Updated Question: New Thread
Original Question: (Thanks cypherfox for answering that one)
I am in need to store data > 100 TB on a local network share (NAS/SAN) and grant individuals access to the encrypted data. For all users, besides me, the data can be read only, and sequential access to the data (only one user can access the data at one time) is fine.
The biggest problem is that I need to revoke individual users access from time to time (in addition to the recall of the network share access). I could encrypt the master key with user individual keys but this would not prevent technical experienced users from stealing the master key right? So I would need to re-encrypt the data every-time a user is recalled. Is there a way to do this more efficient than copying all data to a new encrypted image/disk? For 100 TB this would need more than 9 days.
Maybe someone can give me an advise which system/tools/techniques I should use and where the decryption should take place (client/server). Here the summarized key facts:
- ~ 100 TB Data
- max 5 user at the same time or 20 over the whole time span
- data stored an a local NAS/SAN connected to an 'offline' network
- the files have easily multiple GB, so some kind of transparent decryption to avoid copying the data would be necessary
- even a user could copy the data while he is a regular user, and even if he has no network share access anymore, we need to depreciate his decryption access