [14]’s POR scheme in 2008. PDP scheme also pro- will issue an audit message to the server for checking the
vides data format independence, and it puts no restriction user’s data.
on the format of data. In other words, PDP allows any veri- Homomorphic authenticators are used to verify meta-
fier (not only client) to query the server. POR and PDP both data generated from individual data blocks while the aggre-
employed erasure code, which is a Forward Error Correc- gated authenticators can justify a linear combination of
tion (FEC) for the binary erasure channel, helping recovery data blocks. As a paradigm, one can use a homomorphic
of the original message from slightly damaged data. The token with distributed verification to check the integrity
major difference between initial POR and PDP is that POR of erasure-coded data. The erasure-correcting codes play a
ensures not only data integrity at the server end but also vital role in preparing files for distribution so that the dis-
retrievability, whereas PDP guarantees only data integrity at tributed files have redundancy parity vectors and the data
cloud data storage. Nevertheless, PDP is more efficient com- dependability property. However, the linear combination
pared to Juels–Kaliski’s POR, since it does not require any of data blocks may potentially reveal users’ privacy. With
bulk encryption, and PDP requires smaller storage space random masking, TPA cannot derive user’s data content by
on the client side and fewer bandwidths for challenges and building a correct group of linear equations.
responses. However, both schemes work on static data only, The above model was further improved in [23] by inte-
even though Ateniese et al. [15] proposed a dynamic version grating dynamic data support in 2011. Zhu et al. [24] also
later in 2008, but it is restricted by number of queries and proposed a construction of dynamic audit services for
basic block operations (Fig. 3). untrusted and out-sourced storage. It can detect abnormal
behavior by using fragment structure, random sampling,
and index-hash table.
B) Improvement on public verifiability Even though TPA-based schemes allows public verifi-
Since the Juels–Kaliski’s original POR scheme was proposed cation of data integrity checking, They have a potential
without implementation of public verifiability, and its com- obstacle that requires an additional constituency, which is
plexity was still high for communication and client storage, a third party auditor, added to the entire existing data stor-
it became a popular topic for researchers to improve public age scheme. The implementation of such schemes might be
verifiability and efficiency (discussed in the next subsec- a burden for service providers because of additional costs.
tion). In 2008, Shacham and Waters [14] proposed two new To address this concern, Han and Xin [25] proposed a new
PORs system structures based on Juels–Kaliski’s POR con- scheme offering the traditional TPA functions provided by
cept. Both solutions allow only one authentication value for CSP in a trustful manner. This scheme utilizes RSA and
the purpose of verification. The first one is privately ver- Bilinear Diffie–Hellman techniques, creates message header
ifiable using pseudorandom functions (PRFs); the second and mechanisms to achieve authentication process, while
one is publicly verifiable, and it was built based on signa- reducing complexity of cloud computing. Another work
ture scheme of Boneh, Lynn, and Shacham in a bilinear that provides public verifiability without help from the third
group [16]. Since the BLS signature was adopted, the public party auditor was examined in [26] based on the work of
retrievability was achieved, and the proofs are reduced to Sebe et al. [27], and it has been proved to be secure from an
a single authentication value, thus reduced communication untrusted server.
6 chun-ting huang et al.

Fig. 4. TPA structure [17].

C) Improvement on efficiency it was only relied on symmetric-key cryptography. On the

other hand, it only allowed a limited number of queries and
Efficiency of POR and PDP has been improved from differ-
basic block operations with limited functionality. For exam-
ent aspects of the verification process. For instance, Curt-
ple, block insertion was not supported. Moreover, public
mola et al. [28] showed how to integrate error-correcting
verifiability was not supported either.
codes with PDP and an adversarial error-correcting code
In 2009, Erway et al. proposed an improvement on PDP,
construction similar to PORs. It also enabled PDP scheme
referred as dynamic provable data possession (DPDP) [34].
to secure multiple replicas over distributed system without
In order to support provable updates on the stored data, this
encoding each separate replica.
new model utilized authenticated directories based on rank
Besides, Dodis et al. [29] provided different solutions of
information, and it defined the update as block insertion,
optimized POR schemes under different constraints, such
modification, or deletion to achieve dynamic PDP scheme.
as bounded-use or unbounded-use, knowledge-soundness,
Nevertheless, this scheme maintains skip list [35] for tags
or information-soundness. They analyzed the tradeoffs in
and stores root metadata in clients side to prevent replay
parameters and security between bounded and unbounded
attack, so its computational and communication complexity
use schemes, and they also compared PORs under different
can be up to O(log t).
circumstances in detail. It also improved the Shacham–
The dynamic data updates on POR were first consid-
Waters POR scheme by avoiding the usage of Random Ora-
ered in 2009. Wang et al. [17, 18] proposed the first scheme
cles, which reduced the challenge size down to be linear in
that achieved efficient data dynamics of the POR model by
the security parameter, from O(t 2 ) to O(t).
utilizing the homomorphic token with distributed verifica-
In addition, a theoretical framework of PORs improve-
tion of erasure-coded data, and manipulation of the Merkle
ment was concurrently proposed by Bowers et al. [30].
Hash Tree (MHT) [36], respectively. The first scheme sup-
The model offers an improvement over the protocols of
ported block update, delete and append operations only,
Juels–Kaliski [9] and Shacham–Waters [31] by proposing
while the second scheme provided both public verifiability
a new variant to achieve lower storage overhead and tol-
and data dynamics for remote data integrity check, but the
erate higher error rates. The proposed POR scheme also
verification complexity increased to O(log n) from O(1) as a
decreased the challenge size to be linear of the security
trade-off, and it achieved partially dynamic instead of fully
parameter. Another POR scheme was proposed by Kumar
dynamic. Both schemes also showed a new system model
and Saxena in 2011 [32]. It targeted on simplification of
involving TPA.
Juels–Kaliski’s sentinel scheme, making it suitable for lim-
In addition, Zheng and Xu presented a new POR scheme
ited computational power or small storage at verifier end.
with a fresh property, namely, fairness, to deal with dynamic
For PDP, Ateniese and Burns et al. concluded previous
data [37]. This property prevents unscrupulous clients from
research developments and implementations of PDP in 2011
accusing a legitimate server about modifying their stored
[33], and proposed two improved provably secure PDP
data. This issue arises because of the feature of dynamic
schemes with higher efficiency than previous ones.
data. POR for static data storage can solve this problem
simply by asking the verifier to approve and sign digitally
D) Improvement on dynamic data support
when the data has not been stored into the storage. The pro-
Supporting dynamic data update in data integrity verifi- posed fair and dynamic proof of retrievability (FDPOR) was
cation schemes are especially challenging. Ateniese et al. mainly composed of two parts, a new authenticated data
[15] proposed the first partially dynamic PDP scheme in structure: range-based 2–3 tree (rb23Tree) and a new incre-
2008. This scheme was more efficient in setup and verifi- mental signature scheme called hash-compress-and-sign.
cation phase compared to its previous version in [12], since However, FDPOR did not support public verifiability, and
 survey on securing data storage in the cloud 7

complexity for both the verifier and the prover were higher re-encrypt after the computation. During this process, sen-
than that of previous PORs. sitive information could have been leaked to the curious
server. Otherwise, user would be forced to compromise
E) Summary with the service provider by uploading plaintext and sign-
ing SLA, which exposes their data to higher risks. To solve
PORs and PDPs are the major remote data integrity check- this problem, there have been research attentions drawn to a
ing protocols proposed in cloud storage systems. The orig- newly proposed encryption primitive, namely, FHE, which
inal POR and PDP protocols differs in many aspects. PORs allows ciphertext to be computed without affecting decipher
are considered to be more secure compared to PDPs, process.
because it requires encryption of the original data and error In the following of this section, we first examine new
correction coding to recover damaged data, whereas PDPs access control mechanisms with higher efficiency and fine-
are known for higher efficiency and applicability to large- grain user control suitable for cloud storage. Then introduce
scale public databases, such as digital libraries. With further some new concept of data encryption schemes, such as
improvement of each, the two schemes have been con- searchable encryption and FHE, and discuss their poten-
verging toward the same objectives. For example, although tial applications in protecting data confidentiality in cloud
public verifiability and homomorphic verifiable tags were computing. Then, Other data confidentiality approaches are
first known for PDPs, these characteristics are also applica- also briefly discussed. We provide our insights of the current
ble to PORs. On the other hand, some PDP variants may research efforts and future directions in data confidentiality
also adopt encryption and/or error correction coding tools to summarize this topic.
to strengthen their security measurement. Therefore, it is all
about making tradeoffs among security functionalities and
efficiency.
In Table 1, we summarize the above reviewed POR and A) Access control
PDP schemes by a thorough comparison of their per- As mentioned above, access control has been one of the
formances. It is noteworthy that schemes with dynamic key mechanisms to protect data confidentiality in tradi-
data support suffers higher complexities compared to their tional data networks. It is designed to block unauthorized
counterparts. Future research directions include further users and malicious hackers from accessing data. Although
improvements on efficiency and fully dynamic data sup- the objective of access control in cloud storage does not
port. To improve efficiency of those schemes, reducing differ from that in traditional data network, the require-
communication cost and storage overhead are rightful ment does change. Traditional access control enforced by
considerations. However, fully dynamic data support is a the service provider could not stop a curious cloud service
challenging objective, because it increases complexity but provider accessing users’ sensitive data, which was stored
reduces update information on server-end. in the service provider’s infrastructure and managed by
the service provider. A curious cloud storage server try-
IV. DATA CONFIDENTIALITY ing to derive sensitive information from its stored data, or
from data operations performed by data owner and autho-
Data confidentiality in cloud storage security refers to the rized users, is a new threat model against data confidential-
property that information stored in the cloud storage is not ity in cloud storage service. Moreover, a malicious service
made available or disclosed to unauthorized individuals, provider could intentionally leak the data to unauthorized
entities, or processes. Access control and data encryption parties for profit, or a malicious attacker could compromise
have been widely deployed to protect data confidentiality the service provider and get unauthorized access to the data.
in the traditional data communication networks. It is nat- To address this challenge, cryptographic access control
ural to extend their deployment in cloud storage systems. schemes that shifted the access control agency from the ser-
For instance, Secure Socket Layer (SSL) and AES-256 bit vice provider to the users have been proposed. Instead of
encryption are adopted in Dropbox to ensure data secu- relying on untrusted service provider to grant access con-
rity. However, data confidentiality in cloud storage systems trol, users can enforce their own access control by selectively
faces new risks and challenges, thus calls for new tech- granting different decryption access to a certain part of
niques or improved mechanisms. In this section, we discuss encrypted data. By means of encryption, the owners of data,
new challenges faced by access control and data encryp- i.e., cloud storage users who lost their physical control over
tion mechanisms, as well as recent developments to meet their own data could regain their control at the semantic
those challenges of data confidentiality protection in cloud level.
computing. Plutus [39] and SiRiUS [40] are examples of using
Although traditional encryption techniques can hide the encryption to secure file sharing on remote untrusted stor-
information of data from the cloud server, it would not age. These schemes encrypted different files with different
provide a satisfactory solution if users demand to compute keys, thus changing the problem of access to files to the
on their stored data. Since the computing can not be func- problem of key management. However, this approach is not
tionally performed on the ciphertext, users would have to scalable when applying to cloud storage, because the com-
decrypt the data before performing any computation and plexity of key management increases with the number of
8 chun-ting huang et al.

Table 1. Performance comparison for data integrity verification schemes

Data dynamic Public verifiability Retrievability Server comp. Verifier comp. Communication comp. TPA

2007 JK [9] Static No Yes O(1) O(1) O(t) No

2008 SW [31] Static Yes Yes O(1) O(1) O(1) No
2009 Wang [17, 18] Partially dynamic Yes Yes O(log t) O(log t) O(log t) Yes
2009 Dodis [29] Static Yes Yes O(1) O(1) O(1) No
2009 Bowers [30] Static Yes Yes O(1) O(1) O(1) No
2010 Wang [38] Static Yes Yes O(1) O(1) O(1) Yes
2011 Saxena [32] Static No Yes O(1) O(1) O(1) No
2011 Zheng [37] Partially dynamic No Yes O(log t) O(log t) O(log t) No
2007 Ateniese [12] Static Yes No O(1) O(1) O(1) No
2008 Ateniese [15] Partially dynamic No No O(1) O(1) O(1) No
2008 Curtmola [28] Static Yes No O(1) O(1) O(1) No
2009 Erway [34] Fully dynamic Yes No O(log t) O(log t) O(log t) No
2011 Ateniese [33] Partially dynamic Yes No O(1) O(1) O(1) No
2011 Hao [26] Fully dynamic Yes No O(log t) O(log t) O(log t) No

files and/or the number of users, which both could be enor- with an access tree over the attributes during encryption.
mous in a cloud storage system. As a large number of users As a result, in KP-ABE scheme, it is the key distributor
are sharing the same infrastructure in a public cloud storage (usually the service provider), who decides the access pol-
built upon a complicated network scale, it is crucial to have icy, while in CP-ABE scheme, it is the encryptor (usually
efficient, scalable and reliable access control mechanism in the data owner) who controls the access over the encrypted
place. data.
In the following, we examine recent research on more In the above-mentioned ABE schemes, the access pol-
efficient access control using encryption techniques devel- icy can only contain logical formula “and” and “or”, and
oped for cloud storage systems. threshold gates. A KP-ABE scheme was introduced in [44]
which allows “negative” constraints to be represented in
1) Access control using attribute-based encryption (ABE) access policies. Additionally, many CP-ABE schemes were
In attribute-based access control (ABAC) model, access is proposed such as [45–47] which either achieve chosen-
granted based on attributes of the user. When applied to ciphertext attack (CCA) secure or are built on different
cloud storage, access control is enforced on data encrypted security assumptions. Even though the KP-ABE and CP-
using ABE schemes. In an ABE system, a user’s keys and ABE work in reverse manner, Goyal et al. [48] provided a
ciphertexts are labeled with sets of descriptive attributes. generic approach to transform a KP-ABE scheme into a CP-
A particular key can decrypt a particular ciphertext only if ABE one. Malek and Miri combined the two ABE schemes
there is a match between the attributes of the ciphertext and into one system, and proposed a balanced access control
the user’s key. that allows both service provider setting up system wide
The concept of ABE was introduced by Sahai and Waters access policies and data owner setting up access structure
[41]. Their access control allowed for decryption when the to their own data [49]. Further research on ABE is also
number of overlapped attributes between a ciphertext and discussed in [50, 51]. In a dynamic system, access policies
a private key exceeds a specified threshold k. The fuzzy may differ from time to time, and user qualifications may
nature of this scheme was originally designed for error- also change. Therefore, the ability to revoke attributes from
tolerant identity-based encryption scheme that could use a user is desired in ABE systems. Several revocable ABE
biometric identities. However, with a threshold-based flat schemes [52, 53] were proposed where an ABE system is able
access structure, it could not be generalized to other appli- to revoke users from accessing encrypted data to which they
cations. Two prominent ABE schemes with more general used to have access in the system.
tree-access structures, namely, Key-Policy Attribute-Based When using the ABE in a system where there is a
Encryption (KP-ABE) [42] and Ciphertext-Policy Attribute- large number of attributes, assessing the qualification of
Based Encryption (CP-ABE) [43], were proposed in 2006 users and generating decryption keys by a central author-
and 2007, respectively. Both algorithms associated a set of ity becomes impractical. Multi-Authority Attribute-Based
expressively descriptive attributes with a tree-access struc- Encryption (MA-ABE) was first proposed to address this
tures to enforce access control on the encrypted data, but issue in 2007 [54]. In a MA-ABE scheme, attributes are
they work in a reverse manner. In KP-ABE, each ciphertext divided into different sets, and each set can be man-
was labeled with a set of attributes during encryption, while aged by an independent attribute authority. Corresponding
the users’ private keys were associated with an access tree attribute keys for decryption are issued by multiple attribute
specifying which ciphertexts the key can decrypt. On the authorities, and encryptors can specify an access policy that
contrary, in CP-ABE, Users’ private keys were based on requires a user to obtain decryption keys for appropriate
a set of their attributes while ciphertexts are associated attributes from different authorities in order to decrypt a
 survey on securing data storage in the cloud 9

message. Subsequently, several other MA-ABE construc- a small team of security administrators. Zhou et al. [65]
tions were proposed in [55, 56]. proposed a new RBE scheme using an identity-based broad-
cast encryption (IBBE) algorithm [66], which allows user
2) Role-based access control (RBAC) memberships to be managed by individual roles. In the
Another access control model called RBAC [57, 58], has also new RBE scheme, plaintext can be encrypted to a specified
been commonly adopted in traditional storage system in role, and only users in that role and its predecessor roles
order to simplify management of permissions. Its access can decrypt the data with their role secrets and decryption
policy is determined based on different roles assigned to keys. The employment of a broadcast encryption algorithm
users by the system, while the data owner can specify a set allows dynamically adding new users into a role without re-
of permissions of their data to different roles. By separa- encryption, as well as revoking an existing user from a role
tion the tasks of role assignment and permission assign- without affecting any other existing users. In addition, this
ment, RBAC is much more efficient and scalable compared scheme has other features such as constant size keys and
to other access control based on individual users, because ciphertexts.
the number of roles are usually significantly less than the There have also been combined ABAC and RBAC
number of users. Furthermore, it makes dynamic access schemes proposed in order to take advantage of both to
control easier. For example, in applications where permis- provide effective access control for distributed and rapidly
sions for roles change slowly, while users may enter, leave, changing applications [67]. Hong et al. [68] implemented
or change roles rapidly, the role manager can simply assign RBAC system for cloud storage via CP-ABE. In their work,
a new role to the user or revoke a role from the user. On the permission assignments were handled by data owner while
other hand, the data owner can also add permissions to a role assignments were handled by other users through prop-
role or revoke permissions from a role. The authors of [59] agation.
suggested including RBAC in a new access control model
for the health care system that can provide flexible access
rights, because it can be modified dynamically while the B) Searchable encryption
task changed. However, one of the major criticisms of RBAC With more and more data moving to the cloud storage, it
schemes is the complicated process when setting up the role becomes imperative to enable search over the huge amount
structure. To make RBAC more efficient, roles can be struc- of data for many user applications. To preserve data con-
tured hierarchically so that some roles inherit permissions fidentiality and integrity, it is necessary to store encrypted
from others. data in the cloud storage servers. To perform searching
To enforce RBAC policies, one approach is to transform over data, the user has to either store an index locally,
the access control problem into a key management problem. or download all the encrypted data, decrypt it and search
In the literature, there exist many hierarchical access con- locally. Neither approach is efficient when the data size
trol schemes [60–62] which have been constructed based on grows in the cloud. When users seek to search and down-
hierarchical key management (HKM) schemes. Because of load relevant files from a cloud storage system, it is often
the similarity in structures between hierarchical access con- desirable for the SSP to host search service, because it can
trol and RBAC, a hierarchical access control scheme can be minimize the network traffic and reduce management com-
easily used to enforce RBAC access policies in cloud envi- plexity for the users.Therefore, how to perform searching
ronment. In 2010, a role-based encryption (RBE) scheme on encrypted databases without the need of decryption
[63] was built directly on RBAC policies. The security of has become an increasingly fascinating topic in cloud stor-
the hierarchical access control scheme relies on the correct age systems. Recently, there have been new cryptographic
execution of the key assignment process, while the security primitives, called searchable encryption schemes [69, 70],
of the RBE is based on the security of the cryptographic proposed to address this problem.
algorithm. More specifically, when a user is assigned to a The basic idea of searchable encryption schemes is to
role in RBE, a decryption key is calculated through a cryp- encrypt a search index generated over a collection of data
tographic algorithm by taking as input of the secret value in such a way that its contents are hidden without appro-
and the identity of user and role. In the hierarchical access priate tokens, which can only be generated with a secrete
control scheme, the key for the user is generated based on key. Given a token for a keyword, one can retrieve point-
the access control policies of the whole system. In 2011, ers to the encrypted data files that contain the keyword.
Zhu et al. [64] proposed a revocable RBE scheme which During the retrieval process, there is no contents of either
allows users to be granted or revoked role memberships the data files or the keyword revealed, other than the fact
dynamically. that all the retrieved data files contain one keyword in
In the above schemes for enforcing RBAC policies, user common.
membership of each role and role hierarchy are man- Searchable encryption schemes, including Symmetric
aged by a central authority. However in large-scale RBAC, Search Encryption (SSE) [70], Asymmetric Search Encryp-
systems which have hundred or even thousands of roles tion (ASE) [69] and other improvements on both schemes
and hundreds of thousands of users and permissions, it is are reviewed in [71]. SSE employs symmetric cryptographic
impractical to centralize the task of managing these users algorithms, such as block cipher or hash function, there-
and permissions, and their relationships with the roles in fore is suitable when the party that performs search over the
10 chun-ting huang et al.

data are also the one who generates it, whereas ASE employs structures, where each data was dressed in increasingly
asymmetric cryptographic algorithms such as elliptic curve, stronger encryption, such that the outmost layer provides
thus is also suitable when the party that performs search maximum security, whereas inner layers provide more
over the data are different than the one who generates it. functionality. A trusted proxy determines whether layers
Therefore, ASE has wider applications than SSE in cloud of encryption need to be removed when receiving a query
storage than SSE. Meanwhile, compared to SSE schemes, from the user application.
ASE can achieve more complex search queries, such as con-
junctions of terms, but at the cost of higher complexity C) Fully homomorphic encryption
and weaker security guarantees [72]. Efficient ASE, or ESE
Homomorphic encryption allows specific algebraic oper-
scheme was introduced in [73] to improve the efficiency
ations to be manipulated on a ciphertext, so it can pro-
when the keywords are hard to guess. However, it is more
duce the same encrypted result as the ciphertext of the
vulnerable to dictionary attacks.
result of the same (or different but known) operations per-
Since SSE achieves higher efficiency and stronger secu-
formed on the plaintext. In other words, the operations
rity, it has been further developed recently. For example,
to be performed on original data can now be performed
dynamic SSE [74, 75] extended the inverted index approach
on the encrypted ciphertext without knowing the orig-
[76] to allow update of the encrypted index and data files,
inal data. Homomorphic encryption can be categorized
and to achieve adaptive security against chosen-keyword
into two types: partially homomorphic encryption (PHE)
attacks. Furthermore, Parallel and dynamic SSE [74] enables
and FHE. PHE allows only one homomorphic operation,
more efficient and scalable construction based on a key-
either addition (e.g. Paillier [85]) or multiplication (e.g.,
word red-black tree-based multi-map data structure. On the
unpadded RSA), while FHE supports both addition and
other hand, SSE schemes with improved functionalities but
multiplication operations. Since the original unpadded RSA
compromised security have been proposed. Kuzu et al. [77]
algorithm published in 1977, there have been many PHE
utilized locality sensitive hashing (LSH), which is widely
algorithms developed. However, the partially homomor-
used for fast similarity search in high-dimensional spaces
phic property of an encryption algorithm has rarely been
for plain data, and proposed a search scheme to enable fast
considered advantageous, but rather vulnerable to adap-
similarity search in the context of encrypted data. Another
tive CCAs. Therefore, PHE algorithms have been found
approach, which was proposed by Wang and Cao et al.
useful only in limited security applications such as elec-
[78] to secure ranked keyword search in encrypted cloud
tronic voting systems. On the other hand, since the first
data. This method utilized the Order-Preserving Symmet-
FHE algorithm was announced in 2009 [86], it has been
ric Encryption (OPSE) [79, 80], which achieves both secu-
recognized as a huge breakthrough in the computing secu-
rity and privacy-preserving by protecting sensitive weighted
rity field. Practical application of FHE cryptosystems will
information.
potentially enable development of computing programs,
For cloud storage that are accessible with multiple users,
which runs on encrypted input data to generate encrypted
how to enforce privileges and access control while searching
output. These programs can thus be run by untrusted enti-
through cloud storage has attracted researchers’ attentions.
ties without revealing any sensitive information during the
One approach was proposed by Singh et al. [81] in 2009
computing process.
which performs indexing in the trusted enterprise domain,
A homomorphic cryptosystem ε consists of four algo-
and utilizes the resulting indices systematically with the
rithms, KeyGenε , Encryptε , Decryptε , and an Evaluateε
Access Control Barrel (ACB) [82] primitives and concepts
algorithm. The first three algorithms are defined the same
of user access hierarchy. This solution improves indexing
as those in any public-key cryptosystems. The KeyGenε (λ)
efficiency and allows transferring the indices to the SSP for
produces key-pair (pk, sk) given a security parameter λ. The
hosting, and it can be developed based on the integrity of
Encryptε algorithm takes pk and a plaintext π as input,
search results returned by the SSP in the future.
and it outputs a ciphertext φ. The Decryptε takes s k and
Other than search algorithms on encrypted database,
φ as input, and outputs the plaintext π . In addition, the
more general computation on encrypted database is
Evaluateε algorithm takes as input pk, a circuit C from a
a related topic. Secure Computation ON an Encrypted
permitted set C ε , and a set of ciphertexts ϕ = (φ1 , . . . φt ),
Database (SCONEDB) [83] was proposed to solve the
consequently outputs a ciphertext φ. The homomorphic
k-Nearest Neighbor (kNN) computation in an encrypted
cryptosystem ε is correct for C ε if for any key-pair ( pk, s k)
database utilizing asymmetric scalar-product preserving
generated by KeyGenε (λ), any circuit C ∈ C ε , any plain-
encryption (ASPE). Besides, SCONEDB can incorpo-
texts π1 , . . . , πt , and any ciphertexts ϕ = (φ1 , . . . φt ) with
rate other existing techniques, such as OPSE for the
φi → Encryptε ( pk, πi ), it is the case that
range query and homomorphic encryption for aggregate
queries. CryptDB [84] implemented an integrated system I f φ ← Evaluateε ( pk, C , ϕ),
that supports more general SQL query operations over
then Decryptε (s k, φ) → C (π1 , . . . , πt )
encrypted database, by adapting a number of existing
and new SQL-aware encryption primitives with different The computation complexity of all the above algorithms has
security properties and functionalities. CryptDB dynami- to be polynomial in the size of C and security level param-
cally adjusts the encryption strategies using layered onion eter λ, which is defined as all known attacks against the
 survey on securing data storage in the cloud 11

scheme take time at least 2λ . ε is fully homomorphic if it scheme by a more aggressive analysis of the SSSP assump-
is homomorphic for all circuits [86]. tion, and introducing a probabilistic decryption algorithm
A family of schemes ε(d) : d ∈ Z + is leveled fully homo- implemented by an algebraic circuit of low multiplica-
morphic if they all use the same decryption circuit, ε(d) is tive degree. With these two enhancements, this scheme
homomorphic for all circuits of depth at most d (that use obtains O(λ3.5 ) bit complexity for refreshing a cipher text,
some specified set of gates ), and the computational com- whereas previous scheme claimed O(λ6 ) for the same task,
plexity of ε(d)’s algorithms is polynomial in λ, d, and (in the where λ is the security parameter. However, there is a
case of Evaluateε(d) ) the size of C. non-zero probability of decryption error associated with
The first FHE scheme proposed by Craig Gentry in this scheme.
2009 [86] applies lattice-based cryptography to construct Besides, Zvika Brakerski and Vinod Vaikuntanathan gave
the scheme, where lattice L was a set of points in the another improvement on Gentry’s scheme [89] by changing
n-dimensional Euclidean space R n with a strong period- the two security assumptions made in [86]. First, the some-
icity property. The proposed scheme started from a some- what homomorphic encryption was based on ring learn-
what homomorphic encryption scheme using ideal lattices, ing with errors (RLWE) assumption from Lyubashevsky,
which is limited to “low-degree” polynomials evaluation on Peikert and Regev [90] instead of the ideal lattices BDD
encrypted data due to the augment of noise in the ciphertext problem. Second, to make the somewhat homomorphic
during evaluation. After this “initial construction” stage, a encryption scheme bootstrappalbe, it used a dimension-
“squash the decryption circuit” technique was used to mod- modulus reduction technique instead of Gentry’s squashing
ify the scheme to make it “bootstrappable”. The modified technique, thus eliminating the assumption of SSSP. This
encryption scheme can evaluate its own decryption circuit, new bootstrapping technique also shortened the ciphertext
and effectively refresh the ciphertext to reduce the aug- and reduced the complexity. Based on the above improve-
mented noises, which eliminates the limitation on the depth ment, Brakerski, Gentry, and Vaikuntanathan worked
of circuit evaluated over the ciphertext. In short, Craig together to propose a new leveled FHE scheme without
Gentry slightly modified somewhat homomorphic encryp- Gentry’s bootstrapping procedure in 2011 [91]. By applying
tion by recursive self-embedding. The resulting scheme can RLWE, this FHE scheme has O(λ · L 3 ) per-gate computa-
reduce the accumulated noise caused by multiple algebraic tion for L-level arithmetic circuits. As an optional approach,
operations, thus make it possible to realize FHE in arbitrary they also proposed a leveled FHE scheme using bootstrap-
depth. ping as optimization to further reduce the per-gate compu-
However, this first FHE scheme is impractical since the tation down to O(λ2 ), independent of L.
computation complexity and ciphertext size are high-order Following up in 2011, Coron et al. proposed an improve-
polynomials in the security level parameter λ, which means ment of FHE over the integers described by van Dijk
they increase sharply in order to achieve a practically high- et al. The proposed new scheme shortened the public
enough security level. This prohibit the practical application key size from O(λ10 ) to O(λ7 ) [92]. This procedure is
of the FHE, especially in the cloud computing context where done by using quadratic form instead of linear one in
high security level is crucial. Another major concern of the public key elements, so that the full-length public
this scheme is that its security was based on two relatively key is compressed to a smaller subset of the original key.
new assumptions, namely, the hardness of the worst-case Instead of proposing any further improvement on FHE,
bounded distance decoding problem (BDD) on ideal lat- Ron Rothblum manifests how to transform any addi-
tice, and the hardness of the average-case sparse subset sum tively homomorphic private-key encryption scheme into a
problem (SSSP) of the squashing step. Both are relatively public-key encryption scheme [93]. To construct this pro-
untested cryptographic assumptions. cess, this scheme develops a theorem that any compact
More recently, there have been growing research efforts additively homomorphic with respect to addition mod-
made in searching practical FHE algorithms, which are ulo two can be transformed into a semantically scheme.
more efficient and/or based on more reliable security In consequence, the public-key encryption scheme save
assumptions. A second version of FHE scheme, known as one hop homomorphic with regard to the same set oper-
DGHV, was proposed by Marten van Dijk, Craig Gen- ations with private-key encryption, which are prior FHE
try, Shai Halevi, and Vinod Vaikuntanathan in 2010 [87]. schemes.
DGHV uses Gentry’s techniques with only elementary With all the theoretical development of different FHE
modular arithmetic over integers to convert a simple some- algorithms, it is necessary to investigate their practical
what homomorphic encryption scheme to a bootstappable implementation. There were several implementations of
FHE scheme. This scheme achieved conceptual simplic- Gentry’s FHE in 2010, and the first attempt was made by
ity because all computations were performed over integers Smart and Vercauteren [94]. They were able to implement
instead of ideal lattice. It also reduced the security assump- the somewhat homomorphic scheme using “principle-ideal
tion to the hardness of the greatest common divisor (GCD) lattices” of prime determinant, which can be implied by two
problem. However, the price of this tradeoff is the immense integers only. However, they were not able to implement the
size of public key, which can be impractical for the cur- bootstrapping functionality to obtain a fully homomorphic
rent systems. Stehle and Steinfeld [88] presented a faster scheme. Bottleneck of this implementation was the failure
homomorphic encryption in order to improve Gentry’s to support a large amount of parameters.
12 chun-ting huang et al.

Based on this work, in 2011, Gentry and Halevi devel- is compromised, the information can still be kept confiden-
oped a series of simplifications and optimizations that made tial. The fundamental solution to this problem is still data
bootstrapping implementation possible. As the result, the encryption. The user has to encrypt the data before they
asymptotic complexity is reduced from Smart and Ver- are moved to the cloud server, and keep it encrypted for
cauteren’s O(n2 .5) to O(n1 .5). The optimizations from this the entire period during which the data are in the cloud.
paper were also used in [92] in order to implement the fully When the data needs to be accessed or processed by either
homomorphic DGHV scheme under new variant. With the the data owner or other legitimate users who have the key
result of having similar performance, Coron et al. success- for decryption, it is not efficient to retrieve the encrypted
fully showed that FHE can be implemented with a simple data, decrypt it, process and re-encrypt it before sending
arithmetic scheme. back to the server. Therefore, new encryption mechanisms
In Table 2, we provide a comparison of performance for that allow for processing of the ciphertext directly with-
different FHE schemes. BDD and SSSP are the problems out revealing the original information in the plaintext will
that stated in the first FHE scheme. have a significant potential in cloud storage of sensitive data.
WIth encryption, data owners or users regain their control
over their data that are not physically stored by themselves.
D) Other data confidentiality approaches FHE is an ideal example of these encryption algorithms.
There are several other data confidentiality methods beside However, the promising applications of current FHE algo-
above. For instance, The application of cryptographic algo- rithms are hindered by its computation complexity and
rithms to data blocks in the cloud storage is a popu- other implementation difficulties. Improvements must be
lar method used to ensure the confidentiality of stored made before it can be put in practical applications. In addi-
data. A data confidentiality scheme in coreFS, which is a tion, more implementations of various improvements are
user-level network file system, was proposed in 2009 [96]. awaited to be evaluated on current platforms.
This scheme is constructed based on a new universal-hash Unlike FHE, which has an ambitious aim at arbi-
stateful MAC. It has smaller computational overhead of trary computing on the ciphertext, other cloud encryption
cryptographic operations comparing to the MHT. Besides, schemes aimed at specific type of control over encrypted
it allows better communication capability. However, the data. For example, ABE allows access control being enforced
choice of caching strategy, MAC tree update schedule, and on the encrypted data by incorporating attribute-based
the method to store the tree can affect the performance of access structure into either the ciphertext or the decryp-
this scheme. tion key. Searchable encryption schemes provide a way to
Another data confidentiality scheme exploited the newly search the ciphertext for a keyword token without revealing
proposed secure provenance (SP) model based on the bilin- the real content of either data or the keyword.
ear pairing techniques in 2010 [97]. This scheme records
the ownership and the process history of data objects in
the cloud storage in order to increase the trust from pub- V. AVAILABILITY
lic users. The SP model consists of the following modules:
system setup, key generation, anonymous authentication, As a different security measure, availability in cloud storage
authorized access, and provenance tracking. The provable refers to that the data are accessible and usable when autho-
security technique has been tested on this scheme under the rized users request them from any machine at any time.
standard SP model. It demands some practical considera- In an earlier stage of cloud computing, availability was of
tions in real-world applications and further improvement more security concern due to the lack of mature and reli-
under the current framework. able infrastructure. Many incidents of service unavailability
Different from above schemes, an compelling statement occurred due to hardware failure and resulted in severe con-
was proposed by Dijk and Juel in 2010 [98], which claimed sequences. With better and more reliable infrastructures in
that no cryptographic protocol, even including power prim- place, the challenge facing the availability of cloud stor-
itives such as FHE, can enforce privacy requested by com- age service is how to preserve the user’s data in case of
mon cloud services alone. This paper also demonstrated emergency, such as a natural disaster.
that above demand can be achieved by other enforcements The most straightforward solution is to keep backup
instead, such as tamperproof hardware, distributed comput- copies of data in multiple physical locations. Amazon EC2
ing, and complex trust ecosystems. and S3 provide a perfect example based on availability zone,
which locates within divided geographic regions, for exam-
ple, US-West and US-East. Each region contains several
E) Summary instances with same data. When accident occurs, Ama-
Data confidentiality is one of the most critical issues for zon EC2 and S3 can easily recover damaged or lose data
applications with sensitive data, such as personal informa- from other availability zones within the same region to save
tion, customer’s account information, financial and health- power and time. However, this approach is not efficient in
care information. The new challenge of storing those data in terms of storage resource utilization.
clouds is how to prevent accidental or intentional data leak- There have been backup storage management schemes,
age to the cloud SSP, such that even if the service provider such as incremental backup and data deduplication,
 survey on securing data storage in the cloud 13

Table 2. Performance comparison for FHE schemes

Solution on ideal lattices BDD Solution on SSSP Per-gate comp. Public key size Asymptotic comp.

2009 Gentry [86] SVP Availability of SVP Oracle O(λ6 )

2010 Stehle [88] Refined Analysis O(λ3 )
2011 Brakerski [89] RLWE O(λ3 )
2010 Dijk [87] Replace Ideal Lattice Choosing Large Enough θ O(λ3 ) O(λ10 )
2011 Coron [92] Refined Analysis O(λ3 ) O(λ7 )
2010 Vercauteren [94] O(λ3 ) O(n2.5 )
2011 Halevi [95] O(λ3 ) O(n1.5 )

developed to improve the storage utilization. Incremen- Once the failure has occurred, data recovery schemes
tal backup has been used widely in file backup services. It are necessary to reduce or eliminate the loss. Zhang et al.
exploits the correlation between current files with previous [101] presented a data recovery method that examines the
backup version and only stores the differences. When incre- damage in a fine-grained cloud database and allows the
mental backup being deployed in a data block level or even cloud database owner to know and locate the damage
data byte level, it becomes more efficient in storage utiliza- precisely for the recovery purpose. Information disper-
tion, but with higher processing overhead. Delta encoding is sal algorithm [102] is used to enable greater availability
a famous incremental backup example applied by Dropbox. of data when encountering physical failures and network
Data deduplication is a specialized data compression tech- outages.
nique that identifies common data chunks within and across Besides the above techniques, data recovery can also be
different files, and stores them only once to improve stor- achieved by new service framework. Chi-won Song et al.
age utilization. Unfortunately, data deduplication poten- proposed Parity Cloud Service (PCS) in 2011 [103]. It gener-
tially undermining the data security in terms of both data ates virtual disk in user system for private backup and makes
integrity and data confidentiality. First, by definition, data parity group of multiple users. The same data among those
deduplication alters the original data from the user and users in the parity group are stored at the server-end. There-
stores them in a different form in the cloud storage, thus fore, when users find out that original file requires recovery,
results in concerns of data integrity. Second, data deduplica- they can request data from the server-end without violating
tion attempts to identify and exploit identical data chunks, privacy since private backup is stored at each user’s virtual
while encryption algorithms usually try to randomize them disk. This approach is simple and secure, but each user has
to conceal the real contents. The encrypted ciphertext for to build up virtual disk, which costs additional overhead for
the same plaintext will likely to be extremely different. To users.
address these issues, efficient and secure data deduplication In summary, ensuring availability of users’ data when-
which allows data deduplication performed on encrypted ever users demands it is the basic and primary require-
ciphertext have been developed [99]. This technique uti- ment in cloud storage. The main challenge arises when
lized convergent encryption, in which the encryption key taking other performance and security concerns into
is generated using a hash function of the plaintext of the consideration. Trade-offs between efficiency and reliabil-
data chunk. Therefore, the same plaintext data chunk will ity have to be made to balance the interests of service
be encrypted using the same key, no matter when and provider and the user. Furthermore, data integrity and data
by whom it is encrypted. This results in the same cipher- confidentiality should not be compromised by improved
text data chunk for the same plaintext. The scheme stores availability.
unique chunks of data or bytes during data analysis, and
then compares other chunks to the stored data. If the com-
pared result is matched, then the redundant part is replaced VI. CONCLUSION AND FUTURE
by a small pointer pointing to the location of the matched WORK
stored data.
Another proactive approach is to predict future avail- With the trend of rapid deployment of cloud storage and
ability failure occurrences so that actions could be taken computing nowadays, it is essential for the cloud storage
earlier to avoid interruption of service. Guan et al. pro- systems to be equipped with security solutions proven to
posed two learning approaches to predict failure dynamics be reliable and trustworthy. In this work, we conducted a
in cloud computing systems by using Bayesian meth- survey on most recently developed or proposed primitives
ods and decision trees [100]. An initial stage is required to ensure three of the most critical security measurements,
for monitoring data, and then an ensemble Bayesian namely, data integrity, data confidentiality, and availability,
methods labels data that have anomalous behaviors. for the cloud storage systems. For each aspect, we identified
After all the anomalies are identified, the model can the unique challenges that are different from those in tra-
predict future failure occurrences based on decision tree ditional data network or file storage systems, summarized
classifiers. the existing development progress up to date, and provided
14 chun-ting huang et al.

insight into the future directions of research. Overall, we of Lecture Notes in Computer Science, Springer Berlin/Heidelberg,
feel that the cloud storage security is still in its infancy and 2002, 204–245.
expect to see more salient breakthrough in the near future. [14] Shacham, H.; Waters, B.: Compact proofs of retrievability. In Proc.
For example, although the cloud storage security solutions 14th Int. Conf. on Theory and Application of Cryptology and Infor-
have been developed rapidly in recent years, we have not mation Security: Advances in Cryptology, ASIACRYPT ’08, Berlin,
Heidelberg, 2008, 90–107, Springer-Verlag.
yet seen a widely accepted model for the implementation.
Besides the system design, the cloud storage security sys- [15] Ateniese, G.; Di Pietro, R.; Mancini, L.V.; Tsudik, G.: Scalable and
tem should be flexible enough so that it can be improved by efficient provable data possession. In Proc. 4th Int. Conf. on Secu-
rity and Privacy in Communication Networks, SecureComm ’08, New
new cryptographic algorithms. York, NY, USA, 2008, 9:1–9:10, ACM.
[16] Boneh, D.; Lynn, B.; Shacham, H.: Short signatures from the weil
pairing. In Advances in Cryptology ASIACRYPT 2001, volume 2248
ACKNOWLEDGEMENTS of Lecture Notes in Computer Science, Springer Berlin / Heidelberg,
2001, 514–532.
This work is supported by the Jiangsu Provincial Key Lab-
[17] Wang, Q.; Wang, C.; Li, J.; Ren, K.; Lou, W.: Enabling public verifia-
oratory of Network and Information Security under Grants bility and data dynamics for storage security in cloud computing. In
No. BM2003201, and the Key Laboratory of Information Proc. 14th Eur. Conf. on Research in Computer Security, ESORICS’09,
Network Security, the Ministry of Public Security. Berlin, Heidelberg, 2009, 355–370, Springer-Verlag.
[18] Wang, C.; Wang, Q.; Ren, K.; Lou, W.: Ensuring data storage secu-
rity in cloud computing. In 17th Int. Workshop on Quality of Service,
REFERENCES IWQoS 2009, July 2009, 1 –9.

[1] Chantry, D.: Mapping applications to the cloud. Technical Report, [19] Wang, C.; Chow, S.S.M.; Wang, Q.; Ren, K.; Lou, W.: Privacy-
January 2009. preserving public auditing for secure cloud storage. IEEE Trans.
Comput., 62 (2) (2013), 362–375.
[2] Guttman, B.; Roback, E.A.: Sp 800-12. an introduction to computer
security: the NIST handbook. Technical Report, Gaithersburg, MD, [20] Wang, C.; Ren, K.; Lou, W.; Li, J.: Toward publicly auditable secure
USA, 1995. cloud data storage services. IEEE Netw., 24 (4) (2010), 19 –24.

[3] Mell, P.; Grance, T.: The NIST definition of cloud computing. Tech- [21] Wang, C.; Wang, Q.; Ren, K.; Cao, N.; Lou, W.: Toward secure and
nical Report, July 2009. dependable storage services in cloud computing. IEEE Trans. Serv.
Comput., 5 (2) (2012), 220–232.
[4] Tim Jones, M.: Anatomy of a cloud storage infrastructure. Technical
Report, IBM, 2010. [22] Wang, C.; Wang, Q.; Ren, K.; Lou, W.: Privacy-preserving public
auditing for data storage security in cloud computing. In Proc. 29th
[5] Zeng, W.; Zhao, Y.; Ou, K.; Song, W.: Research on cloud storage Conf. on Information Communications, INFOCOM’10, Piscataway,
architecture and key technologies. In Proc. 2nd Int. Conf. on Inter- NJ, USA, 2010, 525–533, IEEE Press.
action Sciences: Information Technology, Culture and Human, ICIS
[23] Wang, Q.; Wang, C.; Ren, K.; Lou, W.; Li, J.: Enabling public
’09, New York, NY, USA, 2009, 1044–1048, ACM.
auditability and data dynamics for storage security in cloud com-
[6] CCITT Recommendation X.800. Security architecture for open sys- puting. IEEE Trans. Parallel Distrib. Syst., 22 (5) (2011), 847–859.
tems interconnection for CCITT applications. Technical Report,
[24] Zhu, Y.; Wang, H.; Hu, Z.; Ahn, G.-J.; Hu, H.; Yau, S.S.: Dynamic
March 1991.
audit services for integrity verification of outsourced storages in
[7] Paul, M.; Saxena, A.: Proof of erasability for ensuring comprehen- clouds. In Proc. 2011 ACM Symp. on Applied Computing, SAC ’11, New
sive data deletion in cloud computing. In Recent Trends in Network York, NY, USA, 2011, 1550–1557.
Security and Applications, volume 89 of Communications in Com-
[25] Han, S.; Xing, J.: Ensuring data storage security through a novel third
puter and Information Science, Springer–Berlin–Heidelberg, 2010,
party auditor scheme in cloud computing. In 2011 IEEE Int. Conf. on
340–348.
Cloud Computing and Intelligence Systems (CCIS), September 2011,
[8] Perito, D.; Tsudik, G.: Secure code update for embedded devices via 264–268.
proofs of secure erasure. In Proc. 15th European Conf. on Research in
[26] Hao, Z.; Zhong, S.; Yu, N.: A privacy-preserving remote data
Computer Security, ESORICS’10, Berlin, Heidelberg, 2010, 643–662,
integrity checking protocol with data dynamics and public verifi-
Springer-Verlag.
ability. IEEE Trans. Knowl. Data Eng., 23 (9) (2011), 1432–1437.
[9] Juels, A.; Kaliski, B.S. Jr.: Pors: proofs of retrievability for large files.
[27] Sebé, F.; Domingo-Ferrer, J.; Martinez-Balleste, A.; Deswarte, Y.;
In Proc. 14th ACM Conf. on Computer and Communications Security,
Quisquater, J.-J.: Efficient remote data possession checking in crit-
CCS ’07, New York, NY, USA, 2007, 584–597.
ical information infrastructures. IEEE Trans. Knowl. Data Eng., 20
[10] Lillibridge, M.; Elnikety, S.; Birrell, A.; Burrows, M.; Isard, M.: (2008), 1034–1038.
A cooperative Internet backup scheme. In Proc. USENIX Annual
[28] Curtmola, R.; Khan, O.; Burns, R.: Robust remote data checking. In
Technical Conf., ATEC ’03, Berkeley, CA, USA, 2003, 3–3, USENIX
Proc. 4th ACM Int. Workshop on Storage Security and Survivability,
Association.
StorageSS ’08, New York, NY, USA, 2008, 63–68.
[11] Naor, M.; Rothblum, G.: The complexity of online memory check-
[29] Dodis, Y.; Vadhan, S.; Wichs, D.: Proofs of retrievability via hardness
ing. Cryptology ePrint Archive, Report 2006/091, 2006.
amplification. In Proc. 6th Theory of Cryptography Conf. on Theory of
[12] Ateniese, G. et al.: Provable data possession at untrusted stores. In Cryptography, TCC ’09, Berlin, Heidelberg, 2009, 109–127, Springer-
Proc. 14th ACM Conf. on Computer and Communications Security, Verlag.
CCS ’07, New York, NY, USA, 2007, 598–609.
[30] Bowers, K.D.; Juels, A.; Oprea, A.: Proofs of retrievability: theory and
[13] Johnson, R.; Molnar, D.; Song, D.; Wagner, D.: Homomorphic sig- implementation. In Proc. 2009 ACM Workshop on Cloud Computing
nature schemes. In Topics in Cryptology CT-RSA 2002, volume 2271 Security, CCSW ’09, New York, NY, USA, 2009, 43–54.
 survey on securing data storage in the cloud 15

[31] Shacham, H.; Waters, B.: Compact proofs of retrievability. J. Cryp- and Programming, 2008, volume 5126 of Lecture Notes in Computer
tol., 26 (3) (2013), 442–83. Science, Springer, 2008, 579–591.
[32] Sravan Kumar, R.; Saxena, A.: Data integrity proofs in cloud stor- [49] Malek, B.; Miri, A.: Combining attribute-based and access systems.
age. In 2011 3rd Int. Conf. on Communication Systems and Networks In Int. Conf. on Computational Science and Engineering, 2009. CSE
(COMSNETS), January 2011, 1–4. ’09, volume 3, aug. 2009, 305–312.
[33] Ateniese, G. et al.: Remote data checking using provable data pos- [50] Yu, S.; Wang, C.; Ren, K.; Lou, W.: Achieving secure, scalable, and
session. ACM Trans. Inf. Syst. Secur., 14 (1) (2011), 12:1–12:34. fine-grained data access control in cloud computing. In INFOCOM,
2010 Proc. IEEE, March 2010, 1–9.
[34] Erway, C.; Küpçü, A.; Papamanthou, C.; Tamassia, R.: Dynamic
provable data possession. In Proc. 16th ACM Conf. on Computer [51] Zhao, F.; Nishide, T.; Sakurai, K.: Realizing fine-grained and flexible
and Communications Security, CCS ’09, New York, NY, USA, 2009, access control to outsourced data with attribute-based cryptosys-
213–222. tems. In Proc. 7th Int. Conference on Information Security Practice
and Experience, ISPEC’11, Berlin, Heidelberg, 2011, 83–97, Springer-
[35] Papamanthou, C.; Tamassia, R.; Triandopoulos, N.: Authenticated
Verlag.
hash tables. In Proc. 15th ACM Conf. on Computer and Communica-
tions Security, CCS ’08, New York, NY, USA, 2008, 437–448. [52] Sahai, A.; Seyalioglu, H.; Waters, B.: Dynamic credentials and
ciphertext delegation for attribute-based encryption. In Advances
[36] Merkle, R.C.: Protocols for Public Key Cryptosystems, IEEE Com-
in Cryptology – CRYPTO 2012, volume 7417 of Lecture Notes in
puter Society Press, 1980, 122–134.
Computer Science, Springer, 2012, 199–217.
[37] Zheng, Q.; Xu, S.: Fair and dynamic proofs of retrievability. In Proc.
[53] Zhang, F.; Li, Q.; Xiong, H.: Efficient revocable key-policy attribute
of the first ACM Conference on Data and Application Security and
based encryption with full security. In IEEE 8th Int. Conf. on Com-
Privacy, CODASPY ’11, New York, NY, USA, 2011, 237–248.
putational Intelligence and Security 2012, 2012, 477–481.
[38] Wang, C.; Cao, N.; Li, J.; Ren, K.; Lou, W.: Secure ranked keyword
[54] Chase, M.: Multi-authority attribute based encryption. In 4th Theory
search over encrypted cloud data. In 2010 IEEE 30th Int. Conf. on
of Cryptography Conf., volume 4392 of Lecture Notes in Computer
Distributed Computing Systems (ICDCS), June 2010, 253 –262.
Science, Springer, 2007, 515–534.
[39] Kallahalla, M.; Riedel, E.; Swaminathan, R.; Wang, Q.; Fu, K.: Plu-
[55] Chase, M.; Chow, S.S.M.: Improving privacy and security in multi-
tus: Scalable secure file sharing on untrusted storage. In Proc. 2nd
authority attribute-based encryption. In Proc. 2009 ACM Conf. on
USENIX Conf. on File and Storage Technologies, Berkeley, CA, USA,
Computer and Communications Security, 2009, 121–130.
2003, 29–42, USENIX Association.
[56] Lewko, A.B.; Waters, B.: Decentralizing attribute-based encryption.
[40] Goh, E.j.; Shacham, H.; Modadugu, N.; Boneh, D.: Sirius: Securing
In Advances in Cryptology – EUROCRYPT 2011, volume 6632 of
remote untrusted storage. In Proc. Network and Distributed Systems
Lecture Notes in Computer Science, Springer, 2011, 568–588.
Security (NDSS) Symp. 2003, 2003, 131–145.
[57] Ahn, G.-J.; Sandhu, R.: Role-based authorization constraints speci-
[41] Sahai, A.; Waters, B.: Fuzzy identity-based encryption. In Advances
fication. ACM Trans. Inf. Syst. Secur., 3 (2000), 207–226.
in Cryptology – EUROCRYPT 2005, 24th Annu. Int. Conf. on the
Theory and Applications of Cryptographic Techniques, Aarhus, Den- [58] Sandhu, R.S.; Coyne, E.J.; Feinstein, H.L.; Youman, C.E.: Role-based
mark, May 22–26, volume 3494 of Lecture Notes in Computer Science, access control models. Computer, 29 (2) (1996), 38–47.
Springer, 2005, 457–473.
[59] Narayanan, H.A.J.; Gunes, M.H.: Ensuring access control in cloud
[42] Goyal, V.; Pandey, O.; Sahai, A.; Waters, B.: Attribute-based encryp- provisioned healthcare systems. In 2011 IEEE Consumer Communi-
tion for fine-grained access control of encrypted data. In Proc. 13th cations and Networking Conf. (CCNC), January 2011, 247–251.
ACM Conf. on Computer and Communications Security, CCS ’06,
[60] Atallah, M.J.; Blanton, M.; Fazio, N.; Frikken, K.B.: Dynamic and
New York, NY, USA, 2006, 89–98.
efficient key management for access hierarchies. ACM Trans. Inf.
[43] Bethencourt, J.; Sahai, A.; Waters, B.: Ciphertext-policy attribute- Syst. Secur., 12 (3) (2009), 18:1–18:43.
based encryption. In Proc. 2007 IEEE Symp. on Security and Privacy,
[61] De Capitani di Vimercati, S.; Foresti, S.; Jajodia, S.; Paraboschi, S.;
SP ’07, Washington, DC, USA, 2007, 321–334.
Samarati, P.: Encryption policies for regulating access to outsourced
[44] Ostrovsky, R.; Sahai, A.; Waters, B.: Attribute-based encryption with data. ACM Trans. Database Syst., 35 (2) (2010), 12:1–12:46.
non-monotonic access structures. In Proc. 14th ACM Conf. on Com-
[62] Samarati, P.; De Capitani di Vimercati, S.: Data protection in out-
puter and Communications Security, CCS ’07, New York, NY, USA,
sourcing scenarios: issues and directions. In Proc. 5th ACM Symp.
2007, 195–203.
on Information, Computer and Communications Security, 2010, 2010,
[45] Cheung, L.; Newport, C.: Provably secure ciphertext policy abe. In 1–14.
Proc. 14th ACM Conf. on Computer and Communications Security,
[63] Zhu, Y.; Ahn, G.-J.; Hu, H.; Wang, H.: Cryptographic role-based
CCS ’07, New York, NY, USA, 2007, 456–465.
security mechanisms based on role-key hierarchy. In Proc. 5th ACM
[46] Lewko, A.B.; Okamoto, T.; Sahai, A.; Takashima, K.; Waters, B.: Symp. on Information, Computer and Communications Security,
Fully secure functional encryption: Attribute-based encryption and 2010, 2010, 314–319.
(hierarchical) inner product encryption. In Advances in Cryptol-
[64] Zhu, Y.; Hu, H.; Ahn, G.-J.; Wang, H.; Wang, S.-B.: Provably secure
ogy EUROCRYPT 2010, volume 6110 of Lecture Notes in Computer
role-based encryption with revocation mechanism. J. Comput. Sci.
Science, Springer, Berlin/Heidelberg, 2010, 62–91.
Technol., 26 (4) (2011), 697–710.
[47] Waters, B.: Ciphertext-policy attribute-based encryption: an expres-
[65] Zhou, L.; Varadharajan, V.; Hitchens, M.: Enforcing role-based
sive, efficient, and provably secure realization. In Public Key Cryptog-
access control for secure data storage in the cloud. Comput. J., 54
raphy PKC 2010, volume 6571 of Lecture Notes in Computer Science,
(10) (2011), 1675–1687.
Springer Berlin/Heidelberg, 2011, 53–70.
[66] Delerablée, C.: Identity-based broadcast encryption with constant
[48] Goyal, V.; Jain, A.; Pandey, O.; Sahai, A.: Bounded ciphertext policy
size ciphertexts and private keys. In Proc. Advances in Crypotology
attribute based encryption. In 35th Int. Colloq. Automata, Languages
16 chun-ting huang et al.

13th Int. Conf. on Theory and application of cryptology and infor- [84] Popa, R.A.; Redfield, C.M.S.; Zeldovich, N.; Balakrishnan, H.:
mation security, ASIACRYPT’07, Berlin, Heidelberg, 2007, 200–215, Cryptdb: processing queries on an encrypted database. Commun.
Springer-Verlag. ACM, 55 (9) (2012), 103–111.
[67] Richard Kuhn, D.; Coyne, E.J.; Weil, T.R.: Adding attributes to role- [85] Paillier, P.: Public-key cryptosystems based on composite degree
based access control. Computer, 43 (6) (2010), 79–81. residuosity classes. In Advances in Cryptology EUROCRYPT 99,
volume 1592 of Lecture Notes in Computer Science, Springer
[68] Hong, C.; lv, Z.; Zhang, M.; Feng, D.: A secure and efficient role-
Berlin/Heidelberg, 1999, 223–238.
based access policy towards cryptographic cloud storage. In Proc.
12th Int. Conf. on Web-age Information Management, WAIM’11, [86] Gentry, C.: Fully homomorphic encryption using ideal lattices. In
Berlin, Heidelberg, 2011, 264–276, Springer-Verlag. Proc. 41st Annu. ACM Symp. on Theory of Computing, STOC ’09,
New York, NY, USA, 2009, 169–178.
[69] Boneh, D.; Di Crescenzo, G.; Ostrovsky, R.; Persiano, G.: Public
key encryption with keyword search. In Advances in Cryptology [87] Van Dijk, M.; Gentry, C.; Halevi, S.; Vaikuntanathan, V.: Fully homo-
– EUROCRYPT 2004, volume 3027 of Lecture Notes in Computer morphic encryption over the integers. In Advances in Cryptology
Science, Springer Berlin/Heidelberg, 2004, 506–522. EUROCRYPT 2010, volume 6110 of Lecture Notes in Computer Sci-
ence, Springer Berlin/Heidelberg, 2010, 24–43.
[70] Song, D.X.; Wagner, D.; Perrig, A.: Practical techniques for searches
on encrypted data. In 2000 IEEE Symp. Security and Privacy, 2000, [88] Stehle, D.; Steinfeld, R.: Faster fully homomorphic encryption. In
SP 2000, Proc., 2000, 44–55. Advances in Cryptology – ASIACRYPT 2010, volume 6477 of Lec-
ture Notes in Computer Science, Springer Berlin/Heidelberg, 2010,
[71] Kamara, S.; Lauter, K.: Cryptographic cloud storage. In Financial
377–394.
Cryptography and Data Security, volume 6054 of Lecture Notes in
Computer Science, Springer Berlin/Heidelberg, 2010, 136–149. [89] Brakerski, Z.; Vaikuntanathan, V.: Fully homomorphic encryption
from ring-IWE and security for key dependent messages. In Proc.
[72] Abdalla, M. et al.: Searchable encryption revisited: Consistency
31st Annu. Conf. on Advances in Cryptology, CRYPTO’11, Berlin,
properties, relation to anonymous IBE, and extensions. J. Cryptol.,
Heidelberg, 2011, 505–524, Springer-Verlag.
21 (3) (2008), 350–391.
[90] Lyubashevsky, V.; Peikert, C.; Regev, O.: On ideal lattices and learn-
[73] Bellare, M.; Boldyreva, A.; O’Neill, A.: Deterministic and efficiently
ing with errors over rings. J. ACM, 60 (6) (2013), 43:1–43:35.
searchable encryption. In Proc. of the 27th Annu. Int. Cryptology
Conf. on Advances in Cryptology, CRYPTO’07, Berlin, Heidelberg, [91] Brakerski, Z.; Gentry, C.; Vaikuntanathan, V.: Fully homomor-
2007, 535–552, Springer-Verlag. phic encryption without bootstrapping. Cryptology ePrint Archive,
Report 2011/277, 2011.
[74] Kamara, S.; Papamanthou, C.: Parallel and dynamic searchable sym-
metric encryption. In Financial Cryptography, 2013, 258–274. [92] Coron, J.-S.; Mandal, A.; Naccache, D.; Tibouchi, M.: Fully homo-
morphic encryption over the integers with shorter public keys.
[75] Kamara, S.; Papamanthou, C.; Roeder, T.: Dynamic searchable sym-
In Proc. 31st Annu. Conf. on Advances in Cryptology, CRYPTO’11,
metric encryption. In ACM Conf. on Computer and Communications
Berlin, Heidelberg, 2011, 487–504, Springer-Verlag.
Security, 2012, 965–976.
[93] Rothblum, R.: Homomorphic encryption: From private-key to
[76] Curtmola, R.; Garay, J.; Kamara, S.; Ostrovsky, R.: Searchable sym-
public-key. In Theory of Cryptography, volume 6597 of Lec-
metric encryption: Improved definitions and efficient constructions.
ture Notes in Computer Science, Springer Berlin/Heidelberg, 2011,
J. Comput. Secur., 19 (5) (2011), 895–934.
219–234.
[77] Kuzu, M.; Islam, M.S.; Kantarcioglu, M.: Efficient similarity search
[94] Smart, N.; Vercauteren, F.: Fully homomorphic encryption with rela-
over encrypted data. In Proc. 2012 IEEE 28th Int. Conf. on Data
tively small key and ciphertext sizes. In Public Key Cryptography PKC
Engineering, ICDE ’12, 2012, 1156–1167.
2010, volume 6056 of Lecture Notes in Computer Science, Springer
[78] Wang, C.; Cao, N.; Ren, K.; Lou, W.: Enabling secure and efficient Berlin/Heidelberg, 2010, 420–443.
ranked keyword search over outsourced cloud data. IEEE Trans.
[95] Gentry, C.; Halevi, S.: Implementing gentry’s fully-homomorphic
Parallel Distrib. Syst., 23 (8) (2012), 1467–1479.
encryption scheme. In Proc. 30th Annu. Int. Conf. on The-
[79] Boldyreva, A.; Chenette, N.; Lee, Y.; O’Neill, A.: Order-preserving ory and Applications of Cryptographic Techniques: Advances in
symmetric encryption. In Proc. 28th Annu. Int. Conf. on Advances Cryptology, EUROCRYPT’11, Berlin, Heidelberg, 2011, 129–148,
in Cryptology: the Theory and Applications of Cryptographic Springer-Verlag.
Techniques, EUROCRYPT ’09, Berlin, Heidelberg, 2009, 224–241,
[96] Yun, A.; Shi, C.; Kim, Y.: On protecting integrity and confidentiality
Springer-Verlag.
of cryptographic file system for outsourced storage. In Proc. 2009
[80] Boldyreva, A.; Chenette, N.; O’Neill, A.: Order-preserving encryp- ACM Workshop on Cloud Computing Security, CCSW ’09, New York,
tion revisited: Improved security analysis and alternative solutions. NY, USA, 2009, 67–76.
In Proc. 31st Annual Conf. on Advances in Cryptology, CRYPTO’11,
[97] Lu, R.; Lin, X.; Liang, X.; Shen, X.S.: Secure Provenance: the Essential
Berlin, Heidelberg, 2011, 578–595, Springer-Verlag.
of Bread and Butter of Data Forensics in Cloud Computing, ACM,
[81] Singh, A.; Srivatsa, M.; Liu, L.: Search-as-a-service: Outsourced New York, 2010, 282–292.
search over outsourced storage. ACM Trans. Web, 3 (2009), 13:1–
[98] Van Dijk, M.; Juels, A.: On the impossibility of cryptography alone
13:33.
for privacy-preserving cloud computing. In Proc. 5th USENIX Conf.
[82] Singh, A.; Srivatsa, M.; Liu, L.: Efficient and secure search of enter- on Hot Topics in Security, HotSec’10, Berkeley, CA, USA, 2010.
prise file systems. In IEEE Int. Conf. on Web Services, 2007. ICWS USENIX Association, 1–8.
2007, July 2007, 18 –25.
[99] Storer, M.W.; Greenan, K.; Long, D.D.E.; Miller, E.L.: Secure data
[83] Wong, W.K.; Wai-lok Cheung, D.; Kao, B.; Mamoulis, N.: Secure deduplication. In Proc. 4th ACM Int. Workshop on Storage Security
KNN computation on encrypted databases. In Proc. 35th SIGMOD and Survivability, StorageSS ’08, New York, NY, USA, 2008, 1–10.
Int. Conf. on Management of data, SIGMOD ’09, New York, NY, USA,
[100] Guan, Q.; Zhang, Z.; Fu, S.: Proactive failure management by inte-
2009, 139–152, ACM.
grated unsupervised and semi-supervised learning for dependable
 survey on securing data storage in the cloud 17

cloud systems. In Proc. 2011 6th Int. Conf. on Availability, Reliability [102] Rabin, M.O.: Efficient dispersal of information for security, load
and Security, ARES ’11, Washington, DC, USA, 2011, 83–90. balancing, and fault tolerance. J. ACM, 36 (2) (1989), 335–348.
[101] Zhang, M.; Cai, K.; Feng, D.: Fine-grained cloud db damage exam- [103] won Song, C.; Park, S.; wook Kim, D.; Kang, S.: Parity cloud ser-
ination based on bloom filters. In Proc. 11th Int. Conf. on Web- vice: A privacy-protected personal data recovery service. In 2011
age Information Management, WAIM’10, Berlin, Heidelberg, 2010, IEEE 10th Int. Conf. Trust, Security and Privacy in Computing and
157–168, Springer-Verlag. Communications (TrustCom), November 2011, 812 –817.