Secure Authentication System for Hybrid Cloud Service in Mobile Communication Environments

Abstract

We want more cloud service because of computer resource reuse, server device cost, and space problems. So, related researchers suggest private cloud service to solve these problems in internetwork environment for only inner users. Therefore if outside users want to use private cloud service using mobile device, they do not support any services to outside user. Public cloud services can overcome private cloud services with the existing constraints. Amazon was the first public cloud service. In Korea, KT provide computing power and storage devices with payment. But this service is very expensive, so hybrid cloud service is developed. Hybrid cloud service operates mobile communication environment. User can contact to service using smart phone, tablet and PC. So, it has many security threats such as internet environment with server-client system. Furthermore, mobile device user wants more nomadic attribute and free contact to server through outside communication environments. So it can make many security problems to server. Therefore researcher must solve security threats in mobile communication environment with hybrid cloud service system. But now anybody have no idea about these problems. In this paper, we approach to user and mobile device authentication system with hybrid cloud service server. They have smart phone, Tablet, Ultrabook and PC to uses hybrid cloud service such as attribute based services. Our proposed authentication system can support user authorization, device certification and service authentication service to user very easily. It uses RADIUS method and Two-factor authentication schemes. So, we propose a secure authentication system for the hybrid cloud service in mobile communication environments in this paper. Our proposal scheme can provided security, availability, applicability, and resistance about Man-In-The-Middle attack.

1. Introduction

The cloud computing service can support the computer hardware or software resources to user conveniently. Cloud services have three kinds of service [1, 2]. First service is public cloud service that was suggested by Amazon to support high performance, huge volume storage to user. It will be able to provide user services using the virtualization techniques. Public cloud services have difficulty in making this service because they must have difficult knowledge and construct data about it. But they are able occur privacy, availability, or man-in-the-middle attack problems in the wired or mobile communication environments. So, public cloud user are lower about 22%.

The private cloud services can provide only users who are allowed from the inside of the enterprise. The private cloud service is very expensive method and it has many restrictions. So only the enterprises of 20% degree are using a service only from domestic.

Therefore, hybrid cloud services are only hopeful services. This service selects strong points between the public cloud service and private cloud services. This service must agree network, database, and security services between service providers before make services. And this is a very difficult [3].

Hybrid cloud services must understand secure weak points of private cloud services and public cloud services. And they must support a way of resolving the security threats. They must provide a secure authentication system for hybrid cloud services in mobile communication environments.

Therefore, hybrid cloud service provider must understand secure weak points for private and public cloud service and they must support suitable security services to hybrid cloud service users such as user and device authentication service. Hybrid cloud service must have three security services that are very important. First, user authorization is a user identification and access control service. Second service is a mobile device authentication service such as smart phone, tablet, and PC. Third, hybrid cloud service user requested data or its stored media must have authentication service for them.

Two-factor authentication service was researched by related researcher for hybrid cloud service user to suitable service. It is a simple authorization scheme. And it uses two factors for authorization of user information such as ID, password, and another authorization factor—one-time token. Therefore, we propose the novel authentication system that mixes two-factor authorization scheme and RADIUS authentication methods in mobile communication environments. We will call this system new hybrid cloud authentication system. We can provide authentication differentiated services for public cloud service using the 2-Factor existing authentication systems. And RADIUS (Remote Authentication Dial-In User Service) provides authentication service to inside user with private cloud service. Our new authentication system which we proposed is able to improve the safety, availability, and adaptability against conventional systems.

The paper is organized as follows. Section 2 is a related study. We explain characters of mobile communication environments, kinds of cloud services, RADIUS method, and two-factor authentication scheme in this section. We describe five security threats with hybrid cloud service, our proposed system architecture, and nine-step procedures in Section 3. Section 4 is system test and discussion. Last section is conclusion.

2. Related Works

In this paper, we describe three related works. First, we explain character of mobile communication environments and cloud services. RADIUS authentication method is second. It is a cross-authentication method for mobile communication environment such as between smart phone and wireless access points. Finally, we describe two-factor authorization scheme [4, 5].

2.1. Characters of Mobile Communication Environments and Cloud Service [2, 6]

Characters of mobile communication environments are wired network environment using PC, terminal, and so on. Wireless network environments using smart phones or other mobile devices. Today, many users have PC, tablet, smart phone, and other devices. And they have behavior of nomadic and multiplayer ability. So, future communication environment must support mobile communication environments and ability.

In the example, student has desktop PC in his home. And he have a smart phone and tablet or ultrathin notebook in his school. And he is going to go to school at morning and is working for his study in school. And he comes back to his home using fast mobility vehicle or subway and he can use his smart phone or tablet. In this time, on the vehicle or subway if he wants to use his individual information using hybrid cloud service for his job, then he must have cloud service authentication method.

But existed authentication method cannot provide secure authentication method in these environment. It is because of the following three reasons. First, the professor assigned homework to the student, the professor must be sure to authenticate the student's PC. However, the student's mobile device such as smart phone, tablet, and ultrabook that is very difficult to authenticate. Because student's mobile devices have high mobility. Second, the student is using hybrid cloud services to do homework, the students will use their skills to provide hardware or software virtualization. In this time, the cloud environment using virtualization technology embedded in many devices, it is difficult to authenticate. Third, the student use software by software virtualization from cloud server, the professor must certification. But student connected a virtual cloud services to authenticate the software have many way.

Cloud services are divided into three types. First, private cloud services will build by enterprise using these's own hardware and software. This is a very powerful method, enterprise cloud be provide this service to the user. But this service's cost is very expensive. And this service's maintenance is very difficult because whenever you need to this service, service provider make individual service and bind many resources such as each hardware and software. Second, public cloud services such as Amazon connect to the server or storage devices cloud services to users. This allows the user to easily configure devices without having to purchase of hardware devices. But every time user use this service, the user must pay the costs about used device or software. Third, hybrid cloud services must provide authentication services to users such as private cloud service. And this must support many resources to user such as public cloud service. Hybrid cloud service can support efficient to user by various way. But this is very difficult. Because cloud service provider is difficult to find a way of cheaper private cloud service making. And they need obtain consent to many hardware devices producer, software producer, and network service providers. As a public cloud service, so that the shape of the internal as well as external users of your cloud services are configured to use it.

2.2. RADIUS (Remote Authentication Dial-In User Service)

RADIUS is the authentication method with a token between mobile device user and wireless access pointer. The authentication server can generate a token and send it to user. Token uses device authentication by this owner and user identification. Figure 1 shows example of RADIUS architecture.

Figure 1

RADIUS.

As shown in Figure 1, user of outside must request authentication way to inside RADIUS server for using computer resources such as hardware or software resource. Smart phone users in the extra network must request token for device certification to RADIUS server in the internal network using wired or wireless internet environment. Then RADIUS server checks smart phone certification by device information. And if smart phone have alright device information, RADIUS server generates the token and transmits token to smart phone users. Next time, smart phone user connects VPN server for user certification using token and more individual information. When smart phone user have alright user authentication, VPN server allow smart phone user wanted cloud service. And smart phone user can use cloud service as well as SaaS (Software as a Service). RADIUS server have many complex procedures for device and user authentication. And But RADIUS server cannot provide complement security services. This is a disadvantage in RADIUS server scheme.

2.3. Two-Factor Authentication Service [7–11]

Generally, the authentication service is to check a user or device certification. In this time, authentication server want to receive about user or device information such as ID, Password, Bioinformatics, and so on. And this server check to certificate is correct. Traditional authentication method confirm user ID and password for certificate. However, this method is too easy and not secure. So, a new authentication method propose recently that is two-factor authentication. this is very conventional method. Traditional authentication check a single identity information such as ID and password fairs. But two-factor authentication check more two authenticate information such as ID and password fair, token, and one-time password, random number. This is more secure, convenient authentication method in mobile communication environment.

Hybrid cloud service environment need two-factor authentication method for more secure certificate against of ID and password fair, SSO, PKI methods. Two-factor authentication system can support various token. So, our proposed system approach two-factor authentication method by ID and password fair with token. Token have user id, device information, time, date, and random number. And another certificate information is USIM, MTM, and anthings. Figure 2 shows an example of a method that can provide a two-factor authentication service.

Figure 2

Example of 2-factor authentication service (used ID-PW and token).

As shown in Figure 2, cloud service user sends ${ID ∣ PW}$ only two pairs of information in general but it is very simple. So, this scheme is very dangerous. So researcher approaches two-factor authentication system. It adds some token such as time-stamp or one-time token. And authentication server requests second authentication information user such as extended token. Next, user makes extended token and transmits server then authentication server checks extended token and allows or rejects user request.

Like this, two-factor authentication server can provide general authentication token such as ${ID ∣ PW}$ and extend token. This way is very easy and strong authentication way for mobile communication environment using smart phone or tablet and ultrabook.

3. Proposal System

In this section, we propose new hybrid cloud service authentication system architecture and procedures using two-factor authentication scheme and RADIUS server. Furthermore, our proposal system solve security threats in wireless communication environment. So we will describe about it at next section.

3.1. Security Threats in Hybrid Cloud Service [2, 6, 12–14]

We must understand security threats in hybrid cloud computing environments to propose authentication system suitable for hybrid cloud services. So we will divide and describe five kinds of threats that as follows. (1)

First is man-in-the-middle attack or man-in-the-middle-browser attack. this threat happen between authentication server on internal network and outside user such as smart phone, tablet.

(i)

Generally, right outside user connect Win2008 RADIUS server for check his identification information. And Win2008 RADIUS server checks user and user's device identification. When attacker can man-in-the-middle attack using cheat user information in the intranetwork. Or he can try man-in-the-middle-browser attack by masquerade his individual information against alright user's identification information.

(2)

Second threat is DoS or DDoS attack.

(i)

DoS (Denial of Service) or DDoS (Distributed Denial of Service) attack can happen in the internal network by inner user that don't want to it. Furthermore mobile environment have many vulnerabilities. Because mobile device don't have completed security check about software, memory management, and deployment of app. So, attacker can insert DoS or DDoS agent to mobile device easily. And when the attack time, many mobile device on the outside network will attack to hybrid cloud service server. This is Zero-day attack skill.

(3)

Third threat is location certification attack. On the outside, mobile devices move very frequently. But, mobile device's location information is very important for it's certification.

(i)

Win2008 RADIUS server cannot solve every authentication problems for mobile device. Among many authentication threats, location based authentication problems is very important in mobile communication environment. Because location information is component of token.

(4)

Fourth threat is script attack weakness by inside attacker.

(i)

Every internal user are don't trusted user. Someone can attack authentication server, VPN server, or cloud service server by steal and modify the alright information. So, this is a problem in hybrid cloud service with mobile device such as smart phone and tablet.

(5)

Fifth threat is outside user authentication for public cloud service.

(i)

Simple user identification is very easy and fast using ${ID ∣ PW}$ . Many general authentication systems use it. No matter how your server is a trusted internal network, if any, in the internal network to an external network authentication service cannot authenticate all users. In this case, the external network to the internal network users to request services in a hybrid cloud, the problem is severe.

As in the list shown above, general network security vulnerabilities can occur in the hybrid cloud computing environment with mobile devices. And this environment has various special vulnerabilities.

3.2. Proposal System

We propose new authentication system suitable for hybrid cloud services in mobile communication environment. Our proposal system have five sub components on server. First is RADIUS module that checks outside user authorization and device authentication using RADIUS and two-factor token method. Second module is Hash machine that checks data integrity between user and mobile device access point. Connect_manager is a third component. This module checks session between mobile device user and inside hybrid cloud service server. Firth component is User_manager. This module stores, deletes, modifies, and checks user individual information such as ID, PW, MAC, time stamp, and RND in these database. Finally, Service_manager module provides software cloud service to user by attribute certificate method. Figure 3 shows our proposal system architecture briefly.

Figure 3

Architecture of proposal system.

And client system has three modules. First, client system has RADIUS module like hybrid cloud server. Client system request to server that check mobile device and user authentication in this module. Second, Hash machine checks integrity of transmitted data between server and client against of cracker. Last, Connect_requester is wireless communication request module that manages mobile device communication session and service request and response.

3.3. Procedures of Our Proposal System

Our authentication system for hybrid cloud services performs 9-step processing procedures. This is divided into two stages. Figure 4 shows it.

Figure 4

Procedure of proposal system.

The first stage has 5 steps for user and device identification between internal user and RADIUS server. Inside user or outside user has mobile device that must save these individual user and device information at RADIUS server in first approach time. We explain this stage with RADIUS server. Steps from 1 to 5 show more details of these procedures. (1)

IU → RADIUS: Req_User_Auth $(ID ∣ PW ∣ IP ∣ MAC)$ .

(i)

Internal user send identity, password, IP address, and MAC address to RADIUS server for user and device authentication. In this time, ID, PW, IP, MAC was saved RADIUS server's database at the before time.

(2)

RADIUS checks Req_User_Auth $(ID ∣ PW ∣ IP ∣ MAC)$ .

(i)

RADIUS server save user transfer data such as ID, password, IP address, MAC address at the last time. And RADIUS find user's saved information on the database. If user transfer data equal find data, RADIUS server response user's authentication. But if user transfer data don't equal, RADIUS server don't allow user's approach.

(3)

RADIUS → IU: response (one-time token).

(i)

If RADIUS checks that result is right, server sends response (one-time token). Response (one-time token) has IP, MAC, time-stamp, and RND calculated by Hash 256 function.

(ii)

One-time token consists of user device IP, media access control address, time-stamp value, random number. time-stamp value is time at server location. Random number is a pseudorandom value that makes server and user use random algorithm on each devices.

(iii)

One-time token = Hash256 $(IP ∣ MAC ∣ time - stamp ∣ RND)$ .

(4)

IU → RADIUS: response (OTT).

(i)

Internal user make OTT and send it to RADIUS server for device authentication more securely. OTT consist of PC's IP, MAC address, and RADIUS transferred one-time token. This can verify attacker's data modification.

(ii)

OTT = Hash256 $(IP ∣ MAC ∣ time stamp + Reserve ∣ RND + Reserve)$ .

(iii)

Reverse is kind of random number. IU select random number and exclusive-or calculation with RADIUS's one-time token.

(iv)

OTT can prove user request is right.

(5)

RADIUS check IU's OTT and accept IU authentication.

(i)

OTT2 = Hash256 $(OTT + Reserve 2 ∣ RND + Reserve 2)$ .

(ii)

RADIUS server checks user request by OTT. If this result is right, RADIUS accepts and finally check OTT2.

(iii)

OTT2 consists of OTT + Reserve2 and RND + Reserve2. Reserve2 is a another random value for integrity checks.

This is the first stage. And next stage have 4 steps when External user request hybrid cloud service and Hash machine check and response HASH_VAL. This procedures process to mobile device user connects to cloud server and request service.

(6)

Hash machine → EU: Req_Ext_Auth $(ID ∣ IP)$ .

(i)

External user connects and requests hybrid cloud service to hybrid cloud server and then Hash machine requests to send user ID and smart phone IP address. And Hash machine waits to user response about it.

(7)

EU → Hash machine: Res_Ext_Auth (HASH_VAL).

(i)

HASH_VAL = Hash256 $(USIM ∣ IP ∣ MAC)$ .

(ii)

USIM = {user information ∣ phone number ∣ identification number of provider}.

(iii)

External user makes HASH_VAL. This is a Hash value. It consist of USIM information, IP address, and MAC address. It can provide to user masquerading attack resistant ability. USIM is a simple universal secure identification number.

(8)

Hash module checks HASH_VAL.

(i)

USIM hash Check Server verify user transmitted HASH_VAL. If this is alright, USIM hash Check server allow user's hybrid cloud service request. But if this wrong, External user don't use it.

(9)

Hash module → EU: connected.

(i)

Between cloud server and external user, they keep up this connection state. This session don't disconnect while external user and hybrid cloud service wanted.

We describe our proposal system procedures 9 steps. In the next section.

4. Test and Discussion

We try to test to our new authentication system for hybrid cloud service in mobile communication environments. Therefore we suggest test environment such as Figure 5. Our test environment have 4 components. External user is user that have mobile device on outside network. RADIUS is authentication server. Internal user is user that have PC on inside network. SaaS is hybrid cloud service server that have MS-Office 2012 software such as MS-Word, MS-powerpoint, MS-Excel, and MS-Access. We will test authentication, confidentiality, integrity, MITBM [15–17].

Figure 5

Test system procedure of our proposal scheme.

4.1. Test Scenario

Figure 5 shows our test scenario. External user has mobile device such as smart phone and tablet and internal user uses PC to connect SaaS.

We construct SaaS group that have MS Office software such as MS Word 2012, MS PowerPoint 2012, and MS Excel 2012 and some PC has a printing service. Internal user connect cloud service using his desktop on inside network. But external user connect cloud service using only mobile device. Our test scenario have 9 steps. More detail test scenario shows Figure 5 that have 9 steps like our proposed authentication system that we were described it. (1)

Smart phone 1 connects to cloud server through RADIUS checks using outside communication environment. Then RADIUS verifies mobile device identification and user authorization.

(2)

Next, every verified user request connects SaaS service to server.

(3)

Tablet 1 is untrusted user that calls cracker. He wants to steal smart phone 1's ${ID ∣ PW}$ data and masquerade his individual information.

(4)

Smart phone 2 user has right user authorization information but he masquerades his device information like tablet user. So he modifies his device information and steals tablets transmit data using script edit attack method.

We explain test scenario with 4 steps. step 3 and 4 are security attack. Generally, step 3 is external user's information stealing and masquerading. And step 4 is script attack such as MITBM. This is very popular attack method.

4.2. Discussion

We consider our proposal system by upper test scenario [18]. (1)

Confidentiality: authentication system of hybrid cloud proposed is safe middle browser attacks and man-in-the-middle attacks. We use IDEA, Tight, and Seed security algorithm that can support confidentiality service to user. If attacker steal between hybrid cloud server and internal or external user's transferred data, but he don't read it. Because it is encrypted by security algorithm.

(2)

Integrity: external device user must generate token between user and RADIUS server for user and device authentication. In this time, Hash module makes token and one-time token. This method vouches integrity service. So, if someone modifies user authorization and device certification data, HASH-VAL must change insignificant data. Therefore they do not use it repudiate.

(3)

Availability: our proposed system provide availability service because our RADIUS server locate DMZ area. So, attacker don't attack our RADIUS server. and hybrid cloud server more secure inner zone.

(4)

Resist of script modify attack: our proposed system can vouch resist of script modify attack by Hash value and integrity algorithm. If someone tries to script attack, he must change Hash value. But this is very difficult because Hash value does not support return value known.

In this paper, we propose authentication system for hybrid cloud service. Our proposal system can support 4 security services such as confidentiality, integrity, availability, and resist of script modify attack. We will more complete test and evaluate our proposal system after study.

5. Conclusion

Latest virtualization technologies and cloud services is rapidly developing. Moreover, communication environment change from existing each wired network and wireless network to wired/wireless integrated network environment. Because the user need a hybrid cloud service in the integrated network environment. And we have proposed an authentication system for hybrid cloud services wired/wireless integrated network that provide device and user authenticate service.

However, hybrid cloud services is extremely low in the wired/wireless integrated network environment. moreover, this system will provide authentication and security services is very low. Hybrid cloud service provider must support user device and user authentication and security service in wired/wireless communication environment. But this system is don't appear now. Therefore we proposed this system similar environment in this paper. We designed RADIUS authentication server and add two-factor authentication system on the our proposed system. Our proposed system can support device and user authentication service and the confidentiality and integrity can provided. Our proposed system good compared with existing hybrid cloud system in terms of the authentication service, confidentiality and integrity services. Furthermore, our system can provide devices authentication in wired network environment also it can lightweight and fast in the wireless communication environment.

We was explain proposed system design and operating procedures. And describe about our proposed system test scenario above In this paper. We will study extended test and experimental results on future research.

Footnotes

Conflict of Interests

The authors have no conflict of interests related to the conducting and reporting of this research.

References

Kim

T. H.

Kim

I. H.

Min

C. W.

Yeom

Y. I.

Security technical trend of cloud computing

Computer Science Managine 2012 30 1 30 38

Bang

Y. H.

Jeong

S. J.

Hwang

S. M.

Security requirement development tools of mobile cloud system

Information and Communications Magazine 2011 28 10 19 29

Jansen

Grance

Guidelines on security and privacy in public cloud computing

2011

Amazon, AWS http://aws.amazon.com/

Azure http://www.windowsazure.com/en-us/

Hubbard

Sutton

Top Threats to Cloud Computing V1.0 March 2010

Cloud Security Alliance

Mannan

Kim

B. H.

Ganjali

Lie

Unicorn: two-factor attestation for data security

Proceedings of the 18th ACM Conference on Computer and Communications Security (CCS '11)

October 2011

17 28

2-s2.0-80755187832

10.1145/2046707.2046712

Lakshmiraghavan

Two-factor authentication

Book of Securiing ASP.Net Web API 2013 chapter 5 319 343

Abhishek

Roshan

Kumar

Ranjan

A comprehensive study on two-factor authentication with one time passwords

Computer Networks & Communications (NetCom) 2013 131

Springer

405 415 Lecture Notes of Electrical Engineering

10.

Wang

C.-S.

A two-factor authentication mechanism in the cloud environment [M.S. thesis] 2012

SHU

11.

Lee

Research on access control method by user authority using two-factor authentication

Proceedings of the 1st International Conference on Convergence and It's Applicatio (ICCA '013)

172 175

12.

Liao

I.-E.

Lee

C.-C.

Hwang

M.-S.

A password authentication scheme over insecure networks

Journal of Computer and System Sciences 2006 72 4 727 740

2-s2.0-33748126252

10.1016/j.jcss.2005.10.001

13.

Vignos

Kim

Metzer

R. L.

Demystifying the fog: cloud computing form a risk management perspective

Journal of Information Systems Applied Research 2013 6 3

14.

Chen

G. F.

Zeng

G. W.

Research and application of cloud computing technology inf agricultural information resources sharing service

International Journal of Advanced Materials Research 2013 756 1522 1526

15.

Howell-Barber

Lawler

Desai

Joseph

A study of cloud computing software-as-a-service(SaaS) in financial firms

Journal of Information Systems Applied Research 2013 6 3

16.

Hong

Nirjon

Stankovic

J. A.

Stone

D. J.

Shen

A mobile-cloud service for physiological anomaly detection on smart-phones

Proceedings of the 12th International Conference on Information Processing in Sensor Networks (IPSN '13)

2013

327 328

17.

Yang

Kandula

Zhang

CloudCmp: comparing public cloud providers

Proceedings of the ACM SIGCOMM Conference

2012

702 713

18.

Biswas

Roy

Roy Chowdhury

Cloud service: cost efficitve stragegy to manage cloud services

International Journal of Computer Applications 2013 71 9 33 38