Design and Implementation of Data Security and Access Control Systems for Cloud Computing

雲端運算(Cloud Computing)的興起帶來網路服務型態的劇變，大幅改變了使用者端的操作習慣與行為。其中最普及化的服務類型非雲端儲存服務(Cloud Storage Service)莫屬。由於雲端儲存服務的跨裝置性、便利性、省時省力等多項優點，使得應用雲端儲存服務的使用者範圍與使用目的十分廣泛，從小至僅僅個人的娛樂、學習與工作檔案備份，大至國際級的商業財團做機密資料的保存與交易，皆存在相異規模與規範的應用。但在充斥網路攻擊與病毒氾濫的透明網路環境下，如何保障資料安全即是個極為艱困的議題。 本研究針對個人與中小企業的雲端儲存服務，設計並實作兩套雲端資料系統: 輔助安全儲存雲(SecureDropbox)與企業私有儲存雲(Enterprise Private Cloud Drive，EPCD)。SecureDropbox是一套針對個人使用者於現存雲端儲存服務(如：Dropbox、Google Drive、iCloud等)的檔案加密系統，不同於現有知名檔案加密系統，SecureDropbox具跨電腦性、金鑰管理與自動同步等優點，更適用於雲端儲存環境的檔案加密。EPCD為一套針對中小企業的企業私有雲儲存系統，除了必備的檔案備份存取，EPCD導入角色存取控制的機制，不僅提升企業成員同事間檔案交流的便捷度，也增加了上級管理者對下級員工檔案與進度的控管效率。最後，鑒於隱私權保護意識的抬頭，本研究彙集近十篇著名論文，探討相關隱私權保護機制應用於資料存取控制的議題，並提出可能的未來發展，作為企業導入隱私權保護機制的參考依據。The rise and development of cloud computing make the type of network services drastically change and alter users’ habits and behavior of usage of computer. Among cloud computing services, the one of most universal applications is Cloud Storage Service (CSS). However, it is extremely arduous to preserve data security from numerous network attacks and computer viruses under the transparent internet environment. In this research, we design and implement two systems containing data security and access control for individual users and small businesses, SecureDropbox and Enterprise Private Cloud Drive (EPCD). SecureDropbox is a file encryption system designed for individual users for being applied to existing CSS (e.g., Dropbox, Google Drive, iCloud, etc.). Distinct from existing famous file encryption systems, SecureDropbox is more suitable for CSS with its specific advantages like cross-platform ability, key management, and automatic synchronization. EPCD is a private cloud storage system designed for small businesses. Beside essential cloud file storage and access, EPCD provides the mechanism of role-based access control for not only increasing the convenience of file communication between coworkers but also the efficiency of management between senior roles and junior roles. Eventually, in view of the raise of privacy-aware consciousness, this research collects and studies numerous literatures which associate the issue of privacy protection applied to data access control. Furthermore, we synthesize significant factors and propose future works for helping the trend of privacy protection development.摘要 I Abstract Ii Contents Iii List of Tables Vi List of Figures Vii Chapter 1. Introduction 1 1.1 Motivations 1 1.2 Objectives 2 1.2.1. A File Encryption System for CSS: SecureDropbox 2 1.2.2. A Private Cloud Storage System: EPCD 2 1.2.3. A Research of Privacy Protection Data Access Control 3 1.3 Research Scopes 3 1.3.1. A File Encryption System for CSS: SecureDropbox 3 1.3.2. A Private Cloud Storage System: EPCD 4 1.3.3. A Research of Privacy Protection Data Access Control 5 1.4 Organization 5 Chapter 2. SecureDropbox: A File Encryption System Suitable for Cloud Storage Services 7 2.1. Preliminary 7 2.2. Related Works 7 2.2.1. Gnu Privacy Guard 7 2.2.2. Truecrypt 8 2.2.3. Axcrypt 8 2.3. SecureDropbox 9 2.3.1. Key Generation Module 10 2.3.2. Key Management Module 11 2.3.3. Synchronization Module 12 2.3.4. File Encryption Module 13 2.4. Analysis 14 2.5. Implementation 15 2.6. Summary 18 Chapter 3. EPCD: Enterprise Private Cloud Drive with Role-based Access Control…...…… 19 3.1. Preliminary 19 3.2. Related Works 20 3.2.1 Role-based Access Control 20 3.2.2 Safesync for Enterprise 22 3.2.3 Openfind Secushare 23 3.3. Enterprise Private Cloud Drive 24 3.3.1. Role Hierarchy 25 3.3.2. Individual File Synchronization and File Collaboration 26 3.3.3. Hierarchical Inherit 27 3.4. Implementation 28 3.4.1. EPCD Server 28 3.4.2. EPCD Client 32 3.5. Summary 35 Chapter 4. Privacy Protection Data Access Control 37 4.1. Preliminary 37 4.2. Privacy Protection Data Access Control 40 4.2.1. Role-based Data Access Control 40 4.2.2. Purpose-based Data Access Control 43 4.2.3. Extension Mechanisms 45 4.3. Comparison 48 4.4. Future Research 50 4.5. Summary 51 Chapter 5. Conclusions and Future Works 53 5.1. Conclusions 53 5.2. Future Works 54 Reference 5