@conference {373611,
	title = {Sieve: Cryptographically Enforced Access Control for User Data in Untrusted Clouds},
	booktitle = {NSDI},
	year = {2016},
	address = {Santa Clara, CA},
	abstract = {
	Modern web services rob users of low-level control over\&nbsp;cloud storage{\textemdash}a user{\textquoteright}s single logical data set is scattered\&nbsp;across multiple storage silos whose access controls are\&nbsp;set by web services, not users. The consequence is that\&nbsp;users lack the ultimate authority to determine how their\&nbsp;data is shared with other web services.



	In this paper, we introduce Sieve, a new platform which\&nbsp;selectively (and securely) exposes user data to web services.\&nbsp;Sieve has a user-centric storage model: each user\&nbsp;uploads encrypted data to a single cloud store, and by\&nbsp;default, only the user knows the decryption keys. Given\&nbsp;this storage model, Sieve defines an infrastructure to support\&nbsp;rich, legacy web applications. Using attribute-based\&nbsp;encryption, Sieve allows users to define intuitively understandable\&nbsp;access policies that are cryptographically\&nbsp;enforceable. Using key homomorphism, Sieve can reencrypt\&nbsp;user data on storage providers in situ, revoking\&nbsp;decryption keys from web services without revealing new\&nbsp;keys to the storage provider. Using secret sharing and\&nbsp;two factor authentication, Sieve protects cryptographic\&nbsp;secrets against the loss of user devices like smartphones\&nbsp;and laptops. The result is that users can enjoy rich, legacy\&nbsp;web applications, while benefiting from cryptographically\&nbsp;strong controls over which data a web service can access.

},
	url = {http://mickens.seas.harvard.edu/files/mickens/files/sieve.pdf},
	author = {Wang, F. and J. Mickens and N. Zeldovich and V. Vaikuntanathan}
}
