Table of contents
Abstract
1. Preliminary
2. Basic Theory
2.1 Cloud storage
2.2 Eliptic Curve Digital Signature Algorithm
2.3 Advanced Encryption Standard Algorithm
2.4 Secure Sockets Layer (SSL)
2.5 FTP (File Transfer Protocol)
2.6 HTTPS (Hypertext Transfer Protocol Secure)
3. Design and Implementation
3.1 System Overview
Figure 3.1 System overview.
3.1. The stages of the system are as follows:
3.2 System Design
Figure 3.2 Flowchart of data security in cloud storage.
3.3 Classification of the ECDSA Algorithm
Figure 3.3 Network classification of the ECDSA algorithm
3.4 Implementation of the ECDSA Algorithm on the network
Figure 3.4 Implementation of the ECDSA algorithm on the network.
3.5 Implementation of AES Algorithm on cloud storage
Figure 3.5 Implementation of the AES Algorithm on cloud storage
4. Testing and Analysis
4.1Testing
TABLE 4.1 Method Black Box
4.2 Security Testing on Website Network and in cloud storage
Figure 4.1 Certificate and ciphertext and encrypted data
4.3 Security Testing of Data Stored in Cloud Storage
Figure 4.3 Files encrypted with AES module.
5. Conclusions and Suggestions
5.1 Conclusion
5.2 Suggestions
Reference
DATA SECURITY BY USING ADVANCED ENCRYPTION
STANDARD AND ELLIPTIC CURVE DIGITAL SIGNATURE ALGORITHM
ON SECURE SOCKET LAYER BASED WEBSITE
Abstract
Cloud Storage is an online or digital file storage media that relies on an internet connection for data access. Cloud storage is a new breakthrough in the world of data storage that features many advantages when compared to offline storage media such as hard drives and flash drives, so data stored in cloud storage will be stored on a number of servers managed by service providers or commonly known as hosting. Eliptic Curve Digital Signature Algorithm is an implementation of the elliptic curve of the DSA. Functionally where RSA and DSA require a key length of 3072 bits to provide 128 bit security, ECDSA can achieve the same thing with only 256-bit keys. However ECDSA relies on the same degree of randomness as DSA.
Keywords: Cloud storage, server, cloud, Eliptic Curve Digital Signature Algorithm, Owncloud.
1. Preliminary
With the increasing amount of data stored in cloud storage, data security and privacy issues are becoming increasingly important. Cloud storage providers can be trusted because they have adequate security mechanisms to protect user data from a hacker or also known as a hacker. Therefore, it is very important for cloud storage users to evaluate the security of cloud storage providers [1]. It is very important for the service provider to maintain the site by encrypting it via SSL or TLS. Elliptic curve cryptography (ECC) is one of the more promising technologies in this TLS field, ECC is capable of being faster and more scalable on this server, and provides more security than ordinary cryptography used on other webs [2]. Data security is an important issue that must be solved immediately for cloud storage technology. In recent years, more and more attacks occur on cloud storage systems, and data leaks are frequent. The Advanced Encryption Standard (AES) is a symmetric block cipher chosen by the US government to protect classified information. AES is implemented in software and hardware worldwide to encrypt sensitive data.
2. Basic Theory
2.1 Cloud storage
Cloud storage is a method of storing data on a number of servers managed by the service provider. An internet connection is required to access the data stored on the server. This method has a number of advantages over data storage in conventional physical memory, namely that data can be accessed using various devices, as long as they are connected to the internet network. Users of cloud storage media can share data on the server to other parties quickly and easily, and the security and integrity of the data is guaranteed. A number of leading cloud storage services offer their respective services for free to use, if you need a larger storage capacity there is a paid version that can be used by cloud storage service users.
2.2 Eliptic Curve Digital Signature Algorithm
ECDSA is a type of digital signature from ECC that provides data origin authentication, data integrity and non-repudiation services. ECDSA was first introduced in 1992 by Scott Vanstone and in 1998 received the ISO (International Standards Organization) standard, namely ISO 14888-3. In 1999 it was accepted as an ANSI (American National Standards Institute) standard ANSI X9.62 and in 2000 as an IEEE (Institute of Electrical and Electronics Engineers) standard IEEE 1363-2000 and a NIST (National Institute of Standards and Technology) standard, namely FIPS 186-2 . ECDSA (Elliptic Curve Digital Signature Algorithm), or ECC (Elliptic Curve Cryptography) as it is sometimes known, is the successor to the DSA (Digital Signature Algorithm) algorithm. ECDSA was born when two mathematicians named Neal Koblitz and Victor S. Miller proposed the use of elliptical curves in cryptography. However, it took almost two decades for the ECDSA algorithm to become the standard. ECDSA is an asymmetric cryptographic algorithm built around an elliptical curve and a basic function known as a trapdoor function. Elliptical curves represent the set of points that satisfy a mathematical equation. As all asymmetric algorithms go, ECDSA works in a way that is easy to compute in one direction, but very difficult to reverse. In the case of ECDSA, the number on the curve is multiplied by another number to produce a point on the curve.
2.3 Advanced Encryption Standard Algorithm
The Advanced Encryption Standard (AES) is a symmetric block cipher chosen by the US government to protect classified information. AES is implemented in software and hardware around the world to encrypt sensitive data. This is important for government computer security, cyber security, and protection of electronic data. The National Institute of Standards and Technology (NIST) began development of AES in 1997 when it announced the need for an alternative to the Data Encryption Standard (DES), which began to become vulnerable to brute force attacks. NIST states that newer advanced encryption algorithms will not be classified and should be able to protect sensitive government information well into the 21st century. It is intended to be easy to deploy across hardware and software, as well as in restricted environments such as smart cards and to offer a viable defense against a variety of attack techniques. AES was created for the U.S. government. with the addition of voluntary, free use of public or private, commercial or non-commercial programs that provide encryption services. However, nongovernmental organizations that choose to use AES are subject to restrictions imposed by U.S. export controls
2.4 Secure Sockets Layer (SSL)
SSL (Secure Socket Layer) is a security layer to protect transactions on the website with advanced data encryption technology. Websites that use SSL, the address changes to https and a padlock sign appears in the browser's address bar, and can be pressed to see the type of SSL, the encryption technology used and the identity of the website owner. SSL has many benefits in its use, one of which is being able to secure transactions on the website with encryption including credit card data and passwords.
2.5 FTP (File Transfer Protocol)
File Transfer Protocol is a standard network protocol used to send computer data between a client and a server on a computer network. FTP is built on a client-server model architecture using separate control and data connections between the client and server, using FTP users can send and download files. In addition, FTP is used as a remote (controller) server that manages the web without the need to log in (login) into a hosting account or VPS (Virtual Private Server). FTP users can authenticate themselves with a clear-text sign-in protocol which usually takes the form of a username and password, as well as being able to connect anonymously if the configuration server allows it. For secure transmission and protecting usernames and passwords as well as encrypting content, FTP is often secured with SSL (Secure Socket Layer).
2.6 HTTPS (Hypertext Transfer Protocol Secure)
Description: HTTPS ensures data security over networks - especially public networks such as Wi-Fi. HTTP is not encrypted and is vulnerable to attackers who eavesdrop and can gain access to website databases and sensitive information. By principle, HTTPS encryption is bidirectional, which means that data is encrypted on the client and server sides. Only the client can decode the information coming from the server. Thus, HTTPS encrypts data between the client and server, which protects against eavesdropping, information falsification, and data tampering. However, this design can be different for different browsers. For example, consider visiting a bank's website, such as hdfcbank.com. Insecure HTTP will open. But when we enter the login page, we can see HTTPS in the address bar with some special designs. Implementation: HTTPS is primarily used by websites that handle monetary transactions or transfer users' personal data which may be highly sensitive. Banking websites are a common example. In layman's terms, HTTPS ensures that users watch the websites they want to watch. The data that is exchanged between the user and the website is not read, stolen or tampered with by third parties. But it can't encrypt everything, it also has some limitations. For example, HTTPS cannot encrypt host addresses and portal numbers.
3. Design and Implementation
3.1 System Overview
An overview of the system used in this application is as shown in Fig
3.1. The stages of the system are as follows:
1. The network is secured with secure socket layer ECDSA.
2. The system starts with the initial process of the user taking data.
3. The data has been taken and will carry out the process of uploading data.
4. The uploaded data will be continued at the data encryption stage using AES.
5. After the data passes the AES encryption validation, then the validation code for the data will be stored.
3.2 System Design
The system design in the picture above is as follows:
1. Start by entering data into cloud storage.
2. Then the data is encrypted using the Advanced Encryption Standard.
3. Then the data is checked by the system is encrypted correctly, if not it will be encrypted again.
4. If the data is encrypted properly, it will go directly to cloud storage.
3.3 Classification of the ECDSA Algorithm
The network classification process from the ECDSA algorithm above is as follows:
1. The sender calculates the hash value of the message M to be sent.
2. The sender encrypts the hash value h using the privacy key from ECC.
3. The sender sends the message M and the ECC encryption result from the hash of the message to the recipient.
4. The recipient separates the message and signature.
5. The recipient decrypts the signature using the sender's public key.
6. The recipient hashed the received message.
7. The results of numbers 2 and 3 are compared, if the results are the same then the data sent is valid.
8.
3.4 Implementation of the ECDSA Algorithm on the network
The client performs an ECC based Handshake in general, the same as an RSA based Handshake via the first 2 messages. The client and server negotiate over the ECC cipher suite. The certificate message on the server contains the ECDH public key, the server is signed by the certificate authority that uses ECDSA. After validating the ECDSA signature, the client sends its ECDH public key to the server in a Client Key Exchange message. Next, both the client and server use their respective ECDH private keys and the public key they received earlier to perform an ECDH operation that generates the pre-master secret. Derivation of master secrets and symmetric keys, and the rest of the operations are the same as handshakes in RSA.
3.5 Implementation of AES Algorithm on cloud storage
The AES algorithm generates a strong public or private key pair of 4096 bits per user. The private key is encrypted with the user login password using AES-256. Then file generates a 32-byte base64 encoded ASCII key for each file, then encrypts the file with File-key using AES-256. Decrypt the file key with the matching private-key and share-key, then decrypt the file using the AES-256 key file, which has a key length of 256 bits, supports the largest bit size and is practically unbreakable by brute force based on current computing power, making it the strongest encryption standard. Table 3.1 shows that the probability of key combinations increases exponentially with key size.
|
Key Size |
Possible Combinations |
|
1 bit |
|
|
2 bits |
|
|
4 bits |
|
|
8 bits |
|
|
16 bits |
|
|
32 bits |
|
|
56 bits (DES) |
7.2
|
|
64 bits |
1.8
|
|
128 bits (AES) |
3.4
|
|
192 bits (AES) |
6.2
|
|
256 bits (AES) |
1.1
|
The key size used for the AES cipher determines the number of rounds of transformation that converts the input, called plaintext, into the final output, called ciphertext. The number of rounds is 10 rounds for 128-bit keys, 12 rounds for 192-bit keys, 14 rounds for 256 bits. Each round consists of several processing steps, including steps that depend on the encryption key itself. A set of reverse loops is applied to convert the ciphertext back into plaintext using the same encryption key.
4. Testing and Analysis
4.1Testing
The tests carried out in this sub-chapter of the system consist of security testing on the website network, user data security testing, and data security testing in cloud storage.
TABLE 4.1 Method Black Box
|
No |
Testing |
|
|
Goal Achieved |
Results Obtained |
Success Or Not |
Information |
|
1 |
Login |
|
|
|
|
|
|
|
|
|
- |
Fill in the username and password |
Can enter the website |
Can enter the website |
Success |
Valid |
|
|
|
- |
Username only Empty password |
Tidak dapat masuk dan masukkan username dan password kembali |
Can't login and enter username and password again |
Success |
Valid |
|
|
|
- |
Password only |
Can not |
Can not |
Success |
Valid |
|
|
Empty username |
come in and Enter username and password again |
come in and Enter username and password again |
|
|
||
|
2 |
Upload file |
|
|
|
|
||
|
|
By pressing the “+” button |
Data uploaded in storage |
Data uploaded in storage |
Success |
Valid |
||
|
|
- By dragging files into the website |
Data uploaded in storage |
Data uploaded in storage |
Success |
Valid |
||
|
3 |
Deleting Files |
|
|
|
|
||
|
|
- By pressing once on the icon files |
Files are tagged and can be delete |
Files are tagged and can be delete |
Success |
Valid |
||
|
|
- By pressing "Delete files" |
Files are marked and can be deleted |
Files are marked and can be deleted |
Success |
Valid |
||
4.2 Security Testing on Website Network and in cloud storage
This test is carried out to find out the data path of the cloud storage website has been properly encrypted.
The network has been certified and has been encrypted with Transport Layer Security (TLS) with a length of 747 bytes and files that have been uploaded or downloaded from the cloud storage have encrypted with a length of 742 bytes and the data is in the form of ciphertext.
When the network is not protected by Secure Socket Layer and encrypted from cloud storage, the data will be visible in wireshark in plaintext form, where the file name and size can be seen and known by hackers. So with that security using SSL and encryption from cloud storage can add security or privacy to the data, because only the user knows the data.
4.3 Security Testing of Data Stored in Cloud Storage
The results of testing the security of user data in cloud storage obtained an analysis that data stored in cloud storage cannot be easily retrieved by hackers, other users or admins from cloud storage, because the data stored in cloud storage is encrypted Advanced Encryption Standard (AES) which is based on 256 keys which cannot be accessed because the file is encrypted, and the network security is encrypted and does handshaking between the client and server with the Eliptic Curve Signature Algorithm (ECDSA)
Files that have been uploaded to cloud storage are encrypted with the AES 256 keys module, the data is in the host, but the data cannot be read when it is encrypted. AES-256, which has a key length of 256 bits, supports the largest bit sizes and is practically unbreakable by brute force based on current computing power.
5. Conclusions and Suggestions
5.1 Conclusion
From the research conducted, it can be concluded as follows:
1. Testing using the AES algorithm on cloud storage security makes data that has been uploaded to storage encrypted well and not easy to do brute force.
2. Testing using Secure Socket Layer ECDSA on the data network, when handshaking the client and host then the host and client, creates an encryption for the data network, so that sniffing cannot be done by other parties.
5.2 Suggestions
Suggestions for the development of security in the future system are:
1. Can add algorithm methods from this cloud storage.
2. Can be tested with other tools and other methods on cloud storage and networks.
Reference
[1] Wu, Yuzhao ; Lyu, Yongqiang ; Shi, Yuanchun (December 2019). "Cloud Storage Security Assessment Through Equilibrium Analysis" (PDF). Tsinghua Science and Technology (Volume: 24, Issue 6).
[2] Smart, Nigel (February 19, 2008). "Dr Clifford Cocks CB". Bristol University. Retrieved August 14, 2011.
[3] Rivest, R.; Shamir, A.; Adleman, L. (February 1978). "A Method for Obtaining Digital Signatures and Public-Key Cryptosystems" (PDF). Communications of the ACM.
[4] Diffie, W.; Hellman, M.E. (November 1976). "New directions in cryptography". IEEE Transactions on Information Theory. 22 (6): 644–654.
[5] Jesus Luna, Ahmed Taha, Ruben Trapero, and Neeraj Suri, "Quantitative Reasoning About Cloud Security Using Service Level Agreements". (October 2014) https://ieeexplore.ieee.org/document/7226823
[6] Vijay Varadharajan and Udaya Tupakula, "Security as a Service Model for Cloud Environment" (March, 1 2014) https://ieeexplore.ieee.org/document/6805344/.
[7] Understanding Denial-of-Service Attacks. US-CERT. 6 February 2013. Retrieved 26 May 2016. Prince, Matthew (25 April 2016). "Empty DDoS Threats: Meet the Armada Collective". CloudFlare. Retrieved 18 May 2016.
[8] Cocks, C.C. (20 November 1973). "A Note on Non-Secret Encryption" (PDF). www.gchq.gov.uk. Retrieved 2017-05-30.
[9] Jim Sauerberg "From Private to Public Key Ciphers in Three Easy Steps".
[10] Brand.com President Mike Zammuto Reveals Blackmail Attempt. 5 March 2014. Archived from the original on 11 March 2014..
[11] Alasdair McAndrew. "Introduction to Cryptography with Open-Source Software". p. 12.
[12] Surender R. Chiluka. "Public key Cryptography".
[13] Victor Chang and Muthu Ramachandran, "Towards achieving Data Security with the Cloud Computing Adoption Framework" (2015) https://ieeexplore.ieee.org/document/7299312 [14] Cryptography and Network Security, W. Stallings.
[15] Distributed Denial of Service Attacks - The Internet Protocol Journal - Volume 7, Number 4. Cisco. Retrieved 2019-08-26. Smith, Steve. "5 Famous Botnets that held the internet hostage". tqaweekly. Retrieved November 20, 2014.
[16] Jack Doerner, Yashvanth Kondi, Eysa Lee, and Abhi Shelat "Secure Two-party Threshold ECDSA from ECDSA Assumptions. Y. Lindell, Fast Secure Two-Party ECDSA Signing", 2017.
[17] Sirikarn Pukkawanna and Youki Kadobayashi , "Classification of SSL Servers based on their SSL Handshake for Automated Security Assessment." 2014
[18] Andy Triwinarko, Elliptic Curve Digital Signature Algorithm (ECDSA), Makalah TA, Departemen Teknik Informatika ITB.
