Achieving Secure, Scalable, and Fine-grained Data Access Control in Cloud Computing

Achieving Secure, Scalable, and Fine-grained Data Access Control in Cloud Computing

Abstract Abstract —Cloud computing is an emerging computing paradigm in which resources of the computing infrastructure challenges that, if not well resolved, may impede its fast are provided as services over the Internet. As promising as it is, growth. Data security, as it exists in many other applications, this paradigm also brings forth many new challenges for data is among these challenges that would raise great concerns security and access control when users outsource sensitive data from users when they store sensitive information on cloud for sharing on cloud servers, which are not within the same servers. These concerns originate from the fact that cloud trusted domain as data owners. To keep sensitive user data confidential against untrusted servers, existing solutions usually servers are usually operated by commercial providers which apply cryptographic methods by disclosing data decryption keys are very likely to be outside of the trusted domain of the users. only to authorized users. However, in doing so, these solutions Data confidential against cloud servers is hence frequently inevitably introduce a heavy computation overhead on the data desired when users outsource data for storage in the cloud. In owner for key distribution and data management when fine- some practical application systems, data confidentiality is not grained data access control is desired, and thus do not scale well. The problem of simultaneously achieving fine-grainedness, only a security/privacy issue, but also of juristic concerns. For scalability, and data confidentiality of access control actually still example, in healthcare application scenarios use and disclosure remains unresolved. This paper addresses this challenging open of protected health information (PHI) should meet the require- issue by, on one hand, defining and enforcing access policies basedments of Health Insurance Portability and Accountability Act on data attributes, and, on the other hand, allowing the data (HIPAA) [5], and keeping user data confidential against the  owner to delegate most of the computation tasks involved in fine- grained data access control to untrusted cloud servers without storage servers is not just an option, but a requirement.disclosing the underlying data contents. We achieve this goal by Furthermore, we observe that there are also cases in which exploiting and uniquely combining techniques of attribute-based cloud users themselves are content providers. They publish encryption (ABE), proxy re-encryption, and lazy re-encryption. data on cloud servers for sharing and need fine-grained data Our proposed scheme also has salient properties of user access access control in terms of which user (data consumer) has the privilege confidentiality and user secret key accountability. Extensive analysis shows that our proposed scheme is highly efficient access privilege to which types of data. In the healthcare case, and provably secure under existing security models.