Denna fallstudie har undersökt och studerat hur ett företag som arbetar med informationsteknologi (IT) hanterar problemet att anställda lagrar arbetsrelaterad information i sina privata molnlagringstjänster. En enkätundersökning gjordes för att undersöka och jämföra hur olika avdelningar på företaget bland annat använder sin privata molnlagringstjänst och om de är medvetna om risker med molnlagring. En intervju genomfördes med en informant från företaget för att kontrastera svaren från enkätundersökningen. Vidare genomfördes också en valideringsintervju med en informant från ett annat företag som arbetar inom samma bransch.Resultatet visade att anställda som arbetar inom IT-branschen faktiskt lagrar eller har lagrat arbetsrelaterade information i sina privata molnlagringstjänster. En av avdelningarna som deltog i enkäten var informationssäkerhetsteamet. Anställda som arbetar med informationssäkerhet kan antas vara mest pålästa och kunniga vad gäller säkerhet kring information, trots det så visade resultatet att dessa personer var de som använde privat molnlagring mest, i jämförelse med övriga avdelningar. Vidare så visar resultatet också att företagen arbetar med att motverka och upplysa anställda om risker med hur information hanteras, det ena företaget i synnerhet arbetar väldigt proaktivt och tar informationssäkerhet på stort allvar. / In this work, a case study was made on one company that is working with IT. The study was made to see how an IT company mitigates and handles the problem that employees use their private cloud storage to store work related information. A survey was sent to three different departments at the company to examine what employees think about private cloud storage and work related information and how and if it differs between different departments. One interview was also made with one informant from the same company to compare with the results from the survey. A second interview with another company was also made to validate the result from the first interview.The results from the survey showed that employees do store or have stored work related information in their private cloud storage, despite that the company policies forbid it. One of the departments that the survey was sent to was the information security team. It can be assumed that employees that work with information security have better understanding about security regarding information and how it should be stored. Despite that did the results show that the information security team was the department that used private cloud storage the most, compared to the other departments. The results from the interviews shows that the companies at least have policies on how and where the employees are allowed to store work related information. One company in particular works really hard and continuously to educate and enlighten its employees to take great care when dealing with work related information.

Durch die immer stärker werdende Flut an digitalen Informationen basieren immer mehr Anwendungen auf der Nutzung von kostengünstigen Cloud Storage Diensten. Die Anzahl der Anbieter, die diese Dienste zur Verfügung stellen, hat sich in den letzten Jahren deutlich erhöht. Um den passenden Anbieter für eine Anwendung zu finden, müssen verschiedene Kriterien individuell berücksichtigt werden. In der vorliegenden Studie wird eine Auswahl an Anbietern etablierter Basic Storage Diensten vorgestellt und miteinander verglichen. Für die Gegenüberstellung werden Kriterien extrahiert, welche bei jedem der untersuchten Anbieter anwendbar sind und somit eine möglichst objektive Beurteilung erlauben. Hierzu gehören unter anderem Kosten, Recht, Sicherheit, Leistungsfähigkeit sowie bereitgestellte Schnittstellen. Die vorgestellten Kriterien können genutzt werden, um Cloud Storage Anbieter bezüglich eines konkreten Anwendungsfalles zu bewerten. / Due to the ever-increasing flood of digital information, more and more applications make use of cost-effective cloud storage services. The number of vendors that provide these services has increased significantly in recent years. The identification of an appropriate service provider requires an individual consideration of several criteria. This survey presents a comparison of some established basic storage providers. For this comparison, several criteria are extracted that are applicable to any of the selected providers and thus allow for an assessment that is as objective as possible. The criteria include factors like costs, legal information, security, performance, and supported interfaces. The presented criteria can be used to evaluate cloud storage providers in a specific use case in order to identify the most suitable service based on individual requirements.

La quantité de données stockées dans le monde ne cesse de croître et cela pose des challenges aux fournisseurs de service de stockage qui doivent trouver des moyens de faire face à cette croissance de manière scalable, efficace, tout en optimisant les coûts. Nous nous sommes intéressés aux systèmes de stockage de données dans le nuage qui est une grande tendance dans les solutions de stockage de données. L'International Data Corporation (IDC) prédit notamment que d'ici 2020, environ 40% des données seront stockées et traitées dans le nuage. Cette thèse adresse les challenges liés aux performances d'accès aux données et à la sûreté de fonctionnement dans les systèmes de stockage dans le nuage. Nous avons proposé Mistore, un système de stockage distribué que nous avons conçu pour assurer la disponibilité des données, leur durabilité, ainsi que de faibles latences d'accès aux données en exploitant des zones de stockage dans les box, les Points de Présence (POP), et les centre de données dans une infrastructure Digital Subscriber Line (xDSL) d'un Fournisseur d'Accès à Internet (FAI). Dans Mistore, nous adressons aussi les problèmes de cohérence de données en fournissant plusieurs critères de cohérence des données ainsi qu'un système de versioning. Nous nous sommes aussi intéressés à la sécurité des données dans le contexte de systèmes de stockage appliquant une déduplication des données, qui est l'une des technologies les plus prometteuses pour réduire les coût de stockage et de bande passante réseau. Nous avons conçu une méthode de déduplication en deux phases qui est sécurisée contre des attaques d'utilisateurs malicieux tout en étant efficace en termes d'économie de bande passante réseau et d'espace de stockage. / The quantity of data in the world is steadily increasing bringing challenges to storage system providers to find ways to handle data efficiently in term of dependability and in a cost-effectively manner. We have been interested in cloud storage which is a growing trend in data storage solution. For instance, the International Data Corporation (IDC) predicts that by 2020, nearly 40% of the data in the world will be stored or processed in a cloud. This thesis addressed challenges around data access latency and dependability in cloud storage. We proposed Mistore, a distributed storage system that we designed to ensure data availability, durability, low access latency by leveraging the Digital Subscriber Line (xDSL) infrastructure of an Internet Service Provider (ISP). Mistore uses the available storage resources of a large number of home gateways and Points of Presence for content storage and caching facilities. Mistore also targets data consistency by providing multiple types of consistency criteria on content and a versioning system. We also considered the data security and confidentiality in the context of storage systems applying data deduplication which is becoming one of the most popular data technologies to reduce the storage cost and we design a two-phase data deduplication that is secure against malicious clients while remaining efficient in terms of network bandwidth and storage space savings.

Most applications and documents are stored in a public cloud for storage and management purposes in a cloud computing environment. The major advantages of storing applications and documents in public cloud are lower cost through use of shared computing resources and no upfront infrastructure costs. However, in this case the management of data and other services is insecure. Therefore, security is a major problem in a public cloud as the cloud and the network are open to many other users. In order to provide security, it is necessary for data owners to store their data in the public cloud in a secure way and to use an appropriate access control scheme. Designing a computation and communication efficient key management scheme to selectively share documents based on fine-grained attribute-based access control policies in a public cloud is a challenging task. There are many existing approaches that encrypt documents prior to storage in the public cloud: These approaches use different keys and a public key cryptographic system to implement attribute-based encryption and/or proxy re-encryption. However, these approaches do not efficiently handle users joining and leaving the system when identity attributes and policies change. Moreover, these approaches require keeping multiple encrypted copies of the same documents, which has a high computational cost or incurs unnecessary storage costs. Therefore, this project focused on the design and development of an efficient key management scheme to allow the data owner to store data in a cloud service in a secure way. Additionally, the proposed approach enables cloud users to access the data stored in a cloud in a secure way. Many researchers have proposed key management schemes for wired and wireless networks. All of these existing key management schemes differ from the key management schemes proposed in this thesis. First, the key management scheme proposed in this thesis increases access level security. Second, the proposed key management scheme minimizes the computational complexity of the cloud users by performing only one mathematical operation to find the new group key that was computed earlier by the data owner. In addition, this proposed key management scheme is suitable for a cloud network. Third, the proposed key distribution and key management scheme utilizes privacy preserving methods, thus preserving the privacy of the user. Finally, a batch key updating algorithm (also called batch rekeying) has been proposed to reduce the number of rekeying operations required for performing batch leave or join operations. The key management scheme proposed in this thesis is designed to reduce the computation and communication complexity in all but a few cases, while increasing the security and privacy of the data. / De flesta program och dokument lagras i ett offentligt moln för lagring och hantering ändamål i en molnmiljö. De stora fördelarna med att lagra program och dokument i offentliga moln är lägre kostnad genom användning av delade datorresurser och ingen upfront infrastruktur costs.However, i detta fall hanteringen av data och andra tjänster är osäker. Därför är säkerhet ett stort problem i en offentlig moln som molnet och nätverket är öppna för många andra användare. För att ge trygghet, är det nödvändigt för dataägare att lagra sina data i det offentliga molnet på ett säkert sätt och att använda en lämplig åtkomstkontroll schema. Utforma en beräkning och kommunikation effektiv nyckelhantering system för att selektivt dela dokument som grundar sig på finkorniga attributbaserad åtkomstkontroll politik i en offentlig moln är en utmanande uppgift. Det finns många befintliga metoder som krypterar dokument före lagring i det offentliga molnet: Dessa metoder använder olika tangenter och en publik nyckel kryptografiskt system för att genomföra attributbaserad kryptering och / eller proxy re-kryptering. Dock har dessa metoder inte effektivt hantera användare som ansluter och lämnar systemet när identitetsattribut och politik förändras. Dessutom är dessa metoder kräver att hålla flera krypterade kopior av samma dokument, som har en hög beräkningskostnad eller ådrar sig onödiga lagringskostnader. Därför fokuserade projektet på design och utveckling av en effektiv nyckelhantering system för att möjliggöra dataägaren att lagra data i en molntjänst på ett säkert sätt. Dessutom, den föreslagna metoden gör det möjligt för molnanvändare att få tillgång till uppgifter lagras i ett cloud på ett säkert sätt. Många forskare har föreslagit viktiga förvaltningssystem för fasta och trådlösa nätverk. Alla dessa befintliga system ke, skiljer sig från de centrala förvaltningssystemen som föreslås i denna avhandling. Först föreslog nyckelhanteringssystemet i denna avhandling ökar Medverkan nivå säkerhet. För det andra, minimerar den föreslagna nyckelhanteringssystemet beräkningskomplexiteten för molnanvändare genom att utföra endast en matematisk operation för att hitta den nya gruppknapp som tidigare beräknades av dataägaren. Dessutom är denna föreslagna nyckelhanteringsschema lämpligt för ett moln nätverk. För det tredje, den föreslagna nyckeldistribution och nyckelhantering systemet utnyttjar integritets bevara metoder och därmed skydda privatlivet för användaren. Slutligen har ett parti viktig uppdatering algoritm (även kallad batch nya nycklar) föreslagits för att minska antalet Ny serieläggning av operationer som krävs för att utföra batch ledighet eller gå med i verksamheten. Nyckelhanteringssystemet som föreslås i denna avhandling är utformad för att minska beräknings-och kommunikations komplexitet i alla utom ett fåtal fall, och samtidigt öka säkerheten och integriteten av uppgifterna.

With the unprecedented growth of data and the use of low commodity drives in local disk-based storage systems and remote cloud-based servers has increased the risk of data loss and an overall increase in the user perceived system latency. To guarantee high reliability, replication has been the most popular choice for decades, because of simplicity in data management. With the high volume of data being generated every day, the storage cost of replication is very high and is no longer a viable approach. Erasure coding is another approach of adding redundancy in storage systems, which provides high reliability at a fraction of the cost of replication. However, the choice of erasure codes being used affects the storage efficiency, reliability, and overall system performance. At the same time, the performance and interoperability are adversely affected by the slower device components and complex central management systems and operations. To address the problems encountered in various layers of the erasure coded storage system, in this dissertation, we explore the different aspects of storage and design several techniques to improve the reliability, performance, and interoperability. These techniques range from the comprehensive evaluation of erasure codes, application of erasure codes for highly reliable and high-performance SSD system, to the design of new erasure coding and caching schemes for Hadoop Distributed File System, which is one of the central management systems for distributed storage. Detailed evaluation and results are also provided in this dissertation.

Though erasure codes are widely adopted in high fault tolerance storage systems, there exists a serious small-write problem. Many algorithms are proposed to improve small-write performance in RAID systems, without considering the network bandwidth usage. However, the network bandwidth is expensive in cloud systems. In this thesis, we proposed an ECL-based (E-MBR codes, Caching and Logging-based) technique to improve the small-write performance without using extra network bandwidth. In addition, the ECL-based technique also reduces the delayed parity update and data recovery latency compared with the competing algorithm.

Storage services form the core of modern Internet-based services spanning commercial, entertainment, and social-networking sectors. High availability is crucial for these services as even an hour of unavailability can cost them millions of dollars in lost revenue. Unfortunately, it is difficult to build highly available storage services that provide useful correctness properties. Both benign (system crashes, power out- ages etc.) and Byzantine faults (memory or disk corruption, software or configuration errors etc.) plague the availability of these services. Furthermore, the goal of high availability conflicts with our desire to provide good performance and strong correctness guarantees. For example, the Consistency, Availability, and Partition- resilience (CAP) theorem states that a storage service that must be available despite network partitions cannot enforce strong consistency. Similarly, the tradeoff between latency and durability dictates that a low-latency service cannot ensure durability in the presence of data-center wide failures. This dissertation explores the theoretical and practical limits of storage services that can be safe and live despite the presence of benign and Byzantine faults. On the practical front, we use cloud storage as a deployment model to build Depot, a highly available storage service that addresses the above challenges. Depot minimizes the trust clients have to put in the third party storage provider. As a result, Depot clients can continue functioning despite benign or Byzantine faults of the cloud servers. Yet, Depot provides stronger availability, durability, and consistency properties than those provided by many of the existing cloud deployments, without incurring prohibitive performance cost. For example, in contrast to Amazon S3’s eventual consistency, Depot provides a variation of causal consistency on each volume, while tolerating Byzantine faults. On the theoretical front, we explore the consistency-availability tradeoffs. Tradeoffs between consistency and availability have proved useful for designers in deciding how much to strengthen consistency if high availability is desired or how much to compromise availability if strong consistency is essential. We explore the limits of such tradeoffs by attempting to answer the question: What are the semantics that can be implemented without compromising availability? In this work, we investigate this question for both fail-stop and Byzantine failure models. An immediate benefit of answering this question is that we can compare and contrast the consistency provided by Depot with that achievable by an optimal implementation. More crucially, this result complements the CAP theorem. While, the CAP theorem defines a set of properties that cannot be achieved, this work identifies the limits of properties that can be achieved. / text

Data stored in third party storage systems like the cloud might not be secure since confidentiality and integrity of data are not guaranteed. Though cloud computing provides cost-effective storage services, it is a third party service and so, a client cannot trust the cloud service provider to store its data securely within the cloud. Hence, many organizations and users may not be willing to use the cloud services to store their data in the cloud until certain security guarantees are made. In this thesis, a solution to the problem of securely storing the client’s data by maintaining the confidentiality and integrity of the data within the cloud is developed. Five protocols are developed which ensure that the client’s data is stored only on trusted storage servers, replicated only on trusted storage servers, and guarantee that the data owners and other privileged users of that data access the data securely. The system is based on trusted computing platform technology [11]. It uses a Trusted Platform Module, specified by the Trusted Computing Group [11]. An encrypted file system is used to encrypt the user’s data. The system provides data security against a system administrator in the cloud.

This report describes a bachelor thesis performed at Xcerion for their subsidiary CloudMe. CloudMe has a service for cloud computing which makes your files accessible from anywhere, anytime. Cloud computing is addressed to both business and ordinary home users. With the ability to store important documents or family photos in the cloud other important subjects can be focused on. A cloud can in short be described as a metaphor for the internet and with the growing server houses and accessibility of cloud computing the need for USB-sticks (Universal Serial Bus) and hard drives are slowly fading away. CloudMe today offers several different services to access the cloud from a number of devices which includes smartphones, a web-browser and the home computer. This thesis work is about upgrading and improving their desktop application, Easy Upload. Easy Upload makes it possible to back-up several folders to the cloud but with the only option of uploading files and folders. Only uploading files to the cloud makes the application very restricted and lacking of an important feature, downloading from the cloud. Designing this new feature resulted in four different synchronization options; Upload, Download, Bidirectional and Hotsync, each configurable for every connected folder. With these options a user is offered the possibility to choose which synchronization best to use for the task in hand. The ability to choose, and configure, any folder on your computer opens up the restrictions which several large cloud computing services has today with one specific folder for the entire cloud. To ease the access and the understanding of these new synchronization options, a complete redesign of the user interface was developed. The name Easy Upload could no longer be associated with this application and therefore Easy Upload was renamed to suit the new functionality of the application and bring it closer to the association with the company CloudMe. When this thesis work was completed Easy Upload was considered to be the predecessor of CloudMe Sync.

Encrypting data is a solution to enhance the privacy and confidentiality of the data owners when outsourcing storage to cloud storage providers. However, using conventional encryption algorithms would render search queries based on the content of the data useless. One solution to that problem is encrypting the data using a searchable encryption scheme which allows querying the encrypted data by its contents while keeping it encrypted on the cloud to maintain the privacy and confidentiality of the data. One sector that might benefit from using a searchable encryption scheme is the public procurement sector. Preparing to bid on public procurement can be complex because the potential bidder needs to fulfill requirements to confirm that they are eligible. The information and documents needed to win a bid are confidential. Thus, privacy is essential. Tendium offers services to potential bidders to manage their documents with potentially sensitive data in a cloud-based environment. Clients using this service can benefit from using a searchable encryption scheme. A searchable encryption scheme was designed and implemented as a proof of concept. The implemented scheme builds an index database based on keywords extracted from the documents where each keyword is encrypted and stored in the database. Each entry in the database has encrypted keywords and associated identifiers for the corresponding document that the keyword occurs in. The documents are then encrypted using the AES encryption algorithm. Searching the database is performed by utilizing deterministic cryptographic primitives to encrypt the searched keywords and query the database for the resulting ciphertext, which returns its corresponding document identifiers. The document identifiers are used to retrieve the encrypted documents. The documents are decrypted after they are retrieved. The implemented scheme has a linear time complexity relative to the number of words in the document when encrypting a document. The implemented scheme utilizes MongoDB for its index database. It is demonstrated that the scheme is efficient and performs queries for single keyword search and multi-keyword search in less than one millisecond. / Kryptering av data är en lösning för att förbättra integriteten och sekretessen för dataägarna vid outsourcing av lagring till molnlagringsleverantörer. Använ- -dning av konventionella krypteringsalgoritmer skulle dock göra sökfrågor baserat på innehållet i data värdelös. En lösning på det problemet är att kryptera data med hjälp av ett sökbart krypteringsschema som gör det möjligt att söka efter krypterade data med dess innehåll och samtidigt hålla den krypterad på molnet för att upprätthålla upprätthålla dataskyddet och konfident- -ialiteten. En sektor som kan ha nytta av att använda ett sökbart krypteringssche- -ma är sektorn för offentliga upphandlingar. Att förbereda sig för att lägga ett bud på en offentlig upphandling kan vara komplext eftersom den potentiella budgivaren måste uppfylla kraven för att bekräfta att de är berättigade. Informat- -ionen och dokumenten som behövs för att vinna ett bud är konfidentiella. Därför är integritet viktigt. Tendium erbjuder tjänster för att hjälpa potentiella anbudsgivare hantera sina dokument i en molnbaserad miljö. Kunder som använder denna tjänst kan dra nytta av att använda ett sökbart krypteringssc- -hema. Ett sökbart krypteringsschema utformades och implementerades som ett bevis på koncept. Det implementerade schemat bygger en indexdatabas baserad på nyckelord extraherade från dokumenten där varje nyckelord är krypterat och lagrat i databasen. Varje objekt i databasen har krypterade sökord och tillhörande identifierare för motsvarande dokument som sökordet förekommer i. Dokumenten krypteras sedan med AES-krypteringsalgoritmen. Sökning i databasen utförs genom att använda deterministiska kryptografiska primitiv för att kryptera de sökte sökorden och söka databasen efter den resulterande krypterade texten, som returnerar motsvarande dokumentidentifierare. Dokum- -entidentifierarna används för att hämta de krypterade dokumenten. Dokument- -en avkrypteras efter att de har hämtats. Det implementerade schemat har en linjär tidskomplexitet i förhållande till antalet ord i dokumentet vid kryptering av ett dokument. Det implementerade schemat använder MongoDB för sin indexdatabas. Det har visat sig att schemat är effektivt och utför sökfrågor för enstaka nyckelord och flera nyckelord på mindre än en millisekund.