Post-quantum cryptography-driven security framework for cloud computing

1 Introduction

With the emergence of cloud computing, the provision of data security through encryption has been a major technique to safeguard data against attackers/hackers [1]. Usually, data exchange is carried out in mediums that are not secure enough, which gives room for the interception of data by intruders [2,3,4]. According to ref. [4], cloud computing promises enhanced data security, reduced cost for services, enhanced flexibility, and higher availability, but the knowledge domain shows that frameworks for various data security models have been proffered for enhanced cloud data security using advanced encryption standard (AES), data encryption standard, RSA, and Elliptical Curve Cryptography (ECC), yet data security issues still prevail.

Cryptosystems such as RSA and ECC based on factoring problems and discrete logarithms, respectively, have sufficiently provided cloud data security for years over all forms of classical attacks. However, today’s data-driven society is gradually drifting from classical computing, where information is stored in 0s and 1s to quantum computing, where information is stored in qubits. The advent of quantum processors and hence quantum computing, has revealed potential weakness in existing cryptosystems, thus necessitating the urgent need to source for alternatives that will ensure data protection.

Frequently used Cryptosystems, for example RSA and ECC have sufficiently provided cloud data security for years over all forms of classical attacks, yet the theft of data prevails. Hence, the urgent need to deploy quantum safe cryptosystems that are both safe for data processing in the classical and quantum space.

This article proposes a variant of the Code-based cryptosystems and Lattice-based cryptosystems. It seeks to develop a robust hybrid cloud data security framework with a view to understudy the cryptosystems as mentioned earlier and the designing of a variant of McEliece cum NTRU cryptosystems, respectively, in a hybrid architecture.

1.3 The security of cloud computing

According to the Organisation of NIST, cloud computing is described as a service model that enables immediate, simple, and on-demand available network access to shared computing resources such as servers, networks, data, applications, and services [10].

There are four cloud computing models: hybrid, public, private, and community clouds. Furthermore, the model also depicts service delivery models, which include Infrastructure-as-a-Service (IaaS), the Platform-as-a-Service (PaaS), and the Software-as-a-Service (SaaS) (Figure 1).

Figure 1

Cloud computing model [31].

Though it is expected that computing will serve as a utility such as telephone, gas, water, and electricity, it comes with a major challenge: data security problems. Cloud user reception of cloud services can be hindered due to security and privacy issues. Information sourced from the knowledge domain also reveals that cloud users feel reluctant to fully adopt cloud services because of security and privacy issues. Ref. [11] describes data security as a means of securing digital data against unauthorised users/actions. Data sharing is carried out in unsecured channels, which is susceptible to interception. This has led to cloud providers and clients resorting to various means of data protection techniques, one of such techniques is cryptography.

Additionally, data security encompasses three attributes: confidentiality, integrity, and authentication. Confidentiality entails the protection of information and restricting it from unauthorised access. This is achieved by the application of cryptography. Integrity ensures that unauthorised persons are not able to change or manipulate data intended for a specific user and could be achieved by the use of cryptography. It is pertinent to note that data has value only if it is safe. Data which has been manipulated does not have any value and may cause financial waste, for example, data manipulation in which information about financial accounts is stored. Similarly, cryptography plays an important role in ensuring data integrity. Frequently used methods of data integrity protection contain information about data changes and hash checksums by which data integrity is verified. Availability simply refers that information be made consistently/readily accessible for authorised parties. Availability also involves properly maintaining hardware, technical infrastructure, and systems that hold and display the information.

2 Literature review

Ref. [12], proffered a secure framework for a multi-user and multi-owner cloud environment. The authors opined that security, integrity, and privacy of cloud data is the primary threat for cloud deployment in a multi-user/multi-tenant cloud environment. They further developed an algorithm to address the security issues of the cloud environment and proposed/applied a novel algorithm with the integration of Ciphertext Policy-Identity Attribute-based Encryption and the RSA algorithm for securing the cloud. Their research was able to establish a framework where both the owners and users are provided with the public and distinct secret keys that are generated by the Automated Certificate Authority. The proposed framework was implemented through Java. The performance of the proposed framework was analysed using standard metrices by comparing with the metrics output of Anand and Perumal, 2019 and Xue and Ren, 2019. However, the simulation of various data sizes revealed that the proposed framework is more expedient and effective when compared with EECDH and I-CP-ABE algorithms. The study also revealed that the proposed algorithm prevents man-in-the-middle attack. The authors adopted and applied RSA cryptosystem to the model, however, the RSA cryptosytem is not quantum safe.

Ref. [13] posited that the provision of data confidentiality and integrity of user’s cloud data is subject to the provision of an effective security model that provides the mechanism that guarantees prevention of unauthorised access by third parties and a secured communication channel. The authors proposed a security framework that allows cloud users to handle the privacy and integrity of their data. The proposed model avails the user the opportunity to security, network usage, privacy, and data storage in the cloud without depending on the cloud provider. The model grants access to authorised and authenticated users to the cloud data, which has been proposed to be encrypted using a variant of AES algorithm. The proposed model was simulated using CloudSim with iFogSim as simulators on Eclipse integrated development environment. Results of the simulation revealed that the proposed model reduces energy consumption, network usage, and delay. Hence, the proposed framework enhances security, minimises resource utilisation, and reduces delay while utilising services of the cloud. The limitation of the study lies in the fact that the AES cryptosystem has key distribution challenges.

Ref. [14] suggested that cryptography is the most well-known technique for data security in a cloud environment. They further posited that cryptographic services in any cloud environment must accommodate authorisation, availability, confidentiality, integrity, and non-repudiation. They proposed the implementation of RSA, AES, and SHA256 in data security. The limitation of this mechanism is that it consumes a lot of time during execution. The long keys of RSA means that they incur high computational overhead and RSA cryptosystems are susceptible to quantum attacks. Furthermore, AES suffers from key exchange problem which is a limitation.

Ref. [30] researched on privacy and security challenges in a cloud environment in the context of a smart campus security with 100 respondents. The authors postulated that Blockchain technology overcomes the major challenge of cost in cloud computing. They further stated that cloud computing is less expensive and the blockchain technology is more expensive when applied with a chain of objects. More so, they opined that blockchain storage accounts are more secured, though security and privacy challenges depended on the type of business. Also, they stated that Blockchain technology can improve anonymity and security in a cloud environment and the major challenges include data integrity, data authentication, availability of data, location of data, data privacy, confidentiality, data storage, backup, and recovery. They concluded by positing that data integrity is affected because of inadequate encryption and audit control, authentication, and authorisation.

Ref. [10] stated that in spite of research works carried out in the area of cloud computing, challenges have persisted in the section of load balancing in cloud-based applications directed to the IaaS cloud service model. They postulated that IaaS model is technological driven that manages backend servers and virtual machine. Furthermore, they stated that cloud service providers should ensure situations where clients are being overloaded/underloaded to forestall machine failure or higher execution time suggesting task scheduling. The scholars proffered an LB algorithm directed towards optimising resources and enhancing load balancing considering the quality of service (QoS) task parameters, priority of virtual machines, and resource allocation. Results from their experiment revealed that the proposed LB algorithm had better execution time and makespan when juxtaposed with the Dynamic LBA algorithm.

The rest of the literatures reviewed are presented on tabular form (Table 2).

Upon review of relevant literature as regard to data security in cloud computing, it was discovered that most access control (username and password) data and user data were either secured using cryptosystems that will be rendered obsolete with the advent of quantum computing or not secured enough in the classical computing era. More so, most of the literature suggested the securing of both the user data and access control data using the same algorithm. Finally, literature revealed that authors adopted a hybrid cryptographic approach in the safeguarding of cloud data.

The following research gaps were identified based on the review;

Gap one: It can be deduced that most of the scholars/researchers neglect user authentication and how their data should be secured independently. Authentication and authorisation are key to any model proffered for cloud data security, since it decides who gets into a cloud system and what kind of data can be accessed. The adoption and application of authentication and authorisation on feature frameworks will go a long way in ensuring data security. Also, the independent encryption of access control data is also very important as most literature reviewed said little or nothing about this approach.

Gap two: It was revealed that quantum-safe cryptosystems were rarely adopted or applied in securing both access control data and cloud user data. Literature review also revealed that most of the frameworks proposed by authors are not/partially implemented or experimented on.

3 Materials and method

The article proposes a framework for an enhanced cloud data security. The proposed framework comprises a variant of the McEliece and NTRU algorithm. Subsequently, the algorithms are subjected to simulation with standard performance metrics alongside ECC, RSA, AES, and the existing NTRU and McEliece algorithms using MATLAB. The following subsections present the framework and the result of the simulation.

3.1 The proposed hybrid framework

In the proposed system, as depicted in Figure 3, a block diagram of the proposed framework is shown. McEliece cryptosystem is used to encrypt/decrypt user credentials, while the proposed NTRU is used to encrypt/decrypt user data.

Figure 2

Optimised framework for data security in the cloud.

The proposed framework for enhanced data security is presented in Figures 2 and 3 depicts the processes in the proposed framework. The cloud administrator creates users such that their user credentials are encrypted/decrypted using the proposed McEliece cryptosystem. Upon request to access the cloud, users provide their user credentials, which is subjected to authentication. It should be noted that the cloud administrator provides users with their credentials. The proposed model also includes the encryption and decryption of cloud data using a variant of the NTRU cryptosystem. The sections below explain the details of each segment of the model.

Figure 3

A block diagram of the proposed framework.

3.2 Proposed user verification

The framework proposes the authorisation and authentication of cloud users using onetime password (OTP) authentication and user credentials authentication. The figure below depicts the processes involved in the authentication and authorisation of cloud users (Figure 4).

Figure 4

Proposed user verification.

For the proposed data storage/retrieval, an authenticated and authorised user accesses the data that have been stored in the cloud. Data is encrypted using a variant of the McEliece for user credentials and NTRU cryptosystems for user data and then stored/retrieved in the cloud.

3.3 Proposed McEliece cryptosystem

In a bid to increase the security of the McEliece cryptosystem, the key generation mechanism is strengthened, as shown below.

3.3.1 Definition of variables

G: Goppa codes, m: message to be encrypted

S: non-singular matrix, P: permutation matrix

P _k: public key, S _k: private key, t: weight of the distorting matrix, G _key: computed public key

The following are the proposed modifications to the existing McEliece algorithm:

McEliece consists of three algorithms: key generation algorithm, which produces a public and a private key, an encryption algorithm, and a decryption algorithm.

3.3.2 Key generation

Choose a binary Goppa code C, with parameters (n; k; and t). The generator matrix G(n × k) is obtained with a binary non-singular (k × k) matrix S and a permutation (n × n) matrix P, satisfying the following criteria; S ^T ≠ S, S ⁻¹ ≠ S and P ^T ≠ P.

The sender processes the encryption and decryption keys by processing

(1) G key = S T ⋅ G ⋅ P T ,

where T represents transpose.

The sender also sets the public key as:

P k = ( G key, t ) and private key as : S k = ( S T , G , P T ) .

3.3.3 Encryption

The sender’s message (m) is encoded in binary form with a length, k. The following is processed by the sender

The sender processes:

(2) C I = m × G key .

A random n-bit vector z, containing exactly t ones (a vector of length n and weight t), is generated by the sender and then the ciphertext is computed as:

(3) C = C I + z .

3.3.4 Decryption

The receiver upon receiving the ciphertext computes the inverse of P ^T i.e., (P ^T)⁻¹ and computes:

(4) d = C ( P T ) − 1 .

The receiver finally uses the decoding algorithm for the code G to decode d to X and computes:

(5) m = X ( S T ) − 1 ,

which is equivalent to the original message.

Figure 5 below depicts the processes involved in the proposed McEliece algorithm.

Figure 5

Proposed McEliece cryptosystem.

Below is the algorithm for key generation, encryption, and decryption of the proposed McEliece algorithm.

Algorithm 1: Proposed McEliece-key generation

Input: parameters for key generation (S, P, G)

Output: keys ( G key , P k )

Begin

i. Calculate the transpose of S and P

ii. Compute G key = S T ⋅ G ⋅ P T

iii. P k = ( G key , t )

iv. Return ( G key , P k )

End

In the above algorithm, the sender sets the public key as P k = ( G key , t ) and the private key as S k = S T ⋅ G ⋅ P T . Below is the encryption algorithm for proposed McEliece cryptosystem.

Algorithm 2: Proposed McEliece-encryption

Input: Parameters for encryption ( m , G key )

Output: Cipher text (C)

Begin

i. Compute C I = m × G key

ii. A random n-bit vector z, containing exactly t ones (a vector of length n and weight t , is generated)

iii. C = C I + z

iv. Return (C)

End

Below is the proposed decryption algorithm for McEliece cryptosystem.

Algorithm 3: Proposed McEliece-decryption

Input: Parameters for encryption (S, P, G)

Output: Plain text (m)

Begin

i. Computes the inverse of P T i.e., ( P T ) − 1

ii. Use the decoding algorithm for the code G to decode d to X

iii. m = X(ST)−1

iv. Return (m)

End

3.4 Proposed NTRU cryptosystem

Data is encrypted/decrypted using the modified NTRU cryptosystem, the proposed NTRU cryptosystem will be driven by lattice arithmetic. Lattice multiplication is the method for multiplying bigger numbers or for carrying out complex multiplication. It is algorithmically identical to the traditional long multiplication method, but breaks the process into smaller steps. The following steps are required for the proposed NTRU cryptosystem.

3.4.1 Definition of variables

N – the polynomials in the ring R with degree N − 1.

p and q – are small and large modulus respectively, which are used for the reduction in coefficients in the encryption/decryption of data.

f and g – polynomials used to process the public key h, r – a random blinding polynomial used to distort data, m – is the message to be encrypted/decrypted represented in polynomial form.

Upon access to the cloud, users are given the opportunity to either edit already uploaded data or upload fresh data, these data are secured using the proposed NTRU cryptosystem. NTRU algorithms consists of three algorithms: key generation algorithm, which produces a public and a private key, an encryption algorithm, and a decryption algorithm. The following processes are driven by lattice arithmetic.

3.4.2 Key generation

The sender computes f·f _p = 1(mod p) and f·f _q = 1(mod q) and then processes the public key h using:

(6) h = p f q · g ( mod q ) .

3.4.3 Encryption

To encrypt a message, the following is processed:

(7) e = r · h + m ( mod q ) .

3.4.4 Decryption

The following is computed to decrypt the message

(8) a = f · e ( mod q ) ,

(9) b = a ( mod p ) ,

(10) C = f p ⋅ b ,

which is equivalent to the original message.

The figure below shows the processes involved in the encryption and decryption of NTRU cryptosystem driven by lattice arithmetic (Figure 6).

Figure 6

Proposed NTRU cryptosystem.

Below are the algorithms for processes of the proposed NTRU cryptosystem.

Algorithm 4: Proposed NTRU-key generation

Input: parameters for encryption (p, f, g, q)

Output: Keys (h)

Begin

i. Compute f · f p = 1 ( mod p )  and

ii. f · f q = 1 ( mod q )

iii. h = p ⋅ f q · g ( mod q )

iv. Return (h)

End

Algorithm 5: Proposed NTRU-encryption

Input: Parameters for encryption ( m , r , h , q )

Output: Cipher text (e)

Begin

i. Compute e = r · h + m ( mod q )

ii. Return (e)

End

Algorithm 6: Proposed NTRU-decryption

Input: Parameters for encryption (e, f, p, q)

Output: Plain text (c)

Begin

i. Compute a = f·e(mod q)

ii. Compute b = a(mod p)

iii. C = f p· b

iv. Return (c)

End

4 Results and discussion

The proposed algorithms were subjected to limitation against ECC, AES, RSA, existing McEliece, proposed McEliece, NTRU, and proposed NTRU algorithms.

Table 3 above shows the execution time of the proposed McEliece algorithm as well as the average execution time and throughput of the simulated algorithms.

Table 3 above shows that ECC has the best throughput. Comparing the existing and proposed McEliece algorithms, it is revealed that the proposed McEliece algorithm has a higher throughput and a lower average execution. Table 4 below shows the execution time of the proposed NTRU algorithm as well as the average execution time.

Table 4 above depicts that ECC has the best throughput. Juxtaposing the existing and proposed NTRU algorithms, it is revealed that the existing NTRU algorithm has a higher throughput and a lower average execution.

In comparing, the existing and proposed McEliece algorithm, the above proved that the introduction of the transpose function of variables S and P in the proposed McEliece algorithm enhanced the total execution time of the algorithm. However, the proposed NTRU algorithm, which is Lattice multiplication driven, proved to be more time consuming and with lower throughput. It can thus be deduced that the proposed McEliece is effective and efficient while that of the proposed NTRU is less effective and efficient.

5 Conclusion

This article proposes a framework that adopts quantum-safe algorithms to safeguard cloud data. Innovatively, a variant of McEliece cryptosystem was used to safeguard user credentials, while a variant of NTRU cryptosystem was used to safeguard cloud data. The McEliece and NTRU cryptosystems were proposed to provide an efficient data security in the cloud environment amidst the emergence of quantum computing. It is expected that the proposed model will decrease man-in-the-middle attacks and improves data security.

6 Future work

This article highlights post-quantum cryptographic systems and recommends the application of the proposed algorithms on a quantum computer platform as the authors of this article carried out its simulation on a classical computer.