How Safe and Secured is Data in Cloud Environment

International Journal of Emerging Technology and Advanced Engineering

How Safe and Secured is Data in Cloud Environment

T. Venkat Narayana Rao

, Harsh Goel

1

Professor, 2Student, Dept. of Computer Science and Engineering, Sreenidhi Institute of Science and Technology Hyderabad, T.S, INDIA

Abstract: Cloud computing has revolutionized ecosystem by offering organizations with computing avenues resources with easy deployments, automation, connectivity and scalability. This model raises a huge range of safety and privacy problems that must be taken into consideration. With the preamble of several cloud based services and physically isolated cloud service providers, perceptive information of diverse entities are normally stored in distant servers and places with the potential of being exposed to unnecessary unauthorized users in circumstances when the cloud servers stores the information that could be compromised. This paper focus on existing technologies and algorithms widely employed for cloud safety and privacy with a discussion how safe is the cloud environment.

I. INTRODUCTION

Every online data storage service assert that data is encrypted, but not sure technically. With the government taping on the files on Internet search engines, emailing and cloud service providers (CSPs), and any parable about data "privacy" on Internet has been wrecked. Experts say that there is no simple way to ensure complete data security once data is moved on to the cloud [1][2].

While providers of email or chat, social network and cloud services repeatedly maintain that even in their service agreement, that the data they store is encrypted and private. This means a malicious member of staff or any government "legally" would request encryption keys and can decrypt to see the data.

It is observed that service providers claim that only customers can create and maintain their personal encryption keys and it is tedious to be accessed by others. For example, take any cloud provider it claims that all text is encrypted and cannot be accessed or viewed by third parties. It is evident that the product is not open source and there is no means for anyone to know how it really works.

It is evident that the government has admitted to collecting of "metadata" (data defining data about individuals). It is also factual that a few Internet giants for years have been handing over data in reaction to government needs. Some tech giants frequently get requests from federal governments and courts across the world to furnish the user data and in turn around 66% of the time they are bound to provide at least some data.

II. HOW MANDATORY IS CLOUD SERVICES IN THE PRESENT ERA

Making our own data centers might be time consuming and pricey so companies prefer storing data in cloud. Business leaders look forward to optimize and grow their business, and cloud can offer this i.e. reducing costs and providing better customer experience.

a. Improved Partnership

Cloud based services can be used at any instance on any device with an internet connectivity. The again that leads to bigger collaboration with companies that requires their employees to work at any time. Deploying cloud based softwares, teams in diverse location can team up on documents without resorting to email attachments and distribute calendars and job list from anywhere. Participants just sign up their services and run the program on internet with minimal cost.

b. Data Backup

All the data can be backed up in cloud. Suppose there is system failure or server crisis then there is a probability of all data to disappear. So one can opt a cloud based application to backup data frequently.

III. HOW DOES CLOUD PROVIDERS KEEP THE DATA PROTECTED?

The most palpable technique is by means of encryption, both while the data is in transit and also while the data at rest on the cloud servers. Nowadays some cloud providers allow customers in order to control individual encryption keys if they desire to, and with who can and cannot access the applications or data[3].

a. Security methods use for data storage

International Journal of Emerging Technology and Advanced Engineering

b. Is the data actually safe in cloud?

It is totally depended on the quality of your cloud provider. The major data breaches and threats that took place so far had been from internal sources only and not from cloud-based or backend databases. It is understood that there is a natural hazard that managerial personnel functioning for a cloud provider would control/access all the equipments or data from inside which poses a production risk. This is the only reason, why the key cloud service providers offer clientele with the choice to manipulate the encryption keys, this is an indication that no insider would gain admission even if they plan. Some of the companies are now agree to "hybrid" approach - observing the most responsive data in a private managed cloud and other related applications and data in the purview of public domain cloud[4].

c. The data storage

The key public cloud providers offers a number of data centers as shown in figure 1 and 2 . This is done to ensure, if one particular centre is damaged in a tremor or other calamity, the data is said to be still protected.

But the concerns about data privacy, mainly in European nations , still prevails subsequent to the repeal of the Safe

Harbour data sharing agreement and Edward Snowden

leakages, and profit making providers are providing more alternatives to provide data services in customers' respective regions.

Figure 1 : Type RAID storage system

Some US companies are escalating the data storage sites to Tokyo, Ireland, Germany and Singapore by intensifying on accessible cloud infrastructures offered by AWS and IBM. Such arrangements are vital for huge and heavily-regulated industries/sectors, like financial and healthcare services.

d. The choice of good cloud provider

This attribute largely depends on the utility and applications/services. Certain cloud providers specialize in particular functions. It is better user observe up-to-date

certifications from international security standard

organizations. The prime risk is permitting to control our data to someone who uses diverse data centers that too in distant locations. This infers that we are putting data next to someone’s disposal[5].

IV. BASIC STEPS TO MAKE DATA SAFE

If a user is ready to store data on cloud, then it is suggested to utilize a cloud service with multi-factor encryption and authentication. It is advised to follow the listed preeminent practices to maintain data on the secured cloud:

 Employ hardcore password: Lengthy and random passwords must be utilized for data stored on the cloud. Do not use the identical password twice.

 Back-up files/folders on different cloud accounts: Do not put entire vital data in single place.

 Perform smart browsing: When accessing cloud on

public system, bear in mind tologout and not to save

password information[6][7].

Figure 2: Typical cloud scenario

International Journal of Emerging Technology and Advanced Engineering

V. POPULAR ALGORITHMS DEPLOYED FOR CLOUD SAFETY

Some of the popular algorithms are AES, Blowfish and RSA.

A. Advanced Encryption Standard (AES) is also identified

by its original name Rijndael. AES has turned out to be a

specification for the encryption of electronic

data constituted by National Institute of Standards and Technology(NIST)[USA]in 2001[8][9].

High-level description of the algorithm

1.Key Expansion—AES need a separate 128-bit round key block for every round plus one more.

2.Initial Round -AddRoundKey—for each byte the state is combined with a block of the round key by means of bitwise XOR as shown in figure 3a-3b.

Figure 3a : AES bit manipulation

Rounds

SubBytes, it is a non-linear substitution step where every byte is substituted with other as shown figure 3b.

Figure 3b : AES bit manipulation

ShiftRows: It is a transposition step where the last 3 rows of the state are shifted cyclically a certain number of steps as shown in figure 3c.

Figure 3c : AES bit manipulation – Row shift

MixColumns— mixing operation which operate on the columns of the state that combining the 4 bytes in each

column as shown in figure 3d

.

Figure 3d: AES bit manipulation- Mix Columns

B. RSA (Rivest–Shamir–Adleman) is the earliest public-key cryptosystems and is extensively used for safe data communication. In cryptosystem, the encryption key is public and it is dissimilar to the decryption key that is reserved as a secret (private) key. In RSA process, the asymmetry relies on the complexity of the factorization of product of the two large prime numbers, the "factoring problem". A RSA user generates and then publishes his public key basing on two big prime numbers, along with a possible auxiliary value. The prime numbers are expected to be kept undisclosed. Anyone can employ the public key to encrypt the message, but with presently published methods, and if the public key is huge, then someone with acquaintance of the random prime numbers could be able to

decipher the message possibly. Breaking the

RSA encryption is called the RSA problem. It is considered is as difficult as the factoring problem but remains as a challenging question.

RSA algorithm is relatively time taking algorithm, and hence, it is less regularly used to straightforwardly encrypt user data. The RSA passes encrypted shared keys for symmetric key cryptography which in turn can do enormous encryption-decryption operations.

International Journal of Emerging Technology and Advanced Engineering

Blowfish offers a good quality encryption pace in software and hence, no successful cryptanalysis has been traced so far. However, AES has now obtained more awareness, and Schneier proposes Twofish for current and emerging applications.

Schneier has devised Blowfish as a common purpose algorithm and projected as a substitute to classical DES and offers problem free constraints when compared to other algorithms. By the instance Blowfish was in usage, numerous other prototypes were holding proprietary, burdened by patentships or were profitable or governmental secrets. Schneier affirmed that, "Blowfish is not patented, thus would remain same for all nations.

VI. ADVANTAGES AND DEMERITS OF CLOUD STORAGE

A. Advantages

1. Usability: Each cloud storage services has desktop folders for Mac’s and PC’s. This would let users to drop and drag folders and files among the cloud storage and related local storage [10][1].

2. Bandwidth: It is possible to avoid emailing files to other users and as an alternative send a web link to the recipients.

3. Accessibility: Files can be accessed from anyplace by means of Internet link.

4. Disaster revival: It is observed that industries must have a crisis backup arrangement plan in place in the case of any crisis. Cloud storage is handy as a revival plan by businesses by offering a second replica of vital files. The above files are stored at a remote site and be able to be accessed through internet connectivity only[3][6].

5. Reduction in Expenditure: Businesses and companies can cut yearly operating costs by means of cloud storage. Cloud storage costs about 3 percent / gigabyte to accumulate data internally.

B. Demerits

1. Usability: It is advised to vigilant while appying drag/drop to transfer a documents information on cloud storage folder. This would eternally move your document from the parent folder to the cloud site. It is suggested to perform a copy and paste in place of drag/drop if you desire to keep the document(s) in original site in addition to transmission of a replica to the cloud storage folder.

2. Bandwidth: Many cloud storage services have a particular bandwidth payment. If an organization exceeds the given allowance, the additional charges could be considerable. However, some providers allow limitless bandwidth. This cloud be a key factor that companies think when looking at a cloud storage provider[7][9].

3. Accessibility: Internet connection, is mandatory to access data.

4. Data Security Aspect: There are issues and challenges with the protection and privacy of vital data stored remotely. The likelihood of private data dealt with other business partners makes some businesses nervous.

5. Software Constraints: If the user intends to process files locally through multiple devices, it requires to download the service on all the devices.

Cloud servers are basically placed in warehouses offsite and away from most employees, and they are profoundly guarded. The data in those servers is encrypted. Another advantage of storing data on the cloud is the price effectiveness and effortlessness for access. Anyone can store loads of data, usually for free, employing the cloud. Like instead of buying multiple pen drives or hard disk and storing data in multiple locations with cloud storage we can do it at one place. In cloud storage you store the information in database and Internet act as medium to connect it. When we want to view data our data we need not have any supporting software as such because cloud itself provides basic software which is required to view it.

VII.CONCLUSION

This paper reviewed on recent mechanisms in cloud computing security and privacy research. It has focused on cloud computing safety key issues. Several security architectures and challenges are being discussed with regard to cloud data safety. The paper also reviews on algorithms that make the cloud architectures robust and possible breaches that the influence the cloud data.

REFERENCES

[1] Mishra, B.; Jena, D. Securing files in the cloud. In Proceedings of the 2016 IEEE International Conference on Cloud Computing in Emerging Markets, Bangalore, India, 19–21 October 2016. [2] Jaeger, B. Security as a Service Working Group, Defined Categories

of Security as a Service (Preview)—Continuous Monitoring as a Service. Cloud Security Alliance 2016.

[3] J. Prades, B. Varghese, C. Reao, F. Silla, Multi-tenant Virtual GPUs for Optimising Performance of a Financial Risk Application, Journal of Parallel and Distributed Computing (2016) .

[4] I. Stojmenovic, S. Wen, X. Huang, H. Luan, An overview of Fog Computing and its Security Issues, Concurrency and Computation: Practice and Experience 28 (10) (2016).

[5] B. K. Chejerla, S. K. Madria, QoS Guaranteeing Robust Scheduling in Attack Resilient Cloud Integrated Cyber Physical System, Future Generation Computer Systems 75 (2017).

International Journal of Emerging Technology and Advanced Engineering

[7] B. Varghese, O. Akgun, I. Miguel, L. Thai, A. Barker, Cloud Benchmarking For Maximising Performance of Scientific Applications, IEEE Transactions on Cloud Computing PP (99) (2016).

[8] R. Trapero, J. Modic, M. Stopar, A. Taha, N. Suri, A Novel Approach to Manage Cloud Security SLA Incidents, Future Generation Computer Systems 72 (2017).

[9] X. Yuan, G. Min, L. T. Yang, Y. Ding, Q. Fang, A Game Theory-based Dynamic Resource Allocation Strategy in Geo-distributed Datacenter Clouds, Future Generation Computer Systems 76 (2017). [10] S. Singh, I. Chana, M. Singh, The Journey of QoS-Aware