Cloud Security Mechanisms for Data Protection: A Survey
---
paper_title: Single Password Authentication

paper_content:

Users frequently reuse their passwords when authenticating to various online services. Combined with the use of weak passwords or honeypot/phishing attacks, this brings high risks to the security of the user's account information. In this paper, we propose several protocols that can allow a user to use a single password to authenticate to multiple services securely. All our constructions provably protect the user from dictionary attacks on the password, and cross-site impersonation or honeypot attacks by the online service providers. Our solutions assume the user has access to either an untrusted online cloud storage service (as per Boyen [16]), or a mobile storage device that is trusted until stolen. In the cloud storage scenario, we consider schemes that optimize for either storage server or online service performance, as well as anonymity and unlinkability of the user's actions. In the mobile storage scenario, we minimize the assumptions we make about the capabilities of the mobile device: we donotassume synchronization, tamper resistance, special or expensive hardware, or extensive cryptographic capabilities. Most importantly, the user's password remains secure even after the mobile device is stolen. Our protocols provide another layer of security against malware and phishing. To the best of our knowledge, we are the first to propose such various and provably secure password-based authentication schemes. Lastly, we argue that our constructions are relatively easy to deploy, especially if a few single sign-on services (e.g., Microsoft, Google, and Facebook) adopt our proposal.
---
paper_title: Addressing cloud computing security issues

paper_content:

The recent emergence of cloud computing has drastically altered everyone's perception of infrastructure architectures, software delivery and development models. Projecting as an evolutionary step, following the transition from mainframe computers to client/server deployment models, cloud computing encompasses elements from grid computing, utility computing and autonomic computing, into an innovative deployment architecture. This rapid transition towards the clouds, has fuelled concerns on a critical issue for the success of information systems, communication and information security. From a security perspective, a number of unchartered risks and challenges have been introduced from this relocation to the clouds, deteriorating much of the effectiveness of traditional protection mechanisms. As a result the aim of this paper is twofold; firstly to evaluate cloud security by identifying unique security requirements and secondly to attempt to present a viable solution that eliminates these potential threats. This paper proposes introducing a Trusted Third Party, tasked with assuring specific security characteristics within a cloud environment. The proposed solution calls upon cryptography, specifically Public Key Infrastructure operating in concert with SSO and LDAP, to ensure the authentication, integrity and confidentiality of involved data and communications. The solution, presents a horizontal level of service, available to all implicated entities, that realizes a security mesh, within which essential trust is maintained.
---
paper_title: CloudPolice: taking access control out of the network

paper_content:

Cloud computing environments impose new challenges on access control techniques due to multi-tenancy, the growing scale and dynamicity of hosts within the cloud infrastructure, and the increasing diversity of cloud network architectures. The majority of existing access control techniques were originally designed for enterprise environments that do not share these challenges and, as such, are poorly suited for cloud environments. In this paper, we argue that it is both sufficient and advantageous to implement access control only within the hypervisors at the end-hosts. We thus propose Cloud-Police, a system that implements a hypervisor-based access control mechanism. We argue that, not only can CloudPolice support more sophisticated access control policies, it can do so in a manner that is simpler, more scalable and more robust than existing network-based techniques.
---
paper_title: Controllable privacy preserving search based on symmetric predicate encryption in cloud storage

paper_content:

Predicate encryption is a novel cryptographic primitive that provides fine-grained control over the accesses to encrypted data. It is often used in secure cloud storage and biometric matching. In this manuscript, we first propose a variant of symmetric predicate encryption, which provides controllable privacy preserving search functionalities, including revocable delegated search and un-decryptable delegated search. Due to these functionalities, the owner of a cloud storage can easily control the lifetimes and search privileges of cloud data.
---
paper_title: Hierarchical attribute-based encryption and scalable user revocation for sharing data in cloud servers

paper_content:

With rapid development of cloud computing, more and more enterprises will outsource their sensitive data for sharing in a cloud. To keep the shared data confidential against untrusted cloud service providers (CSPs), a natural way is to store only the encrypted data in a cloud. The key problems of this approach include establishing access control for the encrypted data, and revoking the access rights from users when they are no longer authorized to access the encrypted data. This paper aims to solve both problems. First, we propose a hierarchical attribute-based encryption scheme (HABE) by combining a hierarchical identity-based encryption (HIBE) system and a ciphertext-policy attribute-based encryption (CP-ABE) system, so as to provide not only fine-grained access control, but also full delegation and high performance. Then, we propose a scalable revocation scheme by applying proxy re-encryption (PRE) and lazy re-encryption (LRE) to the HABE scheme, so as to efficiently revoke access rights from users.
---

Title: Cloud Security Mechanisms for Data Protection: A Survey

Section 1: Introduction
Description 1: Write an introduction to cloud computing, highlighting its evolution, features, and the associated security concerns.

Section 2: Software as a Service
Description 2: Describe the Software as a Service (SaaS) model and its security measures, along with examples from real-time providers.

Section 3: Platform as a Service (PAAS)
Description 3: Explain the Platform as a Service model, its benefits, and the security features provided by prominent providers.

Section 4: Infrastructure as a Service (IAAS)
Description 4: Discuss the Infrastructure as a Service model, key features, security measures, and examples from leading providers.

Section 5: Security Issues in Cloud Storage
Description 5: Outline the various security issues pertaining to cloud storage, including types of attacks and security measures adopted.

Section 6: Authentication in Cloud
Description 6: Provide details about authentication processes and schemes used in cloud environments to ensure data security.

Section 7: Authorization
Description 7: Describe the authorization methods used in cloud computing to protect data and ensure only authorized access.

Section 8: Encryption
Description 8: Explain the encryption techniques used for data protection in cloud environments, highlighting different methods and their advantages.

Section 9: Access Control
Description 9: Discuss the access control mechanisms employed in cloud computing to ensure data security and authorized access.

Section 10: Conclusion
Description 10: Summarize the benefits and challenges of cloud computing, and review the security mechanisms discussed in the paper.