(IJCST-V12I2P5) :pratik Patil, Prerna Tulsiani, Dr. Sunil Mane
(IJCST-V12I2P5) :pratik Patil, Prerna Tulsiani, Dr. Sunil Mane
ABSTRACT
Public Cloud Computing has become a fundamental part of modern IT infrastructure as its adoption has transformed the way
businesses operate. However, cloud security concerns introduce new risks and challenges related to data protection, sharing, and
access control. A synergistic integration of blockchain with the cloud holds immense potential. Blockchain’s distributed ledger
ensures transparency, immutability, and efficiency as it reduces the reliance on centralized authorities. Motivated by this, our
framework proposes a secure data ecosystem in the cloud with the key aspects being Data Rights, Data Sharing, and Data
Validation. Also, this approach aims to increase its interoperability and scalability by eliminating the need for data migration.
This will ensure that existing public cloud-based systems can easily deploy blockchain enhancing trustworthiness and non-
repudiation of cloud data.
Keywords —Cloud Security, Blockchain, Trust Management, Off-Chain Data Storage
blockchain by embedding predefined terms and programmable In [12], authors found various security risks in cloud and
logic. This logic gets triggered when specified conditions are network issues like compromised credentials, hacked
satisfied which ensures automate the processes of transferring interfaces and APIs, account hijacking, permanent data loss,
assets or updating records. To attain the core principle of DoS attacks, and inadequate diligence. Further, they proposed
security i.e. trust, a resolution process is required for the group how various aspects of cloud security could be solved with the
of nodes so that a decision can be made regardless of any help of blockchain technology. Thus, making the system more
individual choices and this technique to reach a conclusion is secure by adding data encryption, service-level agreements,
known as Consensus Mechanism. In the field of cloud cloud data management, and interoperability. However, the
computing, a voting-based consensus mechanism exhibits increasing size of this distributed ledger may impact the cost
notable efficiency over proof-based counterparts, as it is and degrade the performance.
resource-effective, scalable and prioritizes efficiency [7]. Here [13], the authors proposed a novel blockchain-based
data preservation system for medical data and demonstrated
II. RELATED WORK various performance evaluation results by showing many
The shared infrastructure of the public cloud environment comparisons. They focused on explaining why they used
faces many security vulnerabilities due to dependencies on Ethereum over Bitcoin. The key parameters of comparison
third-party providers introducing concerns about data privacy. were block size, response time, and transactional gas required.
For example, AWS (Amazon Web Services) had 4 hours of Also, their research highlighted the importance of fixed block
downtime on February 28th, 2017, resulting in thousands of size. If the block storage capacity is under-utilized this will
websites and applications becoming completely inaccessible lead to wastage of resources while, if it is over-utilized then
[8]. Hence, integrating blockchain with the cloud offers breaking the data into chunks and then storing will increase
immense scope. Moreover, blockchain’s decentralized and the time required to verify the consistency of blockchain.
tamper-resistant framework complements the cloud’s scalable
and flexible infrastructure. Leveraging this integrated III. RESEARCH GAPS
ecosystem organizations can easily mitigate risks associated The public cloud environment is indeed a very vast and
with data sharing and strengthen trust among stakeholders. complex distributed system architecture. This is because the
In [9], authors designed an architecture to store Electronic cloud architecture not only addresses the continuous growth of
Health Records in a blockchain-based network. This shows the industrial ecosystem but also empowers organizations to
how fast blockchain technology has evolved since its adapt to digital transformation. This in turn leads to seamless
emergence. As it maintains stringent security standards and integration of all the dynamic stakeholders. Organizations
safeguards sensitive health information. This proposed need to enforce legal compliance regulations to protect
architecture introduced a new incentive mechanism for the financial records, strategic plans, customer confidential
creation of new blocks in the blockchain. Also, their design information, and intellectual property. Systems accessing
cloud services have become sophisticated and involve a
ensures that each block gives equal contribution in this
diverse range of individuals, hence, distinguishing
process for conducting the new block insertion process.
responsibilities and roles optimizes the productivity of such
Blocks with the least significance are selected in each iteration
comprehensive systems.
and after completing the task their significance gets updated Based on a comprehensive review of previous research in
and they are given incentive charges. this field, we classified various frameworks into four distinct
BigchainDB [10] is a blockchain database that is a types.
combination of blockchain and database supporting a wide Table II: Comparison of Core Strategy Adoption
range of proof-of-concepts. It allows developers to deploy Off-Chain
Access Validation
their applications with high throughput, low latency, Session and On-
Name Control and
decentralized control, and immutable data storage. With user Tokens Chain
Policies Verification
feedback and iterative improvements, the next version of Bifurcation
BigchainDB software aims to include the integration of Electronic
Tendermint for inter-node networking and Byzantine fault Health
Records ✓ ✓
tolerant (BFT) consensus.
ProvChain [11] is a blockchain-based data provenance Blockchain
architecture in a cloud environment. This architecture Based
ProvChain
System ✓ ✓ ✓
presented a solution to embed metadata of the history of
creation and operations performed on a cloud object in a BigchainDB ✓ ✓
tamper-proof blockchain, thus enhancing user privacy and
reliability. However, the implementation of ProvChain for
multiple cloud servers may require a lot of computational
speed and cost and, hence limit the scalability.
and the specified conditions are compared. According to the • Fixed-size cryptographic hash generated from off-
result obtained following actions are performed: chain requested data.
2.1) Rejection: If a user attempts to access data
for which they are not intended, then the smart contract
will deny the request and the system administrator will V. ALGORITHM DESIGNS
get alerted. This section focuses on the strategic development of three
2.2) Acceptance: If a user has authorised access critical algorithms: the Dynamic Access Control Algorithm
to the requested data, then smart contract will accept this for Data Security, the Check if a user has permission to
request and the system will trigger the generation of a perform a system functionality algorithm, and Blockchain-
session token. This session token will be used to authorise Based Verification in Off-Chain Storage. These algorithms are
a particular user for future data request accesses till it is meticulously crafted to address key challenges in data security,
valid. The session token has attributes containing user’s access control management, and data verification. The design
unique identification number, user role and time validity, principles behind these algorithms have been highlighted by
this token is cryptographically encrypted and will serve as incorporating examples of real-world scenarios. This
a temporary access credential for the user inside our showcases the relevance and easy integration of our
system. framework with existing cloud database systems.
3) Logging: The Dynamic Access Control Algorithm (as shown in
The acceptance / rejection of a user captured from the smart Algorithm 1) defines a procedure to manage and update
contract is recorded in the form logs. These logs are very access permissions based on individual roles. It categorizes
useful for identifying percentage of legitimate users entering individuals into “Controllers” and “Users”. This algorithm
the system. Also logs contribute as a valuable resource for grants Controller authority to onboard new individuals to the
monitoring and auditing purposes. organization and assign them roles. In addition, controllers
can modify access control settings to align with the
4) Off-Chain Data: organization’s compliance regulations. Let’s consider an
Generation of a session token, indicates the user is example for instance:
legitimate and is completely authenticated. This initiates a
successful connection with the cloud servers. Within this • Admin controller logs into the system and he/she has to
connected ecosystem our architecture is connected to both off- onboard a new employee to his organization. This
chain and on-chain data. Off-chain data typically resides in
employee will be working in the HR Department. Thus,
traditional database systems, that are not part of the
the employee should be able to access all HR
blockchain itself. The contents of this off-chain data vary from
department data.
large multimedia files, sensitive customer information,
transaction details, logs, and other proprietary documents.
• From the front end of the application, the controller will
Reference of off-chain data is linked via cryptographic fixed-
size hashes. These hashes are then stored on the blockchain. navigate to the “Access Control Settings” Page. This
Conventional methods store whole data on the blockchain will call the function UPDATE_ACCESS_CONTROL
which is then queried according to the user’s request. This in the backend. First, the function will check whether
increases the response times, transaction gas fees, and latency userRole is Controller or not then only it will allow the
levels. Thus, the linkage of on-chain and off-chain data helps controller to access other actions. After validating the
in compact representation of large existing datasets. It also controller will be able to see these actions: Onboard
facilitates trustworthiness by verifying on-chain hash and off- new users, assign roles, create policy, update
chain cloud data. permission, check control, and audit trail.
5) Digital Certificate: • Now controller will onboard the new employee and
In dynamic cloud environments, continuous real-time data assign role to the employee. Let’s consider userId =
transactions occur at changing frequencies. Thus, a non- “123”.
repudiation mechanism is essential to provide assurance that
the involved parties cannot deny the origin of the message or • The controller will create a new policy named “HR
action performed. A digital certificate is a source of irrefutable Data Access” and then grant permission to the
evidence illustrating the proof of origin and the proof of
employee with userId = “123”. This will ensure that this
receipt [18]. Our framework creates a digital certificate which
new employee can view the HR Department’s Data on
comprises of the following essential components:
his/her dashboard.
• Server’s unique identifier
• User’s unique identifier Algorithm 1: Dynamic Access Control Algorithm for Data
• Expiration date Security
9: // Create a policy corresponding to The front end will call the function
a particular system functionality CHECK_PERMISSION with parameters “123” (userId) and
“HR Data Access” (functionalityName). The algorithm will
10: else if action = Update Permission then search the dictionary for the key “HR Data Access” and then
11: // Grant or Revoke permission to a it will check if “123” belongs to the list of userIds. Finally, the
user for a particular system functionality algorithm will return user permission status.
12: else if action = Check Control then Algorithm 2: Check if a user has permission to perform a
13: // View if a user has permission to system functionality
INPUTS:
perform a particular system functionality
userId, which is a unique identification number
14: else if action = Audit Trail then corresponding to a user
15: // Check past audit trails functionalityName, where functionalityName is a particular
system functionality
16: end if
OUTPUT:
17: else if userRole = user then hasPermission, where hasPermission ∈ [True, False]
18: set validAction = False // Since ASSUMPTION:
only admin controller can update policies “policiesDictionary” is a global variable with key:
19: end if functionalityName & corresponding values: list of
userIds who have permission to access that
20: RECORD_AUDIT_TRAIL (userId, action,
functionality
timestamp, validAction)
1: function CHECK_PERMISSION (userId,
21: return validAction functionalityName):
2: if userId ∈ policiesDictionary[functionalityName]
User Experience plays a significant role as it provides then
seamless access to authorized system functionalities while 3: set hasPermission = True
restricting access to unauthorized areas. Algorithm 2 4: else
automates the process of checking permissions of different 5: set hasPermission = False
users. It ensures that access permissions are granted and 6: end if
revoked appropriately, reducing the risk of compliance
[2] SAP. “Cloud Computing: The Future of IT | SAP,” n.d. [11] Liang, Xueping, Sachin Shetty, Deepak Tosh, Charles
https://www.sap.com/india/products/technology- Kamhoua, Kevin Kwiat, and Laurent Njilla. "Provchain:
platform/what-is-cloud-computing.html. A blockchain-based data provenance architecture in
[3] Amazon Web Services, Inc. “AWS Re:Invent 2022 cloud environment with enhanced privacy and
Storage Leadership Session - AWS Storage Innovations availability." In 2017 17th IEEE/ACM International
at Exabyte Scale,” n.d. Symposium on Cluster, Cloud and Grid Computing
https://aws.amazon.com/products/storage/. (CCGRID), pp. 468-477. IEEE, 2017.
[4] Samarati, Pierangela, and Sabrina De Capitani di [12] Rani, Meena, Kalpna Guleria, and Surya Narayan Panda.
Vimercati. "Cloud security: Issues and concerns." "Blockchain technology novel prospective for cloud
Encyclopedia of cloud computing (2016): 205-219. security." In 2022 10th International Conference on
[5] Nakamoto, Satoshi. "Bitcoin: A peer-to-peer electronic Reliability, Infocom Technologies and Optimization
cash system." (2008). (Trends and Future Directions)(ICRITO), pp. 1-6. IEEE,
[6] Mohanta, Bhabendu Kumar, Debasish Jena, 2022.
Soumyashree S. Panda, and Srichandan Sobhanayak. [13] Li, Hongyu, Liehuang Zhu, Meng Shen, Feng Gao,
"Blockchain technology: A survey on applications and Xiaoling Tao, and Sheng Liu. "Blockchain-based data
security privacy challenges." Internet of Things 8 (2019): preservation system for medical data." Journal of
100107. medical systems 42 (2018): 1-13.
[7] Pahlajani, Sunny, Avinash Kshirsagar, and Vinod [14] “What Is Access Control? | Microsoft Security,” n.d.
Pachghare. "Survey on private blockchain consensus https://www.microsoft.com/en-
algorithms." In 2019 1st International Conference on in/security/business/security-101/what-is-access-control.
Innovations in Information and Communication [15] McLean, Sue, and Simon Deane-Johns. "Demystifying
Technology (ICIICT), pp. 1-6. IEEE, 2019. blockchain and distributed ledger technology–hype or
[8] Amazon Web Services, Inc. “Summary of the Amazon hero?." Computer Law Review International 17, no. 4
S3 Service Disruption in the Northern Virginia (US- (2016): 97-102.
EAST-1) Region,” n.d. [16] Sevend. “Transport Layer Security and Digital
https://aws.amazon.com/cn/message/41926/. Certificates - SQL Server.” Microsoft Learn, March 27,
[9] Yang, Guang, and Chunlei Li. "A design of blockchain- 2023. https://learn.microsoft.com/en-us/sql/database-
based architecture for the security of electronic health engine/configure-windows/certificate-
record (EHR) systems." In 2018 IEEE International overview?view=sql-server-ver16.
conference on cloud computing technology and science [17] Hepp, Thomas, Matthew Sharinghousen, Philip Ehret,
(CloudCom), pp. 261-265. IEEE, 2018. Alexander Schoenhals, and Bela Gipp. "On-chain vs.
[10] McConaghy, Trent, Rodolphe Marques, Andreas Müller, off-chain storage for supply-and blockchain integration."
Dimitri De Jonghe, Troy McConaghy, Greg McMullen, it-Information Technology 60, no. 5-6 (2018): 283-291.
Ryan Henderson, Sylvain Bellemare, and Alberto [18] Coffey, Tom, and Puneet Saidha. "Non-repudiation with
Granzotto. "Bigchaindb: a scalable blockchain database." mandatory proof of receipt." ACM SIGCOMM
white paper, BigChainDB (2016): 53-72. Computer Communication Review 26, no. 1 (1996): 6-
17.