Threat Modeling of Cloud based Implementation of Homomorphic Encryption

Threat Modeling of Cloud based Implementation of Homomorphic Encryption Corresponding Authors: Satish K Sreenivasaiah and Soumya Maity, REVA University, India Abstract Outsourcing of data storage and data processing to cloud-based service providers promises several advantages such as reduced maintenance overhead, elastic performance, high availability, and security. Cloud services offer a variety of functionalities for performing different operations on the data. However, during the processing of data in cloud, security and privacy may be compromised because of inadequate cryptographic implementation. Conventional encryption methods guarantee security during transport (data-in-transit) and storage (data-at-rest), but cannot prevent data leak during an operation on the data (data-in-use). Modern homomorphic encryption methods promise to solve this problem by applying different operations on encrypted data without knowing or deciphering the data. Cloud-based implementation of homomorphic cryptography has seen significant development in the recent past. However, data security, even with implemented homomorphic cryptography, is still dependant on the users and the application owners. This exposes the risk of introducing new attack surfaces. In this paper, we introduce a novel and one of the early attempts to model such new attack surfaces on the implementation of homomorphic encryption and map them to STRIDE threat model [1] which is proliferously used in the industry.