Understanding the Security of Cloud Storage Services: A Case Study and UC-Secure Design

Despite the ubiquity of cloud storage, achieving secure and flexible file sharing remains challenging. Through a case study of six mainstream cloud storage platforms, we identify three key issues: the lack of native or universally available end-to-end encryption, reliance on third-party key management with additional trust assumptions, and inflexible or inefficient privilege revocation. To address these challenges, we propose GuardShare, a secure cloud file-sharing system for user collaboration in an enterprise environment. GuardShare leverages Trusted Execution Environment (TEE) to provide end-to-end data confidentiality and discretionary access control. At its core, we design a TEE-assisted Verifiable and Conditional Proxy Re-Encryption (VCPRE) scheme that eliminates the need for integrity checks or complex cross-validation between re-encryption keys and ciphertexts. By re-encrypting only symmetric data encryption key from the owner to the recipient, our system enables fast file sharing. Our security analysis is conducted under the Universal Composability (UC) framework, covering three subsystems: user, file, and permission management. To align the proposed TEE-assisted VCPRE scheme with UC security, we define a novel ideal functionality that captures both Chosen-Ciphertext Attack (CCA) security and re-encryption verifiability. Finally, we implement GuardShare and integrate it with Microsoft OneDrive in a TEE-enabled cloud environment. Experimental results show that sharing a 1GB file takes only 3.27 s using a 128-byte re-encryption key, indicating the practicality of our system in real use.