5.7 System Usability Scale
5.7.4 Comparison
In this section, we compared our system with SecretSync which we mentioned in 2.4.2. We also selected 17 people to do the SUS questionnaires with 10 questions. The result of SecretSync with our SSTreasury+ system are shown in the below table.
Question
SUS score of SSTreasury+ 73.38
SUS score of SecretSync 69.26
SD: Standard deviation
Table 5-10 Comparison between SSTreasury+ and SecretSync I
According to the table 5-10, the average usability score in SecretSync system is 69.26, our SSTreasury+ system which got 73.38 seems better than SecretSync, so that we can find out that most of users felt that our system is more useful than SecretSync. For instance, they felt that our system has better integrated according to question 5 and easy to use than SecretSync according to question 8.
Which system will you prefer to choose to encrypt files?
SSTreasury+ 11 SecretSync 5 No comment 1 Table 5-11 Comparison between SSTreasury+ and SecretSync II
To vote the preferred system, our system got 11 of 17 votes, SecretSync got 5 of 17 and only one user had no comment. Most of users felt that our system need not have to install the system is the most fascinating reason and portability (the private key to be in the form of QR Code) is another advantage.
Chapter 6 Conclusion and Future Work
6.1 Conclusion
The cloud storage brings the convenient way to access files, we can edit or sync files through different devices. However, the problem which we care about is security because the file which we uploaded could be stolen by some bad guys. Although we can use third-party encryption system to encrypt our files before uploading, but we found that most of encryption systems do not have flexible to save the decryption key.
In this thesis, we proposed an integrated system named SSTreasury+ which integrates security and storage service. We exploit the application named SSGuard to let user encrypt the file before uploading, the decryption key encoded into the QR Code so that it can store in smartphone or flash drive. The processing server named SSManager saves file information and user’s public key, it also processes each user’s requests. The back-end storage server we proposed three policies for provider to construct. In this thesis, we named SSCoffers for our back-end storage servers and each of the storage servers uses cloud storage to backup files to reach reliability.
6.2 Discussion
In this paper we design experiments for each part of our system. We found that using SSGuard to access files can reach approximate 1.5 MB/s the maximum for encryption/uploading; approximate 1.36 MB/s for downloading/decryption by using webcam way; approximate 1.38 MB/s the maximum for downloading/decryption by uploading QR Code image way, the both of two decryption way had the same performance. The SSManager can process fewer than 2500 users to insert and approximate 6500 to query SQL instructions. We also tested two experiments on
SSCoffers. One is using two clients in local LAN and another is four clients with cross-switch, we found that the best number of user for storage server to service is approximate 170 users. The experiments results show that the bottleneck of uploading and downloading are on SSCoffers, even the SSManager can endure more than one thousand concurrent users, but the SSCoffers can only endure approximate 170 users, the performance begin to decline if the concurrent users more than 170 users.
To measure the usability of our system, we used “System Usability Scale” to evaluate our system is useful or not. Our system got 73.38 scores, it represents that our system is a good system and proves the high usability for users to use. We also compared with a third-party encryption system which called “SecretSync”, the experiment result showed that most of the users felt that our system is better than SecretSync because our system has better integrated and portability.
6.3 Future Work
In our system, the user can only encrypt and decrypt file by using SSGuard which is the application we developed, the mobile device can only access the files which saved under “web_upload”. We will implement the mobile apps for mobile and tablet so that the user can access the encrypted file anytime and anywhere.
In our system we made the private key into a QR Code, so the user could store the QR Code in smart phone or flash drive portably. Although it is flexible and prevents to be stolen if the key stored in the computer, it’s not prevent form users to leak out the QR Code. So if there is a bad guy uses social engineering attack to steal the password and
pretending the original user. So we would have to come out with other way to let the user protect their decryption key more secure and convenient.
The uploading and downloading experiments which we tested in this paper are individually, we will test on different file sizes to mix upload and download to measure the total finish time and average megabyte per second to observe the performance of our system.
Creating a new storage server consumes so much time in our system, it has to install the desktop software and set the system environment. The next steps we have to do are to design an application to install and set the system environment automatically, so that the new storage server can be constructed rapidly to speed up the scalable.
Reference
[1] Shucheng Y., Cong W., Kui R., Wenjing L., “Achieving secure, scalable, and finegrained data access control in cloud computing,” In Proceedings of the 29th conference on Information communications, pp.534–542, Piscataway, NJ, USA, 2010
[2] Ion I., Sachdeva N., Kumaraguru P., Capkun S., “Home is Safer than the Clould!
Privacy Concerns for Consumer Cloud Storage,” In Proceedings of Symposium on Usable Privacy and Security, pages 1-20, Pittsburgh, PA, USA, July 2011
[3] Talib A.M., Atan R., Abdullah R., Azmi Murad, M.A., "Security framework of cloud data storage based on Multi Agent system architecture - A pilot study," International Conference on 2012 Information Retrieval & Knowledge Management (CAMP), pp.54-59, March 2012
[4] Hsiao-Ying L., Wen-Guey T., “A secure decentralized erasure code for distributed network storage,” IEEE Transactions on Parallel and Distributed Systems, vol. 21, no. 11, pp. 1586-1594, Nov. 2010
[5] Google Drive terms of services (http://www.google.com/policies/terms/) retrieved in June 2012
[6] Venkatesh M., Sumalatha M.R., SelvaKumar C., "Improving public auditability, data possession in data storage security for cloud computing," International
pp.463-467, April 2012
[7] Tang Y., Lee P., Lui J., Perlman R., "Secure Overlay Cloud Storage with Access Control and Assured Deletion," IEEE Transactions on Dependable and Secure Computing, June 2012
[8] Seiger R., Gross S., Schill A., "SecCSIE: A Secure Cloud Storage Integrator for Enterprises," IEEE 13th Conference on Commerce and Enterprise Computing, pp.252-255, 2011
[9] Zheng H., Qiang L., Dong Z., Kefei C., XiangXue L., "YI Cloud: Improving user privacy with secret key recovery in cloud storage," Proceedings of 2011 IEEE 6th International Symposium on Service Oriented System Engineering, pp.268-272, Dec. 2011
[10] Koletka R., Hutchison A., "An architecture for secure searchable cloud storage," Information Security South Africa (ISSA), pp.1-7, Aug. 2011
[11] Seny K., Kristin L., "Cryptographic cloud storage", Proceedings of the 14th international conference on Financial cryptograpy and data security, pp.136-149, January 2010
[12] Denso Wave Inc. QR Code.com (http://www.qrcode.com/) retrieved in June 2012
[13] Rivest R. L., Shamir A., Adleman L., "A method for obtaining digital signatures
and public-key cryptosystems", Commun. ACM, vol. 21, pp.120 -126, 1978 Encryption Standard (AES) to Protect National Security Systems and National Security Information"
[17] Dropbox (https://www.dropbox.com/dmca#security) retrieved in June 2012
[18] Denial-of-service attack (http://en.wikipedia.org/wiki/Denial-of-service_attack) retrieved in June 2012
[19] Man-in-the-middle attack
(http://en.wikipedia.org/wiki/Man-in-the-middle_attack) retrieved in June 2012 [20] Packet sniffer (http://en.wikipedia.org/wiki/Hacker_(computer_security))
retrieved in June 2012
[23] Neil H., “The s/key(tm) one-time password system”, Symposium on Network and Distributed System Security, pages 151-157, Feb. 1994
[25] Amazon S3 (http://aws.amazon.com/s3/) retrieved in June 2012
[26] Leo D., “Protecting Drive Encryption Systems Against Memory Attacks”, May 2011 (http://eprint.iacr.org/2011/221.pdf) retrieved in June 2012
[27] Yanjiang Y., Youcheng Z., "A Generic Scheme for Secure Data Sharing in Cloud," 40th International Conference on Parallel Processing Workshops, pp.145-153, Sept. 2011
[28] Sanka S., Hota C., Rajarajan M., "Secure data access in cloud computing," IEEE 4th International conference on Internet Multimedia systems architectures and applications, pp.1-6, Dec. 2010
[29] Ahmed M., Yang X., "Trust Ticket Deployment: A Notion of a Data Owner's Trust in Cloud Computing," IEEE 10th International Conference on Trust, Security and Privacy in Computing and Communications, pp.111-117, Nov. 2011
[30] Java Media Framework
(http://www.oracle.com/technetwork/java/javase/tech/index-jsp-140239.html) retrieved in June 2012
[31] Zxing (http://code.google.com/p/zxing/) retrieved in June 2012 [32] VMware (http://www.vmware.com/) retrieved in June 2012
[33] Apache JMeter (http://jmeter.apache.org/usermanual/index.htm) retrieved in June 2012
[34] Bangor A., Kortum P., & Miller J.A., “The System Usability Scale (SUS): An Empirical Evaluation,” International Journal of Human-Computer Interaction, 24(6), pp. 574-594.
[35] System Usability Scale (http://en.wikipedia.org/wiki/System_usability_scale) retrieved in June 2012
[36] Brooke J., "SUS: A 'Quick and Dirty' Usability Scale," Usability Evaluation in Industry, McClelland, I., Ed. London: Taylor & Francis Ltd., pp. 189-194, 1996.