Access Control In Web Services Using Cipher Computer Science Essay

Published:

This essay has been submitted by a student. This is not an example of the work written by our professional essay writers.

Web services are a software system which is designed to support interoperability over the network is now most widely used web based applications. It enables towards asynchronous and loosely coupled collaboration of cross-domain applications. And as they tend to get wide spread which in turn increases the challenge to maintain access control to protect data. Therefore, now a day more and more data is stored in stored in third party server. But trusting third party servers is difficult. To protect data in web services, many security standards have been proposed. Attribute based encryption (ABE) being one of them was proposed to provide privacy and security. Cipher-text policy Attribute based Encryption (CPABE) uses user's attribute for access control. This project will evaluate the success of Ciphertext policy Attribute based Encryption (CP-ABE) algorithm to implement access control in web services and keeping in mind the overall performance of the system.

This proposal focus on features of CP-ABE that makes it well suited than the traditional encryption algorithms. Performance evaluation will be evaluated. A web service will be designed and CP-ABE algorithm will be used to maintain access control on the data that is encrypted. Performance of the CP-ABE's encryption and decryption techniques will be evaluated using multiple attributes and the results will be compared against system using the existing XML encryption. The advantages of CP-ABE will be highlighted. In this project we will define web service that can use CP-ABE algorithm.

.

Index for Figures

Index for Tables

Chapter 1

Introduction

Introduction

Web services are the most widely used web-based applications. Web services represent a challenge and an opportunity for organizations wishing to expose product and services offerings through the Internet [1]. Ensuring the security of Web services involves augmenting traditional security mechanisms with security frameworks based on use of authentication, authorization, confidentiality, and integrity mechanisms [5]. Many the features that make Web services interesting, includes greater accessibility of data, dynamic application-to-application connections, and relative autonomy are at odds with traditional security models and controls [6]. Ideally, a user with authentic credentials or attributes should be able to access data. But if this trusted server is compromised so will the data in the server, which directly affects the confidentiality of data policy guaranteed by web services. Access control policy specification defined for controlling the access to Web services is then becoming an promising research area due to the rapid development in the web services based applications [1].

This project will focus on using CP-ABE against traditional encryption algorithms. The feasibility and flexibility of using CP-ABE algorithm within web service will be studied. Performance of using this algorithm with web service will be evaluated. A web service will be designed to incorporate CP-ABE algorithm to maintain access- control on the data stored in the data storage. Performance of the CP-ABE's encryption and decryption techniques will be evaluated using multiple attributes. This performance will be compared against the system using XML Encryption. The advantages of using CP-ABE will be discussed.

Background and Definitions

Standard definitions

Public Key: A cryptographic key generated and distributed by key authority and is one of the keys, which is used to encryption. Public key can be exchanged over unsecure network.

Private Key: A cryptographic key generated and distributed by key authority. Private key along with public key is normally used for encryption and decryption system. Private key is normally transmitted over secure network.

Shared Key: A cryptographic key, which is used for encryption as well as for decryption.

Encryption: Conversion of data into cipher-text which when look in its raw form cannot looks gibberish. Public key and private key together are used for encryption.

Plain Text: Text that will be encrypted is known as plaintext.

Cipher-text: Cipher-text is the result of encryption.

Decryption: Conversion of cipher-text to plain text. Recipient's private key is utilized for while decrypting data.

Public Key Encryption

Public key encryption systems consist of two keys normally a public key that is made public and a private key, which is kept secure. Public key is made available to the users publicly and can be used to encrypt data by anyone who desires to send a message to the person that the key belongs to. Public key can be exchanged over unsecure network. Private key also known as secret key is kept secure by the user and is used decryption. In standard public-key cryptography it is necessary to explicitly enumerate all of the users who may decrypt each data item. While it is possible to issue group keys, this creates complex key management issues and several problems still remain. It's a convenient for distributing keys for encryption over unsecure network but it is difficult to specify authenticity of the person with the public key. PKE is slow especially for big data size.

Symmetric Key Encryption

Symmetric key encryption (SKE), normally known as single or shared key encryption system. Same key can be used to encrypt and also decrypt the data. Sender and receiver can share the key that they will use to encrypt data and also as well as decrypt data. Sender and receiver will have to specify the key in the beginning after that they can begin he encryption and decryption process using the same shared_key. That means they have to rely and assume that the medium they use to share the key is a secure network channel. Even though it is simple and fast to implement you have to rely on the secure channel for secure key exchange. And if this shared_key is compromised, data can easily be compromised. As sender and receiver share the same key and it is exchanged over the network, authenticity of key can also be questioned. Generating a new-shared key for every data makes it difficult to manage the keys.

Attribute-based Encryption

Sahai and Waters [3] introduced attribute-based encryption (ABE) as a new approach in the area of access control of encrypted data. Attribute-based encryption provides a solution for defining fine-grained access control system to groups of people. In attribute-based encryption system cipher-texts are not essentially encrypted to one particular user [3]. Instead both senders and receiver's secret keys and cipher texts are linked with a set of attributes or a policy over those attributes. A user can decrypt the cipher text if his private key and the cipher-text are linked. With ABE, a user Alice assigns sets of attributes to other users (we will call these users Alice's contacts) and issues the corresponding secret keys. She encrypts data items using policies expressed in terms of plain attributes that defines what attributes one must have in order to decrypt the piece of data (this variant is called cipher-text-policy ABE; key-policy ABE reverses the process, with attributes assigned to data items and policies to keys). But one of the main drawbacks of the Sahai-Waters threshold ABE model is that the threshold semantics are not very expressive and therefore are limiting for designing more general systems [3].

Web Services

Web service are systems that allows different cross-domain applications to communicate or interact with each other in a way that is does not have to depend on platform or the programming language for it to talk to each other. It is an interface, which is, consists of collection of operations that can be accessed by applications over any network using standardized XML messaging. It uses standard protocols that are normally XML based and is used to describe an operation and it will accept execution of an operation within the web service, or allows data to exchange with another Web service.

The major advantages of Web services are

Interoperability: Web services can interact in a distributed, cross-domain environment and can be also made hardware and software independent.

Accessibility: Different applications can access the service through firewalls with the help of standardized web protocols over the network.

Web services architecture consists of two main components namely Service requester (client) and service provider.

Service Requester

Service requesters are the clients or business entities that require use of provider's service. They exchange messages with service provider.

Service Provider

Service Provider tends to be owner of the service. They provide a platform to host the service. They exchange messages with service requester agents.

The following standards play key roles in Web services:

Universal Description, Discovery and Integration (UDDI):

UDDI is a directory for storing information about web services [7]. UDDI is a directory of web service interfaces described by WSDL [16]. UDDI uses SOAP to communicate, as it is XML based also. UUDI makes it possible to discover the right service. Defining rules to enable to communicate once the preferred business is discovered. Expanding the offerings of the service and extending market reach. UDDI defines a solution for a customer-driven environment that requires organizations to remove barriers, which will hinder growth of the organization in a rapidly growing global Internet economy. UDDI describes a services and its business processes together.

Web Services Description Language (WSDL):

A WSDL document defines services as collections of network endpoints, or ports. [8] In WSDL, we separate the abstract definition of messages and endpoints from their network deployment or data format bindings. This will allow the reuse of definitions that includes messages, as they are the descriptions of the data that is being exchanged, and also port types, which are collections of operations defined. The protocol and data format for a particular port type will create a reusable binding. A port is defined by linking a network address to a reusable binding, and a service is defined by a collection of ports.

SOAP

SOAP is also part of web services standard. The Simple Object Access Protocol (SOAP) provides an XML-based messaging framework to exchange data between peers in a decentralized, distributed environment [9]. SOAP supports communication within web services, and WSDL delivers means to formally describe and define a web service. Standards are defined to describe envelope, which are used to transfer request and response. SOAP comes with a well-defined and standardized WS-Stack, which also makes it a little complex. SOAP provides simple object structure, which allows different applications to call different remote object methods. Application creates a request object in XML, which provides data required by the remote method along with the location of the remote object. 

Example of SOAP message

<env:Envelopexmlns:env="http://www.w3.org/2001/06/soap-envelope" >

 

<env:Body>

 

 

<m:someAction

env:encodingStyle="http://www.w3.org/2001/06/soap-encoding" xmlns:m="http://example.org/2001/06/action">

 

 

 

<resource>someResource</resource>

 

 

</m:someAction>

 

</env:Body>

</env:Envelope>

REST

REST is the web services architecture that simplifies web service access as it makes use of simple HTTP protocol. REST is a lightweight approach to consume resources with no specific encapsulation, thus lacking of meta-data descriptions for security requirements [15]. Unlike web services based on SOAP protocol, which normally depend on standardized security specification model like WS-Security, REST based web services tends to lacks on a well-defined security model structure. That can be one of the reasons for them being easy are simple to define without a requirement of a standardized interface as they are layered, stateless client/server design. REST web services are resource oriented and they have four generic operations POST, PUT, GET and DELETE. They do not come with security standards.

Example:

Client request's for resources to the server using GET

GET resources/action=someAction?HTTP/1.1

And server responds with a POST

<?xml version="1.0"?>

<rspactionResponse>

<resource id="1">

<resource id="2">

…

</rsp>

Request/Response structure using XML

Request and Response headers can be constructed using XML tags or JSON object structure.

XML Encryption

WS Security Specification describes specifications made for SOAP messaging, which tells to provide integrity, confidentiality, non-repudiation of messages. In XML Encryption, each party will maintains a secure state or an insecure state with any of the interacting entities. Both secure data as well as non-secure data can be exchanged using same XM document. XML Encryption system has the flexibility to handle both XML data as well as non-XML data. We can also use XML encryption to encrypt either full message or just the partial XML schema in the document. XML Encryption can also be used to encrypt JPEG file format by changing the IANA media-type to jpeg.

XML Encryption cannot be done without keys. XML Encryption can be either done by exchanging keys (asymmetric encryption) or using the same keys that were previously exchanged over secure network (symmetric encryption). In asymmetric key exchange, public key is exchanged over the network. This public key is used to encrypt secret key. The XML elements like <ds: EncryptedKey> and <ds:KeyValue> used during key exchange are in XML digital signature namespace. Encrypted data is with <EncryptedData> tag. Now that the key exchange is done, we can use secret key to encrypt the data. Data is now encrypted using this secret key under <CipherValue> inside <CipherData> element.

Another approach is of using symmetric keys in encryption. But WS Security Specification advises use of symmetric keys while encrypting. The reason being low performance issue of asymmetric key based encryption. Even if we want to use asymmetric keys, it is normally advised to use symmetric keys. In this kind of scenarios, we can use PKI to establish the symmetric keys. Originator needs to come up with the symmetric and encrypt it using the public key of the recipient. The recipient then can go and decrypt this key and find out the symmetric key.

Goal and Motivation

An organization that uses XML along with web Services should ensure that right users are sending the appropriate XML content which is can be access the organizations Services. The ISO security standard defines security services as:

Identification: User should be identified

Authentication: User requesting access should be authentic

Authorization: User requesting access should be authorized in the system

Integrity: Integrity of the resources should be maintained

Confidentiality: Confidentiality of the resources should be maintained

SOAP protocol is transferred over HTTP, which means it is allowed to flow through most firewalls without much restriction or rules. And also, most of the application used SSL/TLS protocol use to protect information in the web servers, Transport Layer Security (TLS), is used to authenticate web-based messages and also encrypt them but still it tends to be insufficient for protecting the integrity of SOAP messages as they are designed to operate between endpoints.

One can also use encryption techniques to achieve data security, privacy along with overall performance. But using standard encryption techniques like Symmetric-Key and Public-Key Encryption techniques for encryption or decryption can lead to an increase in access control and performance overhead [4]. Symmetric-Key encryption (SKE) is efficient but increases the complexity of the system. In this method, one key is used for encryption and decryption and when this key is compromised so is the system. Public-key encryption (PKE) requires an additional storage of Public Key Infrastructure (PKI), must be maintained for managing and distributing public keys, which is expensive.

Only a user with authentic set of credentials or attributes should be able to access data in the system. To make access control mechanisms along with encryption technique so data cannot be compromised on untrusted servers. Using CP-ABE allows us to do that. It uses access control mechanism while encrypting and decrypting the data. Also measure the performance of the web service when implemented using CP-ABE because it includes storage and processing the request.

Related Works

Attribute based Encryption (ABE) was introduced by Sahai and Waters [3] as a new means of encrypted access control. In their system, instead of using traditional public key cryptography for encrypting cipher text to one particular user but instead use both user's private key. Cipher texts will be associated with a set of attributes or a rule can be established over those attributes. But the threshold semantics are not very expressive and therefore are limiting for designing more general systems [2]. Key-policy attribute based encryption was introduced by Goyal [6] in which cipher exists are associated with a set of user attributes or roles and user's key is associated with monotonic tree access structure.

The XML Access Control Markup Language (XACML) [11] defines a generic authentication and authorization architecture and uses XML to allow a policy language for expressing as well as exchanging access control policy (rules) information. Web Services Security (WSS) [6] serves as the foundation which addresses the SOAP message level security issues, which comes with three main propositions: (1) to identify and authenticate user use security tokens in SOAP headers, (2) to check for message integrity and also the authenticity use of XML Digital Signature (XML-DSIG) standard, and (3) to maintain message confidentiality use of XML-Encryption (XML-ENC). WS-Security one of the first standards proposed by W3C to offer a broader security framework for building Web Services. According to the analysis by Rodrigues [12] of XML encryption algorithms, AES 192 shows the best performance in terms of speed. However, in some cases, its performance shows no statistical difference with relation to AES 256 algorithm, which will provides a greater security level for a relatively similar cost in performance. XML encryption is used in SOAP message [13] level security.

Example:

<?xml version='1.0' ?>

<EncryptedDataxmlns='http://www.w3.org/2001/04/xmlenc#'

Type='http://www.isi.edu/in-notes/iana/assignments/media-types/text/xml'>

<CipherData>

<CipherDataValue>A1234567</CipherDataValue>

</CipherData>

</EncryptedData>

Problem and Proposed Solution

Problem Statement

With the increase in number of companies outsourcing their data at the third party location, there has been increase in the need of securing the data stored by this web services. Currently, only method to do this is to assume that the data is located at a trusted server and mediate access control. But what if the server if compromised, so is the data stored in that server. The need for only rightful user can access the data has increased even though the server where this data is located is compromised. The need for user who is encrypting the data should be able to define a rule to define who decrypts the data.

Proposed Solution

Attribute based encryption [3] provides a solution. It allows defining of access control policy and utilizes user role for secure handling of data. I plan to use Cipher-text Policy Attribute-Based Encryption (CP-ABE) [2]. Each cipher text is associated with a set of access control policies. User who encrypts will specify an associated access structure over attributes [2]. Attributes will be used to describe user's credentials and the user who encrypts the data sets the policy to decrypt the data. CP-ABE devises a novel private key randomization technique that uses a new two-level random masking methodology [2]. Therefore, there is no secret sharing scheme. And one of the main advantages of CP-ABE is that it offers resistance against collusion attacks. CP-ABE provides more practical solution than Public-Key Encryption (PKE) and Symmetric-Key Encryption (SKE). CP-ABE is a more lightweight security solution than XML encryption and XACML for web services. A performance evaluation will be conducted to compare SOAP based web service and RESTful web service. Enterprise planning that wants to implement policy-based encryption can use the proposed work.

The main aim of the proposed solution is that the integrity of the data should still be maintained even if the data storage is compromised. This data storage can be inside the controlled environment or outside the controlled environment (third party storage). User with necessary set of credentials/attributes can only decrypt encrypted data stored in the data storage. And each data files will have different sets of rules applied to it for decryption. That means even if a user has access to this data storage, they will still need right credentials to decrypt a particular file. The aim of the project is analyze flexibility and scalability of using CP-ABE with web services (REST and SOAP) at the same time reducing the underlying key management problem of standard encryption systems. The main aim of the project is to check the feasibility of using CP-ABE algorithm within web services for data security (especially for data stored at third party location which is the new trend). ABE algorithm is comparatively lightweight with lesser overhead than XML encryption algorithms. System using XML encryption and CP-ABE will be compared based on the metrics.

Road Map

In order to understand and evaluate the findings the report is divided in to different parts. Here Chapter 1 will give an introduction, background and explain the design of the framework, Chapter 2 will discuss about the CP-ABE algorithm. Chapter 3 and Chapter 4 will discuss the design approach and implementation of the system. Chapter 5 describes the experimental results, outcomes and the analysis. Chapter 6 will discuss current status, future enhancements and conclusion.

Chapter 2

CP-ABE

CP-ABE

Ciphertext Policy Attribute based encryption [2] is an algorithm that enforces access control to the data using set of credentials. CP-ABE can also be said as a type of Identity base encryption [14]. In Identity based encryption, public and master key are generated and this will be master key used to generate a private key. But in CP-ABE, we can define complex rules, which will be used to generate private key. This is the advantage of CP-ABE over Identity based encryption. Policy with rules can be applied on the data while it is being encrypted. Users share the public key but the private key remains unique and is generated with user attributes. Each user who wants to encrypt the file will define rules for decryption and data will be encrypted with those rules and the public key. And since private key is generated using user's attributes, only the user with matching set of credentials can decrypt the information.

Example of policy:

(director AND (join date <123456 or security team)) OR (marketing AND 2 of (executive level >= 4 audit group, marketing team))

CP-ABE has the flexibility of using AND and OR for flexibility, and can be used as while defining the policy.

CP-ABE mainly consists of following three algorithms:

Setup: Other than the implied security parameter this algorithm does not take any input, and this security parameter is implicit in this algorithm. The output of this algorithm is the public key and the master key.

Key Generation (MK, S): This algorithm will generate the private key with the help of the master key MK along with set of attributes S, which describes the key. The output of this algorithm is the private key SK. The secret key generated using random generator that is identifies with the set of attribute S.

Encryption (PK, M, A): This algorithm will take public key PK, message M and access policy also known as access structure A as input. The algorithm will generate cipher text CT from the message M such that only a particular user that have similar set of attributes to satisfy the access structure (policy) can decrypt the message. It is assumed that the cipher text CT created contains access structure A.

a:rule_1 AND (b:rule_2 OR c:rule_3)

Figure : Sample Access Structure Tree

Figure 1 shows the example of sample access structure tree that is generated from the access structure. The algorithm uses the access structure A to encrypt the message M. The access structure A is first converted into policy tree like structure with AND and OR gates as the notes.

Decryption (PK, CT, SK): This algorithm will take public key PK, generated cipher text CT and private key SK as an input. It is implied that CT will contains access policy A and private key SK will contain set of attributes S. If the set of attributes S satisfy the access structure A, the algorithm will allow decryption of cipher text CT and will return message M.

CP-ABE randomizes user's private key so they cannot be combined. CP-ABE is secure against plaintext attacks as well as chosen cipher text attacks. Thus we can say that Ciphertext Policy Attribute Based Encryption is a flexible approach with a fine-grained access control. Only authorized user with right set of attributes and private key can access the encrypted data.

Working of CP-ABE

Bilinear maps are used in CPABE algorithm. We use two multiplicative cyclic groups G0 and G1 of prime order p. Therefore, for e: G0 * G0 ->G1, where e is the bilinear maps and Go is the multiplicative cyclic group. Following properties are observed in the bilinear map e:

Therefore, we can say that for the group operation in e: Go * G0 -> G1 and group operation in G0 are efficiently computable for bilinear map G0.

In CP-ABE, private keys are generated with the reference of the set of attributes S. The user who wants to encrypt the data also needs to specify the access policy, which is an access tree structure T. This policy must be satisfied if a user wishes to decrypt the data. We represent interior nodes with the threshold gate and attributes with the leaves. Choosing a bilinear group G0 that has a prime order p and generator g generates public key and the master key.

Where α and β are random exponents that belong to Zp

Encryption (PK, M, T)

The input to the encryption algorithm is the public key PK, the data that needs to be encrypted M and the access structure T. To encrypt the data with the access structure tree T, for each node x and the leaves choose a polynomial qx. Beginning from the root node R, choose a random s εZp and set the polynomial for the root node as qR(0) = s. Then the algorithm chooses the degree for the polynomial.

The ciphertext is constructed as follows:

Key Generation (MK, S)

We generate the key using the set of attributes S as input along with master key MK and the output will be private key, which will identify with the set S. A random r ε Zp is chosen and random rj ε Zp is chosen for each attribute in S. The key is computes as

Decryption (CT, SK)

Decryption is done through recursive algorithm. This recursive algorithm first defines DecryptNode(CT, SK, x) where x is a node in the access tree T. The input to this algorithm is

CT = (T, Ć, C, for all y ε Y : Cy, C'y )andSK

Where SK is associated with set of attributes S.

Therefore,

The algorithm is designed in such a way that it prevents against attacks from colluding users [2] as it randomizes private keys of the users in such a way that it cannot be easily combined and also the secret sharing requirements is embedded in the cipher text. Therefore, to decrypt the ciphertext one must recover e(g, g)αs

The algorithm is secure against chosen plaintext attacks also and can be extended against chosen ciphertext attacks too.

Efficiency of the key generation reasonable. The algorithm requires for every attributes of the user, two exponentiations. The private key consists of two group elements for each attribute [2].

Chapter 3

Design

Architecture Diagram:

Figure 2 shows the high-level architecture diagram of the web service. The high level architecture for web services using XML encryption and the ones using CP-ABE algorithm will remain the same. The application will consist of three main components:

Client: They are the service requestors. They are the authorized users who will request service to the web service. Clients will provide the data that has to be encrypted. Client will be setup with the service and at the end of the setup he will be provided with public key, master_key and private key. They provide files along with the public key, master_key and user defined rules (policy) that will be used by web service to encrypt and decrypt.

Web Servers: This is a tomcat server, which will host the web service. They act as middleware between client and the data storage. They will have various api's and jars files as a reference. These api's will be used to setup users, generate keys and to encrypt and decrypt data. The web service will make sure that only user with correct credential can decrypt the file.

Data storage: This will be the storage that will be used to store encrypted files. These are the location that is supposed to be a secured and trusted location but it's not always the case. Performance is also important as time required to read and write in the data storage also reflects on the overall performance of the system.

Figure : High Level Architecture

User Case Design

Figure 3 shows the use case diagram of web service. Authorized user can request service from service provider. There will be a key generator. The key generator will generate users private key and provide it to the user. The requester along with the public key and rules defined by the requester will provide the file that is needs to be encrypted. These encrypted files will be stored in the database. When the requestor requests to download the stored file, they will use their private key and public along with their user attributes and if they match to the rules defined by the encrypter data will be decrypted.

http://yuml.me/diagram/nofunky/usecase/6749a9c1.png

Figure : Web services USE case diagram

Web Service Detailed Design

Web services will consist of various components. Figure 4 shows us the components of the system implemented. Each component is explained below.

The web service designed will allow users to store and retrieve data in the data storage. Only authorized user will be able to retrieve the data. The web service consists of following components.

Client Component:

This component is an html form that will allows user to choose his action. The user can perform following actions from the client interface.

Setup: This is the client interface that allows the user to perform action, which will trigger web service call to setup the user. User does not have to provide any input. The web service will generate the public key and the master key for the user.

Key Generation: This allows user to perform action, which trigger web service call to generate private key. The private key is generated using user attributes. User provides string that contains the user attributes.

Upload: This is the client interface that allows user to upload the data they want to store through the web service. To perform the action of storing the data, following inputs parameters are to be provided. The public key, the data file, and the policy (rules).

Download: This is the client interface that allows the user to download file from the data storage. To perform the download action user has to provide following download parameters: data file name, secret key and private key.

Servlet: After user chooses their action, the call goes to appropriate servlet. Servlets get the input parameters from the html form, which is given to the doPost method. One of the input parameter of the servlet is "request". Servlets have the appropriate service function calls and sets the appropriate input parameter so the web service can be consumed appropriately.

WSDL: Web service descriptor is generated when we create or run the web service. They contain the appropriate functions that are defined in the web service. They define the input parameters.

Sample wsdl generated

<xs:element name="cpabeFileEncryption">

<xs:complexType>

<xs:sequence>

<xs:element minOccurs="0" name="publicKey" nillable="true" type="xs:string"/>

<xs:element minOccurs="0" name="policy" nillable="true" type="xs:string"/>

…

</xs:sequence>

</xs:complexType>

</xs:element>

Web Service:

The web service component performs various operations depending on the action requested. It will read the action from the servlet and calls the appropriate functions.

The main operations of the web service are:

Setup:

This operation is performed for the user who comes in for the first time and needs to generate their public key (PK) and master key (MK). There is no input parameter for this service. This service will generate the public key (PK) and master key (MK).

Key Generation:

The new user performs this operation after their public key (PK) and master key (MK) is generated. The request object consists of user attributes that describe the user we just setup. Using the attributes private key is generated.

Data Storage:

This operation is performed when the user request to upload the data and store it in the data storage. Request object send to the web service consist of the data that has to be stored in the data storage. But before storing the data in the data storage, this web service performs additional step of encryption. As the aim of this web service is to secure the data stored at untrusted data storage and only allow authorized user to access the data. Therefore, we encrypt the data with rules made up of attributes. These are the access policies.

Encryption:

This operation is performed before data is stored in the data storage. Along with the data user request object also consist of the public key and policy (rules) string with which the data should be encrypted. These inputs are passed to the encryption function which is append with a .cpabe file extension. The output of this function is an encrypted data. This data is now ready to be stored at an untrusted storage.

The data is stored in the data storage. The response object contains a successful flag as true at the end of this operation, which indicates the data storage operation was successful.

Data Retrieval:

This operation is performed when user request to retrieve certain data from the data storage. The request object consists of data they want to retrieve. If the data exist in the storage we perform an additional step of decrypting the data since it's in the encrypted form. If the data is not found in the response object consist of successful flag will be false.

Decryption: Once the data is found in the storage and assuming the user has the access right, which is determined using the private key, and the public key provided, we decrypt the data. The decrypted data is ready to be accessed by the user. If the user attempting to decrypt the data does not have the access right, successful flag will be false in the response object.

Storage:

This is the storage that will be used to store encrypted data. Data will be written into the storage when user chooses to store data. If users want to retrieve the data, data will be read from the storage. This can be any kind be at any location and can be connected with web service.

Figure Web Service Components

SOAP based Web Service

SOAP based web-service will be implemented. The architecture of the SOAP based web services will be based on the figure 4. This web services will store data in the database. Users depending on their roles will be setup in the system. Standard user name and password of the user will be used to authorize the user. Public and private keys for these users will be generated. When data is stored in the database, it will be encrypted and the person who encrypts the data is allowed to define access control rules that allow rules on who can decrypt the data. The person with appropriate credentials and who matches the access control rules set by the set by the person encrypting the data can decrypt the data. As normal password based authentication will be used to enter the system only authorized user will be allowed to access the system. Functions are written to generate soap message.

Sample Soap request example:

SOAP web-service can be made additionally secured by making it password protected. SOAP envelope is defined in XML; we can use XML security standards like XML encryption and along with XML digital signatures. Role based access control which is part of CP-ABE also ensures web service security.

RESTful Web service

Following operations are main part of rest web services

GET operations: It can be defined as a standard read operation of the resource which will not allow any change to the resources

PUT operations: It will create a new resource.

DELETE operations: It will delete the resource.

POST operation: It will update the already existing resource or can be used to create new resource.

REST based web service will be implemented. The architecture of the REST web service will be based on the figure 4. This web services will store data in the database. Users depending on their roles will be setup in the system. Standard user name and password of the user will be used to authorize the user. Master key and public key will be generated using the setup function. User's private key will be generated using the master_key and any number of attributes. If someone wants to encrypt sensitive data before storing in the database, all they have to do is define rules and use public key to encrypt. When data is stored in the database, it will be encrypted and the person who encrypts the data is allowed to define access control rules. The users who satisfy the defined rules based on the attributes and their private key can decrypt the data.

To secure the web service authenticated users will be allowed to enter the system only authorized user will be allowed to access the system by defining login-config. Security constraints will be defined which define methods (GET and POST) that need to be protected. And user constraints will define how the data will be transmitted between client and server.

Evaluation

We will perform some experiment that will helps us determine time required for each process based on the number of attributes and file size. The result collected will help us understand performance of the algorithm.

Analysis

Performance analysis results produced will give us more insight on the performance of the algorithm based of various factors like the policy structure and file size. The increase in the file size of the encrypted data will also be observed. The results collected will help us analysis the algorithm that will increase security of the data stored in the remote storage, which we necessarily trust.

The data storage will store encrypted files. Analysis will be done on data of different sizes. We will also use different set of attributes for the analysis to get the better understanding and results.

After running the algorithm on different data sizes following results were generated, different file size and attributes sets were processed

Chapter 4

Implementation

Implementation Methodology

For this project, web service will be implemented. The web services will allow users to store data in the online data storage, which will be located outside the network. Users depending on their roles will be setup in the system. Standard user name and password of the user will be used to authorize the user. Master key (MK) and public key (PK) will be generated using the setup function. User's private key will be generated using the master_key and any number of attributes. If someone wants to encrypt sensitive data before storing in the database, all they have to do is define rules and use public key to encrypt. When data is stored in the database, it will be encrypted and the person who encrypts the data is allowed to define access control rules. The users who satisfy the defined rules based on the attributes and their private key can decrypt the data. Authenticated users will be able to enter the system only authorized user will be allowed to access the system.

For this project I have implemented a web service that stores data for client. Client is allowed to store data and apply their rules while encrypting the data, which needs to be fulfilled if someone wants to decrypt the data. These rules can be simple or can be complex. They are based on user attributes. He can also set minimum requirements that need to be fulfilled to access the data. The project implements a client that allows user to upload data to the web server. Client interface is made up of form page. The request parameters consist of the action which user wants to perform. If action is encryption they can upload the data file as an input along with their public key, master key and access policy. On the encryption request, web server will call the web service, which has the encryption function. This function takes the input parameters, encrypts the data file with the rules specified in the access policy. The output of this function is an encrypted file. This file will be stored at a specified location. The encrypted file generated is appended with .cpabe file extension. Now, a user comes in who wants to access a particular file. The action is decryption and the other input parameters are the filename they want to access along with their private key. When the web service gets the request to decrypt the file, it goes to the file storage and checks if the file exists in the storage. If it does exist, it will use the user's secret key to decrypt the file. And if the user's attributes match that with ones set by the encrypter, the decrypted file is returned in the response to the user, If the user's attributes does not match, he will get an error message saying you do not have permission to access the file.

SOAP Implementation

This web service will use SOAP messages to exchange data. Service request will be send to the web service which will contain action parameter which will indicate what kind of service is being requested by the user. It will also contain additional parameters like public key, policy for encryption the file that needs to be encrypted. The response for the encryption request, will have a parameter to indicate if the encryption was successful true or false. For the request to decrypt the data, user will send filename and his private key. If the user attributes matches as requested by the encrypter along with his private and public key the response object will contain the file otherwise a message that says you are not authorized to access this file.

REST Implementation

This web service will use json request response structure to exchange data with the web service. Service request will be send to the web service which will contain action parameter which will indicate what kind of service is being requested by the user. The object will also contain additional parameters like public key, policy for encryption the file that needs to be encrypted. The response for the encryption request, will have a parameter to indicate if the encryption was successful true or false. For the request to decrypt the data, user will send filename and his private key. If the user attributes matches as requested by the encrypter along with his private and public key the response object will contain the file otherwise a message that says you are not authorized to access this file.

XML Encryption

A system will be implemented which will use XML encryption in the web service to encrypt data. Data will be encrypted using symmetric key. User will be authenticated using their id and password. XML encryption will be used for encrypting and decrypting data that will be exchanged will be encrypted. There will be no role-based access of data. Any authentic and authorized user with secret key will be able to decrypt the data.

The implementation will be is done in for both SOAP and REST and Java API's will be used to build and deploy web service on a Tomcat server.

Requirements

Hardware

Hardware components for this system consist of CPU, storage, and I/O devices along with operating system will form base for our system.

Implementation will be done on my local machine

2.7 Ghz Intel core i7 processor

Macintosh Operating system (64-bit)

4 GB 1333 MHz DDR3

Software

Our system will be build-using Java (1.6) API's will be used to build the web service. The editor used will be Eclipse IDE. The web service will be hosted on Apache Tomcat Server v7.0. Since CPABE is dependent on java paring based cryptography [15]., we need to include the jar file in the build path. Different essential api's are also needed. Following additional jar files also needs to be referenced for the implementation

Jersey api jar

Jpbc-1.2.1 api jar

Xmlsec jar

Xmlsec1.1 jar

Xml-api-1.2.04 jar

Xlan-2.7.1 jar

Commons-loggin-1.1.1 jar

Httpcomponent-clients 4.2.3 jar

File Storage

Web service require content server to store its data, which may include text files, pdf's, images etc. Therefore, it is necessary to consider the performance of this file system for the overall performance of the system. With the advent of "big data" it is the capacity of the file storage system always has to be enough to store huge amount of data and also deliver good performance. Therefore, it is important to choose file storage system with good performance.

Metrics

Architecture

As architecture flexibility of SOAP based web service and RESTful web service to use CP-ABE. Data stored in the server will be encrypted and when requested only authorized user can decrypt the data. The exact architectural diagram will be provided at the later stage.

Encryption Time

The time required encrypting and uploading the file to the server would be compared. Time required to encrypt a file depends on the file size and number of attributes used to define the access control rules. They require some heavy computation and therefore will be one of the metrics used. Time taken by web services to encrypt will be compared and presented.

Following columns will be included in the table:

File size: As the file size increases the time required to download and decrypt the file will increase.

Number of attributes: As number of attributes defined in the rule by the encrypter increases time required to check if all the defined rules are followed while decrypting will increase.

Encryption time: Time required encrypting the file in milliseconds.

Upload time: Total time required encrypting and uploading the file

Decryption Time

The time required decrypting and download the file from the server would be compared. Time required to decrypt a file depends on the file size and number of attributes and also to check if person is the authorized user. They require some heavy computation and therefore will be one of the metrics used. Time taken by web services to decrypt will be compared and presented.

Following columns will be included in the table:

File size: As the file size increases the time required to download and decrypt the file will increase.

Number of attributes: As number of attributes defined in the rule by the encrypter increases time required to check if all the defined rules are followed while decrypting will increase.

Decryption time: Time required decrypting the file in milliseconds.

Download time: Total time required decrypting and downloading the file.

Round Trip Time (RTT)

The end-to-end response time will be compared between two web services. For good QoS, end-to-end response time should be as low as possible.

Following columns will be included in the table:

File size: As the file size increases the time required to download and decrypt the file will increase.

Number of attributes: As number of attributes defined in the rule by the encrypter increases time required to check if all the defined rules are followed while decrypting will increase.

Upload time: Total time required encrypting and uploading the file.

Download time: Total time required decrypting and downloading the file.

Round Trip Time: Total time required completing the entire task requester by service requestor in milliseconds. This time will determine QoS.

Chapter 5

Analysis

Basic Setup

In order to evaluate results we carry out experiments to check the performance of our system. The outcomes were generated based on the different parameters.

Here, we will use files. The file size will vary. Users will be setup with different set of attributes. Every encryption request will contain different access policy, which will have different access structure. The combination of file size, access policy and set of attributes will be used to evaluate the system. This system will be compared against the system using XML encryption, which will be used to encrypt and decrypt data.

The efficiency will be evaluated by comparing the encryption time and decryption time of our system against XML encryption system. We will also compare the effectiveness of the system. We can show that by using Ciphertext Policy Based Encryption we can securely store data at remote location.

Performance Metrics

Based to the data we show the evaluation of CP-ABE in terms of encryption time, decryption time. Different experiments will be conducted to produce the results necessary to evaluate the algorithm.

Initially to measure the encryption time we keep the attributes in the access structure constant. We keep number of attributes as five for the experiment.

Table : Performance Matrix

File

Size

CPABE

XML Encryption

SOAP

REST

SOAP

REST

Encrypt

Decrypt

Encrypt

Decrypt

Encrypt

Decrypt

Encrypt

Decrypt

5 MB

650.6

302.4

639.4

298.4

114485

11358

115228

113486

10 MB

684.25

419

682

416

120337

119085

126177

119006

20 MB

905.3

750.3

866.3

722.3

465007

459509

452572

450012

30 MB

1231.5

1010

1243.7

1062

666851

657621

665854

661048

40 MB

1530.25

1423.6

1502.2

1329.3

1732117

1722107

1731111

1730117

50 MB

1807

1548.6

1752

1540

2730957

2730454

2730656

2720951

From the above table as we keep the access policy unchanged but only change the file size, we see a constant minimal increase in the time for encryption as well as decryption as the file size increases marginally for the above file size. This is because we keep the policy size the same, which during the encryption and the decryption process is also an important factor in terms of time and the storage overhead. We can observe that for almost twice the increase in the file size (30 MB to 150 MB) time required for encrypting the file is not two times. For storing the files at the remote location where having custom access policy is important but so is time, which also plays a very important factor. Another observation we can make is that the encryption time along with decryption time in the SOAP and the rest architecture is the almost the same. REST is lightweight services than SOAP, which may contribute to a being little faster than SOAP services. Therefore, no matter SOAP or REST, we can efficiently use the encryption technique for better access control while storing the data in an untrusted environment.

Experimental Setup

Here for the experiment we need to show the working in two web services; one using SOAP and another one using REST framework. I have used Java 1.6 using Eclipse IDE to create SOAP and REST web service. First setup in the process is to setup the Tomcat v7.0 server to host the web service. We use the same server to host both the web services. We create data of different sizes and store them in the local storage. Both the web services allow user to upload data from the local storage. The request to the web service will contain following data; public key, data, and the access structure. Along with the size of the data access structure which basically are the rules to be applied on that file. Anyone who meets the rule criteria can access the file. CP-ABE has the flexibility of using AND and OR gates which makes it easier for the user to define his rules. These rules can be applied on individual data. The size or number of rules in each access policy also affects the time complexity of the algorithm. But from the analysis above we can see that it is still feasible to have a complex access policy on the data.

For the experiment below, we maintain a constant file size but will increase the number of attributes used in the access policy.

Below is the example of the example of the access structure used during experiments

admin_policy = "sn:Robln:Brownuid:robbrownmanager:Kevindirector:Sara" +" userPassword:robcity:rochesterschool:rit" +" server:tomcatdatabase:oracletext:arialhost:localhost " +" prevjob:devtitle:sysadminprocessor:intel 12of15 ";

The size of the access structure can vary depending on the rules that needs to be applied for the data to be accessed. Here, "12of15" means at least the decrypter must satisfy 12 rules in order to access the file. We can also have a strict rule where in all the rules set by the encrypter must be satisfied.

Table : Experimental Set-up

Number of attributes

File Size

Encryption Time (in ms)

SOAP

REST

1

30 MB

977

960

5

30 MB

1181

1134

10

30 MB

1420

1406

15

30 MB

1707

1699

20

30 MB

2193

1956

From the results of the experiment above, we can observe that increasing the number of attributes linearly results in a linear increase in the encryption time. We started out with just one attribute in the policy and it only took 0.9 secs to encrypt a 30 MB file. We keep on increasing the number of attributes at an interval of five and we observe minimal increase in the encryption time. If we observe the results, the difference between encryption time required with ten attributes and 20 attributes is only 0.7 secs which tells us that the performance of CP-ABE is better than XML encryption.

The graph below shows a linear increase in the encryption time when we keep the file size constant but increase the number of attributes in the access structure S while encrypting the file.

Figure : Performance Graph

We conduct the same set of experiment on the files that were encrypted above

Table : Encrypted Setup matrix experiment

Number of attributes

File Size

Decryption Time (in ms)

SOAP

REST

1

30 MB

954

940

5

30 MB

1043

1023

10

30 MB

1142

1128

15

30 MB

1275

1183

20

30 MB

1368

1273

From the results in the table above we observe that time required to decrypt the 30 MB file with ten attributes in the access structure is approximately 1.1 secs. Which we can say is feasible. We can see that even though there is a double increase in the number of attributes; from ten to twenty, there is only 0.2 sec increase in the decryption time. So we can say from the graph above and from the graph below that CPABE is a feasible and efficient solution for implementing access control for storing data at remote untrusted location.

Figure : Performance Matrix for encrypted experiment

Now to analysis the performance in terms of file size we keep the number of attributes constant but increase the file size. This scenario is useful when you want to implement same access policy on multiple files like a common access policy. Key manager can have a common access policy, which can be used by default for storing all the files.

From results in the table below we can analyze that when we keep the number of attributes in the access structure constant we see linear increase in the encryption and the decryption time, which we can say is makes the algorithm feasible and efficient to use for implementing access control for storing file at remote file storage.

Table : Experimental setup with increasing file size

File Size (in MB)

Encryption Time (in ms)

Decryption Time (in ms)

SOAP

REST

SOAP

REST

5 MB

650.6

639.4

302.4

298.4

10 MB

684.2

682

419

416

20 MB

905.3

886.3

750.3

722.3

30 MB

1231.5

1243.7

1010

1062

40 MB

1530.2

1502.7

1423.6

1329.3

50 MB

1807

1752

1583.6

1540

100 MB

3211

3209

3237

3244

Now, we evaluate the increase in the file size of encrypted file and the decrypted files. It is important to check the file sizes for better storage management. We do not want to cause out of storage space if the encrypted files tend to increase exponentially.

For this experiment, we will keep the number of attributes in the access structure S constant but keep on changing the file sizes.

Table : File Size experiment

CPABE

XML

Original File Size

(in KB)

Encrypted File Size

(in KB)

Original File Size

(in KB)

Encrypted File Size

(in KB)

4,675

4,681

5020

6763

9,301

9,307

1003

13558

20,140

20,146

20073

27117

30,904

30,910

30061

40535

40,538

40,544

40146

54233

49,109

49,115

50182

100,177

100,183

100364

As we can see from the above results, that the increase in the file size of each file after encryption is very minimal (few KB's) for CPABE but when we use XML Encryption we see a drastic increase in the encrypted file size. Even with the complex access structure there is minimal increase in the file size when we use CPABE, which is expected. From the above results we can conclude that CPABE is feasible for storing files at remote locations where even though we have large storage area we still have to pay for the amount of storage space we use. So we would like to utilize the space to the fullest.

Chapter 6

Conclusion

Current Status

Analyzing the results and the outcomes of the system, we can say that we can use Ciphertext Policy Attribute Based Encryption with web a service that uses remote storage for storing data. This encryption techniques gives freedom to the data encrypter to create his own access rules on a particular data.

Future Works

The future work of this project can be that we can include this encryption technique as part of web service framework. We can include it as part of web services security standard. Currently, we created a framework to use it on top of normal authentication and authorization. But in future we can use it along with the authorization. We can include access control as a part of protocol when using third party data storage

Conclusion

Based on the analysis and the outcomes of the experiments we can say that Ciphertext Policy Attribute Based Encryption is a good approach for to be included for web services that uses remote or third party location for storing data, a trend which has seen an increase recently. Different kind of services is being made available which gives users the opportunity today store their data. CP-ABE is certainly being an approach to ensure more role-based access to the data. We have seen the encryption time and the decryption time required is feasible which makes it efficient. And also we have seen that the increase in the size of the encrypted file is also feasible which makes it efficient to use when the user is paying to store the data.

Writing Services

Essay Writing
Service

Find out how the very best essay writing service can help you accomplish more and achieve higher marks today.

Assignment Writing Service

From complicated assignments to tricky tasks, our experts can tackle virtually any question thrown at them.

Dissertation Writing Service

A dissertation (also known as a thesis or research project) is probably the most important piece of work for any student! From full dissertations to individual chapters, we’re on hand to support you.

Coursework Writing Service

Our expert qualified writers can help you get your coursework right first time, every time.

Dissertation Proposal Service

The first step to completing a dissertation is to create a proposal that talks about what you wish to do. Our experts can design suitable methodologies - perfect to help you get started with a dissertation.

Report Writing
Service

Reports for any audience. Perfectly structured, professionally written, and tailored to suit your exact requirements.

Essay Skeleton Answer Service

If you’re just looking for some help to get started on an essay, our outline service provides you with a perfect essay plan.

Marking & Proofreading Service

Not sure if your work is hitting the mark? Struggling to get feedback from your lecturer? Our premium marking service was created just for you - get the feedback you deserve now.

Exam Revision
Service

Exams can be one of the most stressful experiences you’ll ever have! Revision is key, and we’re here to help. With custom created revision notes and exam answers, you’ll never feel underprepared again.