DOCSLIB.ORG

Securing Secrets and Managing Trust in Modern Computing Applications

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

Securing Secrets and Managing Trust in Modern Computing Applications by Andy Sayler B.S.E.E., Tufts University, 2011 M.S.C.S., University of Colorado, 2013 A thesis submitted to the Faculty of the Graduate School of the University of Colorado in partial fulfillment of the requirements for the degree of Doctor of Philosophy Department of Computer Science 2016 This thesis entitled: Securing Secrets and Managing Trust in Modern Computing Applications written by Andy Sayler has been approved for the Department of Computer Science Prof. Dirk Grunwald Prof. Eric Keller Prof. John Black Prof. Sangtae Ha Prof. Blake Reid Date The final copy of this thesis has been examined by the signatories, and we find that both the content and the form meet acceptable presentation standards of scholarly work in the above mentioned discipline. iii Sayler, Andy (Dissertation) Securing Secrets and Managing Trust in Modern Computing Applications Thesis directed by Prof. Dirk Grunwald The amount of digital data generated and stored by users increases every day. In order to protect this data, modern computing systems employ numerous cryptographic and access control solutions. Almost all of such solutions, however, require the keeping of certain secrets as the basis of their security models. How best to securely store and control access to these secrets is a significant challenge: such secrets must be stored in a manner that protects them from a variety of potentially malicious actors while still enabling the kinds of functionality users expect. This dissertation discusses a system for isolating secrets from the applications that rely on them and storing these secrets via a standardized, service-oriented secret storage system. This \Secret Storage as a Service" (SSaaS) model allows users to reduce the trust they must place in any single actor while still providing mechanisms to support a range of cloud-based, multi-user, and multi-device use cases. This dissertation contains the following contributions: an overview of the secret-storage prob- lem and how it relates to the security and privacy of modern computing systems and users, a frame- work for evaluating the degree by which one must trust various actors across a range of popular use cases and the mechanisms by which this trust can be violated, a description of the SSaaS model and how it helps avoid such trust and security failures, a discussion of how the SSaaS approach can integrate with and improve the security of a range of applications, an overview of Custos { a first-generation SSaaS prototype, an overview of Tutamen { a next-generation SSaaS prototypes, and an exploration of the legal and policy implications of the SSaaS ecosystem. Dedication Dedicated to Edward Snowden, Chelsea Manning, Bill Binney, Thomas Drake, Perry Fell- wock, Russ Tice, Mark Klein, Thomas Tamm, and all those who have risked and who will risk their lives and livelihoods to expose the privacy and security abuses of governments around the world. vii Acknowledgements This document could not have been completed without the assistance of a variety of indi- viduals. First, thanks to all of my committee members for their oversight, suggestions, and time. Dirk Grunwald, my advisor, provided numerous suggestions and coauthored the Custos and Tu- tamen papers that predated this document. Eric Keller provided suggestions and assistance on a variety of topics including the original Custos implementation that was undertaken as project for his course. Blake Reid provided the impetus for me to get more involved in the policy side of technology and was kind enough to have me as a member of the Colorado Technology Law and Policy Clinic (TLPC) during the Spring of 2015. John Black and Sangtae Ha have both provided suggestions and answers a variety of technical questions. Beyond those that served on my committee, many other individuals also provided technical support and insights. Matt Monaco provided the implementation of the Tutamen dm-crypt FDE client and is a coauthor on the Tutamen paper. Taylor Andrews provided the Tutamen-backed encrypted Dropbox client implementation and is also a coauthor on the Tutamen paper. Joseph Lorenzo Hall and Erik Stallman both provided mentorship and guidance on a variety of security and policy topics during my time in Washington, DC at the Center for Democracy and Technology. Finally, a big thanks to my partner Denali Hussin for her continual support throughout my time as a PhD student, as well as her editing support on a range of (overly) verbose technical documents. Thanks also to my parents Mike and Lori for their 27+ years of support and assistance. And thanks to all those who assisted and supported my efforts, but whom I have unintentionally failed to mention here. Contents Chapter 1 Introduction 1 1.1 Overview..........................................1 1.2 Motivating Examples....................................3 1.3 Goals............................................6 2 Background 9 2.1 Cryptography........................................9 2.1.1 Symmetric Cryptography.............................9 2.1.2 Asymmetric Cryptography............................ 11 2.1.3 Secret Sharing................................... 14 2.2 Usability........................................... 15 2.3 Storage........................................... 16 2.4 Access Control....................................... 19 2.5 The Cloud.......................................... 22 2.5.1 Benefits....................................... 22 2.5.2 Service Classes................................... 24 2.5.3 Enabling Technologies............................... 25 3 Challenges to Privacy and Security 27 3.1 Modern Use Cases..................................... 27 x 3.1.1 Consumer Use Cases................................ 28 3.1.2 Developer Use Cases................................ 34 3.2 Threats to Security and Privacy.............................. 37 3.2.1 Misuse of Data................................... 37 3.2.2 Data Breaches................................... 38 3.2.3 Government Intrusion............................... 40 3.2.4 Physical Security.................................. 42 3.3 Need for New Solutions.................................. 43 4 Related Work 47 4.1 Trust, Threat, and Security Models............................ 47 4.2 Minimizing Third Party Trust............................... 48 4.2.1 Cryptographic Access Control........................... 49 4.2.2 Homomorphic Encryption............................. 50 4.2.3 Secure Storage................................... 51 4.3 Enhancing End User Security............................... 52 4.3.1 Communication Tools............................... 52 4.3.2 Password Managers................................ 53 4.3.3 Storage Tools.................................... 54 4.4 Key and Secret Management Systems.......................... 55 4.4.1 Key Management in Storage Systems...................... 56 4.4.2 Key Escrow..................................... 56 4.4.3 Automated and Cloud-based Secret Management................ 57 5 An Issue of Trust 61 5.1 Analyses Framework.................................... 61 5.2 Traditional Model..................................... 64 5.3 SSaaS Model........................................ 66 xi 5.4 Trust Survey of Existing Systems............................. 68 5.4.1 Cloud File Storage................................. 71 5.4.2 Social Media.................................... 73 5.4.3 Communications.................................. 74 5.4.4 Password Managers................................ 77 5.4.5 Cloud Infrastructure Services........................... 78 5.4.6 SSaaS Alternatives................................. 79 6 Secret Storage as a Service 83 6.1 Architecture......................................... 84 6.1.1 Stored Secrets................................... 84 6.1.2 Secret Storage Providers.............................. 85 6.1.3 Clients........................................ 88 6.2 Economics.......................................... 89 6.3 Security and Trust..................................... 92 7 SSaaS Applications 95 7.1 Common Patterns and Challenges............................ 95 7.1.1 SSaaS Metadata Storage.............................. 95 7.1.2 Data Granularity.................................. 98 7.2 Use of SSaaS Libraries and Utility Programs...................... 99 7.3 Storage........................................... 100 7.3.1 Cloud File Sync/Storage.............................. 101 7.3.2 Server Data Encryption.............................. 102 7.3.3 Mobile Device Encryption............................. 103 7.3.4 Personal Data Repository............................. 105 7.4 Communication....................................... 106 7.5 Authentication....................................... 107 xii 7.5.1 SSH Agent Key Management........................... 108 7.5.2 SSH Server Key Management........................... 110 7.6 Dedicated Crypto-Processor................................ 112 8 Custos: A First-Generation SSaaS Prototype 115 8.1 Architecture......................................... 115 8.1.1 Access Control................................... 116 8.1.2 Protocol....................................... 122 8.2 Implementation....................................... 123 8.2.1 SSP Server..................................... 123 8.2.2 EncFS........................................ 124 9 Tutamen: Next-Generation Secret Storage 125 9.1 A New Approach...................................... 125 9.1.1 Flaws in Custos..................................
Recommended publications
  • Secure Data Sharing in the Cloud

    Secure Data Sharing in the Cloud

    Eivind Nordal Gran Secure data sharing in the cloud Eivind Nordal Gran Eivind Nordal Master’s thesis in Communication Technology Supervisor: Colin Alexander Boyd, Gareth Thomas Davies & Clementine Gritti June 2019 Master’s thesis Master’s Secure data sharing in the cloud data Secure NTNU Engineering Communication Technology Communication Department of Information Security and Department of Information Faculty of Information Technology and Electrical Technology of Information Faculty Norwegian University of Science and Technology of Science University Norwegian Eivind Nordal Gran Secure data sharing in the cloud Master’s thesis in Communication Technology Supervisor: Colin Alexander Boyd, Gareth Thomas Davies & Clementine Gritti June 2019 Norwegian University of Science and Technology Faculty of Information Technology and Electrical Engineering Department of Information Security and Communication Technology Problem description: Data sharing using cloud platforms has become increasingly more popular over the last few years. With the increase in use comes a heightened demand for security and privacy. This project will conduct a thorough study of a key transport proto- col developed at NTNU, which targets strong security as its preeminent property, including a form of forward secrecy. More specifically, it will investigate how this escalation in security level affects the performance and usability of the protocol. How will the new protocol designed with security as its primary concern compare against other already established schemes when it comes to efficiency and practicality? Abstract Cloud sharing security is an important topic in today’s society. The majority of the most common cloud sharing solutions require that the user trust the Cloud Service Provider (CSP) to protect and conceal uploaded data.
  • A Study of Cryptographic File Systems in Userspace

    A Study of Cryptographic File Systems in Userspace

    Turkish Journal of Computer and Mathematics Education Vol.12 No.10 (2021), 4507-4513 Research Article A study of cryptographic file systems in userspace a b c d e f Sahil Naphade , Ajinkya Kulkarni Yash Kulkarni , Yash Patil , Kaushik Lathiya , Sachin Pande a Department of Information Technology PICT, Pune, India [email protected] b Department of Information Technology PICT, Pune, India [email protected] c Department of Information Technology PICT, Pune, India [email protected] d Department of Information Technology PICT, Pune, India [email protected] e Veritas Technologies Pune, India, [email protected] f Department of Information Technology PICT, Pune, India [email protected] Article History: Received: 10 January 2021; Revised: 12 February 2021; Accepted: 27 March 2021; Published online: 28 April 2021 Abstract: With the advancements in technology and digitization, the data storage needs are expanding; along with the data breaches which can expose sensitive data to the world. Thus, the security of the stored data is extremely important. Conventionally, there are two methods of storage of the data, the first being hiding the data and the second being encryption of the data. However, finding out hidden data is simple, and thus, is very unreliable. The second method, which is encryption, allows for accessing the data by only the person who encrypted the data using his passkey, thus allowing for higher security. Typically, a file system is implemented in the kernel of the operating systems. However, with an increase in the complexity of the traditional file systems like ext3 and ext4, the ones that are based in the userspace of the OS are now allowing for additional features on top of them, such as encryption-decryption and compression.
  • Photos Copied" Box

    Photos Copied" Box

    Our photos have never been as scattered as they are now... Do you know where your photos are? Digital Photo Roundup Checklist www.theswedishorganizer.com Online Storage Edition Let's Play Digital Photo Roundup! Congrats on making the decision to start organizing your digital photos! I know the task can seem daunting, so hopefully this handy checklist will help get your moving in the right direction. LET'S ORGANIZE! To start organizing your digital photos, you must first gather them all into one place, so that you'll be able to sort and edit your collection. Use this checklist to document your family's online storage accounts (i.e. where you have photos saved online), and whether they are copied onto your Master hub (the place where you are saving EVERYTHING). It'll make the gathering process a whole lot easier if you keep a record of what you have already copied and what is still to be done. HERE'S HOW The services in this checklist are categorized, so that you only need to print out what applies to you. If you have an account with the service listed, simply check the "Have Account" box. When you have copied all the photos, check the "Photos Copied" box. Enter your login credentials under the line between the boxes for easy retrieval. If you don't see your favorite service on the list, just add it to one of the blank lines provided after each category. Once you are done, you should find yourself with all your digital images in ONE place, and when you do, check back on the blog for tools to help you with the next step in the organizing process.
  • Full-Text (PDF)

    Full-Text (PDF)

    Vol. 10(14), pp. 2043-2050, 23 July, 2015 DOI: 10.5897/ERR2015.2297 Article Number: 6B548DF54295 Educational Research and Reviews ISSN 1990-3839 Copyright © 2015 Author(s) retain the copyright of this article http://www.academicjournals.org/ERR Full Length Research Paper Computer education and instructional technology teacher trainees’ opinions about cloud computing technology Ay şen Karamete Balikesir University, Necatibey Education Faculty, Department of Computer Education and Instructional Technology, Turkey. Received 15 May, 2015; Accepted 13 July, 2015 This study aims to show the present conditions about the usage of cloud computing in the department of Computer Education and Instructional Technology (CEIT) amongst teacher trainees in School of Necatibey Education, Balikesir University, Turkey. In this study, a questionnaire with open-ended questions was used. 17 CEIT teacher trainees participated in the study. The aim of this qualitative study was to determine trends about cloud technology. The cloud technology under study included “Dropbox”, “SpiderOak”, “Google Drive”, “IDrive”, “pCloud”, “OpenDrive”, “Bitcasa”, “OneDrive”, “Tresorit”, “Box” and “Yandex.Disk. The CEIT teacher trainees’ opinions about cloud storage and its purposes; their opinions about types of cloud storage and the level of importance of cloud storage were investigated. The reliability and validity were taken. The advantages and disadvantages of cloud computing were examined. The study found that CEIT teacher trainees’ had used cloud storages such as Dropbox
  • Data Protection and Collaboration in Cloud Storage

    Data Protection and Collaboration in Cloud Storage

    Technical Report 1210 Charting a Security Landscape in the Clouds: Data Protection and Collaboration in Cloud Storage G. Itkis B.H. Kaiser J.E. Coll W.W. Smith R.K. Cunningham 7 July 2016 Lincoln Laboratory MASSACHUSETTS INSTITUTE OF TECHNOLOGY LEXINGTON, MASSACHUSETTS This material is based on work supported by the Department of Homeland Security under Air Force Contract No. FA8721-05-C-0002 and/or FA8702-15-D-0001. Approved for public release: distribution unlimited. This report is the result of studies performed at Lincoln Laboratory, a federally funded research and development center operated by Massachusetts Institute of Technology. This material is based on work supported by the Department of Homeland Security under Air Force Contract No. FA8721-05- C-0002 and/or FA8702-15-D-0001. Any opinions, findings and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of Department of Homeland Security. © 2016 MASSACHUSETTS INSTITUTE OF TECHNOLOGY Delivered to the U.S. Government with Unlimited Rights, as defined in DFARS Part 252.227-7013 or 7014 (Feb 2014). Notwithstanding any copyright notice, U.S. Government rights in this work are defined by DFARS 252.227-7013 or DFARS 252.227-7014 as detailed above. Use of this work other than as specifically authorized by the U.S. Government may violate any copyrights that exist in this work. Massachusetts Institute of Technology Lincoln Laboratory Charting a Security Landscape in the Clouds: Data Protection and Collaboration in Cloud Storage G. Itkis B. Kaiser J. Coll W. Smith R.
  • Lightweight Virtualization with Gobolinux' Runner

    Lightweight Virtualization with Gobolinux' Runner

    Lightweight virtualization with GoboLinux’ Runner Lucas C. Villa Real [email protected] About GoboLinux ● Alternative distribution born in 2002 ● Explores novel ideas in the Linux distribution ecosystem ● Introduces a rather diferent directory hierarchy How diferent? lucasvr@fedora ~] ls / bin dev home lib64 media opt root sbin sys usr boot etc lib lost+found mnt proc run srv tmp var lucasvr@fedora ~] ls /usr bin games include lib lib64 libexec local sbin share src tmp lucasvr@fedora ~] ls /usr/local bin etc games include lib lib64 libexec sbin share src lucasvr@gobolinux ~] ls / Data Mount Programs System Users GoboLinux File System Hierarchy /Programs Self-contained programs: no need for a package manager ~] ls /Programs AbsTk DifUtils GnuTLS Kerberos LibXML2 ACL Dit GoboHide Kmod LibXSLT Acpid DosFSTools GParted Lame Linux AGNClient E2FSProgs Gperf LCMS Linux-Firmware ALSA-Lib EFIBootMgr GPM Less Linux-PAM ALSA-Utils ELFUtils Grep LibDRM Lsof APR EncFS Grof LibEvdev Lua APR-Util ExFAT GRUB LibExif LuaRocks … /Programs Multiple versions of a given program can coexist ~] ls /Programs/GTK+ 2.24.22 2.24.30 3.10.6 3.21.4 Current Settings ~] ls /Programs/GTK+/2.24.22 bin doc include lib Resources share ~] ls /Programs/GTK+/2.24.22/bin gtk-builder-convert gtk-demo gtk-query-immodules2.0 gtk-update-icon-cache ~] ls /Programs/GTK+/2.24.30/bin gtk-builder-convert gtk-demo gtk-query-immodules2.0 gtk-update-icon-cache /Programs Easy to tell which fles belongs to which packages lucasvr@fedora ~] ls -l /bin/bash -rwxr-xr-x. 1 root root 1072008
  • Operating System Support for Run-Time Security with a Trusted Execution Environment

    Operating System Support for Run-Time Security with a Trusted Execution Environment

    Operating System Support for Run-Time Security with a Trusted Execution Environment - Usage Control and Trusted Storage for Linux-based Systems - by Javier Gonz´alez Ph.D Thesis IT University of Copenhagen Advisor: Philippe Bonnet Submitted: January 31, 2015 Last Revision: May 30, 2015 ITU DS-nummer: D-2015-107 ISSN: 1602-3536 ISBN: 978-87-7949-302-5 1 Contents Preface8 1 Introduction 10 1.1 Context....................................... 10 1.2 Problem....................................... 12 1.3 Approach...................................... 14 1.4 Contribution.................................... 15 1.5 Thesis Structure.................................. 16 I State of the Art 18 2 Trusted Execution Environments 20 2.1 Smart Cards.................................... 21 2.1.1 Secure Element............................... 23 2.2 Trusted Platform Module (TPM)......................... 23 2.3 Intel Security Extensions.............................. 26 2.3.1 Intel TXT.................................. 26 2.3.2 Intel SGX.................................. 27 2.4 ARM TrustZone.................................. 29 2.5 Other Techniques.................................. 32 2.5.1 Hardware Replication........................... 32 2.5.2 Hardware Virtualization.......................... 33 2.5.3 Only Software............................... 33 2.6 Discussion...................................... 33 3 Run-Time Security 36 3.1 Access and Usage Control............................. 36 3.2 Data Protection................................... 39 3.3 Reference
  • A Novel Cryptographic Framework for Cloud File Systems and Cryfs, a Provably-Secure Construction

    A Novel Cryptographic Framework for Cloud File Systems and Cryfs, a Provably-Secure Construction

    A Novel Cryptographic Framework for Cloud File Systems and CryFS, a Provably-Secure Construction Sebastian Messmer1, Jochen Rill2, Dirk Achenbach2, and J¨ornM¨uller-Quade3 1 [email protected] 2 FZI Forschungszentrum Informatik frill,[email protected] 3 Karlsruhe Institute of Technology (KIT) [email protected] Abstract. Using the cloud to store data offers many advantages for businesses and individuals alike. The cloud storage provider, however, has to be trusted not to inspect or even modify the data they are entrusted with. Encrypting the data offers a remedy, but current solutions have various drawbacks. Providers which offer encrypted storage themselves cannot necessarily be trusted, since they have no open implementation. Existing encrypted file systems are not designed for usage in the cloud and do not hide metadata like file sizes or directory structure, do not provide integrity, or are prohibitively inefficient. Most have no formal proof of security. Our contribution is twofold. We first introduce a comprehensive formal model for the security and integrity of cloud file systems. Second, we present CryFS, a novel encrypted file system specifically designed for usage in the cloud. Our file system protects confidentiality and integrity (including metadata), even in presence of an actively malicious cloud provider. We give a proof of security for these properties. Our implemen- tation is easy and transparent to use and offers performance comparable to other state-of-the-art file systems. 1 Introduction In recent years, cloud computing has transformed from a trend to a serious competition for traditional on-premise solutions. Elastic cost models and the availability of virtually infinite resources present an alternative to offers of a preset volume.
  • Encfs Goes Multi-User: Adding Access Control to an Encrypted File System

    Encfs Goes Multi-User: Adding Access Control to an Encrypted File System

    c 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. http://ieeexplore.ieee.org/document/7860544/ EncFS goes Multi-User: Adding Access Control to an Encrypted File System Dominik Leibenger Jonas Fortmann Christoph Sorge CISPA, Saarland University University of Paderborn CISPA, Saarland University [email protected] [email protected] [email protected] Abstract—Among the different existing cryptographic file entities, which especially preserves the opportunity of creating systems, EncFS has a unique feature that makes it attractive for efficient, server-side snapshots if supported by the provider.1 backup setups involving untrusted (cloud) storage. It is a file- based overlay file system in normal operation (i.e., it maintains In contrast to other file-based encryption tools, EncFS a directory hierarchy by storing encrypted representations of has a unique feature: It allows to reverse its functionality files and folders in a specific source folder), but its reverse mode as to generate a deterministic, encrypted view of an existing allows to reverse this process: Users can mount deterministic, (unencrypted) folder on a local file system on the fly. The encrypted views of their local, unencrypted files on the fly, encrypted view can be synchronized to external, untrusted allowing synchronization to untrusted storage using standard cloud storage using standard tools like rsync [6] without hav- tools like rsync without having to store encrypted representations ing to store a local copy and without requiring changes to the on the local hard drive.
  • Evaluating Mobile App Vetting Integration with Enterprise Mobility Management in the Enterprise

    Evaluating Mobile App Vetting Integration with Enterprise Mobility Management in the Enterprise

    Evaluating Mobile App Vetting Integration with Enterprise Mobility Management in the Enterprise June 26, 2019 ii Executive Summary Federal agencies increasingly use mobile devices and mobile applications (apps) to meet their mission and business needs and improve productivity and efficiency. The ubiquity of mobile apps and the increased reliance on their use has a counter side, however. Mobile apps pose substantial risk to federal enterprises because of their potential for exploitable vulnerabilities, malicious code, or privacy-violating behaviors and should be deployed with care. Even apps from the Google Play or Apple App Stores are not free of these risks. Mobile app vetting solutions can automate security analysis of mobile apps to help enterprises determine whether apps are safe to deploy on mobile devices. This generally takes time to review and act upon the findings from these solutions. Enterprise mobility management (EMM) provides the centralized capability to manage an enterprise’s mobile devices, including provisioning security policies to the devices. Many EMM and mobile app vetting solutions advertise integration capabilities—the mobile app vetting solution can share an inventory of installed apps with the EMM, and the EMM can take action based on app vetting findings. The Mobile Security Research and Development (R&D) program within the Department of Homeland Security (DHS) Science and Technology Directorate (S&T) promotes such adoption of safe and secure mobile technology within DHS and across the federal government, and encourages development and adoption of integrated cybersecurity solutions to improve mobile security for the federal government. To help promote this adoption and explore other solutions, the team solicited the Homeland Security Systems Engineering and Development Institute (HSSEDI) to perform an independent evaluation of the integration capabilities of mobile app vetting and EMM solutions.
  • Lamassu: Storage-Efficient Host-Side Encryption

    Lamassu: Storage-Efficient Host-Side Encryption

    Lamassu: Storage-Efficient Host-Side Encryption Peter Shah and Won So NetApp Inc. Abstract moves downstream through the stack. This strategy can Many storage customers are adopting encryption solu- take many forms, such as built-in application encryption, tions to protect critical data. Most existing encryption OS-based file system encryption or VM-level encryp- solutions sit in, or near, the application that is the source tion [3, 19, 22]. We term any encryption that runs on of critical data, upstream of the primary storage system. the same physical hardware as the primary application Placing encryption near the source ensures that data re- data-source encryption. mains encrypted throughout the storage stack, making it In general, existing data-source encryption solutions easier to use untrusted storage, such as public clouds. interfere with content-driven data management features Unfortunately, such a strategy also prevents down- provided by storage systems — in particular, deduplica- stream storage systems from applying content-based fea- tion. If a storage controller does not have access to the tures, such as deduplication, to the data. In this paper, we keys used to secure data, it cannot compare the contents present Lamassu, an encryption solution that uses block- of encrypted data to determine which sections, if any, are oriented, host-based, convergent encryption to secure duplicates. data, while preserving storage-based data deduplication. In this paper, we present an alternative encryption Unlike past convergent encryption systems, which typi- strategy that provides the benefits of upstream encryp- cally store encryption metadata in a dedicated store, our tion while preserving storage-based data deduplication system transparently inserts its metadata into each file’s on downstream storage.
  • Encrypted File System Based on Distributed Key-Value Stores and FUSE

    Encrypted File System Based on Distributed Key-Value Stores and FUSE

    International Journal of Network Security & Its Applications (IJNSA) Vol.11, No.2, March 2019 KVEFS: Encrypted File System based on Distributed Key-Value Stores and FUSE Giau Ho Kim, Son Hai Le, Trung Manh Nguyen, Vu Thi Ly, Thanh Nguyen Kim, Nguyen Van Cuong, Thanh Nguyen Trung, and Ta Minh Thanh Le Quy Don Technical University No 236 Hoang Quoc Viet Street , Hanoi, Vietnam [email protected] Abstract. File System is an important component of a secure operating system. The need to build data protection systems is extremely important in open source operating systems, high mobility hardware systems, and miniaturization of storage devices that make systems available. It is clear that the value of the data is much larger than the value of the storage device. Computers access protection mechanism does not work if the thief retrieves the hard drive from the computer and reads data from it on another computer. Encrypted File System (EFS) is a secure level of operating system kernel. EFS uses cryptography to encrypt or decrypt files and folders when they are being saved or retrieved from a hard disk. EFS is often integrated transparently in operating system There are many encrypted filesystems commonly used in Linux operating systems. However, they have some limitations, which are the inability to hide the structure of the file system. This is a shortcoming targeted by the attacker, who will try to decrypt a file to find the key and then decrypt the entire file system. In this paper, we propose a new architecture of EFS called KVEFS which is based on cryptographic algorithms, FUSE library and key-value store.