See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/309321387

Data Security in Cloud Computing

Conference Paper · August 2016

DOI: 10.1109/FGCT.2016.7605062

CITATIONS READS

99 62,668

4 authors:

Ahmed Albugmi Madini O. Alassafi

University of Southampton King Abdulaziz University, University of Southampton,
5 PUBLICATIONS 116 CITATIONS 120 PUBLICATIONS 2,312 CITATIONS

SEE PROFILE SEE PROFILE

Robert John Walters Gary Wills

University of Southampton University of Southampton
163 PUBLICATIONS 3,499 CITATIONS 697 PUBLICATIONS 10,388 CITATIONS

SEE PROFILE SEE PROFILE

All content following this page was uploaded by Madini O. Alassafi on 10 October 2017.

The user has requested enhancement of the downloaded file.

 !"#$%&'#()'*#!+'*,%-+'"()('.(%+'% /#/)(%0('()*#!+'%-+11/'!.*#!+'%2(.$'+,+3!(4%5 0-2%6789:

Data Security in Cloud Computing

Ahmed Albugmi Madini O. Alassafi Robert Walters, Gary Wills
School of Electronics and Computer Science School of Electronics and Computer Science School of Electronics and Computer Science
University of Southampton University of Southampton University of Southampton
Southampton, United Kingdom Southampton, United Kingdom Southampton, United Kingdom
[email protected] [email protected] (rjw1- gbw)@ecs.soton.ac.uk

Abstract— This paper discusses the security of data in cloud using internal organizational cloud. This approach can help in
computing. It is a study of data in the cloud and aspects related securing data by enforcing on-premises data usage policy.
to it concerning security. The paper will go in to details of data However, it still does not ensure full data security and privacy,
protection methods and approaches used throughout the world to since many organizations are not qualified enough to add all
ensure maximum data protection by reducing risks and threats. layers of protection to the sensitive data.
Availability of data in the cloud is beneficial for many
applications but it poses risks by exposing data to applications This paper is the study of data security techniques used for
which might already have security loopholes in them. Similarly, protecting and securing data in cloud throughout the world. It
use of virtualization for cloud computing might risk data when a discusses the potential threats to data in the cloud and their
guest OS is run over a hypervisor without knowing the reliability solutions adopted by various service providers to safeguard
of the guest OS which might have a security loophole in it. The data.
paper will also provide an insight on data security aspects for
The remainder of the paper is organized as follows. Section
Data-in-Transit and Data-at-Rest. The study is based on all the
levels of SaaS (Software as a Service), PaaS (Platform as a 2 is the review of literature that provides an insight into the
Service) and IaaS (Infrastructure as a Service). work already done in this area. Section 3 discusses the types of
threats to data in cloud. Section 4 examines some efficient data
Keywords— Data Security, Cloud Computing, Data Protection, security techniques adopted throughout the world. The final
Privacy, Risks and threats section is the conclusion which provides summary for this
study.
I. INTRODUCTION
The term word Cloud Computing has emerged recently and II. LITERATURE REVIEW
is not is widespread use. Of the several definitions which are
available, one of the simplest is, “a network solution for In order to understand the basics of cloud computing and
providing inexpensive, reliable, easy and simple access to IT storing data securing on the cloud, several resources have been
resources” [1]. Cloud Computing is not considered as consulted. This section provides a review of literature to set a
application oriented but service oriented. This service oriented foundation of discussing various data security aspects.
nature of Cloud Computing not only reduces the overhead of Srinivas, Venkata and Moiz provide an excellent insight
infrastructure and cost of ownership but also provides into the basic concepts of cloud computing. Several key
flexibility and improved performance to the end user [2, 3]. concepts are explored in this paper by providing examples of
A major concern in adaptation of cloud for data is security applications that can be developed using cloud computing and
and privacy [4]. It is very important for the cloud service to how they can help the developing world in getting benefit from
ensure the data integrity, privacy and protection. For this this emerging technology [1].
purpose, several service providers are using different policies On other hand, Chen and Zhao have discussed the
and mechanism that depend upon the nature, type and size of consumers concern regarding moving the data to the cloud.
data. According to Chen and Zhao, one of the foremost reasons of
One of the advantages of Cloud Computing is that data can why large enterprises still would not move their data to cloud is
be shared among various organizations. However, this security issues. Authors have provided outstanding analysis on
advantage itself poses a risk to data. In order to avoid potential data security and privacy protection issues related to cloud.
risk to the data, it is necessary to protect data repositories. Furthermore, they have also discussed some of the available
solutions to these issues [5,6].
One of the key questions while using cloud for storing data
is whether to use a third party cloud service or create an However, Hu and A. Klein provided a standard to secure
internal organizational cloud. Sometimes, the data is too data-in-transit in the cloud. A benchmark for encryption has
sensitive to be stored on a public cloud, for example, national been discussed for guarding data during migration. Additional
security data or highly confidential future product details etc. encryption is required for robust security but it involves extra
This type of data can be extremely sensitive and the computation. The benchmark discussed in their study presents
consequences of exposing this data on a public cloud can be equilibrium for the security and encryption overhead [7].
serious. In such cases, it is highly recommended to store data

978-1-5090-1306-7/16/$31.00 ©2016 IEEE

55
 Tjoa, A.M. and Huemer examine the privacy issue by Storage and memory etc. it is threat to not only a single user
preserving data control to the end user to surge confidence. but multiple users.
Several Cloud computing attacks are reviewed and some
solutions are proposed to overcome these attacks [8]. In such scenarios there is always a risk of private data
accidentally leaking to other users. Multitenancy exploits can
Therefore, Abdelkader and Etriby propose a data security be exceptionally risky because one fault in the system can
model for cloud computing based on cloud architecture. They allow another user or hacker to access all other data [15].
also developed software to enrich the effort in Data Security
model for cloud computing further [9]. These types of issues can be taken care of by wisely
authenticating the users before they can have access to the data.
Several authentication techniques are in use to avoid
III. RISKS AND SECURITY CONCERNS IN CLOUD multitenancy issues in cloud computing [16].
COMPUTING
Several risks and security concerns are associated with IV. DATA SECURITY IN CLOUD COMPUTING
cloud computing and its data. However, this study will discuss
Data security in cloud computing involves more than data
about the virtualization, storage in public cloud and
encryption. Requirements for data security depends upon on
multitenancy which are related to the data security in cloud
the three service models SaaS, PaaS, and IaaS.
computing [3].
Two states of data normally have threat to its security in
A. Virtualization clouds; Data at Rest which means the data stored in the cloud
Virtualization is a technique in which a fully functional and Data in Transit which means data that is moving in and out
operating system image is captured in another operating system of the cloud. Confidentiality, and Integrity of data is based
to utilize the resources of the real operating system fully. A upon the nature of data protection mechanisms, procedures,
special function called hypervisor is required to run a guest and processes. The most significant matter is the exposure of
operating system as a virtual machine in a host operating data in above mentioned two states.
system [5,10].
A. Data at Rest
Virtualization is a foundational element of cloud computing
Data at rest refers to data in cloud, or any data that can be
which helps in delivering the core values of cloud computing.
accessed using Internet. This includes backup data as well as
However, virtualization poses some risks to data in cloud
live data. As mentioned earlier, sometimes it is very difficult
computing. One possible risk is compromising a hypervisor
for organizations to protect data at rest if they are not
itself. A hypervisor can become a primary target if it is
maintaining a private cloud since they do not have physical
vulnerable. If a hypervisor is compromised, the whole system
control over the data. However, this issue can be resolved by
can be compromised and hence the data [11].
maintaining a private cloud with carefully controlled access.
Another risk with virtualization is associated with
allocation and de-allocation of resources. If VM operation data B. Data in Transit
is written to memory and it is not cleared before reallocation of Data in transit normally refers to data which is moving in
memory to the next VM, then there is a potential for data and out of the cloud. This data can be in the form of a file or
exposure to the next VM which might be undesirable [12]. database stored on the cloud and can be requested for use at
A solution to above mentioned issues is a better planning some other location. Whenever, data is uploaded to the cloud,
for the use of virtualization. Resources should be carefully used the data at time of being uploaded is called data in transit. Data
and data must be properly authenticated before de-allocating in transit can be very sensitive data like user names and
the resources. passwords and can be encrypted at times. However, data in
unencrypted form is also data in transit [17].
B. Storage in Public Cloud Data in transit is sometimes more exposed to risks than the
Storing data in a public cloud is another security concern in data at rest because it has to travel from one location to
cloud computing. Normally clouds implement centralized another. (See Fig 1). There are several ways in which
storage facilities, which can be an appealing target for hackers. intermediary software can eavesdrop the data and sometimes
Storage resources are complicated systems that are have the ability to change the data on its way to the destination.
combination of hardware and software implementations and In order to protect data in transit, one of the best strategies is
can cause exposure of data if a slight breach occurs in the encryption.
public cloud [13].
In order to avoid such risks, it is always recommended to
have a private cloud if possible for extremely sensitive data.

C. Multienancy
Shared access or multitenancy is also considered as one of
the major risks to data in cloud computing [14]. Since multiple
users are using the same shared computing resources like CPU,

56
 of separate storage can be deadly to businesses. Other concerns
involving guest hopping attacks and their problems are
considered to be a great hurdle in the use and implementation
of cloud computing applications [20].

· Malicious attacks from management internally

Sometimes the architecture of cloud computing
environments poses risks to the privacy and security of the
customers [21].Although it happens rarely, this risk is very
difficult to deal with. Examples include the administrators and
managers of cloud service providers who can sometimes act as
Fig 1: Data at Rest and in Transit.
malicious agents and threaten the security of the clients using
cloud computing applications.

V. MAJOR SECURITY CHALLENGES · Insecure or incomplete data deletion

Undoubtedly it is not easy to secure and ensure the safety In instances where clients request data to be deleted either
of linked computers because a series of computers and clients partially or completely, this raises the question of whether it
are involved; this is known as multi-tenancy. The cloud service will be possible to delete the desired part of their data segment
providers and cloud computing have to face many challenges, with accuracy. This makes it harder for the clients to subscribe
particularly in the area of security issues. Thus, it is very to the services of the cloud-computing [22].
important to consider how these challenges are mimicked and
how security models are implemented in order to ensure the · Data interception
security of clients and establish a safe cloud computing Unlike with tradition computing, the data in cloud
environment. The major challenges involved are: computing is segmented and distributed in transit. This poses
more threats due to the vulnerability and fragility of the
· Lack of appropriate governance computing technology and, in particular, sniffing and spoofing,
During cloud computing the services provider has full third party attacks and reply attacks [23].
control. By passing this control to the provider there is a danger
that the loss of control over authority parameters could possibly · Compromise of management interface
result in security being compromised, leading to problems in Since the services of cloud computing are delivered
terms of data access and the application of the resources. This remotely over the Internet and the resources are accessible to
compromised security concern comes with another threat of the service provider, third party access can result in malicious
creating a gap in security cover in cases where Service Level activities [24] . As a result the vulnerabilities, manipulation of
Agreements are not in place with the service provider. Further, services and involvement of the service provider are amplified.
the terms of use are also open to the liberty of user meaning For instance, the customer may take over the machines and
that access to data can be exploited quite easily. For instance, conversely the provider can take over the control by setting up
the Google search engine states that the user: “agrees that no-go zones in the applications of cloud computing.
Google has no responsibility or liability for deletion or failure
to store any content and other communication maintained or Other challenges related to security include the transfer of
transmitted through use of the service [18]. Amazon also information within different applications of cloud computing,
clearly state that they don’t take any responsibility, liability or leakage of information while uploading data to cloud, attacks
authority for unauthorized use, corruption, access, loss or on privacy and security of user’s data, loss or malicious
deletion of data, or any other sort of access including harm to manipulation of encryption keys and conflicts between service
the application [19]. Hence, customers are faced with security providers and customers on procedure and policies on the
concerns regarding their data and application, as hosted by the operation of cloud computing applications. [25] .
third party, service provider or mediator.
There are also challenges that indirectly interact with or
influence cloud computing but have no direct impact upon the
· Lock-in integrity of cloud computing applications. Such scenarios
Another hurdle is inadequate standards of data format, a include: modification of network traffic, network breaks and
lack of operating methods and shortage of tools which administrative issues, such as non-optimal use of resources,
collectively cause compromised portability between the congestion and miss-connection. There are some other risks
services and applications, even between service providers. associated to the applications of cloud computing, for instance,
Consequently, the customer has to be dependent wholly and the risk of social engineering attacks, natural disasters and theft
solely on the vendor. of equipment [26] .

· Isolation failure VI. PROTECTING DATA USING ENCRYPTION

The sharing of resources owing to multi-tenancy of cloud Encryption techniques for data at rest and data in transit can
computing is itself a questionable characteristic. The shortage be different. For examples, encryption keys for data in transit

57
can be short-lived, whereas for data at rest, keys can be
retained for longer periods of time.

Fig 2: Basic Cryptography Process

Different cryptographic techniques are used for encrypting

the data these days. Cryptography has increased the level of Fig 4: Stream Cipher Mechanism
data protection for assuring content integrity, authentication,
and availability. In the basic form of cryptography, plaintext is As illustrated in Fig 4, stream cipher uses an encryption
encrypted into cipher text using an encryption key, and the key to encrypt each bit instead of block of text. The resultant
resulting cipher text is then decrypted using a decryption key as cipher text is a stream of encrypted bits that can be later
illustrated in Fig 2. decrypted using decryption key to produce to original plain
Normally there are four basic uses of cryptography: text.
A. Block Ciphers C. Hash Functions
A block cipher is an algorithm for encrypting data (to In this technique, a mathematical function called a hash
produce cipher text) in which a cryptographic key and function is used to convert an input text in to an alphanumeric
algorithm are applied to a block of data instead of per bit at a string. Normally the produced alphanumeric string is fixed in
time [27]. size. This technique makes sure that no two strings can have
In this technique, it is made sure that similar blocks of text same alphanumeric string as an output. Even if the input strings
do not get encrypted the same way in a message. Normally, the are slightly different from each other, there is a possibility of
cipher text from the previous encrypted block is applied to the great difference between the output string produced through
next block in a series. them .

As illustrated in Fig 3, the plain text is divided in to blocks This hash function can be a very simple mathematical
of data, often 64 bits. These blocks of data are then encrypted function like the one shown in equation (1) or very complex.
using an encryption key to produce a cipher text. F(x) = x mod 10 (1)

B. Stream Ciphers Fig 5, below shows the mechanism of hash function

cryptography.
This technique of encrypting data is also called state cipher
since it depends upon the current state of cipher. In this
technique, each bit is encrypted instead of blocks of data. An
encryption key and an algorithm is applied to each and every
bit, one at a time [28].

Fig 5: Cryptographic Hash Function Mechanism

Fig 3: Block Cipher Mechanism

All these above mentioned methods and techniques are

Performance of Stream ciphers is normally faster than widely used in encrypting the data in the cloud to ensure data
block ciphers because of their low hardware complexity. security. Use of these techniques varies from one scenario to
However, this technique can be vulnerable to serious security another. Whichever technique is used, it is highly
problems if not used properly. recommended to ensure the security of data in both private and
public clouds.

58
 VII. CONCLUSION [13] Cloud Security Alliance, “The Notorious Nine. Cloud
Increased use of cloud computing for storing data is Computing Top Threats in 2013,” Security, no.
certainly increasing the trend of improving the ways of storing February, pp. 1–14, 2013.
data in the cloud. Data available in the cloud can be at risk if [14] L. Rodero-Merino, L. M. Vaquero, E. Caron, A.
not protected in a rightful manner. This paper discussed the Muresan, and F. Desprez, “Building safe PaaS clouds:
risks and security threats to data in the cloud and given an A survey on security in multitenant software
overview of three types of security concerns. Virtualization is platforms,” Comput. Secur., vol. 31, no. 1, pp. 96–108,
examined to find out the threats caused by the hypervisor. 2012.
Similarly, threats caused by Public cloud and multitenancy [15] A. U. Khan, M. Oriol, M. Kiran, M. Jiang, and K.
have been discussed. One of the major concerns of this paper Djemame, “Security risks and their management in
was data security and its threats and solutions in cloud cloud computing,” 4th IEEE Int. Conf. Cloud Comput.
computing. Data in different states has been discussed along Technol. Sci. Proc., pp. 121–128, 2012.
with the techniques which are efficient for encrypting the data [16] T. Mather, S. Kumaraswamy, and S. Latif, “Cloud
in the cloud. The study provided an overview of block cipher, Security and Privacy,” p. 299, 2009.
stream cipher and hash function which are used for encrypting [17] F. Yahya, V. Chang, J. Walters, and B. Wills,
the data in the cloud whether it is at rest or in transit. “Security Challenges in Cloud Storage,” pp. 1–6,
2014.
REFERENCES [18] Ion, I., Sachdeva, N., Kumaraguru, P., & Čapkun, S.
[1] J. Srinivas, K. Reddy, and A. Qyser, “Cloud (2011, July). Home is safer than the cloud!: privacy
Computing Basics,” Build. Infrastruct. Cloud Secur., concerns for consumer cloud storage. In Proceedings
vol. 1, no. September 2011, pp. 3–22, 2014. of the Seventh Symposium on Usable Privacy and
[2] M. A. Vouk, “Cloud computing - Issues, research and Security (p. 13). ACM
implementations,” Proc. Int. Conf. Inf. Technol. [19] Lipinski, T. A. (2013, September). Click Here to
Interfaces, ITI, pp. 31–40, 2008. Cloud: End User Issues in Cloud Computing Terms of
[3] P. S. Wooley, “Identifying Cloud Computing Security Service Agreements. In International Symposium on
Risks,” Contin. Educ., vol. 1277, no. February, 2011. Information Management in a Changing World (pp.
[4] A. Alharthi, F. Yahya, R. J. Walters, and G. B. Wills, 92-111). Springer Berlin Heidelberg.
“An Overview of Cloud Services Adoption Challenges [20] Ransome, J. F., Rittinghouse, J. W., & Books24x7, I.
in Higher Education Institutions,” 2015. 2009).
[5] S. Subashini and V. Kavitha, “A survey on security [21] Wang, Y., Chandrasekhar, S., Singhal, M., & Ma, J.
issues in service delivery models of cloud computing,” (2016). A limited-trust capacity model for mitigating
J. Netw. Comput. Appl., vol. 34, no. 1, pp. 1–11, Jan. threats of internal malicious services in cloud
2011. computing. Cluster Computing,19(2), 647-662.
[6] F. Zhang and H. Chen, “Security-Preserving Live doi:10.1007/s10586-016-0560-2
Migration of Virtual Machines in the Cloud,” J. Netw. [22] Wang, L., Ranjan, R., Chen, J., & Benatallah, B.
Syst. Manag., pp. 562–587, 2012. 2011).
[7] J. Hu and A. Klein, “A benchmark of transparent data [23] Shah, H. and Anandane, S.S., 2013. Security Issues on
encryption for migration of web applications in the Cloud Computing. arXiv preprint arXiv:1308.5996.
cloud,” 8th IEEE Int. Symp. Dependable, Auton. [24] Jensen, M., Schwenk, J., Gruschka, N. and Iacono,
Secur. Comput. DASC 2009, pp. 735–740, 2009. L.L., 2009, September. On technical security issues in
[8] D. Descher, M., Masser, P., Feilhauer, T., Tjoa, A.M. cloud computing. In 2009 IEEE International
and Huemer, “Retaining data control to the client in Conference on Cloud Computing (pp. 109-116). Ieee.
infrastructure clouds,” Int. Conf. Availability, Reliab. [25] Winkler, V. (. R. )., & Books24x7, I. (2011). Securing
Secur. (pp. 9-16). IEEE., pp. pp. 9–16, 2009. the cloud: Cloud computer security techniques and
[9] E. Mohamed, “Enhanced data security model for tactics. NL: Syngress Media Incorporated.
cloud computing,” Informatics Syst. (INFOS), 2012 [26] Catteddu, D., & Hogben, G. (2009). Cloud computing
8th Int. Conf., pp. 12–17, 2012. risk assessment. European Network and Information
[10] C. Modi, D. Patel, B. Borisaniya, A. Patel, and M. Security Agency (ENISA), 583-592.
Rajarajan, “A survey on security issues and solutions [27] H. Qian, J. He, Y. Zhou, and Z. Li, “Cryptanalysis and
at different layers of Cloud computing,” J. improvement of a block cipher based on multiple
Supercomput., vol. 63, no. 2, pp. 561–592, 2013. chaotic systems,” Math. Probl. Eng., vol. 2010, pp. 7–
[11] V. J. Winkler, “Securing the Cloud,” Cloud Comput. 9, 2010.
Secur. Tech. tactics. Elsevier., 2011. [28] P. Gope and T. Hwang, “Untraceable Sensor
[12] F. Sabahi, “Virtualization-level security in cloud Movement in Distributed IoT Infrastructure,” IEEE
computing,” 2011 IEEE 3rd Int. Conf. Commun. Sens. J., vol. 15, no. 9, pp. 5340–5348, 2015.
Softw. Networks, pp. 250–254, 2011.

59

View publication stats