Abstract

Outsourcing of data storage and data processing to cloud-based service providers promise several advantages such as reduced maintenance overhead, elastic performance, high availability, and security. Cloud services offer a variety of functionalities for performing different operations on the data. However, during the processing of data in cloud, security and privacy may be compromised because of inadequate cryptographic implementation. Conventional encryption methods guarantee security during transport (data-in-transit) and storage (data-at-rest), but cannot prevent data leak during an operation on the data (data-in-use). Modern homomorphic encryption methods promise to solve this problem by applying different operations on encrypted data without knowing or deciphering the data. Cloud-based implementation of homomorphic cryptography has seen significant development in the recent past. However, data security, even with implemented homomorphic cryptography, is still dependent on the users and the application owners. This exposes the risk of introducing new attack surfaces. In this paper, we introduce a novel and one of the early attempts to model such new attack surfaces on the implementation of homomorphic encryption and map them to STRIDE threat model [1] which is proliferous used in the industry.

Published in:

International Journal on Cryptography and Information Security. (Volume:10)