Lazy revocation in cryptographic file systems

Abstract A crucial element of distributed cryptographic file systems are key management solutions that allowfor flexible but secure data sharing. We consider efficient key management schemes for cryptographic file systems using lazy revocation. We give rigorous security definitions for three crypto-graphic schemes used in such systems, namely symmetric encryption, message-authentication codes and signature schemes. Additionally, we provide generic constructions for symmetric encryptionand message-authentication codes with lazy revocation using key-updating schemes for lazy revocation, which have been introduced recently. We also give a construction of signature schemes withlazy revocation from identity-based signatures. Finally, we describe how our constructions improve the key rotation mechanism in the Plutus file system. 1 Introduction Networked storage solutions, such as Network-Attached Storage (NAS) and Storage Area Networks(SAN), have emerged recently as an alternative to direct-attached storage. It is desirable that clients have similar security guarantees in these environments to those offered by traditional storage. However,the storage servers in a networked storage system are more exposed than direct-attached disks. Clients need to protect the confidentiality and integrity of the stored data themselves and can not rely on thestorage servers for security guarantees. Cryptographic file systems have been designed for this task. Sharing of information among clients is an important feature offered by file systems. Protecting datain non-cryptographic file systems relies on an access control mechanism, like the access control model of the Unix file system. Data sharing in cryptographic file systems is complicated by the problem of keymanagement. While early cryptographic file systems did not address key management, recent systems offer diverse solutions. They range from fully centralized key distribution using a trusted key server [12]to completely decentralized key distribution done by the file system users [18, 17]