云存储中的数据安全与无线网络

需积分: 5 184 浏览量更新于2024-06-27 1 收藏 6.96MB PDF 举报

"云存储下的数据安全介绍" 在当今数字化时代，云存储已成为企业和个人存储大量数据的主要方式。然而，随着数据量的爆炸性增长，数据安全问题也日益凸显。云存储下的数据安全介绍旨在深入探讨如何在无线网络环境中确保云存储的数据安全。云存储是一种通过互联网将数据存储在远程服务器上的服务，它提供了方便的数据访问和共享，但同时也引入了新的安全挑战。无线网络（如蜂窝网络、WiFi、传感器网络和车载网络）是云存储的关键组成部分，它们为数据传输提供通道，但也使数据更容易受到各种攻击，如中间人攻击、数据篡改、窃听和身份冒充。数据安全在云存储中主要涉及以下几个方面： 1. 加密技术：为了保护数据免受未经授权的访问，云存储服务通常采用加密手段。数据在传输过程中应使用SSL/TLS等协议进行加密，而在存储时则采用AES等对称加密算法或RSA等非对称加密算法。这些加密方法确保即使数据被截取，也无法轻易解密。 2. 认证与授权：云服务提供商需要实施严格的用户认证机制，例如多因素认证，以防止非法用户登录。同时，细粒度的权限控制确保只有授权用户可以访问特定的数据资源。 3. 审计与监控：持续的审计和监控活动能及时发现异常行为，帮助识别潜在的安全威胁。日志记录和分析对于追踪数据访问历史和检测潜在的入侵至关重要。 4. 数据备份与恢复：定期备份数据是防范数据丢失的重要措施。云服务提供商通常会提供跨地区、跨数据中心的数据备份策略，以确保灾难发生时能够快速恢复数据。 5. 安全策略与合规性：云服务提供商需要遵循严格的安全标准，如ISO 27001、PCI-DSS等，并确保符合各种法规要求，如GDPR、CCPA等，以保护用户隐私和数据主权。 6. 内容完整性：通过使用哈希函数和数字签名，可以验证数据在传输和存储过程中的完整性和未被篡改。这有助于检测到数据是否被恶意修改。 7. 安全更新与补丁管理：云服务商需要定期更新和打补丁，以应对新出现的安全漏洞，保持系统安全性。 8. 零信任网络：在云环境中，零信任网络模型强调“永不信任，始终验证”，无论数据在网络内部还是外部，都需进行严格的访问控制。 9. 安全培训与意识：提高用户的安全意识也是确保云存储数据安全的重要环节。教育用户识别并避免点击钓鱼链接，不使用弱密码，以及理解数据泄露的风险。云存储下的数据安全是一个综合性的议题，涉及加密、认证、监控、备份、合规性等多个层面。随着无线网络技术的不断发展，云存储安全需要持续创新和完善，以应对不断演变的网络安全威胁。通过深入了解和实践这些安全措施，企业和个人可以在享受云存储便利的同时，更好地保障自己的数据安全。

4 1 Introduction

to outsource EHRs to the cloud server [7, 8], but also makes a great contribution

to the judgment and dispute resolution in medical malpractices [9]. In addition,

practical eHealth systems always need to support data sharing among different

entities. Typical scenarios include group consultations, where a patient is treated

by a group of doctors and EHRs are generated by these doctors one by one, and

each doctor generates EHRs according to the ones generated by the previous doctor.

Traditionally, this is achieved by requiring the patient to transfer the EHRs

generated by the previous doctor to the next one, which is very cumbersome and

inefﬁcient. With the employment of cloud storage services, the patient’s EHRs

are outsourced to the cloud server, she/he would never need to transfer the EHRs

by herself/himself. Instead, she/he just needs to delegate all authorized doctors

to access her/his EHRs from the cloud server, and thereby improving efﬁciency

signiﬁcantly.

1.1.2.2 Data Sharing

Data sharing is a fundamental requirement for many applications [10]. In the

previous section, we have introduced the signiﬁcance of data sharing in eHealth

systems. In this section, we provide more applications and discuss the potentials of

utilizing cloud storage services.

Particularly, in an open-source software development system, the system require-

ments are released by a project manager, and multiple developers would work

together as a group on the project to complete the source code. In such an

application, the source code completed by one developer might be revised by

another one. Traditionally, the project manager has to keep online to assist all

developers in completing the source code to ensure the consistency of the source

code on each developer. Each developer not only requests the latest version of the

source code from the manager, but also needs to know how the source code was

revised and updated, which is error-prone and cumbersome for the manager. The

same problems also exist in the collaboration systems wherein multiple users jointly

edit a document.

With the employment of cloud storage services, the open-source software

development system can be directly implemented, and it is easy to share data

among developers via the cloud server [11]. Currently, several systems, such as

Codeanywhere [12] and Google Doc [13], have been implemented.

1.1.2.3 IoT

In most IoT applications, IoT devices are lightweight and have limited capabilities

in terms of storage and computation [14]. Therefore, these IoT devices cannot have

capabilities of processing the data collected by them and can only send raw data

to a target entity. In most cases, the entity not only needs to store all raw data for

1.2 Data Security in Cloud Storage 5

data archiving, but also has to process the data before using it, which introduces

considerable costs.

However, with the employment of cloud storage services, the IoT devices in

these applications are enhanced signiﬁcantly in terms of storage and computation

capability. After collecting the data, the IoT device can send it to the cloud server

which not only provides the data backup service, but also assists target entities in

processing the data in an efﬁcient and ﬂexible way [15].

1.2 Data Security in Cloud Storage

While people enjoy the desirable beneﬁts from the cloud storage service, critical

security concerns in data outsourcing have been raised seriously [16–18]. Compared

with traditional data storage systems (users store their data locally), the cloud

storage service provides users with a completely different paradigm to manage

their data, which introduces new and challenging threats towards data security.

Speciﬁcally, in the cloud storage service, users do not physically own their data

once outsourcing the data to the cloud server, and these data are fully controlled

by the cloud server. As such, once the cloud server (including insiders working at

the cloud service provider) misbehaves, the outsourced data would be confronted

with threats, such as corruption, modiﬁcation, removal, and privacy violation. In

addition, since the data are transmitted over public and insecure networks, external

adversaries (e.g., hackers) might eavesdrop on the communication channel between

the user and the cloud server, tamper with the interaction messages between them,

and extract the data contents from the cloud server for ﬁnancial or political reasons

[19, 20].

However, ensuring the security of cloud storage services is challenging in reality,

which is reﬂected in two aspects. On the one hand, although the infrastructures

under the cloud service provider are much powerful and reliable than personal

machines and devices, they still suffer from internal faults for the data security.

These internal faults include network failures, system malfunctions, misoperations,

and software bugs. They would occur in practice, no matter what high degree of

reliable countermeasures the cloud service provider would employ. On the other

hand, both the cloud server and the external adversary have a strong motivation

to compromise the data security if this could increase their proﬁts in the system

signiﬁcantly. Therefore, it is critical and challenging to ensure data security in cloud

storage [21, 22].

From the perspective of users, data security in cloud storage mainly includes

three parts: data reliability, data conﬁdentiality, and secure data investigations.

Data reliability of cloud storage service serves as the fundamental assurance of

its security [23, 24]. Recall that users would not physically own their data once

having outsourced the data to the cloud server. They are always worried about the

data integrity, i.e., whether the outsourced data is well maintained on the cloud

server. However, the integrity of outsourced data is being put at risk in practice.

6 1 Introduction

For example, the cloud server may always conceal incidents of data corruption for a

good reputation, or may delete a part of data that is never accessed to reduce storage

costs. Moreover, an external adversary motivated by ﬁnancial or political reward

may attempt to tamper with the outsourced data but convince the users that their

data are still retained intact.

Data conﬁdentiality is an essential part of cloud storage security. In reality,

some of the outsourced data include the privacy information about their owners,

and thereby are very sensitive. Without proper protection, adversaries (including

the internal and external ones) could easily extract the data contents from the

outsourced data, which allows the adversaries to violate the users’ privacy. To

protect data contents against adversaries, users always encrypt their data before

outsourcing. This can be achieved by utilizing conventional encryption, e.g., AES

[25], but it makes efﬁcient data outsourcing and ﬁne-grained access to outsourced

data impossible, which introduces considerable costs to users. This problem can be

further divided into two parts and will be discussed below.

On the one hand, in reality, different users would outsource the same data to one

cloud server, which enables the cloud server to perform data deduplication across

its users to reduce storage costs. However, due to the randomness of conventional

encryption algorithms (i.e., different users would produce different ciphertexts for

the same data), deduplication over encrypted data is impeded [26].

On the other hand, in some cases, after a user outsources an entire (encrypted)

data set to the cloud server, she/he would only need to retrieve some subset of the

outsourced data set from the cloud server. In this case, if the data is encrypted by

using conventional encryption algorithms, the user has to download the entire data

set, decrypt it, and retrieve the target data from the entire data set. This introduces

prohibitive costs in terms of communication and computation on the user side [27,

28].

Therefore, in actual cloud storage systems, although data conﬁdentiality is a

basic requirement for users, more interfaces that support efﬁcient data outsourcing

and data retrieval are also required. However, new security challenges and threats

towards data conﬁdentiality are also introduced.

Secure data investigations guarantee the trustworthiness of outsourced data and

the cloud storage service. As discussed before, cloud storage has served as a

fundamental component in several data-intensive applications, e.g., eHealth, to

make the data management easy and reliable. On the other hand, the data outsourced

to the cloud server also serves as the key evidence in post investigations. For

example, in an eHealth system, when a medical malpractice occurs, an investigator

who is subject to an authority needs to reconcile the dispute among the medical

institution and the patient as well as her/his families. The most important evidence

to reconcile the dispute is the corresponding EHRs outsourced to the cloud server.

However, it is usual that the defendant challenges the authenticity of a digital

evidence during the trial, since EHRs are fully controlled by the cloud server and the

defendant may question the EHRs that investigators are working on and presented

in the courtroom is not the same ones originated from the medical institution.

1.3 Organization of the Monograph 7

To interference with the judge’s judgment, an adversary might launch the following

two types of attacks.

First, the adversary would tamper with the outsourced data and the corresponding

provenance information which keeps track of what happens to the data throughout

the lifecycle of the data. If the adversary succeeds, the outsourced data cannot serve

as the evidence since they are invalid [29].

Second, the adversary would also tamper with the time when the data is created

to interference with the judgment. In some cases, the creation time of a data ﬁle

is very critical in post investigations [30–32]. If the adversary successfully back-

dates/forward-dates the data, the trustworthiness and authenticity of the judgment

based on the data cannot be guaranteed.

1.3 Organization of the Monograph

In this monograph, we investigate the data security issues in cloud storage systems.

The aim of this monograph is threefold.

First, we elaborate on the threats described above and analyze how they can

be utilized by adversaries and why these vulnerabilities are critical. This presents

basic paradigms and principles of secure cloud storage to a general audience with a

basic computer, communication, or cryptography background. This also serves as a

general introduction suitable for beginning researchers in related areas.

Second, this monograph includes ﬁve research topics in secure cloud storage:

secure data integrity veriﬁcation, secure deduplication, secure keyword search,

secure data provenance, and secure data time-stamping. We make a comprehensive

survey of each research topic and analyze the pros and cons of schemes and

techniques in each research topic. We stress that these research topics are closely

related to each other, and these research works jointly ensure data security in cloud

storage. Speciﬁcally, the relationship among these topics is shown in Fig. 1.2.From

the perspective of a user, after she/he outsources data to a cloud server, she/he

ﬁrst cares about the reliability of the storage service, i.e., whether the data remains

intact on the cloud server. This is related to the data integrity veriﬁcation technique.

Once the reliability is ensured, the user would focus on their privacy, i.e., whether

someone, who is not authorized by the user, is able to extract the contents of

her/his data from the cloud server. This assurance corresponds to data conﬁdentiality

and can be provided by the employment of encryption algorithms. However, from

the point of view of pragmatism, the user would wish the costs of utilizing

cloud storage service as low as possible, but the privacy preservation retains. The

technique that satisﬁes this requirement is secure deduplication. Furthermore, the

user also needs to retrieve target data from the cloud server without downloading

the entire ciphertext set, which requires the cloud storage system to guarantee the

conﬁdentiality of outsourced data without sacriﬁcing its availability. The technique

that accomplishes this goal is secure keyword search. In addition, a secure cloud

storage system also needs to support data investigations, where the provenance

剩余179页未读，继续阅读

javatemptation

粉丝: 65
资源: 324

云存储中的数据安全与无线网络

云存储及其安全性

谈谈数据安全和云存储

浅谈云存储下的数据安全与隐私保护

"云存储审计：高效安全的数据完整性检查方案

"云存储安全：数据加密与完整性保护方法综述

云存储的安全性问题及解决方案

云支持的大数据环境下的数据安全挑战与解决方案

利用Java实现云端数据存储与安全管理

基于云平台的数据安全存储系统

基于云平台的数据安全存储系统如何开发

最新资源