Data security in cloud computing - Part 2: Data encryption applications and limits

Introduced in Chapter 1 (Cloud Computing and Security: An Introduction), cryptography is a complex and esoteric field. In modern times, cryptography has expanded from protecting the confidentiality of private communications to including techniques for assuring content integrity, identity authentication, and digital signatures along with a range of secure computing techniques. Given that range of functional utility, cryptography has been recognized as being a critical enabling technology for security in cloud computing. Focusing on data security, cryptography has great value for cloud computing.

To effect cryptographic data confidentiality, plaintext is converted into cyphertext by numerous means, but the ones of practical value are all based on mathematical functions that must meet several requirements, including:

• The algorithm and implementation must be computationally efficient in converting plaintext to cyphertext, as well as in decryption.

• The algorithm must be open to broad analysis by a community of cryptographers and others.

• The resulting output must withstand the use of brute force attacks even by vast numbers of computers (such as in a computing grid or cloud).

In operation, plaintext is encrypted into cyphertext using an encryption key, and the resulting cyphertext is later decrypted using a decryption key. In Symmetric cryptography, these keys are the same (Figure 5.3).

Symmetric cryptography has broad applicability, but when it is used in communication between parties, the complexity of key management can become untenable since each pair of communicators should share a unique secret key. It is also very difficult to establish a secret key between communicating parties when a secure channel does not already exist for them to securely exchange a shared secret key.

By contrast, with asymmetric cryptography (also known as in public–private key cryptography), the encrypt key (public key) is different but mathematically related to the decrypt or private key (Figure 5.4).

The primary advantage of asymmetric cryptography is that only the private key must be kept secret—the public key can be published and need not be secret. Although public–private key pairs are related, it is infeasible to computationally derive a private key from a public key.

This use of public–private keys is a great enabler for confidentiality in cloud computing, and not just for encryption of content. A private key can be used to authenticate a user or computational component, and it can also be used to initiate the negotiation of a secure channel or connection between communicating parties.

Going one level deeper in our background treatment of cryptography, for the purpose of this book, there are four basic uses of cryptography:

• Block Ciphers These take as input a key along with a block of plaintext and output a block of cyphertext. Because messages are generally larger than a defined block, this method requires some method to associate or knit together successive cyphertext blocks.

• Stream Ciphers These operate against an arbitrarily long stream of input data, which is converted to an equivalent output stream of cyphertext.

• Cryptographic Hash Functions Hash functions take an arbitrarily long input message and output a short, fixed length hash. A hash can serve various purposes, including as a digital signature or as a means to verify the integrity of the message.

• Authentication Cryptography is also widely used within authentication and identity management systems.

Although cryptography is a cornerstone of security, many an adopter has insecurely used it or worse attempted to implement cryptography to either save money or cut corners. The field of cryptography is well beyond the scope of this book, so the reader is encouraged to refer to widely available texts on cryptography in order to develop a better understanding of cryptography, its implementation, and secure application.