FADE is a Linux-based C++ language API which provides a secure overlay cloud storage with file assured deletion. The scheme is implemented as described in the following paper:
Yang Tang, Patrick P. C. Lee, John C. S. Lui, and Radia Perlman, "FADE: Secure Overlay Cloud Storage with File Assured Deletion.", SecureComm 2010, Singapore, September 2010.
FADE is running under Linux with a C++ compiler, e.g., g++, installed. To install FADE in your Linux system, you may take the following procedures.
If everything is successful, you will have client, keymanager, libfade.a and libfade.so in the bin directory.
A sample configuration file is as follows. It is also included in the source code package, as etc/config.xml.
<?xml version="1.0"?> <config type="client"> <keymanagers> <keymanager address="127.0.0.1"/> </keymanagers> <storages> <local path="storage"/> <s3 bucket="fade"/> </storages> <cache path="data"/> <secret file=".fade_secret"/> </config>
The configuration file is in XML format. Between <keymanagers> and </keymanagers> are the configuration for the key managers, in the following format:
<keymanager address="ip.addr.goes.here"/>
Between <storages> and </storages> are the configuration for the storages. Currently FADE supports two kinds of storages: local storage and Amazon S3 storage. For local storage, the format is:
<local path="~/some/directory"/>
For Amazon S3 storage, the format is:
<s3 bucket="bucket_name"/>
In addition, you need to configure where to store local data. The format is:
<cache path="~/some/directory"/>
Finally, you need to configure the file containing the long-term private secret. The format is:
<secret file=".fade_secret"/>
If you want to use Amazon S3 storage, you need to configure the Amazon S3 secrets. Basically you need to set two environment variables: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. You can do this by the following commands:
$ export AWS_ACCESS_KEY_ID="..." $ export AWS_SECRET_ACCESS_KEY="..."
Simply run keymanager:
$ keymanager
In the current implementation of FADE, the key manager saves the keys as PEM files in the "keys" directory. To revoke a policy, you can simply delete the related PEM file.
Run client and specify the configuration file as the command-line argument:
$ client config.xml
Then, you will get a prompt like this:
FADE>>
If this is the first time you run a FADE client, you need to generate a long-term private secret. This can be done by the GENSECRET command: (You may wish to run this command only once.)
FADE>> GENSECRET
After that, you can pick up one of the following commands (case-insensitive):
For example, the following command encrypts and uploads foo.txt with policy DATE-2010-12-31:
FADE>> UPLOAD foo.txt POLICY DATE-2010-12-31
If multiple policies are used, please use "," as the deliminator of conjunctive policies, and use ";" as the deliminator of disjunctive policies. For example, the following command encrypts and uploads bar.txt with policy (P1 and P2) or P3:
FADE>> UPLOAD bar.txt POLICY P1,P2;P3
Below are more examples.
The following command downloads and decrypts foo.txt:
FADE>> DOWNLOAD foo.txt
The following command renews the policy of foo.txt into DATE-2011-12-31:
FADE>> RENEW foo.txt POLICY DATE-2011-12-31
The following command quits FADE:
FADE>> QUIT
FADE provides some APIs that you can use in your own program.
The file src/client/Main.cc is a good sample of how to use FADE APIs. (Please omit the lines between FADE_EVAL.)
The FADE Client class is a singleton. You can access its sole instance by Client::instance().
You need to set the parameters by the following methods:
Alternatively, you can provide a configuration file in XML format, and use the following method to set all the parameters:
Client::instance()->readConfig(configuration_filename);
You should read the secret by
Client::instance()->readSecret();
before doing other stuffs.
Finally, you can freely use the following methods:
See Client class docs for details.