Fine-grained assured data deletion scheme based on attribute association

doi:10.1016/j.cose.2020.101936

Computers & Security

Volume 96, September 2020, 101936

https://doi.org/10.1016/j.cose.2020.101936 Get rights and content

ABSTRACT

With the rapid development of cloud computing technology, an increasing number of enterprises and users store their data in the cloud to achieve convenient storage and data sharing. However, once data is stored in a third-party cloud storage service provider, the privacy and integrity of the data can be compromised. This paper proposes a fine-grained assured data deletion scheme based on attribute association (ADAA), which aims to protect security and achieve assured deletion of outsourced data. The scheme uses standard encryption technology to ensure the privacy and integrity of the data and implements secure deletion based on attribute revocation. At the same time, it incorporates access policy graphs and policy combinations to achieve fine-grained access control and data sharing. In addition, it associates attributes to achieve access control by using a homomorphic hash function, and it establishes a deletion confirmation feedback mechanism to provide a reliable guarantee. By experimenting and comparing with related schemes, ADAA is proved to be safe and efficient, and it provides a practical method for the assured deletion of cloud storage data.

Introduction

Due to the dynamically scalable nature of cloud computing technology, cloud storage systems can provide users with unlimited storage space, so an increasing number of users choose to store their data in the cloud. "Storage as a Service" (Shah and Ganatra, 2014) enables outsourced storage of data but creates a series of security issues at the same time. Once data is stored in the cloud, users lose control of it, and the privacy of the data is thus protected by the cloud storage service provider (CSP) Yang et al., 2015. When users delete data, they hope that when the deletion request is issued, the data will be inaccessible permanently, while users do not know whether the CSP can perform the delete operation to prevent data leakage. Therefore, even if the data are stored as ciphertext in the CSP, there is still an unavoidable risk. For example, the CSP may migrate data to multiple cloud storage servers to ensure high availability. When a user deletes data, the CSP does not delete all backups of the data. If an attacker obtains the encryption key in certain known ways, the data will be leaked. Therefore, achieving assured deletion of cloud storage data becomes a requirement to prevent data leakage.

This paper proposes a fine-grained assured data deletion scheme based on attribute association (ADAA),which ensures safe sharing and assured deletion of cloud storage data by using encryption technology and key management.When data is encrypted and stored in the cloud, only users whose attributes meet the access control structure can get data. Once a data owner revokes some attributes under a data protection class, the key manager will delete the corresponding private key to make the data inaccessible (Xue et al., 2018). After deletion, the cloud sends a deletion confirmation to the data owner.

In summary,this paper makes the following contributions:

We propose a fine-grained assured data deletion scheme based on attribute association, which uses cryptography technology and key management to achieve secure share and flexible assured deletion of cloud storage data.

We introduce the concept of attribute association, which uses the anti-collision hash function to correlate related attributes to achieve access control and encryption protection.

We provide a deletion confirmation feedback mechanism to ensure that the data owner can determine whether the cloud has correctly executed the delete request sent by itself.

We conducted a security and efficiency analysis of the program through experimental and theoretical analysis, and compared it with other schemes in terms of function and efficiency. The results show that the scheme achieves secure encryption protection and flexible assured deletion of cloud storage data with acceptable overhead.

The article consists of the following sections. Section 2 introduces related works. Section 3 describes related technologies and definitions of symbols. Section 4 describes the models, including the system model, adversary model and security model. Section 5 describes the detailed design of the ADAA scheme, and Section 6 carries out security analysis, function analysis and efficiency analysis. Section 7 summarizes the findings.

Section snippets

Related works

To securely delete all backups of data, researchers have proposed a series of solutions. These schemes fall into two broad categories: overwriting and cryptography-based approaches.

There are many schemes that use overwriting technology for secure deletion. Reference HUGHES G et al., 2009 proposed the use of SE commands, block-overwrite programs and secure physical destruction of devices to achieve secure deletion. Reference (Gutmann, 1996) pointed out that only the physical storage space of

Homomorphic hash function (Krohn et al., 2004)

Suppose G is a multiplicative group with prime P. Randomly select g₁, g₂, ..., g_n ∈ Gⁿ,and the hash function of $v = (v_{1}, v_{2}, . . ., v_{n}) \in Z_{p n}$ is $H (v) = \prod_{j = 1}^{n} g_{j}^{v_{j}}$

The homomorphic hash function satisfies the following two properties:

Homomorphism:For any two messages m₁,m₂and two real numbers w₁,w₂, there is $H (w_{1} m_{1} + w_{2} m_{2}) = H {(m_{1})}^{w_{1}} H {(m_{2})}^{w_{2}}$ .

Collision-resistance: Attackers do not have a probabilistic polynomial algorithm to counterfeit (m₁, m₂, m₃, w₁, w₂)that satisfies $(m_{3} \neq w_{1} m_{1} + w_{2} m_{2})$ and $H (m_{3}) = H {(m_{1})}^{w_{1}} H {(m_{2})}^{w_{2}}$ .

Theorem 1

The

System model

The system model of ADAA is shown in Fig. 2.

The system model includes data owners, users, CSPs, key managers and potential adversaries.

Data owner: The data owner constructs the data key, control keys and an access policy graph. He encrypts the data file with the data key, encrypts the data key with the control key and sends the ciphertext to the CSP. The data owner ensures the inaccessibility of the data by deleting attributes.

User: A user with access obtains the public key from the key manager

Scheme design

The design idea of the ADAA solution is as follows:

First, the data file is encrypted by a data key related to a data protection class, and then the data key is divided into n key components by Shamir's threshold secret-sharing scheme (Shamir, 1979). Every key component is encrypted by a control key generated based on an attribute. The homomorphic hash function (Krohn et al., 2004) is used to generate a new attribute by associating attributes under a data protection class, the function value is

Performance analysis

Performance analysis in this section mainly consists of security analysis and certification of the proposed scheme, comprehensive function analysis and efficiency analysis in comparison with other related schemes.

Conclusion

This paper proposes ADAA to safely remove data stored in a CSP. Security analysis and security certification show that the scheme is complete and safe, efficiency analysis shows that the scheme is efficient,and function analysis shows that the scheme's functions are comprehensive. However, data can only be deleted by a delete request sent by the data owner, and ADAA does not take into account the traceability of the key management. If the data owner has doubts about access to the key, the key

CRediT authorship contribution statement

Junfeng Tian: Supervision, Project administration, Funding acquisition. Zhidan Wang: Methodology, Software, Writing - original draft, Investigation, Formal analysis.

Declaration of Competing Interest

None.

Acknowledgements

This work is supported by the National Natural Science Foundation of China (61170254); The Natural Science Foundation of Hebei Province (F2016201244).

Tian Junfeng (1965-), male, comes from Baoding of Hebei province, Ph.D., Professor. He is a director of the China Computer Federation, the chairman of the Hebei Cyber Security Federation, the vice-chairman of the Hebei Computer Federation, the editorial board of the Journal of Communications, a member of the China Cloud Computing Expert Advisory Committee, a member of the editorial board. He is currently the Dean and Ph.D. Supervisor of the School of Cyber Security and Computer, Hebei

REFERENCES (24)

K ZHANG et al.
Novel cloud data assured deletion approach based on ciphertext sample slice[J]
J. on Communications
(2015)
P.D. Shah et al.
Comparative study of data possession techniques for data storage as a service(dsaas)
International J. of Computers And Applications
(2014)
Shamir, A.How to share a secret.Communications of the ACM. 1979; 22(11),612–613....
F. HUGHES G et al.
Disposal of Disk and Tape Data by Secure Sanitization
J. Security & Privacy, IEEE
(2009)
M.N. Krohn et al.
On-the-Fly Verification of Rateless Erasure Codes for Efficient Content Distribution
IEEE Symposium on Security and Privacy
(2004)
Peter Gutmann
Secure deletion of data from magnetic and solid-state memory
D. Boneh et al.
In Usenix Security
(1996)
R. PERLMAN
File system design with assured delete[C]
Third IEEE International Security in Storage Workshop(SISW)
(2005)
Steven Swanson et al.
Safe: Fast, Verifiable Sanitization For Ssds
(2010)
J. Reardon et al.
Secure data deletion from persistent media

C. Cachin et al.

A.. Policy-based secure deletion

Y TANG et al.

FADE: secure overlay cloud storage with file assured deletion[C]

The Security and Privacy in Communication Networks (SecureComm)

(2010)

Cited by (9)

Provable data deletion from efficient data integrity auditing and insertion in cloud storage
2022, Computer Standards and Interfaces
Citation Excerpt :
In 2020, Kaushik and Gandhi [25] designed a capability-based cloud data access control scheme supporting assured deletion, in which they achieved file deletion by user revocation. To achieve fine-grained data deletion, Tian and Wang [26] proposed an assured data deletion scheme. Specifically, they introduced a key manager to manage keys/attributes and achieved data deletion by attribute association and revocation.
With the widespread popularity of cloud storage, a growing number of data owners are willing to outsource their massive data to remote cloud servers, thus effectively avoiding the heavy burden of storing and managing the massive data by themselves in local physical storage mediums. Despite the tremendous advantages, cloud storage inescapably suffers from some severe security challenges resulting from the separation of outsourced data management and its ownership, such as data integrity, data deletion, and data insertion. In this paper, we aim to deal with the problems of integrity auditing, dynamic insertion and provable deletion over outsourced data. Specifically, we design a novel authentication data structure, namely, number-rank-based Merkle hash tree (NR-MHT), which can achieve data dynamic operations. Meanwhile, NR-MHT can maintain many data blocks in each leaf node, thus effectively solving the problem of the height indefinitely increases with the total number of data blocks. Subsequently, we adopt NR-MHT to propose a new provable data deletion scheme based on efficient data integrity auditing and dynamic data insertion. In our presented scheme, the data owner can not only permanently delete the unnecessary outsourced data blocks to save storage expenditures but also efficiently insert new data blocks to dynamically update the outsourced data set. Meanwhile, we analyze the security to formally demonstrate that our presented scheme can satisfy all of the expected security requirements without interacting with a third party auditor. Finally, we also develop a prototype implementation of our presented scheme and provide an accurate efficiency evaluation. The numerical analysis and experimental results show that compared with the existing schemes, our presented scheme is more attractive in efficiency and practicability.
Empowering Data Owners: An Efficient and Verifiable Scheme for Secure Data Deletion
2024, SSRN
Fine-grained assured insertion and deletion scheme based on onion encryption in cloud storage
2023, Concurrency and Computation: Practice and Experience
A Survey on Assured Deletion of Outsourced Data in Cloud Storage
2022, Tien Tzu Hsueh Pao/Acta Electronica Sinica
Preserving DNA in Biodegradable Organosilica Encapsulates
2022, Langmuir
Cloud data assured deletion scheme based on dynamic sliding window
2022, Peer-to-Peer Networking and Applications

View all citing articles on Scopus

More than 80 academic papers have been published in academic conferences and journals at home and abroad, and nearly 60 have been retrieved by SCI, EI, and ISTP; responsible for the Natural Science Foundation of Hebei Province, the Science and Technology Transformation Fund of Hebei Province, the Tenth Five-Year Plan Project of Hebei Province, and commissioning more than 20 development projects.

Wang Zhidan (1997-), female, comes from Qitaihe of Heilongjiang province, who is a,master student of Hebei University, the main research direction is information security and trusted computing.

View full text

Fine-grained assured data deletion scheme based on attribute association

ABSTRACT

Introduction

Section snippets

Related works

Homomorphic hash function (Krohn et al., 2004)

System model

Scheme design

Performance analysis

Conclusion

CRediT authorship contribution statement

Declaration of Competing Interest

Acknowledgements

J. on Communications

Comparative study of data possession techniques for data storage as a service(dsaas)

International J. of Computers And Applications

Disposal of Disk and Tape Data by Secure Sanitization

J. Security & Privacy, IEEE

On-the-Fly Verification of Rateless Erasure Codes for Efficient Content Distribution

IEEE Symposium on Security and Privacy

Secure deletion of data from magnetic and solid-state memory

In Usenix Security

File system design with assured delete[C]

Third IEEE International Security in Storage Workshop(SISW)

Safe: Fast, Verifiable Sanitization For Ssds

Secure data deletion from persistent media

A.. Policy-based secure deletion

FADE: secure overlay cloud storage with file assured deletion[C]

The Security and Privacy in Communication Networks (SecureComm)