Decentralized Access Control with Anonymous Authentication of Data using Hide Attributes

Decentralized Access Control with Anonymous Authentication of Data using Hide Attributes

1S. Thirumurugan, 2S. Vignesh

Department of Computer Science and Engineering, Christ College of Engineering and Technology, Puducherry, India

Abstract:- A new decentralized access management theme for secure knowledge storage in clouds that support anonymous authentication. During this theme, the cloud verifies the believability of the user while not knowing the users identity before storing knowledge and additionally has value-added the feature of access management during which solely valid users area unit ready to rewrite the hold on data. The theme prevents reply attack and supports creation, modification, and reading the information hold on within the cloud user and additionally has the address user revocation. Moreover, our authentication and access management theme is decentralized and sturdy, in contrast to alternative access management schemes designed for clouds that area unit centralized. The communication, computation, and storage overheads area unit resembling centralized approaches. If the user doesn't have credentials to urge the key and incorrectly coming into key to access the file implies that persona non grata identification activates the system to transfer a pretend file to the persona non grata and inform to the administrator of the system {and the|and therefore the|and additionally the} user who created that file is try and access and also hide the attribute and access policy of a user.

Keyword: Trespasser identification, attribute based encryption, attribute based signature

1. INTRODUCTION

Cloud Computing refers to manipulating, configuring and accessing the applications on-line. It offers on-line information storage, infrastructure and application by putting in a bit of computer code on our native laptop and this can be however the cloud computing overcomes platform dependency problems. Hence, the Cloud Computing makes the business application mobile and cooperative like Google Apps, Microsoft on-line and infrastructures like Amazons EC2, Eucalyptus, Nimbus, and platforms to assist developers write applications like Amazons S3, Windows Azure. A lot of the information hold on in clouds is extremely sensitive those square measure medical records and social networks.

Security and privacy square measure the important problems in cloud computing. The user ought to evidence itself before initiating any tasks. User privacy is additionally needed in order that the cloud or the opposite users don't recognize the identity of the user. The cloud will hold the user in command of the information it outsources and therefore the services it provides. The

validity of the user World Health Organization stores the information is additionally verified.

Cloud computing has received plenty of recognition within the previous couple of years and market observers believe it to be the longer term, however not if security issues persist. For folks that aren't accustomed to cloud computing, it's the apply that involves usage of network servers that square measure remotely settled. Users will access the remote servers via the web to manage, store and method relevant information, instead of on the non-public pc of an area server. Several businesses square measure victimization cloud computing that typically seems to be cheaper, quicker and simple to take care of. Now, not solely businesses however regular web users also are victimization cloud computing services like Google Docs, Drop box and additional to access their files whenever and where they require.

Cloud computing has accelerated with the wide use of the web services similarly as development of mobile devices like good phones and tablets. Many of us carry their transportable devices once not on their table and simply access their documents, media and photos on cloud storage via the web. With the event in technology market, consultants also are disturbed regarding the magnified security wants for cloud computing.

Amazon net Services could be a distinguished cloud computing supplier within the trade. The department is that the quickest growing department of Amazon. However, in Oct. 2012, services unsuccessful for a minute. Users World Health Organization had their files hold on with Amazon net Services were unable to access their documents. Experts opine that cloud computing is at its emergent stage and suppliers ought to address problems connected security, accessibility, and additional to expand within the future. Shadow it's a good issue till it runs into the safety of cloud computing. Only too usually line-of- business users square measure establishing applications and moving information into the cloud while not understanding all the safety implications.

"There's no additional discussion," says Rajat Bhargava, co-founder of Jump Cloud, a cloud security start up. "When you do not own the network, it's receptive the remainder of the planet, and you do not management the layers of the stack, the cloud – by definition – is additional insecure than storing information on premises."Some members of Open information Centres Alliance, a pool that

has prime IT firms of the planet like SAP, Infosys, Deutsche Telekom, Disney and additional, area unit believed to be cloud enthusiasts. However, a recent survey of the members reveal that around sixty six p.c of the consortium's members area unit involved concerning information security, that is deferring their efforts for cloud computing. an analogous survey worn out previous years indicated that around eighty p.c of the members were intellect regarding getting into cloud computing attributable to security issues.

While there area unit advantages, there area unit privacy and security issues too. Information is motion over the web and is keep in remote locations. Additionally, cloud suppliers usually serve multiple customers at the same time. All of this might raise the size of exposure to doable breaches, each accidental and deliberate. issues are raised by many who cloud computing could cause function creep uses of knowledge by cloud suppliers that weren't anticipated once the knowledge was originally collected and that consent has generally not been obtained. Given however cheap it's to stay information, there's very little incentive to get rid of the knowledge from the cloud and additional reasons to search out alternative things to try to to with it.

Security problems, the necessity to segregate information once handling suppliers that serve multiple customers, potential secondary uses of the datathese area unit areas that organizations ought to detain mind once considering a cloud supplier and once negotiating contracts or reviewing terms of service with a cloud supplier. on condition that the organization transferring this info to the supplier is ultimately in control of its protection, it has to make sure that the private info is suitable handled.

Existing work on access management in cloud area unit centralized in nature. Except and, all alternative schemes use attribute based mostly cryptography (ABE). The theme in uses a rhombohedral key approach and doesn't support authentication. This frees users from the hassles of maintaining resources on-site .

Clouds will offer many varieties of services like applications, infrastructures, and platforms to assist developers write applications uses a rhombohedral key approach and doesn't support authentication further. Provides privacy protective echt access management. However, the authors take a centralied approach wherever one key distribution centre (KDC) distributes secret keys and attributes to all or any users. sadly, one KDC isn't solely one purpose of failure however tough to take care of thanks to the big range of users that area unit supported in an exceedingly cloud atmosphere. We, therefore, emphasize that clouds ought to take a localised approach whereas distributing secret keys and attributes to users. it's conjointly quite natural for clouds to possess several KDCs in several locations within the world.

A single KDC is employed however tough to take care of thanks to the big range of users that area unit

supported in an exceedingly cloud atmosphere. rhombohedral key approaches offer key to user. Authentication isn't needed.

1. MATHEMATICAL BACKGROUND

   1. SYSTEM INTIALIZATION

      Select a primary letter of the alphabet, and teams G1 and G2, that square measure of order letter of the alphabet. We have a tendency to outline the mapping e:G1

      ×G1 G2. Let g1, g2 be generators of G1 and hj be generators of G2, for j [tmax], for capricious tmax. Let H be a hash perform. Let A0 = hao0, wherever a0 Zq is chosen indiscriminately. (TSig,TVer) mean TSig is that the personal key with that a message is signed and television er is that the public key used for verification. the key key for the trustee is TSK = (a0, TSig) and public secret's TPK = (G1, G2, H, g1, A0, h0, p, . . . , htmax, g2, TVer).

   2. USER AUDITION

      Added users square measure able to choose here. The Search Results panel helps you to find users in your organizations user directory and add them to the list of users for the sort youve elite. To seek out and add user names to a job is to enter a reputation within the Search text box, and so click Search. Contribute shows the nearest matches it finds within the Search Results list. Choose the name of the user you wish to feature to the role, and click on increase move that user to the list of Users to feature. The roles square measure characteristic the attribute to be used here. The attributes square measure typically able to establish the access policy of the files and contents of it.

   3. FILES ACCESS

      Attribute based mostly File Access has been wide deployed during this systems in recent years. The event of knowledge and communication technologies, square measure teams and departments square measure rising, that need dynamic user-role and permission-role assignments. In these situations it's impracticable, if not possible, for few security officers to handle the assignment for varied applications. During this project, we have a tendency to project this approach for redistributed systems.

   4. ATTRIBUTE VERIFICATION

      Attribute Verification one in every of variety of Identity knowledge. Login to a Managed System typically comprises a User ID and word. Identification might also use a PKI certificate, and Authentication could use Tokens or biometry or a collection of private queries that the user should answer. Here I hooked up the method of attribute based mostly access role for every file having the safety lock to access it. The attributes square measure collected from the users profile that got login currently. The attributes lock system and also the set of attributes grant access square measure already designed by the creator of the file.

   5. 2 LAYER APPROACH

      A 2 layer approach is mostly used once one party desires to reveal the contents of messages sent to a different one and encrypted with a key the receiver. This approach is developed because the cipher text is remodeled to the Encoded kind at the primary layer of encoding. Then the encoded text are encrypting with the generated key mistreatment MD5 algorithmic program. This generates a replacement key that may use to decode the message. If we have a tendency to send a message that was encrypted beneath a key, the proxy can alter the message, permitting decipherment it then decrypting it. This methodology permits for variety of applications law-enforcement observance, and content distribution. Since the goal of the many re-encryption schemes is to avoid revealing either of the keys or the underlying plaintext to the proxy, this methodology isn't ideal.

   6. TRESPASSER IDENTIFICATION

      The system can work for the users United Nations agency square measure have the login credentials and also the attributes to access the cipher text knowledge contents and by the approach of Secret keys. The key keys square measure exploring from KDC. If the user doesn't have credentials to urge the key and incorrectly coming into key to access the file means trespasser identification activates the system to transfer a faux file to the trespasser and inform to the administrator of the system and also the user United Nations agency created that file is try and access.

   7. MULTIPLE KDC SETUP

   A typical operation with a KDC involves asking from a user to use some service. The KDC can use crypto logical techniques to demonstrate requesting users as themselves. It will conjointly check whether or not a private user has the correct to access the service requested. If the echt user meets all prescribed conditions, the KDC will issue a price ticket allowing access. KDCs operate with MD5 algorithmic program and Attribute based mostly encoding key on this.

   The KDC produces a price ticket supported a server key. The user receives the price ticket and submits it to the acceptable server. The server will verify the submitted price ticket and grant access to the user submitting it. Security systems mistreatments KDCs embody practicality between 2 totally different agents. The only KDC will build bother whereas we have a tendency to accessing with most variety of users. In this we separate the KDC to 2 gateways. One work for little size files contents key and security handling another one is for to assist the utmost file sized contents key

2. PROPOSED DECENTRALIZED ACCESS CONTROL WITH ANONYMOUS AUTHENTICATION

   OF DATA STORED IN CLOUDS

   Proposed a decentralised approach, their technique doesnt manifest users, World Health Organization need to stay anonymous whereas accessing the cloud. In AN earlier work, Ruj et al. planned a distributed access management mechanism in clouds. However, the theme gives user authentication. Alternative the opposite} disadvantage was that a user will produce and store a file and other users will solely browse the file. Write access wasn't permissible to users apart from the creator. Within the preliminary version of this paper, we have a tendency to extend our previous work with value-added options that permits to manifest the validity of the message while not revealing the identity of the user World Health Organization has keep info within the cloud. During this version we have a tendency to conjointly address user revocation. We have a tendency to use attribute primarily based signature theme to realize legitimacy and privacy.

   Advantages extend our previous work with value- added options that permits to manifest the validity of the message while not revealing the identity of the user World Health Organization has keep info within the cloud. Users attributes area unit hide and conjointly hide access policy from unauthorized user.

   Fig 1: Cloud storage/retrieve process

   1. KNOWLEDGE STORAGE IN CLOUDS

      A user Uu 1st registers itself with one or a lot of trustees. For simplicity we have a tendency to assume there's one trustee. The trustee provides it a token = (u; Kbase; K0; ), wherever is that the signature on u

      Kbase signed with the trustees personal key T Sig (by (6)).The KDCs area unit given keys PK[i]; SK[i] for encryption/decryption and ASK[i]; APK[i] for signing/verifying. The user on presenting this token obtains attributes and secret keys from one or a lot of KDCs. A key for associate degree attribute x happiness to KDC Ai is calculated as Kx = K1/(a+bx) base , wherever (a; b) ASKi]. The user additionally receives secret keys skx,u

      for encrypting messages. The user then creates associate degree access policy X that could be monotone mathematician operate. The message is then encrypted underneath the access policy as

      C = ABE.Encrypt(MSG, X)

      The user additionally constructs a claim policy Y to change the cloud to demonstrate the user. The creator doesn't send the message seasoning as is, however uses the time stamp and creates H(C). this is often done to forestall replay attacks. If the time stamp isn't sent, then the user will write previous stale message back to the cloud with a legitimate signature, even once its claim policy and attributes are revoked. the initial work by Maji et al. [24] suffers from replay attacks. In their theme, a author will send its message and proper signature even once it now not has access rights. In our theme a author whose rights are revoked cannot produce a replacement signature with new time stamp and, thus, cannot write back stale info. It then signs the message and calculates the message signature as

      = ABS.Sign(Public key of trustee, Public key of KDCs, token, linguistic communication key, message, access claim).

      The following info is then sent within the cloud c = (C,,, Y)

      The cloud on receiving the knowledge verifies the access claim victimization the formula ABS.verify. The creator checks the worth of V = ABS.Verify(TPK,,c,Y). If V = 0, then authentication has unsuccessful and also the message is discarded. Else, the message (C,) is keep within the cloud.

   2. READING FROM THE CLOUD

      When a user requests knowledge from the cloud, the cloud sends the ciphertext C victimization SSH protocol. Decoding return victimization formula ABE. Decrypt(C,) and also the message seasoning

   3. WRITING TO THE CLOUD

      To write to associate degree already existing file, the user should send its message with the claim policy as done throughout file creation. The cloud verifies the claim policy, and provided that the user is authentic, is allowed to write down on the file.

   4. USER REVOCATION

   We have simply mentioned the way to forestall replay attacks. we are going to currently discuss the way to handle user revocation. It ought to be ensured that users should not have the power to access knowledge, even though they possess matching set of attributes. For this reason, the house owners ought to amendment the keep knowledge and send updated info to alternative users. The set of attributes Iu possessed by the revoked user Uu is noted and every one users amendment their keep

   knowledge that have attributes i Iu. In [13], revocation concerned ever-changing the general public and secret keys of the smallest set of attributes that area unit needed to decode the information. we have a tendency to don't contemplate this approach as a result of here totally different knowledge area unit encrypted by a similar set of attributes, thus such a smallest set of attributes is totally different for various users. Therefore, this doesn't apply to our model. Once the attributes Iu area unit known, all knowledge that possess the attributes area unit collected. for every such knowledge record, the subsequent steps area unit then carried out:

   1. A replacement worth of s, snew ZZq is chosen.

   2. The primary entry of vector vnew is modified to new snew.

   3. x = Rxvnew is calculated, for every row x akin to leaf attributes in Iu.

   4. C1,x is recalculated for x.

   5. New worth of C1,x is firmly transmitted to the cloud.

   6. New C0 = Me (g,g)snew is calculated and keep within the cloud.

   7. New worth of C1,x isn't keep with the information, however is transmitted to users, WHO would like to decode the information.

      We note here that the new worth of C1,x isn't keep within the cloud however transmitted to the non-revoked users WHO have attribute akin to x. This prevents a revoked user to decode the new worth of C0 and obtain back the message.

3. CONCLUSION

A decentralized access control technique with anonymous authentication, which provides user revocation and prevents replay attacks. The cloud does not know the identity of the user who stores information, but only verifies the users credentials. Key distribution is done in a decentralized way. Here using two Key approach attribute based encryption and attribute based signature. Attribute based encryption used CP-ABE (Cipher text policy attribute based Encryption algorithm) and Attribute based Signature used the MD5. One limitation is that the cloud knows the access policy for each record stored in the cloud. In future, we would like to hide the attributes and access policy of a user. Creating a virtual environment for identify the hacker and compromise him/her (Intrusion detection). Create two Gateway table to access the key information one for large file content another one for small file contents. The future enhancement of this system is using more providers for maintaining large number of data and large number user in cloud and it also acts a best organizer.

1. D.F. Ferraiolo and D.R. Kuhn, Role-Based Access Controls, Proc. 15th Natl Computer Security Conf., 1992

   	REFERENCES		Based Access Control, IEEE Computer, vol. 43, no. 6, pp. 79-81,
   			June 2010.
   [1]	S. Ruj, Member, IEEE, M. Stojmenovic, Member, IEEE, and A.	[12]	M. Li, S. Yu, K. Ren, and W. Lou, Securing Personal Health
   	Nayak, Senior Member, IEEE"Decentralized Access Control with		Records in Cloud Computing: Patient-Centric and Fine-Grained
   	Anonymous Authentication of Data Stored in Clouds",Feb-		Data Access Control in Multi-Owner Settings, Proc. Sixth Intl
   	2014,pp.384-394		ICST Conf. Security and Privacy in Comm. Networks
   [2]	S. Ruj, M. Stojmenovic, and A. Nayak, Privacy Preserving Access		(SecureComm), pp. 89-106, 2010.
   	Control with Authentication for Securing Data in Clouds, Proc.	[13]	S. Yu, C. Wang, K. Ren, and W. Lou, Attribute Based Data Sharing
   	IEEE/ACM Intl Symp. Cluster, Cloud and Grid Computing, pp.		with Attribute Revocation, Proc. ACM Symp. Information,
   	556- 563, 2012.		Computer and Comm. Security (ASIACCS), pp. 261-270, 2010.
   [3]	C. Wang, Q. Wang, K. Ren, N. Cao, and W. Lou, Toward Secure	[14]	G. Wang, Q. Liu, and J. Wu, Hierarchical Attribute-Based
   	and Dependable Storage Services in Cloud Computing, IEEE		Encryption for Fine-Grained Access Control in Cloud Storage
   	Trans. Services Computing, vol. 5, no. 2, pp. 220-232, Apr.- June		Services, Proc. 17th ACM Conf. Computer and Comm. Security
   	2012.		(CCS), pp. 735-737, 2010.
   [4]	J. Li, Q. Wang, C. Wang, N. Cao, K. Ren, and W. Lou, Fuzzy	[15]	F. Zhao, T. Nishide, and K. Sakurai, Realizing Fine-Grained and
   	Keyword Search Over Encrypted Data in Cloud Computing, Proc.		Flexible Access Control to Outsourced Data with Attribute-Based
   	IEEE INFOCOM, pp. 441-445, 2010.		Cryptosystems, Proc. Seventh Intl Conf. Information Security
   [5]	S. Kamara and K. Lauter, Cryptographic Cloud Storage, Proc.		Practice and Experience (ISPEC), pp. 83-97, 2011.
   	14th Intl Conf. Financial Cryptography and Data Security, pp. 136-	[16]	S. Ruj, A. Nayak, and I. Stojmenovic, DACC: Distributed Access
   	149, 2010.		Control in Clouds, Proc. IEEE 10th Intl Conf. Trust, Security and
   [6]	H. Li, Y. Dai, L. Tian, and H. Yang, Identity-Based		Privacy in Computing and Communications (TrustCom), 2011.
   	Authentication for Cloud Computing, Proc. First Intl Conf. Cloud	[17]	S. Jahid, P. Mittal, and N. Borisov, EASiER: Encryption-Based
   	Computing (CloudCom), pp. 157-166, 2009.		Access Control in Social Networks with Efficient Revocation, Proc.
   [7]	C. Gentry, A Fully Homomorphic Encryption Scheme, PhD		ACM Symp. Information, Computer and Comm. Security
   	dissertation, Stanford Univ., http://www.crypto.stanford.edu/craig,		(ASIACCS), 2011.
   	2009.	[18]	R.L. Rivest, A. Shamir, and Y. Tauman, How to Leak a Secret,
   [8]	R.K.L. Ko, P. Jagadpramana, M. Mowbray, S. Pearson, M.		Proc. Seventh Intl Conf. Theory and Application of Cryptology and
   	Kirchberg, Q. Liang, and B.S. Lee, Trustcloud: A Framework for		Information Security (ASIACRYPT), pp. 552-565, 2001.
   	Accountability and Trust in Cloud Computing, HP Technical	[19]	X. Boyen, Mesh Signatures, Proc. 26th Ann. Intl Conf. Advances
   	Report HPL- 2011-38,		in Cryptology (EUROCRYPT), pp. 210-227, 2007.
   	http://www.hpl.hp.com/techreports/2011/HPL-2011-38.html, 2013.	[20]	D. Chaum and E.V. Heyst, Group Signatures, Proc. Ann. Intl
   [9]	R. Lu, X. Lin, X. Liang, and X. Shen, Secure Provenance: The		Conf. Advances in Cryptology (EUROCRYPT), pp. 257-265, 1991.
   	Essential of Bread and Butter of Data Forensics in Cloud	[21]	H.K. Maji, M. Prabhakaran, and M. Rosulek, Attribute-Based
   	Computing, Proc. Fifth ACM Symp. Information, Computer and		Signatures: Achieving Attribute-Privacy and Collusion-Resistance,
   	Comm. Security (ASIACCS), pp. 282-292, 2010.		IACR Cryptology ePrint Archive, 2008.

2. D.R. Kuhn, E.J. Coyne, and T.R. Weil, Adding Attributes to Role-