SESSION SECURITY AND ALLIED TECHNOLOGIES Chair(s) TBA

8 Int'l Conf. Security and Management | SAM'11 |
requires further investigation. The ability to verify the correctness
of the data in a cloud environment can be formidable
and expensive to cloud users [1]. The notion of public
auditability has been proposed in the context of ensuring
remotely stored data integrity with different systems and
security models. However, most of these schemes do not
support the privacy protection of users’ data against external
auditors. How to efficiently audit and provide data secrecy
at the same time also requires further study.
Resource pooling with location independence, rapid elasticity,
and on-demand self-service are three out of the five
essential cloud characteristics [33]. The highly distributed
and dynamic storage environment requires a security service
to be highly flexible and configurable. On-demand security
control and configurable security features are thus highly
desirable.
6.5 Virtualization
With the increasing complexity of massive storage management
and data sharing in heterogeneous environments,
more efficient and intelligent storage systems are in demand.
Zeng et al. [46] proposed a virtual storage architecture to
integrate heterogeneous storage systems and abstract their
management, collaboration and interaction. With more demands
on massive and high capacity storage, we believe
that heterogeneous storage systems will converge in term
of usability. Also, as Zeng pointed out in [46], “network is
storage and storage is the network”.
Data protection becomes even more import as collaboration
is required amongst mutually untrusted distributed
storage systems. The appearance of Fabric, a new system
and language to build secure distributed information systems
[32], has indicated the need of federate storage systems
to share computational resources across various security
domains. We believe federate storage systems with different
storage types across mutual distrust domains will eventually
emerge. Their security management, data transformation,
auditing, usability and scalability will be yet another research
area.
6.6 Optimization
Reliability and availability of storage systems are implemented
through redundancy. Sometimes this can introduce
significant system overheads. Data de-duplication [2]
removes high redundancy among files or data blocks, cuts
storage capacity requirements, reduces network traffic, and
improves performance.
The main challenges of data protection in de-duplication
are integrity, data segmentation and privacy. De-duplication’s
breaking of files into chunks/segments/blocks causes data
integrity concerns. It can also erase the boundaries of data or
file groupings. Encrypting the same data with different keys
will generate different ciphertexts. Even if there is only one
key, management issues, such as key refreshing, can cause
severe problems because each data block can come from
different file version.
De-duplication systems often use meta data, index
trees and hash databases to detect and locate
chunks/segments/blocks in storage. Such information needs
to be properly protected against different threats. Data deduplication
on encrypted data still remains challenging.
Secure keyword searching or pattern matching received
attention [37], but still remains challenging. Consistency
issues of access right, especially the copies cached on the
client side, has not received enough attention.
7. Conclusions
This paper presents a survey of security features and techniques
in existing distributed storage systems. We classified
distributed storage systems into three categories: centralized,
distributed and hybrid. We then listed the threats and protection
mechanisms and identified two protection models (user
centric and storage centric) for distributed storage systems.
We then examined several distributed storage systems and
identified emerging issues. In reality, it will be difficult
(impossible) to build a distributed storage system that can
satisfy all the potential requirements of the environments
in which these systems are needed. However it is hoped
that this discussion has helped to raise awareness of the
challenges and potential solutions that can be applied in
order to incorporate security into systems of this type.
References
[1] Cloud Security Alliance. http://www.cloudsecurityalliance.org. Security
guidance for critical areas of focus in cloud computing.
[2] Lior Aronovich, Ron Asher, Eitan Bachmat, Haim Bitner, Michael
Hirsch, and Shmuel T. Klein. The design of a similarity based
deduplication system. In SYSTOR ’09, 2009.
[3] G. Ateniese, R. Burns, R. Curtmola, J. Herring, L. Kissner, Z. Peterson,
and D. Song. Provable data possession at untrusted stores.
In 14th ACM conference on Computer and communications security,
page 598Ű609. ACM, 2007.
[4] G. Ateniese, R. D. Pietro, L. V. Mancini, and G. Tsudik. Scalable
and efficient provable data possession. In SecureCommŠ08, 2008.
[5] John Bethencourt, Amit Sahai, and Brent Waters. Ciphertext-policy
attribute-based encryption. In IEEE Symposium on Security and
Privacy - S&P, pages 321–334, 2007.
[6] C. Blundo, S. Cimato, S. De Capitani di Vimercati, A. De Santis,
S. Foresti, S. Paraboschi, and P. Samarati. Efficient key management
for enforcing access control in outsourced scenarios. In IFIP Advances
in Information and Communication Technology, volume 297, pages
364–375. Springer Boston, 2009.
[7] Ling Cheung and Calvin Newport. Provably secure ciphertext policy
abe. In the 14th ACM conference on Computer and communications
security, pages 456 – 465. ACM, 2007.
[8] Inc Cluster File Systems. Lustre: A scalab high performance file
system. White paper, Jan 2002.
[9] E. Damiani, S. De Capitani di Vimercati, S. Jajodia, S. Foresti, S. Paraboschi,
and P. Samarati1. Selective data encryption in outsourced
dynamic environments. In VODCA, 2006.
[10] M. Factor, K. Meth, D. Naor, O. Rodeh, and J. Satran. Object storage:
The future building block for storage systems: A position paper. In
the Second International IEEE Symposium on Emergence of Globally
Distributed Data, page 119Ű123, 2005.