Hierarchical group key management for secure data sharing in a cloud‐based environment

Abstract

In cloud environment, the importance of security for the outsourced data has increased much, since the data is maintained and controlled by the semi-trusted third-party cloud providers. Data Security is one of the major factors to be considered in group data sharing. Using the secret key, the entire file is encrypted directly in a conventional security framework; however, in a cloud-based environment for group mechanism, this framework cannot be applied as there is a problem of key distribution. This research paper proposes an efficient hierarchical-based group key mechanism for a cloud-based environment. This proposed system relies on Key Distribution Server (KDS), which performs cryptographic key operations for securing the data in the cloud. Also, this system uses logical key hierarchy (LKH) protocol to maintain hierarchical tree for scalability. The group key is generated using the group member secret values and a secret value assigned by the KDS server. Performance analysis of this system shows that the proposed key management system is more efficient and much suitable for cloud environment. KEYWORDScloud computing, forward and backward secrecy, group key management, logical key hierarchy INTRODUCTIONIn cloud computing, the resources are shared through the internet and the outsourced data needs more security and privacy. To provide the data storage and computation services, many cloud providers have emerged, such as Google App Engine, Amazon Simple Storage Service (Amazon S3), and so on. One of the main services provided by cloud is pay-as-you-go 1 for the usage. In addition, the cloud providers initially provide with the limited storage space for users to store their data. By using cloud computing, users can able to access and retrieve the data any time and any where using these cloud services.There are several case studies related to the data storage in cloud. 2 There are several reasons for organization to prefer cloud servers for storing their company data.(1) Instead of buying the storage server, organizations depend on cloud provider for storing their data as it reduces financial cost and overload; (2) when the data is stored in cloud, data owners can share their data to other users easily. Moreover, many personal data are also stored in cloud by the individuals using Drop box, etc. 3,4 Even though cloud provides us with several advantages, there is lot of security challenges that needs to be considered when storing and sharing data using cloud. In this proposed scheme, we consider two major security issues particularly.First, only authorized persons should have access to the data and it is achieved through efficient key management mechanism. Second, by applying cryptographic operations, it guarantees secure data sharing among group members and also to provide security whenever there is a upload or download services from cloud. The basic approach followed earlier is to use the cryptographic mechanisms of encryption and decryption to store and retrieve data in and out of cloud storage. This basic approa...

A Survey on Identity and Access Management for Cross-Domain Dynamic Users: Issues, Solutions, and Challenges

“…On the other hand, the second model is hard to design but relatively easy to manage after a successful implementation. One work that focuses on the hierarchy inside of a user group is [113]. The authors of this paper proposed hierarchical group key management techniques for a cloud environment.…”

A Hierarchical Multicast Key Distribution Protocol

“…The classic centralized GKD is the logical key hierarchy [2], which reduces the communication overload from O(n) to O(log 2 n) by using a binary key tree. Many such schemes [7,8] for secure multicast communications adopt tree structures, which have a proper balance between communication, computation, and storage overload. Anand et al [9] propose a scheme that integrates the principles of a routing tree mapped logical key tree for lightweight and secure group communication.…”

A secure and efficient WSN by employing symmetric key matrix and rectangular frame scheme

“…The parameters used are defined as follows under the assumption that n sensors are currently employed by the underlying WSN. (1)ID i : the identity of node i, ID i = i , 1 ≤ i ≤ n . (2)KDS: The key distribution server as node 1, ie, ID 1 , is responsible for two main tasks: (a) key management, generation, and assignment; (b) broadcasting messages to all nodes to update their key cross, which will be defined later. (3)Symmetric Key Matrix (SKM): The KDS generates random numbers to construct an n × n symmetric matrix SKM = { K i,j | 1≤ i , j ≤ n }, which is stored in KDS only, where K i,j = K j,i for all i s and j s. 。 (4)Communication Key Group of node i ( CKG i ): Node i , 1 ≤ i ≤ n , having a set of its own communication keys, which is used to construct CKG i , ie, CKG i = { K i,j |1 ≤ j ≤ n and j ≠ i }. (5) K 1,1 : The master key of the KDS, which is a common key shared by all nodes in the WSN for message encryption, authentication, and management. (6) K i,i : The master key used by node i , 2 ≤ i ≤ n , for message encryption and authentication. (7) K g : The group key of the system, which is shared by all nodes in the WSN and used for generation of individual authentication key. (8) G ‐ tab : The system group‐table, a 16×16 random permutation table, which is created by the KDS and shared by all nodes in the WSN to derive temporary encryption keys for message transmission. (9) IC i ‐ tab : The individual characteristic table established for node i , 1 ≤ i ≤ n , which is a 16×16 random permutation table created by the KDS for message encryption and authentication. (10) K i , AK : The individual authentication key of node i , 2 ≤ i ≤ n , which is generated by KDS and utilized by node i to ensure that a received message is sent by the legitimate KDS. (11) K i , AK,V : The verification individual authentication key generated by receiving node, ie, node i , and utilized to ensure that a received message is sent by the legitimate KDS. (12) K h : The system hidden key is owned only by the KDS and used to generate K i , AK , 2 ≤ i ≤ n . (13) t nonce ,s : The source node's CPU time when a message is created, attempting to effectively defend against replay attacks. (14) t nonce ,c : The receiving node's current CPU time when a message is received. (15) K CT : The current time key derived from t nonce , for encrypting messages and effectively defending against replay attacks. (16) rand : a random number of m bits long. (17) EK 1 and EK 2 : The encryption keys which are used to encrypt transmitted messages. (18) VK : The Verification Key which is adopted to authenticate the identity of the sender. (19) TK 1 ∼ TK 4 : Temporary keys used to generate the encryption and verification keys. (20) msg : The transmitted message, the size of which is k times the key size, k ∈Z + . (21) k ‐code: the key‐refreshment‐code, the size of which is the same as that of a key …”