trademark

3.0 Secure Data Storage and Transactions Logs (cont.)
3.9 Use digital rights management
3.9.1 Why?
To counter collusion attacks where users are willing to exchange decrypted contents
when access control is implemented by means of encryption
3.9.2 How?
Digital rights management (DRM) schemes are various access control technologies
that are used to restrict usage of copyrighted works. Such a scheme is also effective
to control access to protected data in a distributed system environment. To prevent
unauthorized access to protected information, some frameworks restrict options
for accessing content. For instance, the protected content can only be opened on a
specific device or with particular viewer software, where access rights and/or policies
are securely enforced (perhaps at the hardware level). Moreover, the integrity of such
software or devices can be attested by a cloud storage provider, etc., by means of
remote attestation techniques and/or TPM (Trusted Platform Module) when necessary.
3.10 Build secure cloud storage on top of
untrusted infrastructure
3.10.1 Why?
To store information in a confidential, integrity-protected way—even with untrusted cloud
service providers—while retaining service availability, reliability and the ability for efficient
data retrieval and flexible data sharing
3.10.2 How?
One solution for implementing a secure cloud storage system is called cryptographic
cloud storage [KL10]. This storage technique employs symmetric encryption, searchable
encryption [BW07, CJJ+13], attribute-based encryption [SW05], and proof of storage (namely
proof of retrievability [JK07] and provable data possession [ABC+07]). Using cryptographic
cloud storage, a data owner can store encrypted data while keeping encryption keys locally.
Moreover, data integrity can be verified efficiently at any time. Thereby, it can address major
challenges, including: regulatory compliance; geographic restrictions; subpoenas; security
breaches; electronic discovery; and data retention and destruction.
CLOUD SECURITY ALLIANCE Big Data Working Group Guidance
© Copyright 2016, Cloud Security Alliance. All rights reserved.
21