Lazy revocation in cryptographic file systems

A crucial element of distributed cryptographic file systems are key management solutions that allow for flexible but secure data sharing. We consider efficient key management schemes for cryptographic file systems using lazy revocation. We give rigorous security definitions for three cryptographic schemes used in such systems, namely symmetric encryption, message-authentication codes and signature schemes. Additionally, we provide generic constructions for symmetric encryption and message-authentication codes with lazy revocation using key-updating schemes for lazy revocation, which have been introduced recently. We also give a construction of signature schemes with lazy revocation from identity-based signatures. Finally, we describe how our constructions improve the key rotation mechanism in the Plutus file system.

1. Introduction

Networked storage solutions, such as Network-Attached Storage (NAS) and Storage Area Networks (SAN), have emerged recently as an alternative to direct-attached storage. It is desirable that clients have similar security guarantees in these environments to those offered by traditional storage. However, the storage servers in a networked storage system are more exposed than direct-attached disks. Clients need to protect the confidentiality and integrity of the stored data themselves and can not rely on the storage servers for security guarantees. Cryptographic file systems have been designed for this task.