A Fine Grained Access Control and Flexible
Revocation Scheme for Data Security on
Public Cloud Storage Services
Tameem Eissa, Gi-Hwan Cho
Division of CSE
Chonbuk National University
Jeonju, Jeonbuk, Republic of KOREA
Tamnet83@hotmail.com, ghcho@chonbukac.kr
Abstract-Cloud computing based storage services have
rapidly spread in the market due to their promising
capabilities and features. However, the security challenge of
outsourcing sensitive data for sharing on the cloud which is not
fully controlled by the data owners is still open. In this paper,
we present negative and positive attributes in attribute based
encryption to support fine grained access control and flexible
revocation. The framework is designed to shift the key
security roles, such as authentication and key management,
from the cloud to be shared between data owners and a trusted
third party. Furthermore, this research aims to enable data
owner to do most of the heavy re-encryption tasks using the
cloud resources and without revealing his data or attributes to
the cloud. We propose a flexible revocation solution which
enables the owner to revocate users without the need for re
encrypting all the affected files or regenerating system and
users' keys. We highlight the performance of our scheme by
analyzing its computational complexity.
Keywords-Secure Storage; Cloud Computing; Proxy Re
encryption; Attribute Based Encryption; Key Policy.
I. [NTRODUCT[ON
Cloud computing is a new technology drowning
extensive attention in the market. Many companies are now
moving towards the cloud computing because it has the
capability to provide them with all business requirements at a
[ower cost. Cloud computing uses the concept of "pay per
use". No deposit is required. The company pays only when
clients hit the service. There are many common cloud
providers in the market such as Amazon [1], Microsoft
Azure [2], Force.com [3] and Google Doc [4]. Cloud
computing is growing fast. [t is expected to spend about
$ 160 billion on cloud computing at the end of 2014. There
are three main different models of cloud services which are:
Infrastructure as a service (IaaS), platform as a service
(PaaS), and Software as a Service (SaaS). In IaaS, the
datacenters, networking connections, servers and storage are
rented as services. Some examples include but are not
limited to: Amazon Simple Storage Service (S3), Amazon
This research was supported by Basic Science Research Program
through the National Research Foundation of Korea (KRF) funded by the
Ministry of Education,Science and Technology (2012RIAIA2042035)
Proceedings of 2012 International Conference on Cloud Computing,Technologies,Applications & Management
978-1-46 73-4416-6112/$31.00 20121EEE
Elastic Compute Cloud (EC2) and Sun's Cloud Services. [n
PaaS, the operating systems and application development
systems are rented as services. Some examples include but
are not limited to: Microsoft Azure, Force.com and Google
App Engine. In SaaS, the business applications are rented in
a pay-per-use mode. Some examples include but are not
limited to: Google Docs and ZOHO. Lately, new types of
public cloud computing hit the market, these include Storage
as a service (STaaS), Security as a service (SECaaS), Data as
a service (DaaS), Database as a service (DBaaS), Test
environment as a service (TEaaS), API as a service (APIaaS)
and Backend as a service (BaaS) [5].
The main challenge in the adoption of cloud computing
is the lack of a holistic view of security. Data are stored in a
remote network and vulnerable to attacks. The owner does
not have a full privacy control on his data when migrating to
the cloud. His private data is accessible to third parties.
Furthermore, the cloud service is vulnerable to a point of
failure when the cloud provider suffers a security breach.
The consequences of such a breach may affect thousands of
companies hosting their data on that provider. Data loss is
the biggest risk that may affect the company's decision to
migrate to the cloud. The open security problems of cloud
computing can be summarized as follows:
Security issues related to the infrastructure of the cloud,
which includes protecting the site which hosts the
applications and platforms from physical attack. It also
includes the protection of virtual machines, storage
systems and shared resources [6]
Security issues related to data protection which includes
data integrity, confidentiality and provenance.
Security issues related to access control. This includes
authentication and managing users' accounts and
permissions [7, 8].
Security issues related to compliance. This includes the
enactment of laws by the relevant authorities delegated
to control the cloud. It also includes the establishment
of necessary procedures and action in case of any
breach in cloud security.
From the previous literatures, one of the challenges
facing cloud application's industry is how to convince data
27
 156621220: A Fine Grained Access Control and Flexible Revocation Scheme for Data Security on Public Cloud Storage Services
'owners to shift to the cloud. This includes a confIrmation
that their outsourced data are safe from theft, modifIcation or
misuse. The traditional solution for this problem is to use the
standard data encryption techniques such as symmetric
encryption or public key cryptography [9]. However this
solution has high encryption cost, because, the owner must
make an encrypted version of each file for each individual
user. Another solution is to make one encrypted version of
each file and share a single secret key among the users.
However this solution has a limitation when the owner needs
to revoke some users in case of resigning or reallocating
tasks. In this case, the owner should regenerates,
redistributes the keys and re-encrypts data to prevent the
leaving users from obtaining access to these data using their
old keys. This solution is not practical when dealing with
large number of users and data.
In this paper, we propose a novel scheme that provides a
fine grained, scalable and secure data access control in
cloud computing environments. In our solution, the owner
does not need to re-encrypt all his data and re-generate all
the affected users' keys after revoking certain users.
Furthermore, most of the heavy computational tasks are
shifted from the owner to the cloud without revealing either
the secret information or the data attributes to the cloud
thanks to proxy re-encryption. The proposed scheme gives
the owner more flexibility in revoking users according to
their attributes and identities.
The rest of the paper is organized as follows: section 2
reviews some related work that has been done to solve the
addressed problem in cloud security. Section 3 presents our
solution. Section 4 discusses the revocation issues. The
paper is concluded in section 5.
II. RELATED WORK
A. Preliminaries
1) Bilinear Mapping
Let G1be an additive group of prime order q and G2 a
multiplicative group of the same order. The map e: G1 x
G1 G2 is called bilinear pairing [10] if (and only it) it
Figure 1. The proposed system design
Proceedings of 20121ntemational Conference on Cloud Computing, Technologies,Applications & Management
satisfies the following properties:
Bilinearity. e(aP; bQ) e(P; Q)ab, for all P, Q E
=
G1; a, b E Zq
Non- degeneratity. Each element of G1is appended to an
element S from G2such that: S =I=- lDgCthe identity element
in G2).
Computability. V P, Q E Gv e(P, Q) can be computed
effIciently.
B. Previous Solutions
Yu et al proposed a model that provides fine grained
access control using Attribute-Based Encryption [11]. In this
encryption, data is encrypted based on a set of attributes that
determine the user characteristics and his access permission
using logical expressions. This technology enables a fme
grained access control in the cloud storage environment. In
this encryption, it is not enough for a decrypter to have the
decryption key, but he should also satisfy the access control
policies which are set by the encrypter. There are two types
of Attribute Based Encryption: Key Policy Attribute-Based
Encryption (KP-ABE) [12] and Ciphertext Policy Attribute
Based Encryption (CP-ABE) [13]. In I<P-ABE, the encrypter
sets attributes to the file and determines which users can
access this fIle using an access policy assigned for each key.
While in CP-ABE, the encrypter assigns attributes to the key
to specify which fIles this key can decrypt according to
attributes assigned to these files.
Blaze et al [14] proposed a proxy re-encryption which
allows the encrypter to ask a third party to re-encrypt his
encrypted message and deliver it to the decrypter. The third
party should be able to re-encrypt the message without
gaining access either to the original message or to the
encrypter cryptography key. All he needs is a re-encryption
key (proxy key) provided by the encrypter. Shucheng et al
[15] proposed a Dummy attribute that allows the cloud to
store the users' private keys in the cloud without disclosing
them. In their scheme, the owner first encrypts the file using
symmetric key. Then he encrypts it using KP-ABE.
Yang and Zhang proposed a generic system for data
protection in the cloud [15]. Their system is compatible with
any type of Attribute-Based Encryption. Wang et al [16]
28
 Tameem Eissa,Gi-Hwan Cho

The proposed framework structure is shown in Figure 2

where "AAAA" (Authentication, Authorizing and
OWNERS\.

Accounting Authority) refers to the cloud service responsible

CLOUD
\. on authenticating, authorizing and accounting users and
Proxy re-encrypts data from Store,

" deliver it to users when requHted

d send a copy back to the Store.
owners. While "Proxy" is the cloud service responsible on
running the re-encryption functions. It also includes a cache
Store servers keeps the
datil received bV owners memory to keep copies of the last requests and responses.
and proxy

RCA Is responsible on
The proposed model combines Proxy Based Encryption
Generatinckeys and
certificates
and Key Policy Attribute Based Encryption in an efficient
AAAAperform
way. Each file is assigned by a set of attributes while each
RCA (Root Certlfites
AuthentIcation
trusactlons with Users,
Authoritv) user key is assigned by an access policy. The main
Owners and RCA.
contribution of our scheme is enabling the cloud to re
I encrypt both data and attributes without disclosing owner's
AAAA1Authentlcatlna.
Authorizlnl and Atcountini
r USERS
data, keys and attributes to any party. The only information
Author1tv )
'- -- disclosed to the cloud is the proxy keys provided by the
Figure 2. The proposed framework's structure. OWNERS,USERS and
owner. These keys will be used to re-encrypt both data and
AAAA perfonn authentication transactions based on certificates obtained
from RCA.
attributes. Using this concept, the owner does not need to be
online to listen to users requests. He encrypts the attributes
embedded a hierarchical structure in the Ciphertext Policy
along with the data using 1 sl encryption algorithm and keeps
Attribute-Based Encryption. They delegated most of the
them in the cloud. The cloud then re-encrypts data and
computation workloads to the cloud and provided
attributes using 2nd encryption algorithm whenever requested
compatibility with complex applications. However, their
by users. To provide scalable access control, we propose an
scheme does not support compound attributes.
access tree that gives the owner more options and flexibility
III. OUR SOLUTION
in managing the users' policies.

Our goal is to prevent the cloud from obtaining an access C. Developing the access control tree
to owner's plain data or credentials and to make user's The access control tree proposed in [12] consists of AND,
revocation without re-encrypting the affected files or OR and threshold gates. [t does not give the owner the
regenerating system parameters and users' keys. Furthermore, flexibility to manage users' keys access control policies.
we aim to shift most of the heavy computations from the Therefore, we propose three types of access control tree:
owner to the cloud. For these reasons, we propose two layers Allowing access control tree: this tree allows all users
of encryptions: owner's level encryption and cloud's level with policy satisfying the file attributes to obtain an
encryption (Figure 1). We also propose a third party RCA access to the file. This type of tree is suitable for private
(Root Certificate Authority) that provides root clouds.
authentications and generate certificates and keys for owners,
Blocking access control tree: this tree prevents all users
cloud and users. Any data sent by any party should be signed
with policy satisfying the file attributes from obtaining
using certificates provided by RCA. RCA is also responsible
an access to the file. This type of tree is recommended in
on issuing, renewing and revoking the cryptography keys..
public clouds. For example, in Video cloud applications,
the video owner implements a user key policy that blocks
tr=l
(ORG,te) users from a specific country or a specific city from
CHI2
obtaining access to the file.
Ir=3 Hybrid access control tree: this tree allows owners to
merge allowing and blocking policies to the same file.
This is done using NOT gate which enable the owner to
",
exclude users holding specific attributes without the need
tr=l 11\
(ORG'te) ,
,
, "
, , to include all the opposite attributes in the tree.
CH42
, ,
, '
,
For example, let's consider the scenario where the owner
wants to prevent sales staffs from getting access to a file
while allowing staffs from all other departments to access
that file. Using the tree from Goyal et al [12], the owner
should add all departments except sales as leaves attributes
leave
Nodes { Id: TOM DEP: SALES DEP:IT
connected by AND, OR and threshold gates. While using
Figure 3. An example of a hybrid access tree (tr: threshold value,CH: the tree proposed by us, the owner has only to add one NOT
number of the current node's children. gate and one leaf that represents the sales department.
Figure 3 shows an example of hybrid access tree where "tr"

Proceedings of 20l 21ntemational Conference on Cloud Computing,Technologies,Applications & Management 29

 156621220: A Fine Grained Access Control and Flexible Revocation Scheme for Data Security on Public Cloud Storage Services

refers to the gate thresho Id (-\ for NOT gate, I for OR gate Where x represents the current node in the access tree.
and >\ for AND gate).
qx(G) =qparen x (index(x))
t( )
2) System Setup
We define the following bilinear pairing The owner signs this information and sends it to the user.
e: G1 X G1 ..... Gz The user then verifies the owner's signature and stores the
Where G1 and Gzare two linear groups of order q. q is a information. The owner then communicates with AAAA to
large prime. We define a random generator P from the linear add B as one of his users to the cloud users' database. The
group G1, a Hash function H: {G,l}* ..... G1. RCA constructs
public and private key of the user b is defined as follows:
the owners key pairs as follow: da is the owner private key,
PK=(hb =h b)
Pda is the owner public key, where: da E Zq.
SK=( db, Dx for x E T)
The attribute space is U, i is an attribute from U.
The public key (PK): Tl =gH(t1); ... , Tlul =
1 c) Reading/rom the cloud
gH(tu),g,ha =gda,fa =gda
When the user b requests to obtain an access to an
The master key (MK): t1, ..... ,tlul' da.
owner's data, the cloud requests a proxy key from the
a) Addingfiles to cloud owner TIA--+B' this proxy key enables only one user (b) to
decrypt the data. This key should be signed by the owner
The owner, users and cloud perform certificates'
certificate only. The proxy key is constructed as follows:
transactions in the bootstrapping phase. To add a file to the
cloud, the owner creates an identity Idfi. assign attributes 1fA-->B:([Crro--+b =

that determines which users can get access to that file and
e(g,g)k.da EB e(fa,[b),],{Erri i
fmally encrypts the file using the first level encryption = Ei.h:Ct )hEA
algorithm ( \ sl encryption) as follows: .................................. (1)
Suppose the file attribute set is A. Where A E U
Enc(M, A. PK)= The cloud re-encrypts data and file attributes using this
k { '. h H(ti).k} key as following:
{A C' =M ill f
e( a' g ) , E l = a
iEA
C" = c' EB C1IOb""""""""""""""""""""""""'" (2)
}

where M represents the data to be outsourced, 9 E Gj, k

'. [
is a random secret from Zq. The owner signs the file using his {E".=}.
[ [Ell.
private key and sends it to the cloud to be stored. AAAA . [
verifies the owner information by checking his certificate in
conjunction with RCA. If the owner is verified, the file IS
stored in the cloud database (STORE). The output is sent to the user along with the cloud
certificate.
b) Adding new user
Whenever a new user, denoted as b, wants to join the d) Decryption
system, RTA first checks if the user is valid. If yes, then it The user b then verifies cloud certificate and then
generates a unique ID and a random secret dbEZp and then decrypts the file using the I<P-ABE recursive algorithm as
assigns a new access control tree T corresponding to the following:
user b roles and permissions. We defme two sets of The algorithm starts from the leaves, for each leave it
attributes in our access tree: positive attributes and negative computes:
attributes. Positive attributes are the standard attributes that, DecryptNode(E,D,X)= e(Dx' E;)
if satisfied by a key policy, the file can be decrypted by the if x is a standard attribute

( 'f) =e(g,g)db.qX(O),1
key holder. Negative attributes are the attributes that if e(Dx,E";)
satisfied by a key policy, the key holder should not be able qx(O).da E ' i n
gH(t;) E ll.
.

to decrypt the file. Negative attributes are the leaves of =e

"NOT" gates while Positive attributes are the leaves of other
=e(g, p)db .qX(O) ..................................... (3)
threshoId gates. The private key at each node of the tree is
if x is a negative attribute
defmed as follows:

( )
e(Dx,E";)

qxC qx(O) da E l i b dbqx (O)

If the attribute is negative then Dx =g
HCt; ) .da =e gH(th , ;; = e(g,gfH"(fJ-,i E ll.
qxCO)
Else Dx
H da
=g C t;l"
............ (4)

Proceedings of 20121ntemational Conference on Cloud Computing, Technologies,Applications & Management 30


For each parent node it computes:
Comedy Season=l 2010
Figure 4-A An example of a key policy before revocation
Season=l
Comedy
Friends Survivor
Figure 4-8 An example of a key policy after revocation
Fx = n FZ lli,s'CO)
ZES
Where z is the child of the current node. Using
Lagrange interpolation: if no negative attributes were
satisfied in the file set of attributes then:
Fx =
e(g, p)db.qX(O)
If the user key policy satisfies the file attributes, then
Fx e(g, p)db.da,.,., .. ,.,.".,.,.,.".,.,.,.".,.,.,."., (5)
=
The user then may obtain the original message as follows:
M EB Fx ..................................."".. (6)
IV, USER REVOCATION
User revocation is the most challenging task in cloud
computing. Revoked users should not obtain access any
more to their previous files after revocation, The traditional
solution is to generate new encryption keys for all other
users accessing the same files and re-encrypt all the affected
files, This consumes a lot of resources, bandwidth and time,
To make the user revocation more flexible, the owner should
only update the revoked user key with "NOT" gate and
negative attributes. The owner requests the cloud to delete
the proxy key associated with that user key and file, Then he
generates a new proxy key for accessing that file, We note
that the 1 sl Encryption algorithm is not affected by adding a
negative attribute to the user key policy. Therefore, the
Proceedings of 20121ntemational Conference on Cloud Computing,Technologies,Applications & Management
Tameem Eissa,Gi-Hwan Cho
owner does not need to re-encrypt the affected file. When
updating the revoked user key, we use the same secret
elementdb. As long as there is no match between the
negative attribute in the key access tree and an attribute
in the file attribute set, the key holder is able to decrypt
the data. Therefore, all other users accessing the same
file can still use their old keys to access that file
without updating or re-generating. The only affected
users are those with key policy satisfying the
revocation condition. Therefore, only the revoked
users' keys need to be updated. The revoked user key
should be updated by RCA, As soon as the new key policy
applied, the user will automatically be unable to obtain
2010
access to the associated files.
For example, let's consider a video broadcasting application
where each owner assign a set of attributes for each of his
video files (title, genre, season, year, month, day, director
name, producing company, ... etc.). Each user is assigned
with a policy to determine which videos package he can
watch. For instance, Figure 4-A shows a key policy which
enables a user to watch the first season of all the comedy
episodes produced in 20 I 0, To prevent this user from
obtaining access to "Friends" and "Survivor" titled episodes
only, we convert the access tree of the key holder to a hybrid
tree as shown in figure 4-B. RCA update the key policy by
adding the following sub tree: { ..,AND { NOT {Title:
Friends} AND { NOT {Title: Survivor}}. Therefore, the
decryption algorithm will automatically be unable to decrypt
the files that contain at least one of these negative attributes.
The reason is that the output of the equation (5) will be different
frome(g,p)db.da (at least one H(t;) will not be eliminated in the
calculation function). As a result, the output of XOR operation in
equation (6) will be different from the original message.
Our scheme also supports user revocation based on an
expiring time, This is implemented by adding the condition
( key expire time < t') to the key access tree, This
_ _
condition is implemented using the "bag of bits" attribute as
in [17],
In our scheme, the owner may request the cloud to delete
the proxy keys associated with the revoked users. The cloud
in this case freezes the user access to the associated files
until the owner update the proxy key. The owner may
aggregate all proxy keys update to the next time he logs in,
This technique is called lazy revocation which is widely used
by many cryptography file systems [18, 19, 20],
V. COMPUTATION COMPLEXITY
Table 1 lists the symbols
Symbol Meaning
S The number of threshold gates in
the key access tree.
L The set of leaf nodes in the key
access tree.
The number of file attributes
31
 156621220: A Fine Grained Access Control and Flexible Revocation Scheme for Data Security on Public Cloud Storage Services
Table 2 Complexity of main operations in our scheme
Operation System Setup Adding a user
Complexity 0(1) O(ILI + 151)
We assume that the owner and users' signatures are
managed by a third party. Therefore, we do not consider the
signature load in our analysis. We focus on the complexity
of the main operations in our scheme (System setup, adding
a user, adding a file, the 2nd encryption and data decryption).
Table I lists the symbols used in the complexity calculation
and their meaning. Table 2 shows the complexity of the
main operations in our scheme.
Adding a{ile
To add a file, the owner must encrypt the file and send it
to the cloud. This requires a 1 st Encryption algorithm
process. This last requires one exponentiation per file
attribute.
Adding a new user
In this operation, the owner creates a private key and an
access policy. The complexity of this operation depends on
the number of leaf nodes and threshold gates in the key
access tree.
.
2ndEncryptlOn
This operation requires the owner to generate a proxy
key and new encrypted attributes to be used by the cloud
whenever a user request an access to the file. This requires
one exponentiation operations per file attribute.
File decryption
The decryption algorithm complexity depends on the
number of pairings which is based on the number of file
attributes to be satisfied by the key access tree. This number
varies for each user key policy and file attributes structure.
Table 2 shows the complexity of the main operations
used in our scheme.
Conclusion
In this paper, we defined a new framework for providing
a fine grained access control and flexible revocation in
cloud storage services. We proved that our scheme enables
the owner to shift most of the extensive computation load to
the cloud by providing attributes and data re-encryption to
the cloud. We developed an access control tree that provides
flexibility in keys policies management. We also proposed a
new technique of scalable and flexible revocation that
enables owners to revoke users with less computational
requirements. Our future work is to implement this system
in a real application to prove its efficiency.
Proceedings of 20121nternational Conference on Cloud Computing,Technologies,Applications & Management
Adding a file 2nd Encryption Decryption
0(111) 0(111) O(max( ILl, III))
REFERENCES
[I] Amazon Web Services (AWS),Online at http://aws.
amazon.com.
[2] Microsoft Azure,http://www.microsoft.com!azure/.
[3] Google App Engine,Online at
http://code.google.com!appenginel.
[4] Force.com platform,Online at http://www.force.com!
[5] Monaco,Ania (7 June 2012 [last updateD. "A View Inside the
Cloud". theinstitute.ieee.org (I EEE). Retrieved August 21,2012.
[6] Carpenter,M.,Liston,t.,and Skoudis,E,Hiding Virtualization
from Attackers and Malware. IEEE Security and Privacy
Magazine,2007.
[7] Eve Maler,Scott Cantor,laban Moreh,Sigaba,Rob Philpott,
"Metadata for the OASIS Security Assertion Markup Language
(SAML) V2.0",Copyright OASIS Open,2005.
[8] T. Mather,S. Kumarasuwamy and S. Latif, "Cloud Security and
Privacy", O'Rielly, ISBN: 978-0-4596-802769,2009.
[9] R. Chow,P. Golle,M. Jakobsson, E. Shi,J. Staddon, R.
Masuoka,and 1. Molina,Controlling Data in the Cloud:
Outsourcing Computation without Outsourcing Control. Proc.
IEEE 3rd International Conference on Cloud Computing,pp.
85-90,2010.
[10] P. Barreto, H. Kim,B. Bynn, and M. Scott,"Efficient
Algorithms for Pairing-Based Cryptosystems," in CRYPTO'02,
Santa Barbara, CA,Aug. 2002, pp. 354-368.
[11] Shucheng Yu,Cong Wang,Kui Ren ,and Wenjing Lou.
Achieving Secure,Scalable,and Fine-Grained Data Access
Control in Cloud Computing, Proc.
INFOCOM'10 Proceedings
of the29th conference on Information communications,pp.
1-9,2010.
[12] V. Goyal,O. Pandy,A. Sahai,and B. Waters. Attribute based
Encryption for Fine-Grained Access Control of Encrypted Data,
Proc. ACM Computer and Communications Security
Conference,CCS'06.
[13] l. Bethencourt,A. Sahai,and B. Waters. Ciphertext-Policy
Attribute-based Encryption. Proc. I EEE Symposium on Security
& Privacy,S&P'07.
[14] M. Blaze,G. Bleumer,and M. Strauss. Divertible Protocols and
Atomic Proxy Cryptography,Proc. Advances in Cryptology -
Eurocrypt'98,1998.
[15] Yanjiang Yang,Youcheng Zhang. "A Generic Scheme for
Secure Data Sharing in Cloud",. Proc.lnternational Conference
on Parallel Processing Workshops:ICPP,pp. 145-153,2011.
[16] G. Wang,Q. Liu,and 1. Wu. Hierarhical Attribute-Based
Encryption For Fine-Grained Access Control In Cloud Storage
Services. Proc. ACM conference on Computer and
Communications Security,CCS'10.
[17] R. Bobba ,H. Khurana and M. Prabhakaran "Attribute-Sets: A
Practically Motivated Enhancement To Attribute-Based
Encryption" Proc. ESORICS,2009.
[18] Michael Backes,Christian Cachin,and Alina Oprea. Secure
Key-Updating for Lazy Revocation. In Research Report RZ
3627,IBM Research,pages 327-346. Springer,2005.
[19] Erik Riedel,Mahesh Kallahalla,and Ram Swaminathan. A
Framework for Evaluating Storage System Security. In
32
 Tameem Eissa,Gi-Hwan Cho

Proceedings of the 1st USENIX Conference on File and Storage

Technologies,FAST '02,Berkeley,CA,USA,2002. USENIX
Association.
[20] Paul Stanton,William Yurcik,and Larry Brumbaugh. Protecting
Multimedia Data In Storage: A Survey Of Techniques
Emphasizing Encryption. In IS and T/SPIE International
Symposium Electronic Imaging I Storage and Retrieval
Methods and Applications for Multimedia,pages 18-29,2005.

Proceedings of 20121nternational Conference on Cloud Computing,Technologies,Applications & Management 33