2026· International Conference on Security and Cryptography· pp. 529-540· 0 citations· 28 references
Computer Science
TL;DR
This work introduces a confidential software-based HSM ( ccHSM) designed to provide strong isolation and scalable key management without the need for dedicated hardware, and shows that ccHSM doesn’t suffer substantial performance trade-offs while significantly reducing cost relative to conventional hardware and cloud-based solutions.
Abstract
: Key management is paramount to security concerns in cloud system. Key protection is vital to avoid data breaches due to the inadvertent or intentional disclosure of cryptographic keys. Hardware security modules (HSM) have been considered as a trustworthy entity to store keys and certificates. However, the systems using HSMs are difficult to achieve scalability because of the heavy workload of cryptographic operations, as well as the cost of the dedicated hardware. Based on the idea of key isolation by HSM, we introduce a confidential software-based HSM ( ccHSM ) designed to provide strong isolation and scalable key management without the need for dedicated hardware. ccHSM delivers cryptographic operations and secure secret storage to cloud-native services throughout lifecycle. To enable this, ccHSM adopts Intel SGX for a trusted execution environment and implementation of HSM features, PKCS#11-compliant key management. Furthermore, ccHSM is able to establish a secure, intra-host PKCS#11 communication with the target application to ensure low-latency and tamper-resistant interaction. Finally, we apply ccHSM for TLS key offloading, JSON Web Token authentication. Our evaluation shows that ccHSM doesn’t suffer substantial performance trade-offs while significantly reducing cost relative to conventional hardware and cloud-based solutions.
The exponential growth of big data coupled with the rapid transition to public cloud storage has created major concerns regarding data confidentiality and integrity. Unsecured cloud storage buckets are vulnerable to unauthorized access and severe compliance violations. This paper presents SecureSphere, a cloud-native security framework designed to protect big data at rest within Amazon Simple Storage Service (S3) by integrating AWS Key Management Service (KMS). We propose a centralized key management and envelope encryption model where S3 objects are encrypted dynamically using data keys generated and managed by AWS KMS. Access to the cryptographic keys and stored assets is governed by strict AWS Identity and Access Management (IAM) policies. By enforcing automated key rotation, comprehensive audit logging via AWS CloudTrail, and department-level folder isolation, SecureSphere provides a robust security blueprint. Experimental results demonstrate that the proposed framework achieves regulatory compliance with negligible administrative overhead and near-zero encryption latency, making it highly suitable for large-scale enterprise deployments.
Mithra Ural, B.S. B.M Bhavya, Rajesh H. N et al.· International Research Journ...· 0 citations
Cloud storage services have become a fundamental component of modern computing infrastructures, enabling scalable and cost-effective data management. However, outsourcing data to remote cloud servers introduces significant security challenges, particularly in ensuring data integrity, secure access control, and efficient auditing of stored information. Existing cloud auditing schemes primarily focus on integrity verification and often rely on trusted third-party auditors, leading to additional trust assumptions, communication overhead, and metadata management complexity. To address these limitations, this research presents a Kerberos-Assisted Secure Data Auditing Protocol (SDAP-K) that integrates authenticated service exchange with lightweight integrity verification for outsourced cloud storage. The proposed framework employs Kerberos-based mutual authentication and ticket-driven access control to establish secure communication among the Data Owner, Authentication Server, Metadata Server, and Cloud Data Server. To verify storage correctness, an N-ary hash tree with the Modified Murmur hash algorithm is used to enable efficient file- and block-level auditing without requiring a trusted third-party auditor. The framework further incorporates metadata-assisted auditing, dynamic data operations, and an error localization and recovery mechanism that identifies and restores corrupted data blocks. Security analysis demonstrates that the proposed protocol mitigates unauthorized access, replay attacks, impersonation attempts, and malicious data modification. Experimental results indicate that SDAP-K reduces storage execution time by 18.6%, retrieval time by 24.3%, update time by 21.8%, file-level auditing overhead by 31.5%, and block-level auditing latency by 36.2% compared with state-of-the-art research, while eliminating the need for a trusted third-party auditor. The results indicate that the proposed framework offers a practical, lightweight, and reliable solution for secure cloud data auditing in enterprise cloud storage environments.
Thangavel Murugan, Nasurudeen Ahamed Noor Mohamed Badusha, Priyan Malarvizhi Kumar et al.· Future Internet· 0 citations
The Secure Hardware Extension (SHE) provides crucial functionalities such as error-detection, authorization, and authentication of messages exchanged between Electronic Control Units (ECUs) over the Controller Area Network (CAN) bus with the help of Advanced Encryption Standard (AES) cryptographic cores. However, the security guarantees of SHE can be entirely compromised if an adversary with physical access to the vehicle extracts the secret key using power or electromagnetic side-channel measurements. While countermeasures like Threshold Implementation (TI) and Domain-Oriented Masking (DOM) offer robust protection, they are impractical for SHE due to the stringent resource constraints and real-time safety requirements of automotive systems. To address this critical vulnerability, this paper explores the concept of re-keying, utilizing two rounds of AES hardware as a lightweight key derivation function. This approach eliminates the need for additional key exchanges between the sender and receiver. Our experimental results, supported by theoretical analysis, indicate that re-keying every 10 encryptions provides a practical and secure solution that limits the effectiveness of side-channel attacks; leakage analysis performed on over 1,000,000 electromagnetic (EM) traces for this configuration revealed no detectable leakage. These findings are supported by real-world side-channel attack experiments conducted on a prototype implemented on the Cora-Z7 platform, built on Xilinx’s Zynq-7000 system featuring a single or dual-core 667 MHz ARM Cortex-A9 processor and Artix-7 FPGA. The proposed lightweight architecture, named LISHARK, maintains the same area footprint as a standalone AES core, making it significantly more efficient compared to TI and DOM. Measurements show that when integrated with the Secure Onboard Communication (SecOC) protocol, the design achieves end-to-end message authentication in approximately 90 microseconds, well within the industry-standard threshold of 10 milliseconds.
Soumi Chatterjee, Siddhartha Chowdhury, Urbi Chatterjee et al.· ACM Transactions on Embedded...· 0 citations
The efficient and secure management of healthcare records is crucial, as it contains sensitive medical information. Any modifications or tampering in the medical information can result in dreadful conditions due to the wrong diagnosis. Existing methods deployed for maintaining secure storage faced complexities due to larger key lengths, resource requirements, and interoperability issues across a broader deployment. Therefore, to address these limitations, the Dual Attentive Consensus mechanism‐enabled Authentication Security (DACAS) scheme is proposed in this research. Specifically, the Dual Attentive Consensus mechanism (DAC) handles the block creations and blockchain transactions to elevate the security against malicious validator nodes and balances the efficiency of the system. Moreover, the proposed method utilizes the dual verification mechanism that involves the Advanced Encryption Standard (AES) algorithm for encrypting the user credentials and the Elliptic Curve Digital Signature Algorithm (ECDSA) for signature generation, bolstering data integrity and authenticity. Additionally, the Ring Learning with Errors (RLWE) Homomorphic algorithm is employed to encode the patient data before storing it in the cloud via blockchain. The method generates the ciphertext without altering the original contents and improves the data integrity by providing strict privacy compliance. Extensive experiments demonstrate that the proposed DACAS scheme exhibits higher security, outperforming the existing BDSS and AES‐IDEA methods with a time delay of 1.48 ms, GUR of 0.902, gas usage of 13414.78, and verification time of 2.54 ms for evaluation over a data volume of 100 KB/patient and network size of 250 nodes. Further, the experimental results show that the DACAS scheme significantly lowers the processing cost of both encryption and decryption, while elevating the security level of data storage.
A. Cholke, S. Rajput, U. Mulani et al.· Concurrency and Computation· 0 citations
In this paper, a behaviour-sensitive session orchestration architecture over secure communication and the rationale behind it will be proposed and discussed, which is a variant of mixed public-key cryptography that aims at offering more manageable, secret, and authenticity in real-time messaging infrastructure. The architecture incorporates the use of RSA and Diffie Hellman in ensuring the setup of user sessions and relies on AES to encrypt instantaneous messages very quickly. Multi-fernet algorithm supports the distribution of session keys and ensures that the key is recovered by the authorized parties only. There are also digital signatures based on RSA that facilitate authentication and non-repudiation but strong hash algorithms are applied to ensure the privacy of user passwords. The system has collaborative features along with cryptographic protection, including co-host delegation, active user blocking, permissions and multi-session to support multi-user logins. Also, the design enables the dynamically updating of the authentication credentials without disruption of the existing communication. The suggested hybrid configuration has a higher level of defense against cryptographic attacks and unauthorized access than single algorithm implementations, which is why it is a more robust and secure solution. In conclusion, the provided solution contributes to the fact that the process of communication in the environment of multi-users becomes much safer, convenient, and manageable.
Tiyasa Paul, Rohan Samanta, Pratik Saha et al.· Interdisciplinary Journal of...· 0 citations
The growing adoption of Cloud Computing has profoundly transformed the management of IT infrastructures by providing flexible, scalable, and on-demand accessible resources. Among the various cloud computing service models, Infrastructure as a Service (IaaS) enables organizations to outsource their computing, networking, and storage resources to cloud providers. However, this outsourcing raises significant security concerns, particularly regarding the confidentiality, integrity, and availability of stored data. This paper presents an analytical study of storage security techniques in IaaS environments and examines the main threats that may affect data hosted in the cloud, including unauthorized access, misconfigurations, insider threats, and cyber attacks. Particular attention is given to cryptographic mechanisms used to protect data, including symmetric, asymmetric, and hybrid encryption techniques, as well as client-side and server-side encryption approaches. Based on this analysis, an enhanced secure storage architecture is proposed. This architecture relies on three main techniques: client-side data encryption using AES-256, encryption key protection through RSA, and the use of a Key Management System (KMS). It also incorporates secure communication protocols and enhanced authentication mechanisms. The objective is to ensure effective data protection while preserving the advantages provided by cloud infrastructures. The results of this study highlight the importance of combining robust encryption techniques, secure key management, and appropriate access control mechanisms to strengthen trust in cloud storage solutions. Finally, emerging approaches such as homomorphic encryption and Zero Trust architectures are presented as promising directions for future developments in cloud security.
Yahaya Coulibaly, Ouedraogo Paloute Karim Charlemagne, Ouedraogo Yann Christian Florian et al.· International Journal of Lat...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
