Attacks on the anti-collusion data sharing scheme for dynamic groups in the cloud

Abstract

As the hype of the evolution of cloud computing has become a real possibility in the modern day outsourcing scenarios, users can benefit from cloud computing by uploading documents into the cloud servers for sharing it among a group of legitimate users. But, though cloud is a viable present day option for elastic storage facilities, its security is still a grave concern. Hence, in order to improve the secure communication among group members, Zhu and Jiang have proposed a protocol and claimed that key distribution to the group users can be done without any secure communication channels. They have claimed that their scheme is resistant to collusion attack and all the other attacks, thereby ensuring forward and backward secrecies as well. Firstly, in this research work, after extensive analysis, we have identified several issues in the protocol proposed by Zhu and Jiang which make it vulnerable to various attacks. Secondly, we have proved that an attacker can use the man-in-the-middle attack and break the protocol thereby getting the secret keys shared between the group manager and the group user. Thirdly, we have given enough proof that the scheme is vulnerable to message modification attack too. Finally, we claim that the earlier proposed protocol is not secure and a new protocol with improved security is the need of the hour.