Real-Time Semantic Search Using Approximate Methodology for Large-Scale Storage Systems

ABSTRACT:

The challenges of handling the explosive growth in data volume and complexity cause the increasing needs for semantic queries. The semantic queries can be interpreted as the correlation-aware retrieval, while containing approximate results. Existing cloud storage systems mainly fail to offer an adequate capability for the semantic queries. Since the true value or worth of data heavily depends on how efficiently semantic search can be carried out on the data in (near-) real-time, large fractions of data end up with their values being lost or significantly reduced due to the data staleness. To address this problem, we propose a near-real-time and cost-effective semantic queries based methodology, called FAST. The idea behind FAST is to explore and exploit the semantic correlation within and among datasets via correlation-aware hashing and manageable flat-structured addressing to significantly reduce the processing latency, while incurring acceptably small loss of data-search accuracy. The near-real-time property of FASTenables rapid identification of correlated files and the significant narrowing of the scope of data to be processed. FASTsupports several types of data analytics, which can be implemented in existing searchable storage systems. We conduct a real-world use case in which children reported missing in an extremely crowded environment (e.g., a highly popular scenic spot on a peak tourist day) are identified in a timely fashion by analyzing 60 million images using FAST. FAST is further improved by using semantic-aware namespace to provide dynamic and adaptive namespace management for ultra-large storage systems. Extensive experimental results demonstrate the efficiency and efficacy of FAST in the performance improvements.

EXISTING SYSTEM:

• ISABELAQA is a parallel query processing engine that is designed and optimized for analyzing and processing spatiotemporal, multivariate scientific data. MixApart uses an integrated data caching and scheduling solution to allow MapReduce computations to analyze data stored on enterprise storage systems.
• The frontend caching layer enables the local storage performance required by data analytics. The shared storage back-end simplifies data management.
• Spyglass exploits the locality of file namespace and skewed distribution of metadata to map the namespace hierarchy into a multi-dimensional K-D tree and uses multilevel versioning and partitioning to maintain consistency.
• Glance, a just-in-time sampling-based system, can provide accurate answers for aggregate and top-k queries without prior knowledge.

DISADVANTAGES OF EXISTING SYSTEM:

• Existing content-based analysis tools not only cause high complexity and costs, but also fail to effectively handle the massive amounts of files.
• The high complexity routinely leads to very slow processing operations and very high and often unacceptable latency. Due to the unacceptable latency, the staleness of data severely diminishes the value of data.
• Existing approaches to unstructured data search and analytics rely on either system-based chunks of data files.
• Due to the long latency incurred in data processing and the resulting data staleness, the value/worth of data becomes diminished and eventually nullified.

PROPOSED SYSTEM:

• In the context of this paper, searchable data analytics are interpreted as obtaining data value/worth via queried results, such as finding a valuable record, a correlated process ID, an important image, a rebuild system log, etc.
• We propose a novel near-real-time methodology for analyzing massive data, called FAST, with a design goal of efficiently processing such data in a real-time manner.
• The key idea behind FAST is to explore and exploit the correlation property within and among datasets via improved correlation aware hashing and flat-structured addressing to significantly reduce the processing latency of parallel queries, while incurring acceptably small loss of accuracy.
• The approximate scheme for real-time performance has been widely recognized in system design and high-end computing. In essence, FAST goes beyond the simple combination of existing techniques to offer efficient data analytics via significantly increased processing speed. Through the study of the FAST methodology, we aim to make the following contributions for near real-time data analytics.

ADVANTAGES OF PROPOSED SYSTEM:

• Space-efficient summarization
• Energy efficiency via hashing
• Semantic-aware namespace
• Real system implementation

SYSTEM ARCHITECTURE:

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS:

• System                           :         Pentium Dual Core.

• Hard Disk                      :         120 GB.

• Monitor                         :         15’’ LED

• Input Devices                 :         Keyboard, Mouse

• Ram                               :         1GB.

SOFTWARE REQUIREMENTS:

• Operating system                    :         Windows 7.
• Coding Language           :         JAVA/J2EE
• Tool                               :         Netbeans 7.2.1
• Database                        :         MYSQL

REFERENCE:

Yu Hua, Senior Member, IEEE, Hong Jiang, Fellow, IEEE, and Dan Feng, Member, IEEE, “Real-Time Semantic Search Using Approximate Methodology for Large-Scale Storage Systems”, IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 27, NO. 4, APRIL 2016.

Protecting Your Right: Verifiable Attribute-Based Keyword Search with Fine-Grained Owner-Enforced Search Authorization in the Cloud

ABSTRACT:

Search over encrypted data is a critically important enabling technique in cloud computing, where encryption-before outsourcing is a fundamental solution to protecting user data privacy in the untrusted cloud server environment. Many secure search schemes have been focusing on the single-contributor scenario, where the outsourced dataset or the secure searchable index of the dataset are encrypted and managed by a single owner, typically based on symmetric cryptography. In this paper, we focus on a different yet more challenging scenario where the outsourced dataset can be contributed from multiple owners and are searchable by multiple users, i.e., multi-user multi-contributor case. Inspired by attribute-based encryption (ABE), we present the first attribute-based keyword search scheme with efficient user revocation (ABKS-UR) that enables scalable fine-grained (i.e., file-level) search authorization. Our scheme allows multiple owners to encrypt and outsource their data to the cloud server independently. Users can generate their own search capabilities without relying on an always online trusted authority. Fine-grained search authorization is also implemented by the owner-enforced access policy on the index of each file. Further, by incorporating proxy re-encryption and lazy re-encryption techniques, we are able to delegate heavy system update workload during user revocation to the resourceful semi-trusted cloud server. We formalize the security definition and prove the proposed ABKS-UR scheme selectively secure against chosen-keyword attack. To build confidence of data user in the proposed secure search system, we also design a search result verification scheme. Finally, performance evaluation shows the efficiency of our scheme.

EXISTING SYSTEM:

• There has been a great interest in developing attribute based encryption due to its fine-grained access control property.
• Goyal et al. designed the first key policy attribute-based encryption scheme, where ciphertext can be decrypted only if the attributes that are used for encryption satisfy the access structure on the user private key. Under the reverse situation, CP-ABE allows user private key to be associated with a set of attributes and ciphertext associated with an access structure. CP-ABE is a preferred choice when designing an access control mechanism in a broadcast environment.
• Cheung and Newport proposed a selectively secure CP-ABE construction in the standard model using the simple Boolean function, i.e., AND gate. By adopting proxy re-encryption and lazy re-encryption techniques, Yu et al. also devised a selectively secure CP-ABE scheme with the ability of attribute revocation, which is perfectly suitable for the data-outsourced cloud model.

DISADVANTAGES OF EXISTING SYSTEM:

• The encrypted data can be effectively utilized then becomes another new challenge.
• Significant attention has been given and much effort has been made to address this issue, from secure search over encrypted data, secure function evaluation, to fully homomorphic encryption systems that provide generic solution to the problem in theory but are still too far from being practical due to the extremely high complexity.
• Symmetric cryptography based schemes are clearly not suitable for this setting due to the high complexity of secret key management.
• Extending user list approach to the multi-owner setting and on a per file basis is not trivial as it would impose significant scalability issue considering a potential large number of users and files supported by the system.
• Additional challenges include how to handle the updates of the user lists in the case of user enrollment, revocation, etc., under the dynamic cloud environment.

PROPOSED SYSTEM:

• This paper focuses on the problem of search over encrypted data, which is an important enabling technique for the encryption-before-outsourcing privacy protection paradigm in cloud computing, or in general in any networked information system where servers are not fully trusted.
• In this paper, we address these open issues and present an authorized keyword search scheme over encrypted cloud data with efficient user revocation in the multi-user multi-data-contributor scenario.
• We realize fine-grained owner-enforced search authorization by exploiting ciphertext policy attribute-based encryption (CP-ABE) technique.
• Specifically, the data owner encrypts the index of each file with an access policy created by him, which defines what type of users can search this index. The data user generates the trapdoor independently without relying on an always online trusted authority (TA). The cloud server can search over the encrypted indexes with the trapdoor on a user’s behalf, and then returns matching result if and only if the user’s attributes associated with the trapdoor satisfy the access policies embedded in the encrypted indexes. We differentiate attributes and keywords in our design.
• Keywords are actual content of the files while attributes refer to the properties of users. The system only maintains a limited number of attributes for search authorization purpose. Data owners create the index consisting of all keywords in the file but encrypt the index with an access structure only based on the attributes of authorized users, which makes the proposed scheme more scalable and suitable for the large scale file sharing system. In order to further release the data owner from the burdensome user membership management, we use proxy re-encryption and lazy re-encryption techniques to shift the workload as much as possible to the CS, by which our proposed scheme enjoys efficient user revocation.

ADVANTAGES OF PROPOSED SYSTEM:

• Formal security analysis shows that the proposed scheme is provably secure and meets various search privacy requirements.
• Furthermore, we design a search result verification scheme and make the entire search process verifiable. Performance evaluation demonstrates the efficiency and practicality of the ABKS-UR.
• We design a novel and scalable authorized keyword search over encrypted data scheme supporting multiple data users and multiple data contributors.
• Compared with existing works, our scheme supports fine-grained owner-enforced search authorization at the file level with better scalability for large scale system in that the search complexity is linear to the number of attributes in the system, instead of the number of authorized users.
• Data owner can delegate most of computationally intensive tasks to the CS, which makes the user revocation process efficient and is more suitable for cloud outsourcing model.
• We formally prove our proposed scheme selectively secure against chosen-keyword attack.
• We propose a scheme to enable authenticity check over the returned search result in the multi-user multi-data-contributor search scenario.

SYSTEM ARCHITECTURE:

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS:

• System                           :         Pentium Dual Core.

• Hard Disk                      :         120 GB.

• Monitor                         :         15’’ LED

• Input Devices                 :         Keyboard, Mouse

• Ram                               :         1GB.

SOFTWARE REQUIREMENTS: 

• Operating system                    :         Windows 7.
• Coding Language           :         JAVA/J2EE
• Tool                               :         Netbeans 7.2.1
• Database                        :         MYSQL

REFERENCE:

Wenhai Sun, Student Member, IEEE, Shucheng Yu, Member, IEEE, Wenjing Lou, Fellow, IEEE, Y. Thomas Hou, Fellow, IEEE, and Hui Li, Member, IEEE, “Protecting Your Right: Verifiable Attribute-Based Keyword Search with Fine-Grained Owner-Enforced Search Authorization in the Cloud”, IEEE TRANSACTIONS ON PARALLEL AND DISTRIBUTED SYSTEMS, VOL. 27, NO. 4, APRIL 2016.

Identity-Based Proxy-Oriented Data Uploading and Remote Data Integrity Checking in Public Cloud

ABSTRACT:

More and more clients would like to store their data to public cloud servers (PCSs) along with the rapid development of cloud computing. New security problems have to be solved in order to help more clients process their data in public cloud. When the client is restricted to access PCS, he will delegate its proxy to process his data and upload them. On the other hand, remote data integrity checking is also an important security problem in public cloud storage. It makes the clients check whether their outsourced data are kept intact without downloading the whole data. From the security problems, we propose a novel proxy-oriented data uploading and remote data integrity checking model in identity-based public key cryptography: identity-based proxy-oriented data uploading and remote data integrity checking in public cloud (ID-PUIC). We give the formal definition, system model, and security model. Then, a concrete ID-PUIC protocol is designed using the bilinear pairings. The proposed ID-PUIC protocol is provably secure based on the hardness of computational Diffie–Hellman problem. Our ID-PUIC protocol is also efficient and flexible. Based on the original client’s authorization, the proposed ID-PUIC protocol can realize private remote data integrity checking, delegated remote data integrity checking, and public remote data integrity checking.

EXISTING SYSTEM:

• In public cloud environment, most clients upload their data to PCS and check their remote data’s integrity by Internet. When the client is an individual manager, some practical problems will happen. If the manager is suspected of being involved into the commercial fraud, he will be taken away by the police. During the period of investigation, the manager will be restricted to access the network in order to guard against collusion. But, the manager’s legal business will go on during the the period of investigation. When a large of data is generated, who can help him process these data? If these data cannot be processed just in time, the manager will face the lose of economic interest. In order to prevent the case happening, the manager has to delegate the proxy to process its data, for example, his secretary. But, the manager will not hope others have the ability to perform the remote data integrity checking.
• Chen et al. proposed a proxy signature scheme and a threshold proxy signature scheme from the Weil pairing.
• By combining the proxy cryptography with encryption technique, some proxy re-encryption schemes are proposed. Liu et al. formalize and construct the attribute-based proxy signature.
• Guo et al. presented a non-interactive CPA (chosen-plaintext attack)-secure proxy re-encryption scheme, which is resistant to collusion attacks in forging re-encryption keys.

DISADVANTAGES OF EXISTING SYSTEM:

• Public checking will incur some danger of leaking the privacy.
• Less Efficiency.
• Security level is low

PROPOSED SYSTEM:

• This paper is based on the research results of proxy cryptography, identity-based public key cryptography and remote data integrity checking in public cloud.
• In public cloud, this paper focuses on the identity-based proxy-oriented data uploading and remote data integrity checking.
• By using identity-based public key cryptology, our proposed ID-PUIC protocol is efficient since the certificate management is eliminated. ID-PUIC is a novel proxy-oriented data uploading and remote data integrity checking model in public cloud. We give the formal system model and security model for ID-PUIC protocol. Then, based on the bilinear pairings, we designed the first concrete ID-PUIC protocol.
• In the random oracle model, our designed ID-PUIC protocol is provably secure. Based on the original client’s authorization, our protocol can realize private checking, delegated checking and public checking.
• We propose an efficient ID-PUIC protocol for secure data uploading and storage service in public clouds.
• Bilinear pairings technique makes identity-based cryptography practical. Our protocol is built on the bilinear pairings. We first review the bilinear pairings.

ADVANTAGES OF PROPOSED SYSTEM:

• High Efficiency.
• Improved Security.
• The concrete ID-PUIC protocol is provably secure and efficient by using the formal security proof and efficiency analysis.
• On the other hand, the proposed ID-PUIC protocol can also realize private remote data integrity checking, delegated remote data integrity checking and public remote data integrity checking based on the original client’s authorization.

SYSTEM ARCHITECTURE:

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS:

• System                           :         Pentium Dual Core.

• Hard Disk                      :         120 GB.

• Monitor                         :         15’’ LED

• Input Devices                 :         Keyboard, Mouse

• Ram                               :         1GB. 

SOFTWARE REQUIREMENTS:

• Operating system                    :         Windows 7.
• Coding Language           :         JAVA/J2EE
• Tool                               :         Netbeans 7.2.1
• Database                        :         MYSQL

REFERENCE:

Huaqun Wang, Debiao He, and Shaohua, “Identity-Based Proxy-Oriented Data Uploading and Remote Data Integrity Checking in Public Cloud”, IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 11, NO. 6, JUNE 2016.

Identity-Based Encryption with Cloud Revocation Authority and Its Applications

ABSTRACT:

Identity-based encryption (IBE) is a public key cryptosystem and eliminates the demands of public key infrastructure (PKI) and certificate administration in conventional public key settings. Due to the absence of PKI, the revocation problem is a critical issue in IBE settings. Several revocable IBE schemes have been proposed regarding this issue. Quite recently, by embedding an outsourcing computation technique into IBE, Li et al. proposed a revocable IBE scheme with a key-update cloud service provider (KU-CSP). However, their scheme has two shortcomings. One is that the computation and communication costs are higher than previous revocable IBE schemes. The other shortcoming is lack of scalability in the sense that the KU-CSP must keep a secret value for each user. In the article, we propose a new revocable IBE scheme with a cloud revocation authority (CRA) to solve the two shortcomings, namely, the performance is significantly improved and the CRA holds only a system secret for all the users. For security analysis, we demonstrate that the proposed scheme is semantically secure under the decisional bilinear Diffie-Hellman (DBDH) assumption. Finally, we extend the proposed revocable IBE scheme to present a CRA-aided authentication scheme with period-limited privileges for managing a large number of various cloud services.

EXISTING SYSTEM:

• Li et al. introduced an outsourcing computation technique into IBE to propose a revocable IBE scheme with a key-update cloud service provider (KU-CSP). They shifts the key-update procedures to a KU-CSP to alleviate the load of PKG.
• Li et al. also used the similar technique adopted in Tseng and Tsai’s scheme, which partitions a user’s private key into an identity key and a time update key.
• The PKG sends a user the corresponding identity key via a secure channel. Meanwhile, the PKG must generate a random secret value (time key) for each user and send it to the KU-CSP.
• Then the KUCSP generates the current time update key of a user by using the associated time key and sends it to the user via a public channel.

DISADVANTAGES OF EXISTING SYSTEM:

• ID-based encryption (IBE) allows a sender to encrypt message directly by using a receiver’s ID without checking the validation of public key certificate.
• In existing system misbehaving/compromised users in an ID-PKS setting is naturally raised.
• Immediate revocation method employs a designated semi-trusted and online authority (i.e. mediator) to mitigate the management load of the PKG and assist users to decrypt ciphertext.
• The computation and communication costs are higher than previous revocable IBE schemes.
• The other shortcoming is un-scalability in the sense that the KU-CSP must keep a time key for each user so that it will incur the management load.

PROPOSED SYSTEM:

• In order to solve both the un-scalability and the inefficiency in Li et al.’s scheme, we propose a new revocable IBE scheme with cloud revocation authority (CRA).
• In particular, each user’s private key still consists of an identity key and a time update key. We introduce a cloud revocation authority (CRA) to replace the role of the KU-CSP in Li et al.’s scheme. The CRA only needs to hold a random secret value (master time key) for all the users without affecting the security of revocable IBE scheme.
• The CRA uses the master time key to generate the current time update key periodically for each non-revoked user and sends it to the user via a public channel. It is evident that our scheme solves the un-scalability problem of the KU-CSP.
• We construct a CRA-aided authentication scheme with period-limited privileges for managing a large number of various cloud services.

ADVANTAGES OF PROPOSED SYSTEM:

• The proposed scheme possesses the advantages of both Tsengand Tsai’s revocable IBE scheme and Li et al.’s scheme.
• The proposed present the framework of our revocable IBE scheme with CRA and define its security notions to model possible threats and attacks
• CRA-aided authentication scheme with period-limited privileges for managing a large number of various cloud services.

SYSTEM ARCHITECTURE:

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS:

• System                           :         Pentium Dual Core.

• Hard Disk                      :         120 GB.

• Monitor                         :         15’’ LED

• Input Devices               :         Keyboard, Mouse

• Ram                               :         1GB. 

SOFTWARE REQUIREMENTS:

• Operating system           :         Windows 7.
• Coding Language           :         JAVA/J2EE
• Tool                                   :         Netbeans 7.2.1
• Database                          :         MYSQL

REFERENCE:

Yuh-Min Tseng, Tung-Tso Tsai, Sen-Shan Huang, and Chung-Peng Huang, “Identity-Based Encryption with Cloud Revocation Authority and Its Applications”, IEEE TRANS. CLOUD COMPUTING 2016.

Geometric Range Search on Encrypted Spatial Data

ABSTRACT:

Geometric range search is a fundamental primitive for spatial data analysis in SQL and NoSQL databases. It has extensive applications in location-based services, computer aided design, and computational geometry. Due to the dramatic increase in data size, it is necessary for companies and organizations to outsource their spatial data sets to third-party cloud services (e.g., Amazon) in order to reduce storage and query processing costs, but, meanwhile, with the promise of no privacy leakage to the third party. Searchable encryption is a technique to perform meaningful queries on encrypted data without revealing privacy. However, geometric range search on spatial data has not been fully investigated nor supported by existing searchable encryption schemes. In this paper, we design a symmetric-key searchable encryption scheme that can support geometric range queries on encrypted spatial data. One of our major contributions is that our design is a general approach, which can support different types of geometric range queries. In other words, our design on encrypted data is independent from the shapes of geometric range queries. Moreover, we further extend our scheme with the additional use of tree structures to achieve search complexity that is faster than linear. We formally define and prove the security of our scheme with indistinguish ability under selective chosen-plaintext attacks, and demonstrate the performance of our scheme with experiments in a real cloud platform (Amazon EC2).

EXISTING SYSTEM:

• While most of the searchable encryption schemes focus on common SQL queries, such as keyword queries and Boolean queries, few studies have specifically investigated geometric range search over encrypted spatial data.
• Wang et al. proposed a novel scheme to specifically perform circular range queries on encrypted data by leveraging a set of concentric circles.
• Some previous searchable encryptions handling order comparisons can essentially manage axis parallel rectangular range search on encrypted spatial data.
• Similarly, Order-Preserving Encryption, which has weaker privacy guarantee than searchable encryption, is also able to perform axis-parallel rectangular range search with trivial extensions.
• Ghinita and Rughinis particularly leveraged certain Functional Encryption with hierarchical encoding to efficiently operate axis-parallel rectangular range search on encrypted spatial data in the application of mobile users monitoring.

DISADVANTAGES OF EXISTING SYSTEM:

• Most of the searchable encryption schemes focus on common SQL queries, such as keyword queries and Boolean queries, few studies have specifically investigated geometric range search over encrypted spatial data.
• Inevitably introduces obstacles in terms of search functionalities over encrypted data.
• None of these previous works have particularly studied geometric range queries which are expressed as non-axis-parallel rectangles or triangles.
• More importantly, there still lacks a general approach, which can flexibly and securely support different types of geometric range queries over encrypted spatial data regardless of their specific geometric shapes.

PROPOSED SYSTEM:

• In this paper, we propose a symmetric-key probabilistic Geometric Range Searchable Encryption. With our scheme, a semi-honest (i.e., honest-but-curious) cloud server can verify whether a point is inside a geometric range over encrypted spatial datasets. Informally, except learning the necessary Boolean search result (i.e., inside or outside) of a geometric range search, the semi-honest cloud server is not able to reveal any private information about data or queries.
• Our main contributions are summarized as follows:
• We present a symmetric-key probabilistic Geometric Range Searchable Encryption, and formally define and prove its security with indistinguishability under Selective Chosen-Plaintext Attacks (IND-SCPA).
• In addition, our search process is non-interactive on encrypted data. In terms of search complexity, our baseline scheme incurs linear complexity (with regard to the number of data records), and its advanced version realizes faster than- linear search by integrating with tree structures.
• Our design is a general approach, which can securely support different types of geometric range queries on encrypted spatial data regardless of their geometric shapes. Furthermore, our design is not only suitable for geometric range queries, but also compatible with other regular types of geometric queries, such as intersection queries and point enclosure queries, over encrypted spatial data.

ADVANTAGES OF PROPOSED SYSTEM:

• The security of our scheme is formally defined and analyzed with indistinguishability under Selective Chosen-Plaintext Attacks.
• Our design has great potential to be used and implemented in wide applications, such as Location-Based Services and spatial databases, where the use of sensitive spatial data with a requirement of strong privacy guarantee is needed.

SYSTEM ARCHITECTURE:

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS:

• System                           :         Pentium Dual Core.

• Hard Disk                      :         120 GB.

• Monitor                         :         15’’ LED

• Input Devices                 :         Keyboard, Mouse

• Ram                               :         1GB 

SOFTWARE REQUIREMENTS:

• Operating system                    :         Windows 7.
• Coding Language           :         JAVA/J2EE
• Tool                               :         Netbeans 7.2.1
• Database                        :         MYSQL

REFERENCE:

Boyang Wang, Student Member, IEEE, Ming Li, Member, IEEE, and Haitao Wang, “Geometric Range Search on Encrypted Spatial Data”, IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 11, NO. 4, APRIL 2016.

Fine-Grained Two-Factor Access Control for Web-Based Cloud Computing Services

ABSTRACT:

In this paper, we introduce a new fine-grained two-factor authentication (2FA) access control system for web-based cloud computing services. Specifically, in our proposed 2FA access control system, an attribute-based access control mechanism is implemented with the necessity of both a user secret key and a lightweight security device. As a user cannot access the system if they do not hold both, the mechanism can enhance the security of the system, especially in those scenarios where many users share the same computer for web-based cloud services. In addition, attribute-based control in the system also enables the cloud server to restrict the access to those users with the same set of attributes while preserving user privacy, i.e., the cloud server only knows that the user fulfills the required predicate, but has no idea on the exact identity of the user. Finally, we also carry out a simulation to demonstrate the practicability of our proposed 2FA system.

EXISTING SYSTEM:

• Mediated cryptography was first introduced as a method to allow immediate revocation of public keys. The basic idea of mediated cryptography is to use an on-line mediator for every transaction. This on-line mediator is referred to a SEM (SEcurity Mediator) since it provides a control of security capabilities. If the SEM does not cooperate then no transactions with the public key are possible any longer.
• The general idea of key-insulated security was to store long-term keys in a physically-secure but computationally-limited device. Short-term secret keys are kept by users on a powerful but insecure device where cryptographic computations take place. Short term secrets are then refreshed at discrete time periods via interaction between the user and the base while the public key remains unchanged throughout the lifetime of the system.

DISADVANTAGES OF EXISTING SYSTEM:

• Key-insulated cryptosystem requires all users to update their keys in every time period. The key update process requires the security device.
• Once the key has been updated, the signing or decryption algorithm does not require the device anymore within the same time period.
• The traditional account/password-based authentication is not privacy preserving. However, it is well acknowledged that privacy is an essential feature that must be considered in cloud computing systems.
• It is common to share a computer among different people. It may be easy for hackers to install some spyware to learn the login password from the web-browser.
• The adversary acts as the role of the cloud server and tries to find out the identity of the user it is interacting with.
• Access without Secret Key: The adversary tries to access the system (within its privileges) without any secret key. It can have its own security device.

PROPOSED SYSTEM:

• In this paper, we propose a fine-grained two-factor access control protocol for web-based cloud computing services, using a lightweight security device. The device has the following properties: (1) it can compute some lightweight algorithms, e.g. hashing and exponentiation; and (2) it is tamper resistant, i.e., it is assumed that no one can break into it to get the secret information stored inside.
• In this paper, we propose a fine-grained two-factor access control protocol for web-based cloud computing services, using a lightweight security device. The device has the following properties. It can compute some lightweight algorithms, e.g. hashing and exponentiation; and it is tamper resistant, i.e., it is assumed that no one can break into it to get the secret information stored inside.
• With this device, our protocol provides a 2FA security. First the user secret key (which is usually stored inside the computer) is required. In addition, the security device should be also connected to the computer (e.g. through USB) in order to authenticate the user for accessing the cloud. The user can be granted access only if he has both items.
• Furthermore, the user cannot use his secret key with another device belonging to others for the access. Our protocol supports fine-grained attribute-based access which provides a great flexibility for the system to set different access policies according to different scenarios. At the same time, the privacy of the user is also preserved. The cloud system only knows that the user possesses some required attribute, but not the real identity of the user. To show the practicality of our system, we simulate the prototype of the protocol.

ADVANTAGES OF PROPOSED SYSTEM:

• Our protocol supports fine-grained attribute-based access which provides a great flexibility for the system to set different access policies according to different scenarios. At the same time, the privacy of the user is also preserved. The cloud system only knows that the user possesses some required attribute, but not the real identity of the user.
• To show the practicality of our system, we simulate the prototype of the protocol.
• Tamper-resistance. The content stored inside the security device is not accessible nor modifiable once it is initialized. In addition, it will always follow the algorithm specification.
• It is capable of evaluation of a hash function. In addition, it can generate random numbers and compute exponentiations of a cyclic group defined over a finite field.
• Presented a new 2FA (including both user secret key and a lightweight security device) access control system for web-based cloud computing services.
• 2FA access control system has been identified to not only enable the cloud server to restrict the access to those users with the same set of attributes but also preserve user privacy.

SYSTEM ARCHITECTURE:

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS:

• System : Pentium Dual Core.
• Hard Disk : 120 GB.
• Monitor : 15’’ LED
• Input Devices : Keyboard, Mouse
• Ram : 1GB

SOFTWARE REQUIREMENTS:

• Operating system :         Windows 7.
• Coding Language : JAVA/J2EE
• Tool : Netbeans 7.2.1
• Database : MYSQL

REFERENCE:

Joseph K. Liu, Member, IEEE, Man Ho Au, Member, IEEE, Xinyi Huang, Rongxing Lu, Senior Member, IEEE, and Jin Li, “Fine-Grained Two-Factor Access Control for Web-Based Cloud Computing Services”, IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 11, NO. 3, MARCH 2016.

Enabling Cloud Storage Auditing With Verifiable Outsourcing of Key Updates

ABSTRACT:

Key-exposure resistance has always been an important issue for in-depth cyber defence in many security applications. Recently, how to deal with the key exposure problem in the settings of cloud storage auditing has been proposed and studied. To address the challenge, existing solutions all require the client to update his secret keys in every time period, which may inevitably bring in new local burdens to the client, especially those with limited computation resources, such as mobile phones. In this paper, we focus on how to make the key updates as transparent as possible for the client and propose a new paradigm called cloud storage auditing with verifiable outsourcing of key updates. In this paradigm, key updates can be safely outsourced to some authorized party, and thus the key-update burden on the client will be kept minimal. In particular, we leverage the third party auditor (TPA) in many existing public auditing designs, let it play the role of authorized party in our case, and make it in charge of both the storage auditing and the secure key updates for key-exposure resistance. In our design, TPA only needs to hold an encrypted version of the client’s secret key while doing all these burdensome tasks on behalf of the client. The client only needs to download the encrypted secret key from the TPA when uploading new files to cloud. Besides, our design also equips the client with capability to further verify the validity of the encrypted secret keys provided by the TPA. All these salient features are carefully designed to make the whole auditing procedure with key exposure resistance as transparent as possible for the client. We formalize the definition and the security model of this paradigm. The security proof and the performance simulation show that our detailed design instantiations are secure and efficient.

AIM & OBJECTIVES:

• In this paper, we consider achieving goal by outsourcing key updates. However, it needs to satisfy several new requirements to achieve this goal.
• Firstly, the real client’s secret keys for cloud storage auditing should not be known by the authorized party who performs outsourcing computation for key updates.
• Secondly, because the authorized party performing outsourcing computation only knows the encrypted secret keys, key updates should be completed under the encrypted state.
• Thirdly, it should be very efficient for the client to recover the real secret key from the encrypted version that is retrieved from the authorized party.
• Lastly, the client should be able to verify the validity of the encrypted secret key after the client retrieves it from the authorized party. The goal of this paper is to design a cloud storage auditing protocol that can satisfy above requirements to achieve the outsourcing of key updates.

EXISTING SYSTEM:

• Yu et al. constructed a cloud storage auditing protocol with key-exposure resilience by updating the user’s secret keys periodically. In this way, the damage of key exposure in cloud storage auditing can be reduced. But it also brings in new local burdens for the client because the client has to execute the key update algorithm in each time period to make his secret key move forward.
• For some clients with limited computation resources, they might not like doing such extra computations by themselves in each time period. It would be obviously more attractive to make key updates as transparent as possible for the client, especially in frequent key update scenarios.
• Wang et al. proposed a public privacy-preserving auditing protocol. They used the random masking technique to make the protocol achieve privacy preserving property.

DISADVANTAGES OF EXISTING SYSTEM:

• Existing system don’t like auditing protocol with verifiable outsourcing of key updates.
• Third party has the access to see client’s secret key without encryption.
• No verification system available for client’s for to check validity of the encrypted secret keys when downloading them from the TPA
• All existing auditing protocols are all built on the assumption that the secret key of the client is absolutely secure and would not be exposed.

PROPOSED SYSTEM:

The main contributions are as follows:

(1) We propose a new paradigm called cloud storage auditing with verifiable outsourcing of key updates. In this new paradigm, key-update operations are not performed by the client, but by an authorized party. The authorized party holds an encrypted secret key of the client for cloud storage auditing and updates it under the encrypted state in each time period. The client downloads the encrypted secret key from the authorized party and decrypts it only when he would like to upload new files to cloud. In addition, the client can verify the validity of the encrypted secret key.

(2) We design the first cloud storage auditing protocol with verifiable outsourcing of key updates. In our design, the thirdparty auditor (TPA) plays the role of the authorized party who is in charge of key updates.

(3) We formalize the definition and the security model of the cloud storage auditing protocol with verifiable outsourcing of key updates. We also prove the security of our protocol in the formalized security model and justify its performance by concrete implementation.

ADVANTAGES OF PROPOSED SYSTEM:

• The TPA does not know the real secret key of the client for cloud storage auditing, but only holds an encrypted version. In the detailed protocol, we use the blinding technique with homomorphic property to form the encryption algorithm to encrypt the secret keys held by the TPA. It makes our protocol secure and the decryption operation efficient.
• Meanwhile, the TPA can complete key updates under the encrypted state. The client can verify the validity of the encrypted secret key when he retrieves it from the TPA.
• The client downloads the encrypted secret key from the authorized party and decrypts it only when he would like to upload new files to cloud. In addition, the client can verify the validity of the encrypted secret key.
• Cloud storage auditing protocol with verifiable outsourcing of key updates
• The client can verify the validity of the encrypted secret key when he retrieves it from the TPA
• The security model of the cloud storage auditing protocol with verifiable outsourcing of key updates.

SYSTEM ARCHITECTURE:

SYSTEM REQUIREMENTS:

HARDWARE REQUIREMENTS:

• System                           :         Pentium Dual Core.

• Hard Disk                      :         120 GB.

• Monitor                         :         15’’ LED

• Input Devices                 :         Keyboard, Mouse

• Ram                               :         1GB. 

SOFTWARE REQUIREMENTS:

• Operating system                    :         Windows 7.
• Coding Language           :         JAVA/J2EE
• Tool                               :         Netbeans 7.2.1
• Database                        :         MYSQL

REFERENCE:

Jia Yu, Kui Ren, Fellow, IEEE, and Cong Wang, Member, IEEE, “Enabling Cloud Storage Auditing With Verifiable Outsourcing of Key Updates”, IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 11, NO. 6, JUNE 2016.