SafeFS: a modular architecture for secure user-space file systems

Abstract

The exponential growth of data produced, the ever faster and ubiquitous connectivity, and the collaborative processing tools lead to a clear shift of data stores from local servers to the cloud. This migration occurring across different application domains and types of users-individual or corporate-raises two immediate challenges. First, outsourcing data introduces security risks, hence protection mechanisms must be put in place to provide guarantees such as privacy, confidentiality and integrity. Second, there is no "one-size-fits-all" solution that would provide the right level of safety or performance for all applications and users, and it is therefore necessary to provide mechanisms that can be tailored to the various deployment scenarios.In this paper, we address both challenges by introducing SafeFS, a modular architecture based on software-defined storage principles featuring stackable building blocks that can be combined to construct a secure distributed file system. SafeFS allows users to specialize their data store to their specific needs by choosing the combination of blocks that provide the best safety and performance tradeoffs. The file system is implemented in user space using FUSE and can access remote data stores. The provided building blocks notably include mechanisms based on encryption, replication, and coding. We implemented SafeFS and performed indepth evaluation across a range of workloads. Results reveal that while each layer has a cost, one can build safe yet efficient storage architectures. Furthermore, the different combinations of blocks sometimes yield surprising tradeoffs. CCS Concepts•Information systems → Hierarchical storage management; Cloud based storage; •Hardware → External storage; •Security and privacy → Management and querying of encrypted data;

Secure Outsourcing and Sharing of Cloud Data Using a User-Side Encrypted File System

“…Other solutions like TrueCrypt [31], and dm-crypt [32] operate as a block device layer to encrypt the entire file system into a single container. Nevertheless, despite the high performance feature provided by the kernel-space file systems, implementing them with complex behavior, such as encryption, is a challenging task that requires extensive modification to the kernel structure [12]. These file systems are designed to mount over the internal storage devices to protect all its contents on-the-fly.…”

“…Five levels are used for representing the required security properties of each scheme. The level is assigned by evaluating the features of the scheme and considering the evaluation results in the literature [12,47,48] that correspond to the security property. The scheme with more stars indicates its ability to achieve the security property.…”

“…The cryptographic file system can be built as a layer inside the kernel space of the operating system [9,10]. It can also be implemented as a file system in user space using FUSE technology [11] to build a cryptographic file system on top of local or remote storage systems [12,13,14]. Other schemes use a cloud-backed file system, such as S3FS [15], BlueSky [16], S3QL [17], which are implemented on remote file systems to provide encryption services to stored data in one or multiple clouds.…”

Erasure coding for distributed storage systems

“…Finally, we look at how storage overhead can be tamed beyond with better compression gains than classic data reduction techniques without sacrificing on performance. [32,34,31] Chapter 4 First and fully functional implementation of STeP [17,141] Chapter 5 Implementation and evaluation of a framework for stackable user-space file systems [207,33] Chapter 6 Integration and evalution of a data deduplication scheme in user-space file system [183] 1.…”

“…• SafeFS [207], a modular framework for stackable file systems in user-space. This work was led by Rogério Pontes with the collaboration of Francisco Maia, João Paulo, Rui Oliveira, Pascal Felber, Valerio Schiavoni and Hugues Mercier.…”