Hello All,
The DuraCloud perspective on this issue comes from a slightly
different angle than that of many of the other members of this group.
As developers of a cloud-based preservation service, our (emerging)
approach to encryption is in response to what consumers of cloud
storage are requesting. Some of these requests and associated concerns
echo points raised by Cory. The number one concern is over
unauthorized access. Similar to the Tivoli Storage Manager example,
many cloud storage consumers want to separate the responsibilities of
data security from that of storage by uploading already encrypted
content. However, the burden of client-side encryption poses a barrier
to some. As a result, we are developing tooling to accommodate a few
different scenarios:
- client does all encryption and key management themselves
- client manages keys, but provides them to upload tooling to encrypt
content prior to transit
- client wants persisted content to be encrypted, but would rather not
deal with key management or the encryption process

Also, as previously mentioned, layered on top of these scenarios is
the consideration of the contents' usability within the storage
system; such as indexing or metadata extraction.

I am interested, Cory (and others), in your ideas around the issue of
long-term, secure management of the keys themselves. Would you be kind
enough to elaborate.
Andrew

On Mon, Feb 13, 2012 at 12:17 PM, Goethals, Andrea
<[log in to unmask]> wrote:
> I hope you all don't mind my starting this series off. I think this would work best if we pass the virtual baton around to a different person after each topic. We can queue up a list of topics on the wiki so people know what's coming next.
>
> The first topic is encryption in preservation storage. I am thinking about hardware or software or file encryption primarily imposed by the repository (but whether or not you accept content encrypted by others is also interesting). I am thinking less about encrypting for transport (e.g. https). Say what you want about it but I'll pose some questions to get you thinking about it.
>
>
>
> *         Do you have any opinions on it? What are your reasons for your opinions (gut feelings are OK)?
>
> *         What kinds of problems do you think it might create in the future?
>
> *         Do you have any current requirements to do this (laws, policies)? What are the conditions under which you need to encrypt? Do you know of any upcoming requirements for you to do this?
>
> *         If you do it what technique(s)/strategies do you use? Do you isolate encrypted content from non-encrypted content?
>
> *         Do you know of any relevant studies/papers, etc. about this topic?
>
> Someone proposed that we keep each topic discussion to around 2 weeks so let's see if we've said what we want to by March 2. We can always extend this one since there was no advance notice of the topic.
>
> Thanks,
> Andrea
>
> Andrea Goethals
> Digital Preservation and Repository Services Manager
> Harvard Library Office for Information Systems
> [log in to unmask]
> (617) 495-3724
>
>
> ############################
>
> To unsubscribe from the NDSA-INFRASTRUCTURE list:
> write to: mailto:[log in to unmask]
> or click the following link:
> http://list.digitalpreservation.gov/SCRIPTS/WA-DIGITAL.EXE?SUBED1=NDSA-INFRASTRUCTURE&A=1

############################

To unsubscribe from the NDSA-INFRASTRUCTURE list:
write to: mailto:[log in to unmask]
or click the following link:
http://list.digitalpreservation.gov/SCRIPTS/WA-DIGITAL.EXE?SUBED1=NDSA-INFRASTRUCTURE&A=1