Secure group file sharing
Aspects of the current subject matter are directed to secure group file sharing. An architecture for end-to-end encrypted, group-based file sharing using a trusted execution environment (TEE) is provided to protect confidentiality and integrity of data and management of files, enforce immediate permission and membership revocations, support deduplication, and mitigate rollback attacks.
1. A system, comprising:
at least one data processor; and
at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
establishing, by an enclave executed by a trusted execution environment that runs at an untrusted provider, a trusted relationship with a user accessing a user application, wherein the establishment is at least partially based on a trust measurement communicated between the enclave and a certificate authority component associated with the user;
associating, by the enclave, one or more access control permissions to a file linked from the user application to a remote file system at the untrusted provider, wherein to link the file to the remote file system, the user application establishes a network connection to an untrusted transport layer security interface at the untrusted provider that runs the trusted execution environment, wherein the untrusted transport layer security interface terminates the network connection with the user application and establishes a secure transport layer security connection to a trusted transport layer security interface within the enclave, the trusted transport layer security interface decrypting or encrypting incoming or outgoing transport layer security data and providing a secure transport layer security connection to the user application, wherein the one or more access control permissions define one or more parameters of access related to the file and defined by the user for individual users and/or groups of users; and
providing, by the enclave, access to the file, wherein the providing is in response to a verification that a request for the file satisfies the one or more access control permissions, and wherein to provide access to the file, the operations further comprise:
receiving, by a trusted file manager at the enclave, the file in an encrypted form from the remote file system at the untrusted provider, wherein the file is encrypted with a file key, the file key unique to the file and derived from a root key generated by the enclave;
decrypting, by the trusted file manager at the enclave, the encrypted file; and
sending, by the enclave, the file over the secure transport layer security connection channel to provide the file.
2. The system of claim 1 , wherein establishing the trusted relationship comprises:
providing, by the enclave and to the certificate authority component, a server token request comprising a public key;
receiving, by the enclave and from the certificate authority component, a server token signed with a certificate authority public key; and
verifying, by the enclave, the received server token, wherein the verification is based upon the certificate authority public key.
3. The system of claim 2 , wherein the certificate authority public key is hard-coded into the enclave, and wherein the server token is persisted to memory of the enclave upon verification of the received server token.
4. The system of claim 2 , wherein establishing the trusted relationship further comprises:
receiving, by the enclave and from the user application, an authentication token; and
verifying, by the enclave, the authentication token based upon the certificate authority public key.
5. The system of claim 1 , wherein the one or more parameters of access related to the file comprise a level of permission for the individual users and/or the groups of users.
6. The system of claim 1 , wherein the encryption of the file with the file key occurs within the enclave.
7. The system of claim 1 , wherein providing, by the enclave, access to the file is further in response to establishment of a second trusted relationship with a second user having individual access rights or being part of a group with access rights.
8. A method, comprising:
establishing, by an enclave executed by a trusted execution environment that runs at an untrusted provider, a trusted relationship with a user accessing a user application, wherein the establishment is at least partially based on a trust measurement communicated between the enclave and a certificate authority component associated with the user;
associating, by the enclave, one or more access control permissions to a file linked from the user application to a remote file system at the untrusted provider, wherein to link the file to the remote file system, the user application establishes a network connection to an untrusted transport layer security interface at the untrusted provider that runs the trusted execution environment, wherein the untrusted transport layer security interface terminates the network connection with the user application and establishes a secure transport layer security connection to a trusted transport layer security interface within the enclave, the trusted transport layer security interface decrypting or encrypting incoming or outgoing transport layer security data and providing a secure transport layer security connection to the user application, wherein the one or more access control permissions define one or more parameters of access related to the file and defined by the user for individual users and/or groups of users; and
providing, by the enclave, access to the file, wherein the providing is in response to a verification that a request for the file satisfies the one or more access control permissions, and wherein to provide access to the file, the method further comprises:
receiving, by a trusted file manager at the enclave, the file in an encrypted form from the remote file system at the untrusted provider, wherein the file is encrypted with a file key, the file key unique to the file and derived from a root key generated by the enclave;
decrypting, by the trusted file manager at the enclave, the encrypted file; and
sending, by the enclave, the file over the secure transport layer security connection channel to provide the file.
9. The method of claim 8 , wherein establishing the trusted relationship comprises:
providing, by the enclave and to the certificate authority component, a server token request comprising a public key;
receiving, by the enclave and from the certificate authority component, a server token signed with a certificate authority public key; and
verifying, by the enclave, the received server token, wherein the verification is based upon the certificate authority public key.
10. The method of claim 9 , wherein the certificate authority public key is hard-coded into the enclave, and wherein the server token is persisted to memory of the enclave upon verification of the received server token.
11. The method of claim 9 , wherein establishing the trusted relationship further comprises:
receiving, by the enclave and from the user application, an authentication token; and
verifying, by the enclave, the authentication token based upon the certificate authority public key.
12. The method of claim 8 , wherein the one or more parameters of access related to the file comprise a level of permission for the individual users and/or the groups of users.
13. The method of claim 8 , wherein the encryption of the file with the file key occurs within the enclave.
14. The method of claim 8 , wherein providing, by the enclave, access to the file is further in response to establishment of a second trusted relationship with a second user having individual access rights or being part of a group with access rights.