# A Usable Encryption Solution for File-Based Geospatial Data within a Database File System
## 6 Discussion
### GIS Security Model and Security Analysis
#### 6.1.2 Confidentiality  
_Consolidation_ of spatial files into a centralised storage repository does provide attackers with a single point of access to \"_more_\" valuable data. To this end, our approach rests on the security strength provided by several components: the _access control mechanism_ provided by the DBFS, the _cryptographic strength_ of the encryption algorithm, how files are _decrypted_, and how encryption keys are _safeguarded_. In our proposed solution, the first security component is access control. Since the DBFS inherits the centralised authentication and access control mechanisms from the underlying DBMS, it provides a strong protection mechanism. The DBFS (ECMSDK) access control model forms the first security layer, where users are first authenticated against their accounts, and based on their privileges, their access is controlled. The spatial files are further _encrypted_ to safeguard against storage-level attacks when the disk or backup removable media is compromised. In our approach, the LOBs storing the original file content are _always in encrypted form_. Upon decryption, temporary files are created, which would be lost upon a server crash caused by an adversary trying to remove the disk. An adversary needs access to the encrypted data, the decryption procedures, and the decryption keys to recover the data. Even if the encrypted data and the decryption algorithm are somehow obtained, the adversary will **not** be able to access the encryption keys stored in a database, which, in turn, are encrypted with another key stored in the _Oracle Wallet_. For sharing these datasets outside the enterprise with individuals having varied access levels, the _MapSafe_ geoprivacy tool [44] can be used, which offers a complete approach for safeguarding and verifying geospatial datasets when passed over the network (see Section 2). Attackers may also attempt to break a targeted cipher through _cryptanalysis_; however, the security provided by the well-researched AES encryption algorithm [83] will prevent such attacks. Another approach would be to carry out a _brute-force_ attack with all the possible keys. However, brute-force attacks against spatial files encrypted with the AES algorithm will either take the adversary _longer_ to recover the plaintext than the actual value of the data or make it more expensive. In this regard, the longer the key length, the higher the security of the system. This proves that the encryption within the proposed security solution can reasonably stand against cryptanalysis. An alternative method for breaking the encryption focuses on _side-channel_ attacks, which attack the physical side effects of its implementation. An error in system design or execution can enable such attacks to succeed. As such, this section presents a substantiation of the security guarantees that the solution offers to enterprise GIS. A malicious adversary can take the following three distinct roles against the security solution:  
(1) _Malicious Insider_: The first form of malicious adversary may arise from misbehaving legitimate users. Misbehaving DBFS users' access to spatial files and folders is controlled through a strong access control model. For instance, the ECMSDK product's authentication and authorisation scheme provides a granular and consistent access control mechanism to finely control user access (see end of Section 3.1). This ACM is not weakened by the elevated privileges of OS users using OS protocol servers to access files and prevents users of these accounts from obtaining any useful spatial information, whether encrypted or not. (2) _Outsider Attackers_: The spatial files within the DBFS can be accessed at multiple instances. This includes once the disk is removed from the DBFS server when files are in (a) _encrypted form_ or (b) have been _decrypted for legitimate users_, (c) access of decrypted files on an _unattended PC of legitimate DBFS users_, or (d) access of spatial files when the databasedatafiles are _transferred to removable storage media_.