ChunkGuard: a user-space secure file storage system with chunk- level encryption and integrity protection
ChunkGuard is a user-space secure file storage system that employs chunk-level AES-128-CTR encryption and HMAC-SHA256 integrity verification to protect data confidentiality and detect tampering, achieving functional security while identifying disk I/O as its primary performance bottleneck.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
When we store a digital file on a computer, we often assume it is safe simply because it sits on a hard drive. However, if that drive is stolen, lost, or accessed by someone who bypasses the usual login screen, the data inside can be read as plain text, exposing everything from personal photos to private documents. To stop this, security experts use encryption, a process that scrambles data so it looks like random noise to anyone without the correct key. While many systems protect entire hard drives or large folders, a new approach called ChunkGuard explores a different strategy: breaking a single file into many small, independent pieces before locking them down. This method aims to provide not just secrecy, but also a way to verify that the data has not been secretly altered or tampered with while sitting in storage.
Researchers at Universal Technology and Management University and Mbarara University of Science and Technology built a prototype system named ChunkGuard to test whether this fine-grained approach works in practice. Instead of treating a file as one giant block of data, their system chops it into small, fixed-size pieces called chunks. Each of these pieces is then encrypted individually using a unique secret key and a random starting number, ensuring that even if two chunks contain identical information, they look completely different when locked. To ensure the data remains trustworthy, the system also creates a digital seal for every single piece. If even a tiny part of the data is changed or corrupted, this seal breaks, alerting the system that something is wrong. The researchers also included a strict check to ensure that only the person who owns the file can open it, rejecting any attempts by unauthorized users to access the contents.
The team put this system through a rigorous series of tests to see how well it performed and how secure it actually was. They ran thirty different scenarios, including attempts to break the system by altering the data or pretending to be a different user. In every single case, the system held firm. It successfully detected when someone tried to tamper with the encrypted data, and it correctly blocked anyone who did not own the file from reading it. When they measured how fast the system worked on a file of one megabyte, they found that encrypting the data took about 161 milliseconds, while decrypting it was faster, taking roughly 79 milliseconds. Checking the data for tampering was even quicker, requiring only about 17 milliseconds. These speeds translate to processing data at a rate of about 6.2 megabytes per second for encryption and 12.7 megabytes per second for decryption.
Perhaps the most surprising discovery came from looking closely at where the system spent its time. The researchers expected the complex mathematical work of scrambling the data to be the slowest part. Instead, they found that the actual act of writing the many small pieces to the disk was the bottleneck. The process of creating and saving these individual chunk files consumed nearly 79 percent of the total time, while the actual encryption math took up less than 18 percent. This finding suggests that the speed of the system is limited not by how hard the computer has to think to lock the data, but by how efficiently it can write thousands of tiny files to the storage drive. The study also noted that while the system worked well in this controlled test, it was not yet ready for real-world use because it lacked some advanced safety features found in mature commercial systems, such as the ability to handle multiple users working at the same time or the protection of its own internal records.
The results demonstrate that it is entirely possible to build a secure storage system that checks every small piece of a file for both secrecy and integrity. However, the study also highlights a practical engineering challenge: breaking files into too many small pieces can slow down the system simply because of the overhead of managing so many separate files. The researchers conclude that while the concept of chunk-level security is sound, future versions would need to organize these pieces more efficiently, perhaps by grouping them into larger containers, to make the system fast enough for everyday use. This work does not replace existing security tools but offers a clear, measured look at how a specific design choice affects performance and security, pointing the way toward more robust solutions for protecting data at rest.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.