Whitepaper

Data Protection
and Data Secrecy
in ownCloud
WHITEPAPER

Introduction which require internal corporate data to be

handled in a stringent manner.

Data Protection is more important than

Data Protection, as regulated by the GDPR
ever. The GDPR regulation in the European
in the European Union, can be achieved
Union, which is effective since May 2018,
by combining physical protection and
with similar principles being adopted by
organizational protection. Physical
other governments worldwide, have led
protection is to make sure that nobody can
to a prominent focus on data protection.
enter your data center and get manual access
The regulation and subsequent national
to the servers and organizational protection
laws require all data processors to apply
is to make sure your admi-nistrators are
state-of-the-art technology to data of all
informed and all actions are logged and
users containing personally identifiable
auditable. In many cases, these two layers
information. Personal data should be
of protection are enough to comply with the
protected against leakage to the public,
GDPR.
failing which the organization may face legal,
monetary or reputational implications.
Data Secrecy is different. Generally all data is
Data Secrecy, in contrast, means to protect
segregated between users inside ownCloud
any type of data which is important to an
itself. If files are not shared with another
organization or to specific people. It can also
user, the other user cannot, under any
be important to other organizations that
circumstance, access such files.There are
certain data is kept private as obligated by
policies available which prevent
contracts such as non-disclosure agreements

2
sharing or accessing certain files in certain data secrecy.
ways through the ownCloud File Firewall
2a. Encryption at Rest
or the ownCloud Document Classification
extensions. Such policies, however, still allow Encryption at rest means to encrypt all files
the system administrator to read all the data saved from the ownCloud application server
accessible by ownCloud. Therefore such data prior to saving them on the actual storage.
must be encrypted in order to prevent access ownCloud uses a master key encryption
by the system administrator. method for this which is supported on all file
systems. For S3 object storage, the native
Three Layers of Encryption
S3 encryption mechanism is recommended.
ownCloud comes equipped with various Master key encryption prevents files to be
mechanisms to ensure data protection and read from the storage. They are encrypted
secrecy within an organization. Both data with a file key that is encrypted with the
protection and data secrecy can benefit from master key. As the master key is located on
encryption. This paper discusses the different the storage, the system administrator can
options of encryption available in ownCloud combine both, the file and the master key
and how these options can help you to decrypt files. This form of encryption is
implement data protection and data secrecy sufficient to prevent data secrecy issues
in your ownCloud content collaboration related to physical access to the storage
platform. including stolen hard disks.

2b. Encryption at Rest with Master

For both data protection and data secrecy,
Key in Hardware Security Module
encryption can be an absolute duty, a helpful
utility or a cumbersome practice to work (HSM)
with. Data can be encrypted at three different In order to exclude the system administrator
levels in an ownCloud setup – in transit, at from the ability to decrypt files, ownCloud
rest and at the endpoint. The last option is makes it possible to put the master key into
also called end-to-end encryption. a HSM. This means that the file key is sent to
the HSM and decrypted there from a process
1. Encryption in Transit
inside the ownCloud application. As long as
Encryption in transit is available in ownCloud the integrity of the ownCloud application
by design and by default. This is assured server is intact there is no way for the system
by using HTTPS leveraging the newest TLS administrator to read the content.
protocols in all supported browsers and
clients. The same is true for all connections to For practical reasons file names cannot
storage, directory and authentication servers be encrypted, so they should not contain
or the supported collaborative editing secrets, which is a preferred practice. This
services. Encryption in transit is mandatory ensures data secrecy is taken care of as
under GDPR for data protection and already long as you have proper organizational
considered state-of-the-art by several court mechanisms in place to prevent and detect
rulings. It is equally mandatory for ensuring malicious behaviour.

3
A HSM or a hardware security module, The plugin subscription pricing starts at 1000
which secures the master key reacts only EUR/ year for up to 50 users. When the plugin
on the request of the ownCloud application. is enabled for a user, such a user can encrypt
Today HSMs are also available as software, any empty folder. Through sharing additional
appliance solutions or small hardware users can be invited.
dongles, which fit into an USB port.
ownCloud supports certified HSMs via PKCS For every file uploaded, the uploader can
11. see to how many people and to whom this
file has been sent. Before uploading to the
The above encryption at rest solutions server the file is encrypted inside the browser
have a distinct disadvantage in regards of leveraging a JavaScript plugin delivered to
performance: any encryption operation the user’s browser securely. The files are
needs cycles and makes ownCloud slower. If encrypted with public keys fetched from the
you share 20,000 files with another user, a lot server. The decryption mechanism happens
of keys must be added to the system and inside the browser as well. This requires the
decryption and encryption of file keys presence of the private key in the browser.
must happen. For each file, a call to the
HSM is needed. In this case either a second For maximum security ownCloud provides
ownCloud instance can be installed which an additional key service. The key service
holds all the data with additional protection assures that the private key can be kept
needs or an end-to-end encryption solution outside of the browser, even in the form
is recommended. of a smart key, a piece of hardware which
prevents that the private key of the user is
3. End-to-End Encryption
ever known on the end user, living exclusively
In order to truly assure that neither the on the hardware device.
system administrators nor anybody else in
your organization is able to access encrypted With end-to-end encryption enabled, it is
data only end-to-end encryption is a viable not possible to leverage collaborative editing
solution. This is the highest level of data or any server-side function including virus
secrecy combined with the highest level of scanning. However, as the solution is inside
data protection. Disadvantages are that the the web browser it is very convenient, easy to
user needs to think about the secrecy or use and needs no additional software to be
data protection requirements of files in each installed.
folder, the performance overhead on the
client side and the system administrator can’t
recover any data for the user. If the private
key is lost, the data cannot be decrypted in
any other manner.

ownCloud provides an End-to-End

Encryption plugin in addition to the
ownCloud Enterprise Edition subscription.

4
 Bob Alice

Smar t Share
Smar t
Key Key
Encr ypted
Decr ypted
File
Decr yptedF ile File
Decr ypt
Encrypted File
Smart Ke y /
Hardware T oken

End-to-end encryption with a key service fulfills the highest needs for data secrecy and data protection.

The Role of the Outlook Plugin in Together with the ownCloud End-to-End
Encryption encryption plugin all such attachments are
encrypted using the receiver public key.
Email is still the number one file sharing
utility, even though it is usually non-
If your organization deals with medical data
encrypted. ownCloud provides the Outlook
you will need to apply either the master key
Plugin which helps your users to deal
in HSM or the end-to-end encryption method
with email attachments. Any attachment
or assure that your system administrators are
is automatically put into ownCloud and
legally obligated to secrecy.
replaced with a link, where such a link can be
password protected. Summary
ownCloud has a solution for any challenges
in regards to data protection or data secrecy.
Exception: Medical data according to Discuss your needs with us, including the
article 9 sentence 2.h in conjunnection attack vectors you would like to be protected
against. A proper ownCloud setup with
with sentence 3
the proper add-ons will deliver the highest
security needs even for the most sensitive
data, no matter the size of the organization.

5
 Whitepaper Data Protection & Secrecy EN 202103
About ownCloud

ownCloud develops and provides open-source software for content collaboration, allowing teams to easily
share and work on files seamlessly regardless of device or location. More than 100 million users worldwide
already use ownCloud as an alternative to public clouds – and thereby opt for more digital sovereignty,
security and data protection.

For further information, please visit owncloud.com or find @ownCloud on Twitter.

ownCloud GmbH Contact:

Rathsbergstr. 17 owncloud.com/contact twitter @ownCloud
90411 Nürnberg Phone: +49 911 14888690 facebook facebook.com/owncloud
Germany owncloud.com linkedin linkedin.com/company/owncloud

Copyright 2021 ownCloud. All Rights Reserved. ownCloud and the ownCloud logo are
registered trademarks of ownCloud in the United States and/or other countries.