Design and Experimental Evaluation of a Secure Cloud File-Sharing System with Expiring Tokens and Distributed Key Custody

Abstract

Public cloud file sharing enhances accessibility and scalability but still suffer from the same issues as bearer tokens and centralized key services: credential theft, credential replay, single point compromise, and continued key availability after credential expiration. To tackle these deficiencies, this study presents a file-sharing prototype system which is a combination of AES-256-GCM encryption, ES256 recipient-bound JSON Web Tokens, proof-of-possession signatures, nonce based replay prevention, atomic single use enforcement, and 3-of-5 Shamir threshold key sharing. A set of trials was employed to evaluate the cryptographic processing, token attacks, threshold recovery, guardian failures, expiration behaviour, and concurrent access, along with synthetic access logs for anomaly detection. The legitimate access succeeded in all trials, while most of the other types of attacks (expired, modified, replayed, stolen-token attacks) reached 0% success rate. Key reconstruction failed with less than 3 guardian failures, was still possible with a maximum of 2 guardian failures and was not possible after deletion of guardian shares. The threshold design had a small amount of extra latency across centralized baseline designs and was able to serve 100 concurrent requests with 100% success. The study concludes that with a combination of recipient bound temporal authorization with distributed key custody, auditable cryptographic expiration becomes possible. The most significant contribution it makes is the union of different features in an integrated and experimented verified workflow, which consists of secure access, replay resistance, threshold recovery, and verifiable post-expiry key unavailability.