Private Cloud Storage: Client-Side Encryption and Usable Secure Utility Functions

With the development of cloud environments and smartphones, and increasing awareness of security and privacy, client-side encryption, represented by end-to-end encryption (E2E Encryption), has made rapid progress over the last 10 years. When client-side encryption is adopted, a wide variety of utility functions such as search and sorting provided by the cloud side, utilization on multiple terminals, and data sharing with other users are restricted. To solve this problem, there has been a great deal of interest in technologies such as searchable encryption and order preserving encryption, which allow data to be processed while being encrypted. However, there are few examples in which the effectiveness was discussed by applying these actually to the application. In particular, these technologies were rarely discussed from the viewpoint of usability. Therefore, we focus on cloud storage and propose an application that combines multiple encryption technologies on the client side to realize secure and usable cloud storage that can be closely linked with existing cloud storage services. The proposed application is then evaluated to demonstrate its usability. The application we proposed provides file encryption on the client side, secure retrieval, sorting, and folder sharing with other users. As a result of the user study, it was shown that the usability of the prototype application did not differ from that of the unencrypted application developed for comparison, and the usability of the proposed application was high. Furthermore, implementation and user experiments have revealed a number of new challenges in securely implementing utility functions while providing client-side encryption for contents, and have newly demonstrated the need for applied research in this field.

[1]  Daniel Zappala,et al.  "We're on the Same Page": A Usability Study of Secure Email Using Pairs of Novice Users , 2015, CHI.

[2]  Rob Miller,et al.  Views, Reactions and Impact of Digitally-Signed Mail in e-Commerce , 2005, Financial Cryptography.

[3]  Roberto Tamassia,et al.  Dynamic provable data possession , 2009, IACR Cryptol. ePrint Arch..

[4]  Jiankun Hu,et al.  Secure searches in the cloud: A survey , 2016, Future Gener. Comput. Syst..

[5]  Rafail Ostrovsky,et al.  Searchable symmetric encryption: improved definitions and efficient constructions , 2006, CCS '06.

[6]  Wakaha Ogata,et al.  Toward Practical Searchable Symmetric Encryption , 2013, IWSEC.

[7]  Andreas Peter,et al.  A Survey of Provably Secure Searchable Encryption , 2014, ACM Comput. Surv..

[8]  Doowon Kim,et al.  An Inconvenient Trust: User Attitudes toward Security and Usability Tradeoffs for Key-Directory Encryption Systems , 2016, SOUPS.

[9]  Simson L. Garfinkel,et al.  How to make secure email easier to use , 2005, CHI.

[10]  Simson L. Garfinkel.  Enabling Email Confidentiality through the use of Opportunistic Encryption , 2003, DG.O.

[11]  Zhihua Xia,et al.  A Secure and Dynamic Multi-Keyword Ranked Search Scheme over Encrypted Cloud Data , 2016, IEEE Transactions on Parallel and Distributed Systems.

[12]  Cong Wang,et al.  Privacy-Preserving Multi-Keyword Ranked Search over Encrypted Cloud Data , 2014 .

[13]  Nathan Chenette,et al.  Order-Preserving Symmetric Encryption , 2009, IACR Cryptol. ePrint Arch..

[14]  Rob Miller,et al.  Johnny 2: a user test of key continuity management with S/MIME and Outlook Express , 2005, SOUPS '05.

[15]  Mauro Conti,et al.  A Survey on Homomorphic Encryption Schemes , 2017, ACM Comput. Surv..

[16]  Jakob Nielsen,et al.  A mathematical model of the finding of usability problems , 1993, INTERCHI.

[17]  Matthew Smith,et al.  Helping Johnny 2.0 to encrypt his Facebook conversations , 2012, SOUPS.

[18]  Kristin E. Lauter,et al.  Cryptographic Cloud Storage , 2010, Financial Cryptography Workshops.

[19]  Matthew K. Franklin,et al.  Identity-Based Encryption from the Weil Pairing , 2001, CRYPTO.

[20]  Rafail Ostrovsky,et al.  Public Key Encryption with Keyword Search , 2004, EUROCRYPT.

[21]  Craig Gentry,et al.  Fully homomorphic encryption using ideal lattices , 2009, STOC '09.

[22]  Akira Kanaoka,et al.  Helping Johnny to Search: Encrypted Search on Webmail System , 2018, 2018 13th Asia Joint Conference on Information Security (AsiaJCIS).

[23]  Ramakrishnan Srikant,et al.  Order preserving encryption for numeric data , 2004, SIGMOD '04.

[24]  Matthew Smith,et al.  Confidentiality as a Service -- Usable Security for the Cloud , 2012, 2012 IEEE 11th International Conference on Trust, Security and Privacy in Computing and Communications.

[25]  Daniel Zappala,et al.  Private Webmail 2.0: Simple and Easy-to-Use Secure Email , 2016, UIST.

[26]  HuJiankun,et al.  Secure searches in the cloud , 2016 .

[27]  J. Doug Tygar,et al.  Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 , 1999, USENIX Security Symposium.

[28]  Geong Sen Poh,et al.  Searchable Symmetric Encryption , 2017, ACM Comput. Surv..

[29]  Scott Ruoti,et al.  Confused Johnny: when automatic encryption leads to confusion and mistakes , 2013, SOUPS.