A Step Toward Better Cloud Security: Searchable Encryption
Posted by Abel Avram on Jan 14, 2010
http://www.infoq.com/news/2010/01/Cloud-Searchable-Encryption
In a whitepaper entitled Cryptographic Cloud Storage (PDF), Seny Kamara and Kristin Lauter
from the Microsoft Research Cryptography Group, propose a “virtual private storage service”
offered by public clouds using new cryptographic techniques.
Cloud computing has gained some traction lately and 2010 is considered to be the year of the
cloud by some. While the benefits of using computing in the clouds are well known, its adoption
is hindered by security concerns. Individuals may have no problem using an online storage
service from a company that has a good security history track, but companies and governmental
agencies are very reluctant to trust their data to the uncertainty of the public clouds.
Kamara and Lauter propose a virtual private storage service which would satisfy the following
requirements:







confidentiality: the cloud storage provider does not learn any information about customer
data
integrity: any unauthorized modification of customer data by the cloud storage provider
can be detected by the customer
non-repudiation: any access to customer data is logged, while retaining the main benefits
of a public storage service
availability: customer data is accessible from any machine and at all times
reliability: customer data is reliably backed up
efficient retrieval: data retrieval times are comparable to a public cloud storage service
data sharing: customers can share their data with trusted parties.
Most of the requirements are obtained by encrypting the documents stored in the cloud, but
encryption makes it very hard to search through such documents or to collaborate in real time
editing. The Cryptographic Cloud Storage whitepaper proposes an architecture for a
cryptographic storage service that would solve the security problems of “back-ups, archival,
health record systems, secure data exchange and e-discovery”.
The architecture is based on three components:



Data Processor (DP) – processes data before sending it to the cloud
Data Verifier (DV) – verifies data’s integrity
Token Generator (TG) – generates tokens allowing the service provider to retrieve
documents
The consumer solution involves using a local application that has the three above mentioned
components. Before uploading data to the cloud, Alice uses the data processor to encrypt and
encode the documents along with their metadata (tags, time, size, etc.), then she sends them into
the cloud. When she wants to download some documents, Alice uses the TG to generate a token
and a decryption key. The token is sent to the storage provider to select the encrypted files to be
downloaded. After that, the DV is invoked to verify the integrity of the data using a master key.
The document is decrypted using the decryption key.
Collaboration is done by Alice generating a new token plus a decryption key which are sent to
Bob who uses them to retrieve documents from the cloud and to decrypt them.
For the enterprise, the whitepaper proposes a similar approach:
This solution proposes the introduction of an additional Credential Generator (CG) that generates
tokens for any user involved in storing/retrieving documents into/from the cloud. The credential
token establishes what rights one has over a specific document and it is used to manage access to
documents. The rest of the process is similar to that for a consumer architecture.
In order to prepare the data for the cloud, the data processor:
begins by indexing it and encrypting it with a symmetric encryption scheme (e.g., AES) under a
unique key. It then encrypts the index using a searchable encryption scheme and encrypts the
unique key with an attribute-based encryption scheme under an appropriate policy. Finally, it
encodes the encrypted data and index in such a way that the data verifier can later verify their
integrity using a proof of storage.
Microsoft Research Cryptography Group and other research organizations have developed
techniques for searchable encryption but the main problem is they are unacceptably slow, tens of
seconds for a single word search. More research and advances in the searchable cryptography
field are necessary before this approach becomes a viable solution for a virtual private storage
service.
Security in the cloud - Encryption for the enterprise
Published: 16:55, 06 March 12
http://www.computerworlduk.com/business-it-hub/management-briefing/3342481/security-incloud-encryption-for-enterprise/
Many experts are touting encryption technology as the solution – offering robust protection
against the rising cybercrime threat, giving only authenticated users access to enterprise data, and
securing data to satisfy compliance requirements.
IT professionals have long since realised that traditional perimeter-based security controls are no
longer adequate. What is required now is more effective, multi-layered encryption of data, both
in motion and at rest.
This is particularly important where enterprise data is being held in multi-tenant cloud
computing environments, serving multiple businesses and users, with data being partitioned
accordingly.
John Kindervag, principal analyst at Forrester Research, says business and IT leaders alike are
eager to adopt cloud computing to lower their IT costs, provide scale, and enable more
flexibility. But cloud computing leads to unique data segregation issues, as providers adopt
virtualisation technology to share their IT infrastructure across multiple user organisations.
“However, many security professionals are uncomfortable with multi-tenancy — and for good
reason. In a multi-tenant environment, data encryption holds the best hope of properly protecting
commingled data,” says Kindervag.
As well as protecting information in shared datacentre environments, encryption can also protect
businesses that have a growing number of remote and mobile workers. “The advent of the
extended enterprise and the ease of accessing corporate information anytime, anywhere, and on
any device will create new pressures on security teams to encrypt data,” says Kindervag. Mobile
devices are easy to lose or steal, he adds, but enterprise-level encryption is the best hope for
securing data on these devices.
Encryption options
The sorts of encryption technologies that are starting to grow in popularity amongst securityconscious enterprises include endpoint encryption, full-disk and file-level encryption, database
and storage encryption, and mobile device authentication.
Whilst these technologies are not new, they are becoming more obviously useful as an increasing
number of organisations move their IT operations into the cloud, whilst facing a growing hacker
threat and more stringent compliance requirements.
Reasonable levels of encryption already exist in today’s enterprises, with common technologies
including email encryption, as well as endpoint encryption using firewalls, Transport Layer
Security (TLS) or Secure Sockets Layer (SSL) VPNs. Many enterprises also use intrusion
detection systems that have behaviour-blocking components, as these can monitor the way
devices are being used to access the network, for example to detect rootkits (stealthy malware
code).
One example of a business that uses several types of encryption, on a daily basis, is Ashfords
Solicitors. The law firm hosts cloud services for its clients, using its own datacentre hardware.
Examples of these services include contract storage and management, deal room document
management, and procurement tendering, all of which clients can access via their web browsers.
Garry Mackay, head of commercial services at the practice, who also heads the IT team, says
Ashfords has its own secure server at a third party datacentre provider (Telehouse in London),
and its cloud uses SSL encryption and is HTTPS-accredited.
HTTPS encrypts and decrypts web sessions, and user authentication is carried using digital
certificates and alphanumeric passwords. This combination protects against eavesdropping and
man-in-the-middle hacker attacks.
Mackay adds, “All users have alphanumeric passwords which are changed every three months,
documents are encrypted, and access to individual documents and folders is limited to authorised
users only.”
“Security is the biggest fear factor when it comes to the cloud,” says Mackay. His advice is to
use secure access to cloud-based data, but also to encrypt individual documents, and Ashfords
does this using a random number generator. However, he admits that the firm’s private cloud
system complements its separate, internal IT system, which is far less open to the outside world.
Only data that the clients need to access goes into the cloud, he says.
Another big user of encryption is the University of Leeds, whose researchers use a file sharing
service called Teamdrive, to share data and documents between different group members. The
file sharing system encrypts all the relevant data on the endpoint computer before uploading it to
a private cloud.
Unlike Dropbox, which holds its customers’ data on servers in the public cloud (using Amazon’s
cloud service), Teamdrive allows users to host the data on their own servers, says University of
Leeds research fellow Dr. Anthony Beck. “The ability to use our own servers for shared cloud
storage is fantastic. Essentially we have an unlimited storage capacity which we can easily share
with colleagues throughout the world at any institution,” he says.
Encryption on the rise
Data encryption is fast growing in popularity, according to Forrester’s John Kindervag. “In the
future, you will encrypt data — both in motion and at rest — by default. This data-centric
approach to security is a much more effective way to keep up with determined cybercriminals.
By encrypting, and thereby devaluing, your sensitive data, you can make cybercriminals bypass
your networks and look for less robustly-protected targets.”
He adds that security professionals have deployed a wide variety of cryptographic solutions in
most modern networks, including the widespread encryption of hard drives on desktops and
laptops, the encryption of emails containing sensitive information, and database encryption.
Compliance requirements and privacy laws have given companies incentives to deploy more and
more encryption, with database and network storage encryption on the rise “as sensitive data
very often resides in enterprise databases”, Kindervag notes. In Forrester’s most recent security
survey, around a third of respondents said they had adopted network storage encryption and/or
database encryption.
Full disk encryption (FDE) and file encryption are also popular choices. FDE encrypts the entire
hard drive, whereas file-level encryption only encrypts the portion of the drive where sensitive
information is stored. The adoption rates of these technologies are nearly equal; 38% of
companies have chosen to implement FDE or desktop encryption, while 34% have implemented
file-level encryption, says Kindervag.
Hardware-based disk encryption generally has a lower performance impact on the backup server
than software-based encryption, because the encryption activity is invisible to the operating
system and the host computer’s CPU. It can also perform encryption after data is compressed and
stored on disk or tape. “Encryption is one of the least costly risk mitigation tools available, and if
aggressively deployed, will greatly reduce the number of data breaches due to lost or stolen
equipment,” says Cal Braunstein, executive director of research at analyst firm Robert Frances
Group.
The latest innovation in full disk encryption is the self-encrypting drive (SED). This brand new
hard disk technology performs the encryption in the hardware itself, securing all the data
automatically, a process which is transparent to the user. “While there is still a need for
encryption management software, self-encrypting drives promise improved cryptographic
performance, thus eliminating one of the final barriers to adopting client encryption,” says
Kindervag.
According to Gartner, SEDs are ideal where significant volumes of sensitive data need to be
held, because the hardware-based encryption method has little impact on the performance of the
drive. In terms of security, erasing the encryption key makes all data on the disk inaccessible.
But businesses choosing to use SEDs for encryption should also use third-party key management
systems to ensure data can always be recovered, analysts warn.
Encryption strategy
In terms of developing an encryption strategy, Gartner security specialist Eric Ouellet advises
businesses to “try to standardise on a single approach to encryption for the whole business, to
enable consistency across the different systems in the business, which will help keep complexity
to a minimum and reduce the cost of deployment and support.”
But you don’t have to be a cryptographer to implement encryption. “A noteworthy inhibitor of
encryption is an unfounded — and unhealthy — fear of cryptographic technologies. Too many
security pros focus on the technology behind encryption, such as the encryption algorithms
themselves,” says Kindervag. “There is a misconception that you need to be a mathematician or
a cryptographer to properly deploy cryptographic solutions. In reality, good encryption is all
about abstraction (defining groups of users, or data assets) and management.”
Encryption has found its way into large parts of our technology systems and can be used by the
non-technical. For example, e-mail encryption is an option for all enterprise grade e-mail
systems; and today’s operating systems even come with endpoint encryption applications that
will enable remote access to the client desktop or laptop. “The widespread use of SSL/TLS is a
good example,” says Kindervag. “This cryptographic solution undergirds the Internet and our ecommerce systems, but the technical details are transparent to the individuals who deploy it.”
“Other cryptographic solutions will evolve in a similar manner; sometime in the near future we
will find that we encrypt almost all of our data and will be surprised when we find unencrypted
data in our organisations,” he adds.
Ultimately, good security is all about reducing the attack surface that is available to hackers and
malicious users as they attempt to infiltrate the business. Encryption options such as FDE and
file and database encryption can go a long way towards making the cloud more secure for doing
business, and less attractive to cybercriminals.
Comments
- “IT professionals have long since realised that traditional perimeter-based security controls are
no longer adequate.”
- “All businesses and people that care about the security of their Data can easily fully protect
themselves from hackers, phishers and fraudsters by signing-up for Cryptoexpress the only 100%
secure and complete SaaS, HTML5, eMail, Data and GSM Voice and VOIP [SIP + IPv6]
communications package with inbuilt Contacts and Calendar databases available. Cryptoexpress
believes you are entitled to your privacy and confidentiality at all times and has been designed to
ensure you are always fully protected by using very sophisticated one-time key encryption and
which is extremely secure because Cryptoexpress does not have any recordings of it's clients
passwords.”