Web Application Security on Top of Public Cloud

Abstract

The prevalence of Microservices has made it quintessential to build web applications in a Cloud-Native fashion. While building applications in a cloud-native way, almost the entire infrastructure of an organization relies on an arbitrary Cloud Service Provider’s data center as the individual components of the organization’s on-premise infrastructure are morphed into the modern Infrastructure as a Service(IaaS) model in pay-as-you-go strategy. In this scenario, every Cloud Service Provider(CSP) ensures that they are responsible for securing the data at rest. But the data in transit is left to the user’s responsibility. Some prominent Cloud Service Providers offer services to encrypt the data in-transit as well. But under such circumstances, a copy of our enciphering keys are in any way kept under their premises which in turn is undesirable for many individual users and organizations. So, the solution is to do Client Side Encryption(CSE) to ensure the security ourselves. We are proposing a cryptosystem such that it solidifies the integrity of in-transit data by implementing the Homomorphic encryption technique using a modified form of RSA algorithm. (A study on in-flight data security using cloud services is also done.)