A Secure Cloud-Based Framework for Data Storage and Access Control

Abstract

Cloud storage improves availability, scalability, and cost efficiency, but outsourcing sensitive data to infrastructure outside the data owner’s direct control creates persistent risks involving confidentiality, unauthorized access, insider exposure, key compromise, data tampering, and ineffective revocation. This methodology paper proposes a secure cloud-based framework that combines client-side hybrid encryption, ciphertext-policy attribute-based encryption (CP-ABE) for fine-grained key release, an identity and attribute authority, policy decision services, controlled key rotation, integrity verification, and tamper-evident audit logging. The framework follows a zero-trust assumption toward cloud storage: the cloud stores ciphertext and security metadata but is not relied upon to preserve plaintext confidentiality. A step-by-step methodology defines threat modeling, data classification, encryption and key encapsulation, authorization, secure retrieval, revocation, integrity auditing, and evaluation. The design is evaluated through security-control test cases and a lightweight prototype microbenchmark of AES-256-GCM, SHA-256, and attribute-policy evaluation. Results show that encryption and integrity overhead scale mainly with file size, while local policy evaluation remains negligible compared with bulk cryptographic processing. The architecture therefore separates high-throughput data encryption from more expressive access-control cryptography, making the approach suitable for enterprise, research, healthcare, and multi-tenant cloud storage where access policies evolve over time. References are restricted to work published no later than 2021.