‘
‘
February 21, 2017
‘
<'">
0
Data?Security?in?Cloud?Computing
0
Data?Security?in?Cloud?Computing
Description
This?is?a?White?paper.?The?topic?of?the?white?paper?is?the?importance?of?data?security?in?cloud?computing?and
incorporating?encryption?techniques.?Identify?what?techniques?have?been?used?to?establish?data?security?with
main?push?being?how?encryption,?mainly,?the?Advanced?Encryption?Standard?is?the?best.?Attached?are?the
instructions?and?and?article?that?can?be?used?as?a?reference?from?my?school?library.
You may take any of the following approaches:
??a white paper to an internal audience ? written to individuals within an organization you work for or are a part of. The white paper might inform them about a trend in the field and/or to solve a problem in the organization.
??a white paper to an external audience ? written to individuals in a particular industry or field of study, but not an organization you are a part of. The white paper could address a problem you are attempting to solve in the organization or to inform an external audience about a relevant trend.
??a white paper promoting a new product or service to potential customers. This is an example of a white paper to an external audience, but it features different rhetorical considerations than the typical white paper written to an external audience does.
Strategies to Consider:
Please follow these guidelines:
??have a focused topic
??write to an identified audience
o if your white paper is to an internal audience, it might have a fairly narrow audience. For example, if you work in a hair salon and write a white paper promoting a new billing system for your salon, the audience will probably be the owner and manager of the hair salon.
o if your white paper is to an external audience, it could have a broad audience or a narrow audience. For example, if you do not work for a hair salon and you write a white paper promoting a new billing system for hair salons, the audience will probably be the various hair salons in your neighborhood.
o if your white paper is to promote a product or service to potential customers, it could have a fairly broad audience. For example, a white paper promoting a new taxi service in your neighborhood has, theoretically, all residents in the neighborhood as a potential audience.
??integrate thorough research
??make sure that you do not directly tell the audience what action it should take. Rather, offer background information that the audience can use to make a decision. The Purdue
OWL video mentions this principle. This is one reason the video refers to the white paper as a backgrounder report.
Please include the following sections in your white paper:
??Executive Summary
??Introduction
??Previous Approaches
??New Findings
??Conclusion
??References
In the Executive Summary, summarize your research and your purpose. The executive summary should be a stand-alone document. It should be written in such a way that a busy executive could read the executive summary and know exactly what the paper is about without reading the rest of the paper.
In the Introduction, you lay the groundwork for your readers for the details that will be introduced in the white paper. If you need to define any terms, you will do so here. You might share an anecdote or illustration to describe why this topic is important.
In the Previous Approaches section, you will describe the approaches or strategies that have been previously used or are currently used on the topic. For example, if your white paper is being written to advertise a new taxi service in your area, you might review what transportation services are provided now. You could show the challenges or problems that the current services involve.
In this section of the white paper, your use of sources will be very important. You should integrate research to show that the problems you have identified exist.
In the New Findings section, you present perhaps the most important information in the paper. In this section, you will describe the findings of your research and relate these findings to the purpose of your report. You will not only provide data and research, but you will also explain the data and research and why it is relevant to your report?s topic.
For example, if your white paper is being written to advertise a new taxi service in your area, you might review what transportation services are provided now and show why the new taxi service fills a need that the current set of transportation services does not fill or solves a problem that the current set of transportation services does not solve. You will provide data and evidence for why the new taxi service has promise in solving the problems you have identified.
In this section of the white paper, your use of sources will be very important as well. You should integrate research to show that the problems you have identified will be solved by your new approach.
In the Conclusion section, you review what your research shows in light of the previous approaches used. You will not tell the audience what steps to take next. However, you will summarize what your findings articulate.
In the References, you will list your sources that you cited in the paper. You will list them in
APA format. Please note that the lectures on white papers that you have viewed and examples of white papers you may have read may not have used APA format. You will be using APA format in this assignment.
You are required to have at least five sources for your paper. In addition, at least one of them is to have been acquired through UMUC Library OneSearch. Primary sources will be very beneficial for the paper. For example, if your white paper is being written to advertise a new taxi service in your area, you might interview some local residents about the problems they have with the current transportation services in the area. The information in such interviews would be persuasive research to integrate into your white paper.
The following websites and documents offer additional guidance in writing a white paper:
??Chapter 1, “A Primer on White Papers,” by Michael Stelzner
??”The Art of the White Paper,” by Manuel Gordon and Gordon Graham
??”Guidelines for Writing White Papers” from Warthman Associates
Length of your paper:
Your white paper should be 2000-3000 words in length. Again, you are required to use at least five sources, with at least one of them being acquired through UMUC Library OneSearch.
Graphics:
Your white paper should incorporate at least three graphics. Graphic can include tables, charts, or graphs showing some research findings. They can also be images that are relevant to the topic of the white paper.
At least two of the graphics must be original. Original graphics can include photos taken by you; tables, charts, or graphs developed by you; or screen captures showing a function on your computer (not a screen capture of an image off of the web).
? copyright FACULTY of ENGINEERING?-?HUNEDOARA, ROMANIA 29
1. Sugata SANYAL, 2. Parthasarathy P. IYER
CLOUD COMPUTING ? AN APPROACH WITH MODERN
CRYPTOGRAPHY
1. CORPORATE TECHNOLOGY OFFICE, TATA CONSULTANCY SERVICES, MUMBAI, INDIA
2. SELF-INVENTIONS-R&D, MUMBAI, INDIA
ABSTRACT: In this paper we are proposing an algorithm which uses AES technique of 128/192/256 bit cipher key in encryption and decryption of data. AES provides high security as compared to other encryption techniques along with RSA. Cloud computing provides the customer with the requested services. It refers to applications and services that run on distributed network using virtualized
resources and accessed by common IP and network standard. While providing data services it is
becoming important to provide security for data. In cloud computing keeping data secure is an important issue to be focused. Even though AES was designed for military purposes, now a days it is been commercially adopted worldwide as it can encrypt most confidential document, as well as it can
work in most restricted areas, and offers good defense against various attack techniques, and security level to protect data for next 2-3 decades.
KEYWORDS: Cryptography, AES, RSA, Cryptography for Cloud, CSP, Berkeley Solution
INTRODUCTION
There are some general key mechanisms for protecting data: access control, auditing,
authentication, authorization etc. In addition with this, cloud demands encryption process. The goal
of encrypted storage in cloud is to create a virtual private storage system that maintains
confidentiality and data integrity while maintaining the benefits of cloud storage. In the following
sections we will see the AES method used for encryption [1].Cloud providers need to safeguard the
privacy and security of personal data that they hold on behalf of organizations and users. In this paper
we have assessed some of the key issues involved, and set out the basis of some approaches that we
believe will be a step forward in addressing security issues [2].Cloud providers often have several
powerful servers and resources in order to provide appropriate services for their users but cloud is at
risk similar to other Internet-based technology. These issues which discussed in this paper are the
main reasons that cause many enterprises which have a plane to migrate to cloud prefer using cloud
for less sensitive data and store important data in their own local machines.
TRICKS FOR SECURITY
To advance cloud computing, the community must take proactive measures to ensure security.
The Berkeley paper?s solution is the data encryption. Before storing it at virtual location, encrypt the
data with your own keys and make sure that a vendor is ready for security certifications and external
audits [3],[4].
1. Identity management, access control, reporting of security incidents, personnel and physical layer
management should be evaluated before you select a CSP (Cloud Service Provider). And you should
minimize personal information sent to and stored in the cloud. CSP should maximize the user
control and provide feedback.
2. Organizations need to run applications and data transfer in their own private cloud and then
transmute it into public cloud. While there are many legal issues exist in the cloud computing,
Cloud Security Alliance should design relevant standards as quickly as possible.
3. Open Security Architecture (OSA) provides free frameworks that are easily integrated in
applications, for the security architecture community. Its patterns are based on schematics that
show the information traffic flow for particular implementation as well as policies implemented
at each step for security reasons.
4. One thing to keep in mind are contract policies between clients and vendors, so that data belongs
only to the client at all times, preventing third parties to be involved at any point. Also,
authentication should be backed by several methods like password plus flash card, or password
plus finger print, or some combination of external hardware and password.
ANNALS OF FACULTY ENGINEERING HUNEDOARA ? International Journal Of Engineering
Tome XI (Year 2013). Fascicule 3. ISSN 1584 ? 2673 30
5. For access Control, Security Assertion Markup Language (SAML) has been around for over 6 years
now and is an excellent way of providing a Single Sign On solution across the enterprise firewall
[5].
6. Examine your service level agreement. Ask your cloud computing vendor the tough questions:
what roles and responsibilities will be theirs alone? How do they verify the safety of their
systems? What immediate steps will be taken if there is a security breach?
7. Hire a third-party to complete an independent IT audit to identify your cloud computing
weaknesses. An auditing firm should conduct interviews, observe and inspect processes and run
penetration testing. The firm conducting the IT audit should have no stake one way or the other in
the outcome.
CRYPTOGRAPHY FOR CLOUD
This standard specifies the Rijndael algorithm, a symmetric block cipher that can process data
blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits. Rijndael was designed to
handle additional block sizes and key lengths and however they are not adopted in this standard.
Throughout the remainder of this standard, the algorithm specified herein will be referred to as ?the
AES algorithm.? The algorithm may be used with the three different key lengths indicated above, and
therefore these different ?flavors? may be referred to as ?AES-128?, ?AES-192?, and ?AES-256?[6][7].
AES algorithm uses a round function that is composed of four different byte-oriented transformations:
1) byte substitution using a substitution table (S-box),
2) shifting rows of the State array by different offsets,
3) mixing the data within each column of the State array, and
4) adding a Round Key to the State.
In AES the main architecture is centrally controlled by both hardware and software. Decryption
of this system is depending upon the designing rule which is called Substitution Permutation
Networking. Advanced Encryption standard has standard blocks with fixed length of 128 bits and their
allowed key size is 128,192 or it can be 256 bits, new research has evolved that multiple key size can
be allocated to the block it could be 32 bits with the least capacity of 128 bits and its key size may be
extended no fixed length is announced. Its operations are based on the 4X4 matrix of the bytes with
finite field calculations especially designed for the purpose of calculations. AES specifies the
repetition numbers for converting the input to the normal readable text. An input provided by the
user undergoes several steps of processing according to the encryption key provided.
These steps are categorized as rounds and for converting the text back to the encrypted form
same rounds are repeated with the same key which was used for decryption [8]. Numbers of
repetitions are decided on the nature and level of the algorithm used as the base of system. Rounds
are depending on the schedule of the algorithm provided by the Rijindael?s key Page Style.
ESSENCE OF CRYPTOGRAPHY AND MODEL
AES Process:
Again, we start by looking at the overall structure of the AES cipher. In the case of AES, the
block size is 128 bits and the key size can be 128, 192 or 256 bits. The original Rijndael specification
also supported several block sizes, but in the AES standard itself only 128 bits blocks are defined.
Just like with DES, the cipher consists of a basic operation called round which is repeated a
number of times. In this case, AES is based in a design principle called Substitution-Permutation
Networks which means that the cipher is composed of a series of substitutions and permutations one
after each other [9][10].
The number of rounds (R) in AES depends on the key length: 10 rounds for 128, 12 rounds for 192
and 14 rounds for 256 bits. AES works on a structure known as the AES state, which is simply an
arrangement of the block in a 4×4 matrix. Furthermore, most AES operations can be described as
operations in the GF (28) finite field. This gives AES a quite neat algebraic description.
However, they can also be seen as byte operations, and we’ll look at it mainly as a byte
operation, since we don’t really want to get into math here. But if you really want to get deep into
crypto, then you will certainly need to learn about finite fields [11]. They get more important in
public key crypto, where we actually use difficult mathematical problems to protect our data.
The basic building blocks of the AES cipher are as follows:
? Sub Bytes – A non-linear substitution, the AES S-boxes
? Shift Rows – Shifts the rows of the AES state
? Mix Column – Mixes columns of the AES state, making each result cell a combination of other
cells
? Add Round Key – Mixes the input AES state with the current round key
As you can see, like in DES we have S-boxes; we have transpositions (Shift Rows), a mixing
operation (Mix Column) and an operation to mix the data and the key.
An AES encryption consists of the following steps:
1. Initial round:
ANNALS OF FACULTY ENGINEERING HUNEDOARA ? International Journal Of Engineering
Tome XI (Year 2013). Fascicule 3. ISSN 1584 ? 2673 31
Add Round Key
2. R-1 rounds:
? Sub Bytes
? Shift Rows
? Mix Columns
? Add Round Key
3. Final round (without Mix Columns):
Sub Bytes
? Shift Rows
? Add Round Key
So, we have an initial Add Round Key step, which mixes input data with the 0th round key.
Then, R-1 (9, 11 or 13) identical rounds take place, and at the end a final round is applied.
SECURITY CONTRIBUTION BY RSA
Clouds provide on-demand access to computing utilities, an abstraction of unlimited computing
resources, and support for on-demand scale up, scale down and scale out. In this talk I will cover the
?why?, ?what? and ?how? of Cloud computing and explore the landscape of cloud services [12],[13].
Cloud computing allows consumers and businesses to use applications without installation and access
their personal files at any computer with internet access. The RSA an algorithm is provides the high
security in high potential data encryption methodology; the clouds are working to maintain the
situation of the security and handover the position. Cloud computing is a comprehensive solution that
delivers IT as a service. It is an Internet-based computing solution where shared resources are
provided like electricity distributed on the electrical grid. Computers in the cloud are configured to
work together and the various applications use the collective computing power as if they are running
on a single system [14].
The flexibility of cloud computing is a function of the allocation of resources on demand. In
future work, this technology allows for much more efficient computing by centralizing storage,
memory, processing and bandwidth. RSA algorithm is very help full to increase the performance on
cloud in cloud computing.
AES ALGORITHM PROTOTYPE
Strong encryption technology is a core technology for protecting data in transit to and from the
cloud as well as data stored in the cloud. The main aim of encryption technology is to provide safety,
security to data. In current era Microsoft allows up to five security accounts per client and one can
use these different accounts to create different zones. But available techniques are not enough to
provide security to data in cloud [15] [16]. It is a demand and necessity of the data
owners/providers/users to get high security for data. AES technique comes with 128/192/256 bits
operations. In the previous section the general working of AES is explained. In this section we will see
the proposed model of AES with cloud computing.
Figure 1. Cloud Model with Cryptography
Figure 1 shows the basic model [17] [18]. In this, data sender sends the data to AES model which
applies the process to get the encrypted data which then sent to cloud service provider [19]. Cloud
service provider will send the stored data which is in encrypted format to the requested site. At the
receiver side AES model will decrypt the data.
CONCLUSIONS
To improve the security for the data we can add biometrics features to the proposed algorithm.
Now a day?s depending upon the particular cloud provider, you can create multiple accounts with
different keys. On Amazon Web Service, you can create multiple keys and rotate those keys during
different sessions. In this paper we have proposed AES method for security of data in cloud
computing. AES method can be most safe, trusted technique to provide security to data in clouds
ANNALS OF FACULTY ENGINEERING HUNEDOARA ? International Journal Of Engineering
Tome XI (Year 2013). Fascicule 3. ISSN 1584 ? 2673 32
compared to other available security techniques in cloud computing. AES is used in data transit
operations on Internet. Here we have suggested data storage, transmit, and receive operations using
AES. It can improve data reliability, integrity with cloud-storage. Although encryption protects your
data from unauthorized access, it does nothing to prevent data loss. Indeed, a common means for
losing encrypted data is to lose the keys that provide access to the data. In this paper we have
suggested AES and RSA technique for data security in clouds. Proposed algorithm is under
implementation.
REFERENCES
[1.] K. D. Bowers, A. Juels, and A. Oprea, ?HAIL: A High-Availability and Integrity Layer for Cloud Storage,?
Cryptology ePrint Archive, Report2008/489, 2008, http://eprint.iacr.org/.
[2.] L. Carter and M. Wegman, ?Universal Hash Functions,? Journal of Computer and System Sciences, vol. 18,
no. 2, pp. 143?154, 1979.
[3.] J. Hendricks, G. Ganger, and M. Reiter, ?Verifying Distributed Erasure coded Data,? Proc. 26th ACM
Symposium on Principles of Distributed Computing, pp. 139?146, 2007.
[4.] J. S. Plank and Y. Ding, ?Note: Correction to the 1997 Tutorial on Reed-Solomon Coding,? University of
Tennessee, Tech. Rep. CS-03-504, 2003.
[5.] Q. Wang, K. Ren, W. Lou, and Y. Zhang, ?Dependable and Secure Sensor Data Storage with Dynamic
Integrity Assurance,? Proc. of IEEEINFOCOM, 2009.
[6.] R. Curtmola, O. Khan, R. Burns, and G. Ateniese, ?MR-PDP: Multiple-Replica Provable Data Possession,?
Proc. of ICDCS ?08, pp. 411?420, 2008.
[7.] D. L. G. Filho and P. S. L. M. Barreto, ?Demonstrating Data Possession and Uncheatable Data Transfer,?
Cryptology ePrint Archive, Report2006/150, 2006, http://eprint.iacr.org/.
[8.] M. A. Shah, M. Baker, J. C. Mogul, and R. Swaminathan, ?Auditing to Keep Online Storage Services
Honest,? Proc. 11th USENIX Workshop on Hot Topics in Operating Systems (HOTOS ?07), pp. 1?6, 2007.
[9.] V Goyal, V Kumar, M Singh, A Abraham, S Sanyal, ?A new protocol to counter online dictionary attacks?
Computers &Security 25 (2), 114-120
[10.] V Goyal, V Kumar, M Singh, A Abraham, S Sanyal, ?CompChall: addressing password guessing attacks?
Information Technology: Coding and Computing, 2005. ITCC 2005.
[11.] P Naik, S Sanyal, ?Increasing Security in Cloud Environment? arXiv:1301.0315 [cs.CR], 2013
[12.] Philip Wik, “Thunderclouds: Managing SOA-Cloud Risk”.Service Technology Magazine. 2011- 10,
http://www.servicetechmag.com/I55/1011-1. Retrieved2011-11
[13.] “Cloud Security Front and Center”. Forrester Research.2009-11-18.
http://blogs.forrester.com/srm/2009/11/cloudsecurity-front-and-center.html. Retrieved 2010-01-25.
[14.] Richard Chow, et al., Controlling Data in the Cloud:Outsourcing Computation without Outsourcing
Control,ACM Workshop on Cloud Computing Security, Chicago,Illinois, November 2009,
[15.] Gartner Says Worldwide Cloud Services Market to Surpass$68 Billion in 2010; Forecast: Public Cloud
Services,Worldwide and Regions, Industry Sectors, 2009-2014, GartnerInc.
[16.] J. Daemen and V. Rijmen, AES Proposal: Rijndael, AES Algorithm Submission, September 3, 1999.
[17.] Security scheme for distributed DoS in mobile ad hoc networksS Sanyal, D Gada, R Gogri, P Rathod, Z
Dedhia, N Mody arXiv preprint arXiv: 1005.0109, 2010.
[18.] Cloud Computing Bible by Barrie Sosinsky.Wiley India Pvt.Ltd. ISBN:978-81-265-2980-3
[19.] Fei Wu, Liang Wang, Jiguang Wan ?A low cost and inner-round pipelined design of ECB-AES-256 crypto
engine for Solid State Disk?, 2010 Fifth IEEE International Conference on Networking, Architecture, and
Storage.
ANNALS of Faculty Engineering Hunedoara
? International Journal of Engineering
copyright ? UNIVERSITY POLITEHNICA TIMISOARA,
FACULTY OF ENGINEERING HUNEDOARA,
5, REVOLUTIEI, 331128, HUNEDOARA, ROMANIA
http://annals.fih.upt.ro
Copyright of Annals of the Faculty of Engineering Hunedoara – International Journal of
Engineering is the property of University Politehnica Timisoara, Faculty of Engineering
Hunedoara and its content may not be copied or emailed to multiple sites or posted to a
listserv without the copyright holder’s express written permission. However, users may print,
download, or email articles for individual use.
Page 1 of 2
Writing White Papers
Forrest Warthman
Warthman Associates
www.warthman.com
The General Approach
In the technology industries, a white paper is typically an overview of a technology, architecture,
product, or issue. It offers companies and industry organizations a standard format with which to
promote their ideas and products. The effectiveness of a white paper depends not only on the relevance
of its subject?certainly the most important factor?but also the format in which it is presented.
Readers have come to expect a somewhat predictable format, one which answers a
progression of commonly asked questions. Adherence to the format allows readers to move rapidly
through the white paper, letting them absorb the message quickly.
The basic progression of questions that a white paper typically answers is:
? What is the problem to be solved?
? What kinds of solutions are available?
? Which solution is best, and why?
For example, a white paper about a product might be organized to answer the following questions
that a potential customer may have:
? What is the customer’s problem, and by what symptoms does it manifest itself?
? What technologies have been tried and are currently available to solve the problem?
? Which technology solves the problem best, and why is it the best choice?
? How is the producer uniquely qualified to implement this technology?
? Which of the producer’s products implements the technology, and to what extent?
? How does the product work, and how is it optimized for this particular problem?
The white paper may go on to discuss prerequisite resources for using the product or how the product
fits into the customer’s work habits, although these topics are often left to separate documents
like product specifications or data sheets.
Guidelines for Effectiveness
Given this general approach, there are several qualities that make it work effectively. All of them
depend on a clear understanding of the target readers. In a word, effectiveness depends on audience
focus. Here are some of the guidelines:
? Put “the bottom line” at the top. Many writers put the conclusion of a paper at the end, but that
is often the least effective location. Most readers start at the beginning; very few continue to the
end. Readers’ attention is greatest at the beginning. That’s the best place to put a summary of
your entire message, including the conclusions you wish the reader to draw. White papers,
unlike books, are scanned or read quickly for content. Other quick-read communications, like
advertisements and newspaper articles, use headlines and paragraph summaries to hold reader
interest. White papers can benefit by the same approach.
? Address customers as if they were investors. Seasoned investors are a discriminating audience.
They judge technologies, products, and ideas on the basis of objective information about market
supply and demand and the track records of the companies or people involved. They respond
to factual information, not unsubstantiated claims or boasting. Getting their attention involves
building trust by stating things that are interesting, relevant, and true. A white paper that
convinces prospective investors is also likely to convince many prospective customers.
Page 2 of 2
? Orient your audience; avoid hidden assumptions. Descriptions written by in-house product
managers, designers, or marketers often contain acronyms and unwritten assumptions
understood only by their close-knit working group. This can result in too-quick a dive into details
that outsiders, even expert outsiders, cannot follow. Before diving into details, describe the
general nature and working environment of your product or technology. Start with the basics: Is
it a piece of hardware or software? Does it reside at your site or mine? Does it require other
resources I should know about? How does it interface with my current product mix and work
habits?
? Be specific; avoid generalities. After providing preliminary orientation, get to the technical heart
of your subject. If your prospective customers are technology experts, don’t try to teach
beginners about your subject. Generalities or repetition of common knowledge drive intelligent
readers away. Instead, describe specific aspects that will ring true with your target audience.
Consumption in the technology industry is lead by intelligent people. They are the ones who buy
effective solutions first and promote them by word-of-mouth (and word-of-email) to the rest of
the community.
? Differentiate your solution from others. It’s one thing to claim your product solves a problem. But
it’s more convincing to describe why it does so best?Why is your solution superior to another
that claims to do the same thing? Intelligent buyers shop the competition. They try to differentiate
between similar choices. Providing the differentiation for them saves them time, one of their
most valuable resources.
? Cite credible, objective third-party evidence. Intelligent readers look for trustworthy evidence to
substantiate claims by self-interested parties. Providing the evidence for them not only saves
them time but also buys you credibility. Finding meaningful testimonials by industry pundits takes
time but is well worth the effort.
? Illustrate objects with pictures. We’ve all learned that a picture is worth a thousand words. But in
fact, only some pictures are this valuable. Pictures are effective when they help audiences
interpret your written message. They are especially good at indicating the names of objects and
the relations between those objects. With names and relations thus identified in pictures, they
can be referred to clearly in the text.
? Use simple, common English; don’t try to coin new words. The world of technology is global.
Many audiences have learned English as a second language, and many native-English
audiences read the language casually, without careful discrimination of words or syntax. They
can be confused by messages that contain complex sentences, new words, or new spins on old
words. Speaking to these audiences effectively requires simple, common English that conveys
the message accurately and unambiguously. That kind of writing carries power?the power to
explain and convince.
The best ingredient for an effective white paper is a great solution to a technical problem. The next
best ingredient is great writing. That’s what Warthm
Previous answers to this question
This is a preview of an assignment submitted on our website by a student. If you need help with this question or any assignment help, click on the order button below and get started. We guarantee authentic, quality, 100% plagiarism free work or your money back.
Get The Answer Data?Security?in?Cloud?Computing
‘
‘
February 21, 2017
‘
<'">
0
Data?Security?in?Cloud?Computing
Description
This?is?a?White?paper.?The?topic?of?the?white?paper?is?the?importance?of?data?security?in?cloud?computing?and
incorporating?encryption?techniques.?Identify?what?techniques?have?been?used?to?establish?data?security?with
main?push?being?how?encryption,?mainly,?the?Advanced?Encryption?Standard?is?the?best.?Attached?are?the
instructions?and?and?article?that?can?be?used?as?a?reference?from?my?school?library.
You may take any of the following approaches:
??a white paper to an internal audience ? written to individuals within an organization you work for or are a part of. The white paper might inform them about a trend in the field and/or to solve a problem in the organization.
??a white paper to an external audience ? written to individuals in a particular industry or field of study, but not an organization you are a part of. The white paper could address a problem you are attempting to solve in the organization or to inform an external audience about a relevant trend.
??a white paper promoting a new product or service to potential customers. This is an example of a white paper to an external audience, but it features different rhetorical considerations than the typical white paper written to an external audience does.
Strategies to Consider:
Please follow these guidelines:
??have a focused topic
??write to an identified audience
o if your white paper is to an internal audience, it might have a fairly narrow audience. For example, if you work in a hair salon and write a white paper promoting a new billing system for your salon, the audience will probably be the owner and manager of the hair salon.
o if your white paper is to an external audience, it could have a broad audience or a narrow audience. For example, if you do not work for a hair salon and you write a white paper promoting a new billing system for hair salons, the audience will probably be the various hair salons in your neighborhood.
o if your white paper is to promote a product or service to potential customers, it could have a fairly broad audience. For example, a white paper promoting a new taxi service in your neighborhood has, theoretically, all residents in the neighborhood as a potential audience.
??integrate thorough research
??make sure that you do not directly tell the audience what action it should take. Rather, offer background information that the audience can use to make a decision. The Purdue
OWL video mentions this principle. This is one reason the video refers to the white paper as a backgrounder report.
Please include the following sections in your white paper:
??Executive Summary
??Introduction
??Previous Approaches
??New Findings
??Conclusion
??References
In the Executive Summary, summarize your research and your purpose. The executive summary should be a stand-alone document. It should be written in such a way that a busy executive could read the executive summary and know exactly what the paper is about without reading the rest of the paper.
In the Introduction, you lay the groundwork for your readers for the details that will be introduced in the white paper. If you need to define any terms, you will do so here. You might share an anecdote or illustration to describe why this topic is important.
In the Previous Approaches section, you will describe the approaches or strategies that have been previously used or are currently used on the topic. For example, if your white paper is being written to advertise a new taxi service in your area, you might review what transportation services are provided now. You could show the challenges or problems that the current services involve.
In this section of the white paper, your use of sources will be very important. You should integrate research to show that the problems you have identified exist.
In the New Findings section, you present perhaps the most important information in the paper. In this section, you will describe the findings of your research and relate these findings to the purpose of your report. You will not only provide data and research, but you will also explain the data and research and why it is relevant to your report?s topic.
For example, if your white paper is being written to advertise a new taxi service in your area, you might review what transportation services are provided now and show why the new taxi service fills a need that the current set of transportation services does not fill or solves a problem that the current set of transportation services does not solve. You will provide data and evidence for why the new taxi service has promise in solving the problems you have identified.
In this section of the white paper, your use of sources will be very important as well. You should integrate research to show that the problems you have identified will be solved by your new approach.
In the Conclusion section, you review what your research shows in light of the previous approaches used. You will not tell the audience what steps to take next. However, you will summarize what your findings articulate.
In the References, you will list your sources that you cited in the paper. You will list them in
APA format. Please note that the lectures on white papers that you have viewed and examples of white papers you may have read may not have used APA format. You will be using APA format in this assignment.
You are required to have at least five sources for your paper. In addition, at least one of them is to have been acquired through UMUC Library OneSearch. Primary sources will be very beneficial for the paper. For example, if your white paper is being written to advertise a new taxi service in your area, you might interview some local residents about the problems they have with the current transportation services in the area. The information in such interviews would be persuasive research to integrate into your white paper.
The following websites and documents offer additional guidance in writing a white paper:
??Chapter 1, “A Primer on White Papers,” by Michael Stelzner
??”The Art of the White Paper,” by Manuel Gordon and Gordon Graham
??”Guidelines for Writing White Papers” from Warthman Associates
Length of your paper:
Your white paper should be 2000-3000 words in length. Again, you are required to use at least five sources, with at least one of them being acquired through UMUC Library OneSearch.
Graphics:
Your white paper should incorporate at least three graphics. Graphic can include tables, charts, or graphs showing some research findings. They can also be images that are relevant to the topic of the white paper.
At least two of the graphics must be original. Original graphics can include photos taken by you; tables, charts, or graphs developed by you; or screen captures showing a function on your computer (not a screen capture of an image off of the web).
? copyright FACULTY of ENGINEERING?-?HUNEDOARA, ROMANIA 29
1. Sugata SANYAL, 2. Parthasarathy P. IYER
CLOUD COMPUTING ? AN APPROACH WITH MODERN
CRYPTOGRAPHY
1. CORPORATE TECHNOLOGY OFFICE, TATA CONSULTANCY SERVICES, MUMBAI, INDIA
2. SELF-INVENTIONS-R&D, MUMBAI, INDIA
ABSTRACT: In this paper we are proposing an algorithm which uses AES technique of 128/192/256 bit cipher key in encryption and decryption of data. AES provides high security as compared to other encryption techniques along with RSA. Cloud computing provides the customer with the requested services. It refers to applications and services that run on distributed network using virtualized
resources and accessed by common IP and network standard. While providing data services it is
becoming important to provide security for data. In cloud computing keeping data secure is an important issue to be focused. Even though AES was designed for military purposes, now a days it is been commercially adopted worldwide as it can encrypt most confidential document, as well as it can
work in most restricted areas, and offers good defense against various attack techniques, and security level to protect data for next 2-3 decades.
KEYWORDS: Cryptography, AES, RSA, Cryptography for Cloud, CSP, Berkeley Solution
INTRODUCTION
There are some general key mechanisms for protecting data: access control, auditing,
authentication, authorization etc. In addition with this, cloud demands encryption process. The goal
of encrypted storage in cloud is to create a virtual private storage system that maintains
confidentiality and data integrity while maintaining the benefits of cloud storage. In the following
sections we will see the AES method used for encryption [1].Cloud providers need to safeguard the
privacy and security of personal data that they hold on behalf of organizations and users. In this paper
we have assessed some of the key issues involved, and set out the basis of some approaches that we
believe will be a step forward in addressing security issues [2].Cloud providers often have several
powerful servers and resources in order to provide appropriate services for their users but cloud is at
risk similar to other Internet-based technology. These issues which discussed in this paper are the
main reasons that cause many enterprises which have a plane to migrate to cloud prefer using cloud
for less sensitive data and store important data in their own local machines.
TRICKS FOR SECURITY
To advance cloud computing, the community must take proactive measures to ensure security.
The Berkeley paper?s solution is the data encryption. Before storing it at virtual location, encrypt the
data with your own keys and make sure that a vendor is ready for security certifications and external
audits [3],[4].
1. Identity management, access control, reporting of security incidents, personnel and physical layer
management should be evaluated before you select a CSP (Cloud Service Provider). And you should
minimize personal information sent to and stored in the cloud. CSP should maximize the user
control and provide feedback.
2. Organizations need to run applications and data transfer in their own private cloud and then
transmute it into public cloud. While there are many legal issues exist in the cloud computing,
Cloud Security Alliance should design relevant standards as quickly as possible.
3. Open Security Architecture (OSA) provides free frameworks that are easily integrated in
applications, for the security architecture community. Its patterns are based on schematics that
show the information traffic flow for particular implementation as well as policies implemented
at each step for security reasons.
4. One thing to keep in mind are contract policies between clients and vendors, so that data belongs
only to the client at all times, preventing third parties to be involved at any point. Also,
authentication should be backed by several methods like password plus flash card, or password
plus finger print, or some combination of external hardware and password.
ANNALS OF FACULTY ENGINEERING HUNEDOARA ? International Journal Of Engineering
Tome XI (Year 2013). Fascicule 3. ISSN 1584 ? 2673 30
5. For access Control, Security Assertion Markup Language (SAML) has been around for over 6 years
now and is an excellent way of providing a Single Sign On solution across the enterprise firewall
[5].
6. Examine your service level agreement. Ask your cloud computing vendor the tough questions:
what roles and responsibilities will be theirs alone? How do they verify the safety of their
systems? What immediate steps will be taken if there is a security breach?
7. Hire a third-party to complete an independent IT audit to identify your cloud computing
weaknesses. An auditing firm should conduct interviews, observe and inspect processes and run
penetration testing. The firm conducting the IT audit should have no stake one way or the other in
the outcome.
CRYPTOGRAPHY FOR CLOUD
This standard specifies the Rijndael algorithm, a symmetric block cipher that can process data
blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits. Rijndael was designed to
handle additional block sizes and key lengths and however they are not adopted in this standard.
Throughout the remainder of this standard, the algorithm specified herein will be referred to as ?the
AES algorithm.? The algorithm may be used with the three different key lengths indicated above, and
therefore these different ?flavors? may be referred to as ?AES-128?, ?AES-192?, and ?AES-256?[6][7].
AES algorithm uses a round function that is composed of four different byte-oriented transformations:
1) byte substitution using a substitution table (S-box),
2) shifting rows of the State array by different offsets,
3) mixing the data within each column of the State array, and
4) adding a Round Key to the State.
In AES the main architecture is centrally controlled by both hardware and software. Decryption
of this system is depending upon the designing rule which is called Substitution Permutation
Networking. Advanced Encryption standard has standard blocks with fixed length of 128 bits and their
allowed key size is 128,192 or it can be 256 bits, new research has evolved that multiple key size can
be allocated to the block it could be 32 bits with the least capacity of 128 bits and its key size may be
extended no fixed length is announced. Its operations are based on the 4X4 matrix of the bytes with
finite field calculations especially designed for the purpose of calculations. AES specifies the
repetition numbers for converting the input to the normal readable text. An input provided by the
user undergoes several steps of processing according to the encryption key provided.
These steps are categorized as rounds and for converting the text back to the encrypted form
same rounds are repeated with the same key which was used for decryption [8]. Numbers of
repetitions are decided on the nature and level of the algorithm used as the base of system. Rounds
are depending on the schedule of the algorithm provided by the Rijindael?s key Page Style.
ESSENCE OF CRYPTOGRAPHY AND MODEL
AES Process:
Again, we start by looking at the overall structure of the AES cipher. In the case of AES, the
block size is 128 bits and the key size can be 128, 192 or 256 bits. The original Rijndael specification
also supported several block sizes, but in the AES standard itself only 128 bits blocks are defined.
Just like with DES, the cipher consists of a basic operation called round which is repeated a
number of times. In this case, AES is based in a design principle called Substitution-Permutation
Networks which means that the cipher is composed of a series of substitutions and permutations one
after each other [9][10].
The number of rounds (R) in AES depends on the key length: 10 rounds for 128, 12 rounds for 192
and 14 rounds for 256 bits. AES works on a structure known as the AES state, which is simply an
arrangement of the block in a 4×4 matrix. Furthermore, most AES operations can be described as
operations in the GF (28) finite field. This gives AES a quite neat algebraic description.
However, they can also be seen as byte operations, and we’ll look at it mainly as a byte
operation, since we don’t really want to get into math here. But if you really want to get deep into
crypto, then you will certainly need to learn about finite fields [11]. They get more important in
public key crypto, where we actually use difficult mathematical problems to protect our data.
The basic building blocks of the AES cipher are as follows:
? Sub Bytes – A non-linear substitution, the AES S-boxes
? Shift Rows – Shifts the rows of the AES state
? Mix Column – Mixes columns of the AES state, making each result cell a combination of other
cells
? Add Round Key – Mixes the input AES state with the current round key
As you can see, like in DES we have S-boxes; we have transpositions (Shift Rows), a mixing
operation (Mix Column) and an operation to mix the data and the key.
An AES encryption consists of the following steps:
1. Initial round:
ANNALS OF FACULTY ENGINEERING HUNEDOARA ? International Journal Of Engineering
Tome XI (Year 2013). Fascicule 3. ISSN 1584 ? 2673 31
Add Round Key
2. R-1 rounds:
? Sub Bytes
? Shift Rows
? Mix Columns
? Add Round Key
3. Final round (without Mix Columns):
Sub Bytes
? Shift Rows
? Add Round Key
So, we have an initial Add Round Key step, which mixes input data with the 0th round key.
Then, R-1 (9, 11 or 13) identical rounds take place, and at the end a final round is applied.
SECURITY CONTRIBUTION BY RSA
Clouds provide on-demand access to computing utilities, an abstraction of unlimited computing
resources, and support for on-demand scale up, scale down and scale out. In this talk I will cover the
?why?, ?what? and ?how? of Cloud computing and explore the landscape of cloud services [12],[13].
Cloud computing allows consumers and businesses to use applications without installation and access
their personal files at any computer with internet access. The RSA an algorithm is provides the high
security in high potential data encryption methodology; the clouds are working to maintain the
situation of the security and handover the position. Cloud computing is a comprehensive solution that
delivers IT as a service. It is an Internet-based computing solution where shared resources are
provided like electricity distributed on the electrical grid. Computers in the cloud are configured to
work together and the various applications use the collective computing power as if they are running
on a single system [14].
The flexibility of cloud computing is a function of the allocation of resources on demand. In
future work, this technology allows for much more efficient computing by centralizing storage,
memory, processing and bandwidth. RSA algorithm is very help full to increase the performance on
cloud in cloud computing.
AES ALGORITHM PROTOTYPE
Strong encryption technology is a core technology for protecting data in transit to and from the
cloud as well as data stored in the cloud. The main aim of encryption technology is to provide safety,
security to data. In current era Microsoft allows up to five security accounts per client and one can
use these different accounts to create different zones. But available techniques are not enough to
provide security to data in cloud [15] [16]. It is a demand and necessity of the data
owners/providers/users to get high security for data. AES technique comes with 128/192/256 bits
operations. In the previous section the general working of AES is explained. In this section we will see
the proposed model of AES with cloud computing.
Figure 1. Cloud Model with Cryptography
Figure 1 shows the basic model [17] [18]. In this, data sender sends the data to AES model which
applies the process to get the encrypted data which then sent to cloud service provider [19]. Cloud
service provider will send the stored data which is in encrypted format to the requested site. At the
receiver side AES model will decrypt the data.
CONCLUSIONS
To improve the security for the data we can add biometrics features to the proposed algorithm.
Now a day?s depending upon the particular cloud provider, you can create multiple accounts with
different keys. On Amazon Web Service, you can create multiple keys and rotate those keys during
different sessions. In this paper we have proposed AES method for security of data in cloud
computing. AES method can be most safe, trusted technique to provide security to data in clouds
ANNALS OF FACULTY ENGINEERING HUNEDOARA ? International Journal Of Engineering
Tome XI (Year 2013). Fascicule 3. ISSN 1584 ? 2673 32
compared to other available security techniques in cloud computing. AES is used in data transit
operations on Internet. Here we have suggested data storage, transmit, and receive operations using
AES. It can improve data reliability, integrity with cloud-storage. Although encryption protects your
data from unauthorized access, it does nothing to prevent data loss. Indeed, a common means for
losing encrypted data is to lose the keys that provide access to the data. In this paper we have
suggested AES and RSA technique for data security in clouds. Proposed algorithm is under
implementation.
REFERENCES
[1.] K. D. Bowers, A. Juels, and A. Oprea, ?HAIL: A High-Availability and Integrity Layer for Cloud Storage,?
Cryptology ePrint Archive, Report2008/489, 2008, http://eprint.iacr.org/.
[2.] L. Carter and M. Wegman, ?Universal Hash Functions,? Journal of Computer and System Sciences, vol. 18,
no. 2, pp. 143?154, 1979.
[3.] J. Hendricks, G. Ganger, and M. Reiter, ?Verifying Distributed Erasure coded Data,? Proc. 26th ACM
Symposium on Principles of Distributed Computing, pp. 139?146, 2007.
[4.] J. S. Plank and Y. Ding, ?Note: Correction to the 1997 Tutorial on Reed-Solomon Coding,? University of
Tennessee, Tech. Rep. CS-03-504, 2003.
[5.] Q. Wang, K. Ren, W. Lou, and Y. Zhang, ?Dependable and Secure Sensor Data Storage with Dynamic
Integrity Assurance,? Proc. of IEEEINFOCOM, 2009.
[6.] R. Curtmola, O. Khan, R. Burns, and G. Ateniese, ?MR-PDP: Multiple-Replica Provable Data Possession,?
Proc. of ICDCS ?08, pp. 411?420, 2008.
[7.] D. L. G. Filho and P. S. L. M. Barreto, ?Demonstrating Data Possession and Uncheatable Data Transfer,?
Cryptology ePrint Archive, Report2006/150, 2006, http://eprint.iacr.org/.
[8.] M. A. Shah, M. Baker, J. C. Mogul, and R. Swaminathan, ?Auditing to Keep Online Storage Services
Honest,? Proc. 11th USENIX Workshop on Hot Topics in Operating Systems (HOTOS ?07), pp. 1?6, 2007.
[9.] V Goyal, V Kumar, M Singh, A Abraham, S Sanyal, ?A new protocol to counter online dictionary attacks?
Computers &Security 25 (2), 114-120
[10.] V Goyal, V Kumar, M Singh, A Abraham, S Sanyal, ?CompChall: addressing password guessing attacks?
Information Technology: Coding and Computing, 2005. ITCC 2005.
[11.] P Naik, S Sanyal, ?Increasing Security in Cloud Environment? arXiv:1301.0315 [cs.CR], 2013
[12.] Philip Wik, “Thunderclouds: Managing SOA-Cloud Risk”.Service Technology Magazine. 2011- 10,
http://www.servicetechmag.com/I55/1011-1. Retrieved2011-11
[13.] “Cloud Security Front and Center”. Forrester Research.2009-11-18.
http://blogs.forrester.com/srm/2009/11/cloudsecurity-front-and-center.html. Retrieved 2010-01-25.
[14.] Richard Chow, et al., Controlling Data in the Cloud:Outsourcing Computation without Outsourcing
Control,ACM Workshop on Cloud Computing Security, Chicago,Illinois, November 2009,
[15.] Gartner Says Worldwide Cloud Services Market to Surpass$68 Billion in 2010; Forecast: Public Cloud
Services,Worldwide and Regions, Industry Sectors, 2009-2014, GartnerInc.
[16.] J. Daemen and V. Rijmen, AES Proposal: Rijndael, AES Algorithm Submission, September 3, 1999.
[17.] Security scheme for distributed DoS in mobile ad hoc networksS Sanyal, D Gada, R Gogri, P Rathod, Z
Dedhia, N Mody arXiv preprint arXiv: 1005.0109, 2010.
[18.] Cloud Computing Bible by Barrie Sosinsky.Wiley India Pvt.Ltd. ISBN:978-81-265-2980-3
[19.] Fei Wu, Liang Wang, Jiguang Wan ?A low cost and inner-round pipelined design of ECB-AES-256 crypto
engine for Solid State Disk?, 2010 Fifth IEEE International Conference on Networking, Architecture, and
Storage.
ANNALS of Faculty Engineering Hunedoara
? International Journal of Engineering
copyright ? UNIVERSITY POLITEHNICA TIMISOARA,
FACULTY OF ENGINEERING HUNEDOARA,
5, REVOLUTIEI, 331128, HUNEDOARA, ROMANIA
http://annals.fih.upt.ro
Copyright of Annals of the Faculty of Engineering Hunedoara – International Journal of
Engineering is the property of University Politehnica Timisoara, Faculty of Engineering
Hunedoara and its content may not be copied or emailed to multiple sites or posted to a
listserv without the copyright holder’s express written permission. However, users may print,
download, or email articles for individual use.
Page 1 of 2
Writing White Papers
Forrest Warthman
Warthman Associates
www.warthman.com
The General Approach
In the technology industries, a white paper is typically an overview of a technology, architecture,
product, or issue. It offers companies and industry organizations a standard format with which to
promote their ideas and products. The effectiveness of a white paper depends not only on the relevance
of its subject?certainly the most important factor?but also the format in which it is presented.
Readers have come to expect a somewhat predictable format, one which answers a
progression of commonly asked questions. Adherence to the format allows readers to move rapidly
through the white paper, letting them absorb the message quickly.
The basic progression of questions that a white paper typically answers is:
? What is the problem to be solved?
? What kinds of solutions are available?
? Which solution is best, and why?
For example, a white paper about a product might be organized to answer the following questions
that a potential customer may have:
? What is the customer’s problem, and by what symptoms does it manifest itself?
? What technologies have been tried and are currently available to solve the problem?
? Which technology solves the problem best, and why is it the best choice?
? How is the producer uniquely qualified to implement this technology?
? Which of the producer’s products implements the technology, and to what extent?
? How does the product work, and how is it optimized for this particular problem?
The white paper may go on to discuss prerequisite resources for using the product or how the product
fits into the customer’s work habits, although these topics are often left to separate documents
like product specifications or data sheets.
Guidelines for Effectiveness
Given this general approach, there are several qualities that make it work effectively. All of them
depend on a clear understanding of the target readers. In a word, effectiveness depends on audience
focus. Here are some of the guidelines:
? Put “the bottom line” at the top. Many writers put the conclusion of a paper at the end, but that
is often the least effective location. Most readers start at the beginning; very few continue to the
end. Readers’ attention is greatest at the beginning. That’s the best place to put a summary of
your entire message, including the conclusions you wish the reader to draw. White papers,
unlike books, are scanned or read quickly for content. Other quick-read communications, like
advertisements and newspaper articles, use headlines and paragraph summaries to hold reader
interest. White papers can benefit by the same approach.
? Address customers as if they were investors. Seasoned investors are a discriminating audience.
They judge technologies, products, and ideas on the basis of objective information about market
supply and demand and the track records of the companies or people involved. They respond
to factual information, not unsubstantiated claims or boasting. Getting their attention involves
building trust by stating things that are interesting, relevant, and true. A white paper that
convinces prospective investors is also likely to convince many prospective customers.
Page 2 of 2
? Orient your audience; avoid hidden assumptions. Descriptions written by in-house product
managers, designers, or marketers often contain acronyms and unwritten assumptions
understood only by their close-knit working group. This can result in too-quick a dive into details
that outsiders, even expert outsiders, cannot follow. Before diving into details, describe the
general nature and working environment of your product or technology. Start with the basics: Is
it a piece of hardware or software? Does it reside at your site or mine? Does it require other
resources I should know about? How does it interface with my current product mix and work
habits?
? Be specific; avoid generalities. After providing preliminary orientation, get to the technical heart
of your subject. If your prospective customers are technology experts, don’t try to teach
beginners about your subject. Generalities or repetition of common knowledge drive intelligent
readers away. Instead, describe specific aspects that will ring true with your target audience.
Consumption in the technology industry is lead by intelligent people. They are the ones who buy
effective solutions first and promote them by word-of-mouth (and word-of-email) to the rest of
the community.
? Differentiate your solution from others. It’s one thing to claim your product solves a problem. But
it’s more convincing to describe why it does so best?Why is your solution superior to another
that claims to do the same thing? Intelligent buyers shop the competition. They try to differentiate
between similar choices. Providing the differentiation for them saves them time, one of their
most valuable resources.
? Cite credible, objective third-party evidence. Intelligent readers look for trustworthy evidence to
substantiate claims by self-interested parties. Providing the evidence for them not only saves
them time but also buys you credibility. Finding meaningful testimonials by industry pundits takes
time but is well worth the effort.
? Illustrate objects with pictures. We’ve all learned that a picture is worth a thousand words. But in
fact, only some pictures are this valuable. Pictures are effective when they help audiences
interpret your written message. They are especially good at indicating the names of objects and
the relations between those objects. With names and relations thus identified in pictures, they
can be referred to clearly in the text.
? Use simple, common English; don’t try to coin new words. The world of technology is global.
Many audiences have learned English as a second language, and many native-English
audiences read the language casually, without careful discrimination of words or syntax. They
can be confused by messages that contain complex sentences, new words, or new spins on old
words. Speaking to these audiences effectively requires simple, common English that conveys
the message accurately and unambiguously. That kind of writing carries power?the power to
explain and convince.
The best ingredient for an effective white paper is a great solution to a technical problem. The next
best ingredient is great writing. That’s what Warthm
Previous answers to this question
This is a preview of an assignment submitted on our website by a student. If you need help with this question or any assignment help, click on the order button below and get started. We guarantee authentic, quality, 100% plagiarism free work or your money back.
Get The Answer