Cloud Data Security
S.W. Sajeth Jonathan
BSc (Hons) in IT specialized in
Cybersecurity
Sri Lanka Institute of Information
Technology (SLIIT)
Sri Lanka
IT18071412
Wishvajith B.L.D.V.
BSc (Hons) in IT specialized in
Cybersecurity
Sri Lanka Institute of Information
Technology (SLIIT)
Sri Lanka
IT18032666
Perera K.D.U.
BSc (Hons) in IT specialized in
Cybersecurity
Sri Lanka Institute of Information
Technology (SLIIT)
Sri Lanka
IT16057616
A. Renu Harshatha
BSc (Hons) in IT specialized in
Cybersecurity
Sri Lanka Institute of Information
Technology (SLIIT)
Sri Lanka
IT18034400
Abstract— The ease of use and scalability of cloud services
has attracted users and organization, encouraging them
to integration cloud solutions in their businesses. As more
and more information of individuals and companies are
placed in the cloud, there is a growing concern about the
safety of information. The review paper highlights issues
related to cloud computing.
Keywords—data security, cloud security, cloud computing,
cloud models, cloud security countermeasures
I. INTRODUCTION
In this developing era of computer technology, the Internet
has become the most indispensable piece of an individual’s
life. The demand for using the internet is not limited to
browse, it is additionally utilized in the industry for business
development and processing. The latest approach to provide
computing infrastructure is Cloud computing. The purpose of
this infrastructure is to reduce the cost of management of
hardware and software resources; therefore, the location of
the computing infrastructure is shifted to the network.
“Cloud Computing” definition from National Institute of
Standards and Technology is that cloud computing enables
ubiquitous, convenient, on demand network access to a
shared pool of configurable computing resources (e.g.,
networks, servers, storage, applications and services) that
can be rapidly provisioned and released with minimal
management effort or service provider interaction. [1]
It is understandable that this model allows users to allot
resources on request and access the computer and storage on
demand by providing fast, efficient and inexpensive
computing power that expands the clients’ storage service
needs. Apart from these advantages of cloud computing are
as follows:
• It allows the user to use software from any device.
• It allows seamless transfer of files from one device
to another.
XXX-X-XXXX-XXXX-X/XX/$XX.00 ©20XX IEEE
Ramanayake A.M.
BSc (Hons) in IT specialized in
Cybersecurity
Sri Lanka Institute of Information
Technology (SLIIT)
Sri Lanka
IT18021912
•
It allows users to save their data online as backup
files which can be retrieved in case of data loss
• It allows the user to access their emails on any
devices.
To be precise, availability of data is 24x7 and files can be
accessed from anywhere with stable internet connection.
Cloud computing is provided to its clients’ using three
Service models and three deployment models. The three
service models of cloud computing are:
• Software as a Service (SaaS):
It is a software distribution model, where the
software is deployed by the cloud service provider
and can be accessed through a web browser. Few
commonly known examples are G-Suite, Outlook,
MySAP.
•
Platform as a Service (PaaS):
It is somewhat like SaaS but has a slight difference,
instead of delivering the software service online it
creates a platform for delivery through internet. In
simple terms the cloud provides a software platform
for the system for its users to do a specific task. Well
known example would be Google App Engine.
•
Infrastructure as a Service (IaaS):
The cloud server provides virtual machines and
storage to develop their business competency for its
user. Users buy this service and customizes it
according to their business environment and gain the
benefits. Commonly known IaaS is Microsoft
Azure.
The three deployment models of cloud computing.
• Public Cloud:
This infrastructure is available to public in general.
By default, the users of public cloud are
untrustworthy. Individuals and Organizations are
mainly considered to be public cloud users.
•
Private Cloud:
This deployment model is solely for a single
organization which is provided exclusively to
trusted users. Simply only authorized person can
access it.
•
This review paper discusses about the security issues and
necessary countermeasures to be taken to enhance the data
security of Cloud computing. This review paper is organized
as follow Section II describes about the characteristics of
Cloud computing, Section III states the related works
associated with data security in cloud and Research
Challenges in Cloud computing, Section IV covers the
Security Issues and Section V states the necessary
countermeasures to be taken to protect data security in Cloud
computing.
II. CHARACTERISTICS OF CLOUD COMPUTING
It is mentioned above that cloud computing supports and
enhances ubiquitous, suitable, on demand network access to
its users/clients. Apart from the mentioned features various
characteristics of cloud computing are as follows:
•
•
•
•
Data is available and ready to use anywhere at
anytime with compatible device and internet
connection.
Hybrid Cloud:
This cloud deployment model is a composition of
two or more clouds i.e. private, community or
public.[2][3][4]
As the technology evolves like this individuals and
organization tend to use the upcoming technology and evolve
with it. The more the individuals and the organization use the
cloud storage it requires to store users’ data in the cloud
storage devices unlike the traditional method (storing data in
personal devices like laptop/external hard disk.) Thus, the
users’ who are not aware of security related issues would face
a higher risk.
•
•
Users can obtain application services regardless of
their location and does not need to bother about
where the application runs, this is simply known as
Virtualization.
Cloud computing ensures high reliability and
reduces the fault tolerance.
Huge improvement of resources utility compared
with a traditional system; thus, cost is reduced
compared with traditional method.
Easy to maintain and the downtime is low.
Data may not get lost even if one of the servers get
damaged as it creates a snapshot of the data stored.
Fig 1.0 Cloud computing characteristics.[5]
III. RESEARCH CHALLENGES
Cloud computing has become a vital technology in the
industry, as reviewed the more the users utilized and save their
data in the servers the more the security issues the servers are
prone to.
Security researchers has been researching a safer and secured
methodologies and models for cloud computing to ensure the
data security in Cloud. Following are such work research
challenges faced by the few such Information security
researchers.
Research Challenges in Cloud Computing
Cloud Computing research addresses the challenges of
meeting the requirements of next generation private, public
and hybrid cloud computing architectures, also the challenges
of allowing applications and development platforms to take
advantage of the benefits of cloud computing. The following
are the main areas of challenges in cloud computing.
• Service Level Agreements (SLA’s)
- A big challenge for the Cloud customers is to
evaluate SLAs of Cloud vendors. Most vendors
create SLAs to make a defensive shield against
legal action, while offering minimal assurances
to customers. So, there are some important
issues, e.g., data protection, outages, and price
structures that need to be considered by the
customers before signing a contract with a
provider.
• Cloud Data Management & Security
- Cloud data can be very large. Confidentiality
is usually achieved using cryptographic
protocols, whereas auditability can be
achieved using remote attestation techniques.
Since service providers typically do not have
access to the physical security system of data
centers, they must rely on the infrastructure
provider to achieve full data security. Even for
a virtual private cloud, the service provider can
only specify the security setting remotely,
without knowing whether it is fully
implemented.
-
• Migration of virtual Machines
- Virtual machine migration has evolved from
process migration techniques. Virtualization
can provide significant benefits in cloud
computing by enabling virtual machine
migration to balance load across the data center.
Currently, detecting workload hotspots and
initiating a migration lacks the agility to
respond to sudden workload changes.
• Interoperability
- Many public cloud networks are configured as
closed systems and are not designed to interact
with each other. To overcome this challenge,
industry standards must be developed to help
cloud service providers design interoperable
platforms and enable data portability.
Organizations need to automatically provision
services, manage VM instances, and work with
both cloud-based and enterprise-based
applications using a single tool set that can
function across existing programs and multiple
cloud providers.
• Energy Management
- Designing energy-efficient data centers has
recently received considerable attention. It has
been estimated that the cost of powering and
cooling accounts for 53% of the total
operational expenditure of data centers.
Significant saving in the energy of a cloud data
center without sacrificing SLA are an excellent
economic incentive for data center operators
and would also make a significant contribution
to greater environmental sustainability.
• Server Consolidation
- The increased resource utilization and reduction
in power and cooling requirements achieved by
server consolidation are now being expanded
into the cloud. Server consolidation is an
effective approach to maximize resource
utilization
while
minimizing
energy
consumption in a cloud computing
environment. However, server consolidation
activities should not hurt application
performance. The system must quickly react to
resource congestions when they occur.
• Reliability & Availability of Service
- The challenge of reliability comes into the
picture when a cloud provider delivers ondemand software as a service. To avoid such
problems, providers are turning to technologies
such as Google Gears, Adobe AIR, and Curl,
which allow cloud-based applications to run
locally, some even allow them to run in the
absence of a network connection. But gamin
and video conferencing systems which are
cloud based are giving a hard time.
• Common Cloud Standards
- The creation of a single accreditation body to
certify the Cloud services would also be a big
challenge. Security based accreditation for
Cloud Computing would cover three main areas
which are technology, personnel and
operations. Currently, one of the main problems
is that there are many separated activities going
in the direction of Cloud accreditation, but a
common body for the coordination of those
activities is missing.[6]
IV. SECURITY ISSUES
When it comes to cloud environment there are several risks
and security concerns associated. This study will mainly
focus on the risks and concerns specifically when it comes to
data residing within cloud.
When it comes to the cloud environment data is at a higher
risk than enterprise environment since unlike in enterprise
computing where storage of data is managed by the enterprise
itself, in cloud the data is usually stored outside of the
enterprise infrastructure. This must be addressed by additional
employment of security measures for cloud data.
Data security in cloud computing goes beyond data
encryption. Security measures for maintaining the data
protection can vary depending on the three service models in
cloud computing SaaS, PaaS, IaaS and by the state of the data.
We can mainly distinguish three states of data in the cloud:
data at rest, data in transit and data in use. [7] [Fig 1.1]
A. Data at Rest
Referred to inactive data stored in cloud that can be accessed
ubiquitously over an active internet connection. Common
uses include backups, archiving information. Main risks and
concerns associated with data at rest can be categorized into
data location and federation risks, multi-tenancy risks and
storage reliability risks.
1) Data location and federation risks : In cloud
computing environment data storage unit’s location is usually
unknown to the user, data can reside in multiple locations
around the world.[8] Sensitive data exposure and unauthorized
access to the data are attached with location problems in
cloud. Off-shore data storing can also pose the risk of
unwanted acccess and rights to demand access to decrypted
data by authorities in relevant countries the data storage units
are located at. e.g. – USA patriot act[9] allows USA authorities
the right to access the data residing within USA data centers
regardless of the owner’s originating country.
2) Multi-tenancy risks: Sharing the physical
infastructure in cloud is common. Given that the multiple
users have access to the same physical data storage medium,
risk of private data leakage and theft increases.
3) Storage reliability risks: Reliability of Cloud service
provider comes down to the level of trust because of the fact
the users do not have physical access to data, relying on
service provider to secure the data and infrastructure and
trusting the provider not to substract the infrastructure for
multiple users has to happen.
B. Data in Transit
Referred to data stored in cloud temporarily to be read or
updated upon request or data actively traversing from one
location to another over a network. This network can either
private or a public i.e. untrusted network. [10]
Common uses include messaging services, VPNs, e-mail
attachments. These data may include sensitive information
like passwords, usernames etc. Therefore, also having an
increased risk than data at rest to be eavesdropped by an
intermediary at any stage of the data flow.
C. Data in Use
When data is actively consumed or in the process creation,
deletion and transformation we can conclude them as data in
use in cloud.[10]
Unlike in enterprise environment the user data is generated
and managed by the cloud service provider. Risk of collected
private data being used for improvements for cloud services
or disclosure to third parties is high due to this reason.
Deletion process of the data in cloud is also questionable as
the cloud service provider is the person managing the
infrastructure. Deleted data may still be present in storage
mediums and can be restored depending upon the services
cloud provider offers. e.g. XYZ cloud provider can offer the
restore option for deleted data within certain time periods (for
7 days, months). In such cases data residues or backups of
data must be present in physical medium even after deletion
of data. This issue is known as ‘Data remanence’ i.e. residual
data being present on storage media after attempts of data
erase or deletion. Data remanence can pose a serious threat
especially in cloud environment where the access to physical
infrastructure is low to none. Users must rely on the trust in
cloud service provider for complete deletion of private data,
which is not ideal. Since the multi-tenancy nature of the cloud
environment the problem of multiple copies and retrieval of
private data using data residues by other users using the same
cloud infrastructure is also a great risk which is still not
properly addressed, and questionable. [11]
V. SECURITY COUNTERMEASURES
1. Protecting Data Using Encryption
Encryption is a better solution which is suggested to secure
cloud data. Cloud data encryption is the process of
transforming or encoding the data that is at rest or at transit
and these techniques are different for each state of data or the
connection. There are different cryptographic techniques that
can be used to encrypt data and there are several uses of these
cryptography techniques.[12]
Block cipher is one technique in which the original data is
divided to blocks of data, which is often 64 bits, where both
a cryptographic key and an algorithm are applied to the block
of data instead of per bit at a time. In this technique, it is made
sure that similar blocks of text do not get encrypted the same
way in a message. Mostly the cipher text from the previous
encrypted block is applied to the next block in a series.[12]
Stream Ciphers is another technique of encrypting data which
is also known as the state cipher as it depends upon the
current state of cipher. In this technique, instead of encrypting
blocks of data, each bit is encrypted one at a time with the use
of an encryption key and an algorithm. The resultant cipher
text is a stream of encrypted bits that can be later decrypted
using decryption key to produce to original plain text.
Performance of Stream ciphers is normally faster than block
ciphers because of their low hardware complexity. However,
this technique can be vulnerable to serious security issues if
it is not used properly.[12]
Hash Functions is another technique used, where a
mathematical function called a hash function is used to
convert an input text into an alphanumeric string. Normally
the alphanumeric string which is produced in this
cryptographic technique is fixed in size. This technique
makes sure that two strings will not be allowed to have same
alphanumeric string as an output. Even if the input-strings are
slightly different from each other, there is a possibility of
great difference between the output-strings produced through
them. This hash function can be a very simple mathematical
function or very complex one.[12]
All these above-mentioned methods and techniques are
widely used in encrypting the data in the cloud to ensure data
security. It is better to encrypt the data before storing it to the
cloud. The techniques given above are used differently for
different scenarios. Whichever technique is used, it is highly
recommended to ensure the security of data in both private
and public clouds.[12][13]
2. Implementation of Security Policies
Cloud computing security is also supported by different
security policies based on different security aspects of the
cloud service that would be helpful in keeping the cloud
environment safe. These policies include issues in privacy,
anonymity, security, liability and reliability. It documents
every aspect of cloud security such as: [14]
•
Fig 1.1 Data states in Cloud
Scope — the specific cloud environments and
services [14]
•
•
•
•
•
•
•
Compliance — the expectations of cloud security in
meeting federal, end user, business, and other
regulatory requirements [14]
Accountability — the areas and people responsible
for ensuring a safe cloud computing environment [15]
Deployment — a high-level view of how cloud
security will be maintained [14]
Identity and access management — who has
access to specific information and how identity is
authenticated and authorized [14]
Confidentiality and sensitivity — an objective
analysis of the confidentiality of specific data sets,
applications, and other cloud elements [14]
Acceptable use — the standards that you expect the
end users, developers, and other authorized users to
follow.[14]
Breach — the possible outcomes in the event of a
breach of security or policy.[14]
Data Federation Policies should also be implemented in order
to provide fair access and usage to all the users of the cloud.
Data federation is the creation of a virtual database that
combines all the data from distributed sources which gives
them a common data model.[15] These are additional issues
that have to be addressed in order to provide a secure
environment which involves moving applications and
services among a collection of federated providers. [16]
3. Security Techniques
Validation of OTP - Providing authentication through One
Time Password (OTP) method which is a single-use
password generated and sent to the mobile number for the
user to access the cloud and is used to verify the cloud user.
It is used for one-time authentication called as system factor
authentication while sometimes it is used for Multiple
Authentication Factor.[17]
Integrity Checking - The integrity of cloud data is a guarantee
that cloud data can only be changed or accessed by an
authorized user. It is a cloud-based data verification process
which ensures that the data is correct and not modified by
unauthorized personnel. One of the basic techniques of
checking data integrity are Provable Data Procession (PDP)
which is used to ensure the integrity of cloud data on a remote
server. Proof Of Retrievability (POR) technique is used to
obtain and verify the evidence that the cloud data stored by
the user on the server is not changed. [17]
Access Control - Cloud data owner takes steps to implement
restrictive permission for the access of their data outsource to
cloud. The authorized users can access cloud data while
unauthorized users can’t due to access control because the
data in the cloud are protected from any modifications or
disclosure of data to unauthorized personnel. [17]
Secure Deletion - It is essential for the authorized users to
know how the data is deleted from the server. Deletion uses
different techniques like Clearing, in this technique the media
is deleted before the reuse of these media and at the same time
the protection for the data is provided for accepting the data
that was contained in the media before deletion. Sanitization
is another protection method for accepting that the previous
data is not provided and that this type of data is regularly
circulated for lower level of classification. [17]
Data Masking – It is a method of shielding an organization’s
confidential data from unauthorized exposure to reduce the
risk of data breaches. This data can be used for software
testing and user training purposes. The use of this data
masking method is to protect the actual data while having a
functional substitute for occasions when the original data is
not required. [17]
4. Intrusion Detection Systems
Network based IDSs (NIDS) are used to capture the traffic of
the whole network and it is analyzed to detect possible
intrusions such as port scanning, DoS attacks, etc. It usually
performs the detection by processing the transport layer and
IP layer headers of the captured network packets. NIDS
collects the network packets and looks for their correlation
with signatures of known attacks or compares the users’
current behavior with their already known profiles in realtime. If the IDS is run in the stealth mode, the existence of
NIDS can be hidden from attacker. [18]
Signature based IDS uses signature-based detection, which is
performed by comparing the information that is collected
from the network against a database of known signatures. A
signature is a previously known and defined set of rules or
patterns that correspond to a known attack. We can protect
the system from single point of failure attack by deploying
the proposed IDS. [18]
5. Authentication in Cloud
Security comes on top for any computing system in the world.
Now Cloud is accommodating sensitive information more
than ever. User authentication and the protection of the user
credentials are key aspects when it comes to the security of
the cloud. The following is a high-level diagram of the
authentication in the cloud.
Fig 1.2 Authentication in Cloud
The figure illustrates that the authentication function and be
performed either by the cloud service provider itself or the
function can be outsourced to a third party. However, a third
party should be incorporated only if the cloud service
provider is unable to provide and strengthen the robustness of
security in the concerned area. [19]
CONCLUSION
Cloud Computing has been on the rise for the past several
years. It has an integral part in the future of computer science.
As much as it is proving to be useful, it also poses various
security risks. The security issues could severely affect
Cloud infrastructures. The problems of the Cloud are mainly
due to the security and privacy of the data stored in it.
Therefore, Cloud Providers must safeguard the Privacy and
Security of personal and confidential data of organizations
and users to provide and support trustworthy Cloud
Computing Services. Also, the customers must securely
configure their Cloud applications, (Multi-Factor
Authentication and strong passwords) to mitigate the risks.
There are also new development emerging in the Cloud like
Container-as-a-Service (Caas) and Cloud-of-Things (CoT),
(a concept combining Cloud Computing and Internet-ofThings (IoT) for smart city applications) [11]. New
development like these will also bring new security
challenged in the domain of Cloud Computing which needs
to be addressed. Security policies of organizations’ must be
updated regularly to align with the development of cloud
services. Cloud Computing leverages many technologies and
it also inherits their security issues. Understanding about the
vulnerabilities existing in Cloud Computing will help
organizations to sustain their shift towards a Cloud
Computing environment.
[9]
[10]
[11]
[12]
[13]
[14]
[15]
[16]
[17]
[18]
[19]
[20]
[21]
REFERENCES
[1]
[2]
[3]
[4]
[5]
[6]
[7]
[8]
Wayne A. Jansen, NIST “Cloud Hooks: Security and Privacy Issues in
Cloud Computing”, Proceedings of the 44th Hawaii International
Conference on System Sciences – 2011
Shazia Tabassam, “Security and Privacy Issues in Cloud Computing
Environment”,Department of Computer Science, University of
Agriculture, Faisalabad, Pakistan., 2017
Dr. C. V. Guru Rao, “Addressing the Security, Privacy and Trust
Challenges of Cloud Computing”, Rama Krishna Kalluri, Department
of Computer Applications, Vasavi college of Engineering, Hyderabad,
India * Department of Computer Science and Engineering, SR
Engineering College, Warangal, India, 2014
Yunchuan Sun,1 Junsheng Zhang,2 Yongping Xiong,3 and Guangyu
Zhu4, “Data Security and Privacy in Cloud Computing”, 2014
Features
of
Cloud
computing,
available
at
https://dataflair.training/blogs/features-of-cloud-computing/ pg.17
[24]Nazir, M., 2012. Cloud Computing: Overview & Current Research
Challenges. IOSR Journal of Computer Engineering, 8(1), pp.14-22.
Ahmed Albugmi, Madini O , Robert Walters , Gary Wills, "Data
Security in Cloud Computing," in FGCT 2016, 2016.
“Data
at
rest”,
[Online],
Available:
https://en.wikipedia.org/wiki/Data_at_rest. [Accessed 15.05.2020].
[22]
[23]
[24]
[25]
[26]
[27]
Fincen.gov., "USA Patriot Act," 01 01 2002. [Online]. Available:
https://web.archive.org/web/20121228161833/http://www.fincen.gov/
statutes_regs/patriot/index.html.
Roy, N., Jain, R, “Cloud computing: architecture and concept of
virtualization.” In J. Sci Technol. Manag 4 (2015)
P. Ravi Kumar*a, P. Herbert Rajb, P. Jelcianac , "Exploring Data
Security Issues and Solutions in Cloud Computing," in ICSCC 2017,
2017.
M. O. A. R. J. W. G. W. Ahmed Albugmi, "Data Security in Cloud
Computing," in Fifth International Conference on Future Generation
Communication Technologies (FGCT 2016), 2016.
K. S. R. Velumadhava Raoa, "Data Security Challenges and Its
Solutions in Cloud Computing," in ICCC-2015, 2015.
"Beyond Trust," 11 January 2018. [Online]. Available:
https://www.beyondtrust.com/blog/entry/cloud-security-bestpractices.
J. Spacey, "Simplicable," 06 November 2016. [Online]. Available:
https://simplicable.com/new/data-federation-definition.
C. V. a. S. T. S. Rajkumar Buyya, "ScienceDirect," 2013. [Online].
Available:
https://www.sciencedirect.com/topics/computerscience/cloud-federation.
J. Kumar, "Cloud Computing Security Issues and Its Challenges: A
Comprehensive Research," in International Journal of Recent
Technology and Engineering (IJRTE), 2019.
D. A. K. S. Sonu Devi, "Understanding of Intrusion Detection System
for Cloud Computing with Networking System," in International
Journal of Computer Science and Mobile Computing (IJCSMC), 2020.
Ahmed, M. and Ashraf Hossain, M., 2014. Cloud Computing and
Security Issues in the Cloud. International Journal of Network Security
& Its Applications, 6(1), pp.25-36.
DIAO Zhe, WANG Qinghong, SU Naizheng, ZHANG Yuhan
University of International Relations, Beijing, China, Study on Data
Security Policy Based On Cloud Storage, 2017
Ujwal Chopra, Naman Thakur, Lavanya Sharma, Cloud Computing:
Elementary Threats and Embellishing Countermeasures for Data
security, July 2019
Divyashree D, Santhosh Kumar, Cloud Security Ecosystem for Data
Security and Privacy, Department of Computer Science, Soundarya
Institute, Bangalore, Karnataka, India, 2019
Sunumol Cherian* , Kavitha Murukezhan, Providing Data Protection
as a Service in Cloud Computing, Department of computer Science,
Vedavyasa Institute of Technology, Calicut, Head of computer science
Department, Vedavyasa Institute of Technology, 6th June 2013.
Monjur Ahmed and Mohammad Ashraf Hossain, CLOUD
COMPUTING AND SECURITY ISSUES IN THE CLOUD, Senior
Lecturer, Daffodil Institute of IT, Dhaka, Bangladesh. , Freelance IT
Consultant, Dhaka, Bangladesh, 1st january 2014
Ms. Manju Sharma, Dr. Sadia Husain, Ms. Shazia Ali, CLOUD
COMPUTING RISKS AND RECOMMENDATIONS FOR
SECURITY, Faculty of Computer Science and Information Systems
Jazan University- Jazan Kingdom of Saudi Arabia, 2017
Ravikant Gupta1 & Dr. Ravikant Kapoor, A Review Paper of Data
Security in Cloud Computing, Research Scholar, Department of
Computer Engineering and Application, NITTTR Bhopal, India,
Associate Professor, Department of Computer Engineering and
Application, NITTTR Bhopal, India, 2016
Utkarsh Singh, Abhay Tiwari, Shruti Sharma, DATA SECURITY IN
CLOUD COMPUTING, Department of CSE Department of CSE, Ass.
Prof. of CSE Aiet, Jaipur, Rajasthan, India, February 2020.