# SASC: Secure and Authentication-Based Sensor Cloud Architecture for Intelligent Internet of Things
## 3 The Proposed Secure and Authentic Sensor Cloud Architecture
### Cloud-Based Data Security Algorithm  
In this algorithm, cloud infrastructure is integrated with sensor networks to support the processing of network management and efficient deployment of resources. Although there are several benefits of sensor cloud such as network scalability, computing, and data storage, security is mostly open research issue under the presence of malicious threats and a variety of attacks may be possible. In such a paradigm, the traditional solutions of sensor networks are not appropriate and realistic for cloud infrastructure [66; 67]. The proposed algorithm copes with data security in terms of confidentiality, integrity, and authentication based on light-weight cryptosystems. The proposed algorithm prevents malicious nodes from disclosure and tampering of network data. The data security between the BS (\(B_{i}\) ) and the cloud server is achieved through the use of an asymmetric based encryption technique. In this technique, the BS and cloud server generate a pair of keys (\(k_{p}\) and \(k_{u}\)), whereas \(k_{p}\) and \(k_{u}\) represents the public and private keys, respectively, where the control of private keys is limited to the cloud server and BS. The generated public keys are used for data encryption and they are shared via a publicly accessible directory that is created on the cloud server. Moreover, the stored public keys on a cloud server are associated with the ID of generated systems. On the other hand, the private keys are not distributed because they are needed to be kept secret. Therefore, they do not leave the system on which it was produced. Similarly, all nodes generate their pair of private-public keys only once and store the public keys along with their IDs on the publicly reachable directory, which is made on the cloud server. In the proposed architecture, the generation of private-public keys is based on the public key cryptosystem of RSA [68]. In the RSA cryptosystem, the key generation is the most important step, where two distinct keys are generated. In this process, two primes p and q are chosen which are kept a secret, and their product \(n=p*q\) is compute. In the next step, \(\lambda(n)\) is computed, where \(\lambda\) is [PERSON]'s totient function with \(\lambda(n)=lcm(p-1,q-1)\). Furthermore, an integer e coprime to \(\lambda(n)\) is chosen which satisfies the two condition, i.e., \(1<\) e \(<\)\(\lambda(n)\) and \(\gcd(e,\lambda(n))\). Finally, determine \(d\equiv e^{-1}(mod\,\lambda(n))\), where d is the modular multiplicative inverse of e. Thus, the generated public keys are \((e,n)\) and the private keys are \((d,n)\). The encryption of the data 'D' from the BS towards the cloud server is accomplished by computing Equation (2). \[E\equiv\ D^{e}(mod\ n) \tag{2}\]  
The cloud server can decrypt the encrypted data E using Equation (3). \[D\equiv E^{d}(mod\ n) \tag{3}\]  
For authenticating the cluster heads ( \(U_{j}\)) in the network, the MAC technique is used with each data packet transmitted between the cluster heads and BS. A cluster head \(U_{i}\) integrates the data 'D' with the private key to generate a short MAC or digital signature. Upon receiving the data 'D', the cluster head \(U_{j}\) verifies the MAC or digital signature using the corresponding public key of cluster head \(U_{i}\)For transmitting data \(D_{U_{i}}\) from the cluster heads to the BS, the data \(D_{U_{i}}\) is XORed with the key \(k_{i}\) to produce a MAC or signature \(AD\) of the data, as given in Equation (4). \[AD=D_{U_{i}}\oplus k_{i} \tag{4}\]  
\[ND=AD+D_{U_{i}} \tag{5}\]  
The ND is transmitted from the BS towards the cloud server by encrypting it through the public key generated using the RSA cryptosystem, as given by Equation (2). Upon receiving the encrypted data, the cloud server first decrypts the data using its private key \(k_{u}\). Moreover, the private-public key is the combination of well-defined security techniques and offers prevention from impersonation attacks.