Upload
others
View
3
Download
0
Embed Size (px)
Citation preview
IMPROVING SECURITY AND EFFICIENCY IN
ATTRIBUTE BASED DATA SHARING
NURUL SYAFIQAH BINTI JOHARI
BACHELOR OF COMPUTER SCIENCE
(NETWORK SECURITY)
UNIVERSITI SULTAN ZAINAL ABIDIN
2017
IMPROVING SECURITY AND EFFICIENCY IN ATTRIBUTE BASED DATA
SHARING
NURUL SYAFIQAH BINTI JOHARI
Bachelor of Computer Science (Network Security)
Faculty of Informatics and Computing
Universiti Sultan Zainal Abidin, Terengganu, Malaysia
MAY 2017
i
DECLARATION
I hereby declare that this report is based on my original work except for quotations
and citations, which have been duly acknowledged. I also declare that it has not been
previously or concurrently submitted for any other degree at Universiti Sultan Zainal
Abidin or other institutions.
________________________________
Name : Nurul Syafiqah Binti Johari
Date : ..................................................
ii
CONFIRMATION
This is to confirm that:
The research conducted and the writing of this report was under my supervisor.
________________________________
Name : Dr Ahmad Nazari Bin Mohd Rose
Date : ..................................................
iii
DEDICATION
Firstly and foremost praised to Allah, the most Merciful for giving bless and
opportunity to undergo the final year project, Improving Security and Efficiency in
Attribute Based Data Sharing. Besides, I would like to express my gratitude to my
supervisor, Dr Ahmad Nazari Bin Mohd Rose for his full support, expert guidance,
ideas, understanding, motivation and encouragement towards research of this project.
I feel so proudly to be supervised by Dr Ahmad Nazari Bin Mohd Rose with his
guidance and invaluable advices.
Next, I would to thank to the Faculty of Informatics and Computing for giving
me an opportunity to discover and explore new things as my final year project. Last
but not least, I would to thank my family, all others lecturers and my fellow friends for
helping me a lot of moral support in order to complete this final year project. I am
very pleasure for their kindness and encouragement that make me able to endure all
the hardship that I have face to complete this project.
iv
ABSTRACT
Nowadays, many people easily sharing data through network and computing
technology using online external storages. The key generation center (KGC) can
decrypt all cipher text addressed to specific users by generating their attribute keys.
This can be a potential threat to the data privacy in the data sharing system. To
overcome this problem, we improve the security in data sharing by attribute-based
encryption (ABE) which is a cryptographic approach that achieves fine-grained data
access control. Then, cipher text-policy attribute-based encryption (CP-ABE) scheme
can encrypt the attribute and secure data sharing system. The advantage of (CP-ABE)
is a major drawback which is known as a key escrow problem that can be solved by
escrow-free key issuing protocol. The key issuing protocol can generate user secret
key by use a secure two-party computation (2PC) protocol between the KGC and data
storing center with their own master secrets. In conclusion, we can more secure and
fine-grained data access control in the data sharing system by using (CP-ABE)
scheme. The data confidentiality can be cryptographically applied against any KGC or
data storing center in the scheme.
.
v
ABSTRAK
Pada masa kini, ramai orang dengan mudah berkongsi data melalui rangkaian
dan teknologi pengkomputeran menggunakan penyimpanan luar talian. “Key
Generation Center” (KGC) boleh menyahsulit semua “cipher text” yang
ditujukan kepada pengguna tertentu dengan menjana kunci atribut mereka. Ini
boleh menjadi satu ancaman kepada privasi data dalam sistem perkongsian data.
Untuk mengatasi masalah ini, kita meningkatkan keselamatan dalam perkongsian
data dengan “Attribute-Based Encrypton” (ABE) yang merupakan pendekatan
kriptografi yang mencapai kawalan akses data halus. Kemudian,“Cipher text
Policy Attribute-Based Encryption” (CP-ABE) boleh menyulitkan sifat dan sistem
perkongsian data yang selamat. Kelebihan (CP-ABE) merupakan kelemahan
utama yang dikenali sebagai masalah escrow utama yang boleh diselesaikan
dengan protokol pengeluaran utama escrow bebas. Protokol pengeluaran utama
boleh menjana pengguna kunci rahsia dengan menggunakan “secure two-party
computation” (2PC) antara KGC dan data menyimpan pusat dengan rahsia tuan
mereka sendiri. Kesimpulannya, kita boleh mengawal akses data lebih selamat
dan halus dalam sistem perkongsian data dengan menggunakan (CP-ABE) skim.
Kerahsiaan data boleh secara kriptografi digunakan terhadap mana-mana KGC
atau data menyimpan pusat dalam skim ini.
vi
CONTENTS
PAGE
DECLARATION i
CONFIRMATION ii
DEDICATION iii
ABSTRACT iv
ABSTRAK v
CONTENTS vi
CHAPTER I INTRODUCTION
1.1 Background 1
1.2 Problem statement 2
1.3 Objectives 2
1.4
1.5
Project Scopes
Limitation of work
3
3
CHAPTER II LITERATURE REVIEW
2.1 Introduction 4
2.2 Overview of Cipher text – Policy Attribute-Based
Encryption
4
2.3 Elements of Cipher text–Policy Attribute-Based
Encryption
5
2.4 RSA Cryptography 5
vii
2.5
2.6
Analysis of Existing Research Paper
2.5.1 Secure Data Sharing and Retrieval Using
Attribute-Based Encryption in Cloud-Based OSN
2.5.2 Cipher text-Policy Attribute Based Data-
Sharing with Enhanced Productivity and Security
2.5.3 A Survey on Attribute-based Encryption
Schemes of Access Control in Cloud
Environments
2.5.4 Applied Attribute-based Encryption Scheme
2.5.5 Cipher text Policy Attribute Based
Encryption Using 2Party Computation Protocol
Data Sharing
Summary
6
6
7
8
9
10
11
CHAPTER III
METHODOLOGY
3.1
3.2
Introduction
Waterfall Model
3.2.1 Requirement Gathering and Analysis
3.2.2 System Design
3.2.3 Implementation
3.2.4 Testing
3.2.5 Deployment of System
3.2.6 Maintenance
12
13-14
3.3 Technique Used 15
3.4 Why RSA Algorithm 16-17
viii
3.5
3.6
3.7
3.8
3.9
How RSA Algorithm works
3.4.1 How to Determine Suitable Value of e, d and
n
Diagram of Integration Data sharing with RSA
Algorithm
Framework of Project
Process Model of Data Sharing
Data Model of Data Sharing
18
19
20
21
22
REFERENCES 23
1
CHAPTER I
INTRODUCTION
1.1 Background
The data sharing model in distributed system such as online network have been
increasing request for distributed data security. The problems that have been arising
are the data by the storage server by outside users could be possible dangers to their
data with using the key generation center (KGC). The KGC is defined the process of
generating keys in cryptography. Furthermore, KGC can decrypt all messages or data
with using their private keys. Thus, KGC is not suitable for data sharing because the
owner want to make their private data that only can available to designated users key.
[6] By using technique Cipher text Policy Attribute-Based Encryption (CP-ABE), the
encrypted data can be kept private even if the storage server is untrusted but our
techniques are secure against conspiracy attacks. The CP-ABE is enabling to encrypt
the attribute set over a universe of attributes that a decrypt to possess in order to
decrypt the cipher text and apply it. [9]
2
1.2 Problem Statement
Security is an important thing in the data sharing. While the data are was sharing on
the network because there are several problem where the data is not secure. The
leakage of data may occur and intruders or attackers will steal or change the data. To
prevent the leakage of the data owner’s from intruders, attackers or unauthorized user;
the data owner should provide access to large amount of consumer while also being
able to efficiently cancel consumers from data access at any time. This project intends
to solve the problem when data sharing occur and to prevent leakage of data happened
through using Cipher text Policy Attribute-Based Encryption technique.
1.3 Objectives
a) To design a system using CP-ABE
b) To implement the encryption technique for data sharing using RSA
algorithm
c) To test and evaluate the successfulness of RSA algorithm in CP-ABE for
data sharing
3
1.4 Project Scope
This project is using JAVA language programming as a platform to develop this
application. A user friendly Graphic User Interface (GUI) will be developed by using
JAVA programming in NetBeans application. This interface will interact with user
throughout the process. The data that want to share will be encrypted by using RSA
algorithm. This project is mainly focused to protect data from other person in the
network by encrypting it and will send it in the social networks. The authorized user
that received the message will send the key request to the data owner. After receiving
the key from sender only the message will be decrypted
1.5 Limitation of Work
This project is about data sharing between two users in Attribute-Based Data Sharing
using CP-ABE technique and RSA algorithm. This project cannot be applied on many
users at the same time. As example, when User 1 want to share data to User 2 they can
use the one public key and one private key at that time. Thus, when came new User 3
they need to request the new public key to share the data.
4
CHAPTER 2
LITERATURE REVIEW
2.1 Introduction
The main objective of this project is to improve the security and efficiency in
attribute-based data sharing. This chapter describes the previous research that related
to on-going project. Furthermore, this chapter also describes the technique or method
to be taken in the implementation of projects. There are similar published studies
concerning about Cipher text-Policy Attribute Based Encryption (CP-ABE) and
Attribute Based Encryption. For this chapter, there are some reference such as journal
article, internet and thesis. However, there are less likely of this study to be related to
secure data sharing using RSA algorithm.
2.2 Overview of Cipher text Policy Attribute-Based Encryption
Cipher text Policy Attribute-Based Encryption is a type of identity-based encryption
that has one public key and master private key used to make more limited private
keys. Moreover, the attributes in the CP-ABE are attached to the user secret key and
access policy is attached to the cipher text. Thus, CP-ABE enables an encryption to
define the attribute set over a universe of attributes that a decryption needs to possess
in order to decrypt the cipher text and enforce it on the contents.[1]
5
2.3 Elements of Cipher text Policy Attribute-Based Encryption
There are four fundamental algorithms to be executed in CP-ABE which are Setup,
Keygen, Encrypt and Decrypt. Firstly, Setup algorithm takes no input other than
implicit security parameter and the output is the public parameters PK and a master
key MK. Secondly, Keygen algorithm. It is takes input as the master key MK and a set
of attributes S as key. Then, it outputs is private key SK. Next, Encrypt (PK, M, A)
takes the public parameters PK as input, M is a message and A is an access structure
over the universe of attributes. Lastly, Decrypt algorithm (PK, CT, SK) is as an
input in the public parameters PK, a CT cipher text which contain an access policy A
and private key for a set S of attributes.[8]
2.4 RSA Cryptography
The RSA Algorithm is named after Ron Rivest, Adi Shamir and Len Adleman that
who designed it in 1977. The RSA is the most widely-used public key cryptography
algorithm in the world. It can be used to encrypt message without need to exchange a
secret key separately. Furthermore, the RSA algorithm can be used for both public key
encryption and digital signatures. The public key cryptography is also known as an
asymmetric cryptography that used two different but it is mathematically linked keys
that contain one public and one private. Moreover, the RSA has provides a method the
confidentiality, integrity, authenticity and non-reputability of data storage. [2]
6
2.5 Analysis of Existing Research Paper
2.5.1 Secure Data Sharing and Retrieval Using Attribute Based Encryption in
Cloud Based OSNs
The outcome of this project is to allow data owners to outsource encrypted data to the
OSNs (Online Social Networks) service provider for sharing and enables data
disseminators to disseminate the data owner’s by converting new access policy that
based on using Cipher text Policy Attribute-Based Encryption (CP-ABE).
Furthermore, the most access control in OSNs is achieved by requiring the users to
manually maintain the Access Control List (ACL) which is inflexible and coarse-
grained. This means the users can only choose that either publish their data to all users
or grant authorities merely to their approved friends by manually maintaining ACL.
Based on Attribute-Based Encryption (ABE), the users can get a set of
attributes and the data owner can encrypt data with access policy. This will protect
data from unauthorized users or malicious OSNs service provider. Data security is
very important when sharing data thus the solution is encrypt data before sending it to
OSNs service provider. Then, users in OSNs can share their private data based on
Proxy re-encryption (PRE).[3]
7
2.5.2 Cipher text-Policy Attribute based Data Sharing with Enhanced
Productivity and Security
Attribute Based Encryption (ABE) is a technique that is suitable for storing data with
encryption. In this paper, the main objective is to improve the security data integrity.
The benefits of using ABE are reduces the communicational overhead of the Internet.
Furthermore, it is a fine grained access control. Thus, the major drawback is the Key
Escrow problem that’s means that can resolved by escrow free key issuing protocol
which is constructed by using the secure two-party computation between the data
centre and key generation centre. The proposed system in this project for system data
becomes more secure when applied CP-ABE in data sharing system.
Furthermore, in CP-ABE for users Key Generation Centre (KGC) will
generates private keys by applying the KGC’s master secret keys to users
corresponding set of attributes. The benefits are it is much secured data transfer with
advanced encryption technique so that other person cannot decrypt it easily. Then, the
receiver can send multiple key requests to the data owner for the single data.[1]
8
2.5.3 A Survey on Attribute-based Encryption Schemes of Access Control in
Cloud Environments
In Attribute-based Encryption schemes, the attributes play a very important role. The
attribute is to generate a public key for encrypting data and used as an access policy to
control user’s access. The access policy can be categorized as either key-policy or
cipher text-policy. The advantages of ABE schemes are to reduce the communication
overhead the Internet and also to provide a fine-grained access control. In this project,
the authors had survey a basic attribute-based encryption scheme, two various access
policy attribute based encryption-based encryption schemes and two various access
structures that are analyzed for cloud environments. Firstly, the Key-Policy Attribute-
based Encryption (KP-ABE) is proposed by Goyal in 2006.
This scheme uses as set attributes to describe the encrypted data and builds an
access policy in user’s private key. Secondly, the Cipher text-policy Attribute-Based
Encryption scheme by Bethencourt et al. in 2007 and the access policy in the
encrypted data cipher text. The access control method is same as key-policy
attributed-based encryption. In KP-ABE, the access policy is in user’s private key
while the access policy is switched to the encrypted data in CP-ABE. Thus, a set of
descriptive attributes are related with the user private key and the access policy is built
in the encrypted data. [7]
9
2.5.4 Applied Attribute-based Data Encryption Schemes
The schemes of Attribute-based Encryption (ABE) became most popular including
cipher text-policy and key-policy ABE. This article gives an overview about the
existing implementations and elaborates on value in specific cloud computing and IoT
application situations. There are many existing of cryptographic schemes that depend
on the idea of a secret key which is a private key within symmetric or asymmetric
cryptography. ABE is an asymmetric encryption schemes that means keys come in
pairs such as one key encrypts and the other one is decrypt. It is also called as public
key that use different keys for encryption and decryption.
The important characteristic of ABE is the prevention of collusion attacks.
There are two main options of ABE. Firstly, Cipher text-Policy ABE (CP-ABE) that is
Boolean formula is saved in the cipher text. The attributes that are needed is to satisfy
policies are saved in a private key. Secondly, Key-Policy ABE (KP-ABE) which is the
private keys that holds the formula and the cipher text saves attributes. In the IoT
world, securing the data transfer is sometimes difficult. By applying ABE schemes, it
will prove the security can be increase and have advantages such as grouping sensors
that share a certain characteristics and can apply attributes to them for end-to-end
encryption method are achievable. [6]
10
2.5.5 Cipher text Policy Attribute Based Encryption Using 2 Party
Computation Protocol in Data Sharing
Data sharing in distributed system such as in online social network that demands for
distributed data security. In this paper, it is proposed a Cipher text Policy Attribute
Based Encryption (CP-ABE) scheme for overcoming the key escrow problem by
solved it with using the secure two-party computation protocol between key
generation centre and data storing centre. Furthermore, the performance and security
analyses show that this scheme is efficient to securely manage the data distributed in
the data sharing system. The CP-ABE scheme is the most powerful cryptographic
solution to the issue of updates access policy in a distributed data sharing system.
In this paper, the author had proposed a 2 Party Computation Protocol that are
completely removes the problem of key escrow. The key escrow was removed by 2
PC Protocol that are establishes two secret key components where is one from the
KGC SK and another is from the data storing centre SK. [5]
11
2.6 Summary
In a nutshell, the security for data sharing is very important to secure our data from
being stolen from unauthorized user. A scheme to achieve more secure and fine
grained data access control in the data sharing system, it is should to demonstrate the
efficient and scalable to securely manage user data in the data sharing system.[4]
12
CHAPTER 3
METHODOLOGY
3.1 Introduction
This chapter reports the model development of a comprehensive framework taken in a
development system, application or implementation of study. The waterfall model has
been used in this project because it is simple, suitable and easy to understand and use.
In a waterfall model, each phase must be fully completed before the next phase can
begin. This model phase does not overlap.
Figure 1: Waterfall Model
Requirement gathering
and analysis
System design
Implementation
Testing
Deployment of System
Maintenance
13
3.2 Waterfall Model
This project used a sequential order and move to next step of development and testing
if the previous steps is successfully which a waterfall model is shown in Figure 1. The
waterfall model concept carried out in downward mechanism like water falls towards
down. In waterfall model, when the first step is complete and next step has to start in
development process. Thus, the waterfall model cannot revert back to the previous
step to perform any change.
3.2.1 Requirement Gathering and Analysis
In this phase, detailed requirement of the system to be developed are gathered.
Then, analysed all the gather requirements whether the requirements are valid
or invalid.
3.2.2 System Design
In this phase, all the system design is analysed and specified such as system
configuration and architecture of the system. Furthermore, it is contain
framework and use case diagram.
3.2.3 Implementation
In this phase, all the development works are achieved and development
components are handed over to testing team.
3.2.4 Testing
For testing phase, the testing team will test each component and make sure the
developed components are working as expected. All the testing activities are
performed in this phase.
14
3.2.5 Deployment of System
Once the testing phase is completed and make sure there is no any kind of
issue, then the project is ready to be deployed. Once the product is deployed to
production the end users can start using the product.
3.2.6 Maintenance
For keep the maintenance in a good condition, we must always keep eye on the
product and provide all the necessary issues fix if occurs in production and get
report by end users.
.
15
3.3 Technique Used
In this project, tools that have been used are latest NetBeans application to
develop data sharing system using JAVA programming language. Furthermore, RSA
algorithm is improved and integrate with the system that have been developed to make
encryption and decryption process. RSA is an asymmetric cryptographic algorithm
that means have two different keys. The asymmetric algorithms use different keys for
encryption and decryption. Thus, it is important because they can used for transmitting
encryption keys or other data securely even when the parties have no opportunity to
agree on a secret key in private. The most important, RSA implements a public-key
cryptosystem.
Moreover, Cipher text Policy Attribute-Based Encryption much more flexible
than plain identity-based encryption, it is allows complex rules specifying which
private keys can decrypt which is cipher texts. Specifically, the private keys are
associated with sets of attributes or labels, and when encrypt an access policy which
specifies which keys will be able to decrypt.
16
3.4 Why RSA algorithms:
RSA stands for Ron Rivest, Adi Shamir and Len Adleman, who first publicly
described it in 1977. In this project, using RSA algorithm to encrypt the data to
provide security so that only the concerned user can access it. By securing the data,
we are not allowing unauthorized access to it. User data is encrypted first and then it is
stored in the cloud. When it is required, user places a request for the data for the cloud
provider. Then, cloud provider will authenticate the user and delivers the data.
Furthermore, RSA is a block cipher in which every message is mapped to an integer.
RSA consists of public key and private key. [5]
In cloud environment, public key is recognized to all, whereas private key is
recognized only to the user who originally has the data. Thus, encryption is done by
the cloud service provider and decryption is done by the cloud user. Once the data is
encrypted with the public key, it can be decrypted with the private key only.
Moreover, the RSA algorithm has involves three operation where are key generation,
encryption and decryption. [10]
1) Key Generation
- The key generation algorithm takes the master key MK and a set of attributes
S that describe the key as input. It delivers a private key SK as the output.
2) Encryption
- The encryption algorithm consumes the public parameters PK, a message
M, and an access structure A as input. The algorithm will encrypt M and
produce a cipher text CT such that only a user that keeps a set of attributes
that fulfills the access structure will be able to decrypt the message.
3) Decryption
- The decryption algorithm takes the public parameters PK, a cipher text CT,
and a private key SK, as input. Then, the algorithm will decrypt the cipher
text and return a message M as output.
17
Key Generation
Select p, q p , q both prime, p ≠ q
Calculate n = p x q
Calculate ɸ (n) = (p-1) x (q-1)
Select integer e gcd (ɸ(n),e) = 1; 1 < e < ɸ (n)
Calculate d
Public key KU = {e , n}
Private key KR = {d , n}
Encryption
Plaintext : M < n
Cipher text : C = Me (mod n)
Decryption
Cipher text : C
Plaintext : M = Cd (mod n)
Table 1 : Operation of RSA Algorithm
18
3.5 How RSA Algorithm works
RSA is one of the first applied public-key cryptosystems and is widely used for secure
data transmission. In a cryptosystem, the encryption key is public and varies from the
decryption key which is kept secret. The RSA algorithm take advantage of on the fact
that there is no efficient way to factor very large (100-200 digit) numbers.
Using an encryption key (e, n), the algorithm is as follows:
1. Represent the message as an integer between 0 and (n-1). Large messages can
be broken up into a number of blocks. Each block would then be represented
by an integer in the same range.
2. Encrypt the message by raising it to the eth
power modulo n. The result is a
cipher text message C.
3. To decrypt cipher text message C, raise it to another power d modulo n
The encryption key (e, n) is made public. The decryption key (d, n) is kept private by
the user.
3.5.1 How to Determine Suitable Values for e, d, and n
1. Choose two very large (100+ digit) prime numbers. Denote these numbers
as p and q.
2. Set n equal to p * q.
3. Choose any large integer, d, such that GCD(d, ((p-1) * (q-1))) = 1
4. Find e such that e * d = 1 (mod ((p-1) * (q-1)))
19
3.6 Diagram of Integration Data Sharing with RSA Algorithm
Figure 2: Integration of Data Sharing of RSA
20
3.7 Framework of project
Figure 3: Framework
Data
Attribute
Encryption using
RSA algorithm
Cipher text
Encrypted
Attribute
Encrypted
Attribute
Access
Structure
Encryption
Cipher text
Decrypt using
RSA algorithm
Attribute
Verification
Plaintext
USER 1
USER 2
21
3.8 Process Model of Data Sharing
Figure 4: Use Case Diagram
Figure 4: Use Case Diagram
Register
Log In
Share Data
Upload
View Data
Encrypt
Decrypt
Download data
Log Out
USER 1 USER 2
22
3.9 Data Model of Data Sharing
Figure 5: Class Diagram
user1
+username
+password
+register ()
+log in ()
+share data ()
+encrypt data ()
+upload data ()
+view data ()
+log out ()
user2
+username
+password
+register ()
+log in ()
+view data ()
+decrypt data ()
+download data ()
+log out ()
23
REFERENCES
[1] K. Patil and V. Chitre, “Ciphertext-Policy Attribute based Data-Sharing with
Enhanced Productivity and Security,” vol. 4, no. 11, pp. 165–169, 2015.
[2] J. Jones, “The RSA algorithm,” ACM Commun. Comput. Algebr., no. June, pp.
1–11, 2008.
[3] Q. Huang, Z. Ma, Y. Yang, J. Fu, and X. Niu, “Secure data sharing and
retrieval using attribute-based encryption in cloud-based OSNs,” Chinese J.
Electron., vol. 23, no. 3, pp. 557–563, 2014.
[4] M. Pratheepa and R. Bharathi, “Improving Security and Efficiency in Attribute
Based Data Sharing,” vol. 3, no. 1, pp. 119–122, 2014.
[5] N. Y. Goshwe, “Data Encryption and Decryption Using RSA Algorithm in a
Network Environment,” vol. 13, no. 7, pp. 9–13, 2013.
[6] Junbeom Hur, "Improving Security and Efficiency in Attribute-Based Data
Sharing," vol. 25, no. 10, 2013.
[7] Cheng-Chi Lee, Pei Shan Chung and Min-Shiang Hwang, "A Survey on
Attribute-based Encryption Schemes of Access Control in Cloud
Environments," vol. 15, no. 4, pp. 231-240, 2013.
[8] John Bethencourt, Amit Sahai and Brent Waters," Ciphertext-Policy Attribute-
Based Encryption,"pp. 321-334, 2007.
[9] K.Gonnade and F.Zama, "Design Secure Sharing Protocol," vol. 4, no. 6, pp.
12449-12452, 2015.
[10] Matthew Pirretti, Pattrick Traynor , Pattrick Mcdaniel and Brent Waters,
"Secure Attribute-Based System," 2006.