雲端計算安全機制之研究

A Research on Security Mechanisms for Cloud Computing

黃文欣(Wen-Hsin Huang)

指導教授 ： 張雅芬

國立臺中科技大學/資訊與流通學院/資訊工程系碩士班/碩士(2018年)

摘要

雲端計算是一種新興和應用廣泛的概念。透過雲端計算，軟體和硬體的資源及資訊可被共享，另外，它為企業提供了低成本的服務，並提高效率。雖然雲端計算帶給人們便利，為了確保數據的安全性和資料的隱私，雲端服務供應商必須將數據保護、身分管理、應用安全、隱私保護視為重點。
在本研究中，我們針對雲端計算的安全機制進行討論。首先，在2017年，Kumari等學者為了確保用戶與雲端伺服器之間的通訊安全以實現物聯雲，提出了一種基於生物特徵的認證方案，並宣稱他們的方法可確保用戶匿名性。在分析Kumari等學者的方法後，我們發現他們的方法存在一個缺失，它無法保證用戶匿名。
另一方面，使用者將共享的機密資料儲存在雲中，這使得資料安全成為一個重要的議題。為確保資料安全，雲服務提供商必須提供完善的安全機制，該安全機制須具備可靠的加密方法和合適的存取控制系統。為實現此理想，Huang等學者在2017年提出了一種基於分層屬性加密的資料協作方案。並宣稱他們的方法可以保證資料機密性。在分析了Huang等學者的方案之後，我們發現他們的方案存在一個弱點，即半可信的雲服務提供者可以解密受保護的數據以獲得機密資料。在這篇研究中，我們將明確指出Kumari等學者和Huang等學者針對雲端計算不同應用所提出方案所面臨之資訊安全威脅。

關鍵字

雲端計算 ； 驗證 ； 安全性 ； 生物特徵 ； 物聯網 ； 物聯雲 ； 資料協作 ； 資料機密性 ； 基於分層屬性的加密

並列摘要

Cloud computing, a new and widely-applied concept, makes hardware, software and information shared. It provides low-cost services for business and improves efficiency. Although cloud computing brings people convenience, cloud service providers must focus on data protection, identity management, application security, and privacy to ensure that data is secure and data privacy is protected.
In this thesis, we make discussions on security mechanisms for cloud computing. In 2017, Kumari et al. proposed a biometrics-based authentication scheme to ensure the security of communications between a user and cloud-servers to realize Cloud of Things. They claimed their scheme ensured user anonymity. After analyzing Kumari et al.’s scheme, we find that one weakness exists in their scheme such that user anonymity is not ensured as claimed.
On the other hand, users store and share confidential data in the cloud while this approach makes data security become an important and tough issue. To ensure data security, cloud service providers must provide efficient and feasible mechanisms to provide a reliable encryption method and a suitable access control system. In order to realize this ideal, Huang et al. proposed a data collaboration scheme with hierarchical attribute-based encryption in 2017. After analyzing Huang et al.’s scheme, we find that one weakness exists in their scheme such that the semi-trusted cloud service provider can decrypt the protected data to obtain the plaintext. Data confidentiality is not ensured as claimed. In this thesis, we will explicitly indicate how these weaknesses damage Kumari et al.’s and Huang et al.’s schemes designed for different applications in cloud computing.

並列關鍵字

cloud computing ； authentication ； anonymity ； biometrics ； the Internet of Things (IoT) ； Cloud of Things (CoT) ； data collaboration ； data confidentiality ； hierarchical attribute-based encryption

參考文獻

[1] Q. Huang, Z. Ma, Y. Yang, J. Fu and X. Niu, “Secure data sharing and retrieval using attribute-based encryption in cloud-based OSNs,” Chinese Journal of Electronics, Vol. 23, pp.557-563, 2014.

[2] C. Stergiou, K. E. Psannis, B. G. Kim and B. Gupta, “Secure integration of IoT and cloud computing,” Future Generation Computer Systems, Vol. 78 , pp. 964-975, 2018.

[3] E. Yoon and K. Yoo, “Robust biometrics-based multi-server authentication with key agreement scheme for smart cards on elliptic curve cryptosystem,” The Journal of Supercomputing, Vol. 63, No. 1, pp. 235-255, 2013.

[4] D. He and D. Wang, “Robust biometrics-based authentication scheme for multiserver environment,” IEEE Systems Journal, Vol. 9, No, 3, pp. 816-823, 2015.

[5] V. Odelu, A.K. Das and A. Goswami, “A secure biometrics-based multi-server authentication protocol using smart cards,” IEEE Transactions on Information Forensics and Security, Vol. 10, No. 9, pp. 1953-1966, 2015.