Enabling Efficient User Revocation in Identity-based Cloud Storage Auditing for Shared Big Data

Abstract

Cloud storage auditing schemes for shared data refer to checking the integrity of cloud data shared by a group of users. User revocation is commonly supported in such schemes, as users may be subject to group membership changes for various reasons. Previously, the computational overhead for user revocation in such schemes is linear with the total number of file blocks possessed by a revoked user. The overhead, however, may become a heavy burden because of the sheer amount of the shared cloud data. Thus, how to reduce the computational overhead caused by user revocations becomes a key research challenge for achieving practical cloud data auditing. A novel storage auditing scheme that achieve highly-efficient user revocation independent of the total number of file blocks possessed by the revoked user in the cloud was proposed. This is achieved by exploring a novel strategy for key generation and a new private key update technique. Using this strategy and the technique, user revocation by just updating the non-revoked group users’ private keys rather than authenticators of the revoked user was realized. The integrity auditing of the revoked user’s data can still be correctly performed when the authenticators are not updated. Meanwhile, the proposed scheme is based on identity-base cryptography, which eliminates the complicated certificate management in traditional Public Key Infra structure (PKI) systems. The security and efficiency of the proposed scheme are validated via both analysis and experimental results.

Existing System

In cloud storage auditing schemes, the data owner needs to use his/her private key to generate authenticators (signatures) for file blocks. These authenticators are used to prove that the cloud truly possesses these file blocks. When a user is revoked, the user’s private key should also be revoked. For traditional cloud storage auditing schemes for share data all of authenticators generated by the revoked user should be transformed into the authenticators of one designated non revoked group user. This non-revoked group user needs to download all of revoked user’s blocks, re-sign these blocks, and upload new authenticators to the cloud.

Proposed System

In this proposed system, a novel cloud storage auditing scheme was constructed for shared data supporting real efficient user revocation. In order to realize efficient user revocation, strategy for key generation is used. In this design, the group’s public key is replaced by the group’s identity information, which remains unchanged in the whole lifetime. The group’s private key derives from two components. One component remains fixed since being issued, and the other component alters with user revocation. A novel private key is used to support user revocation. When users are revoked from the group, all of the non-revoked users can update their private keys by this technique to make the cloud storage auditing still work, while the identity information of the group does not need to change. In addition, the revoked users are not able to upload data and authenticators to the cloud any more. In this way, all of the authenticators generated before user revocation do not need to be recomputed. Therefore, the overhead of user revocation is fully independent of the total number of the revoked user’s blocks. Even when the amount of data is immense, the group can still complete user revocation very efficiently. Besides, this scheme is based on identity-based cryptography, which eliminates the complicated certificate management in traditional PKI systems, including certificate generation, certificate revocation, certificate renewal, etc. The correctness and the security of the proposed scheme is proved by concrete analysis.

Architecture

ARCHITECTURE DIAGRAM