First of all,I am new to security as a whole and taking my first formal course on it.So sorry if any major errors are present. I had a scheme for remote file storage as an attempt to use my course topics:
- I have a few google accounts(say 2 = N) to which seperate firebase storage instances(2 again) are there
- within each instance there are a few folders(say 3 = M) each corresponding to a deployment service(heroku,pythonanywhere..).No cross folder access is permitted.
- Each deployed service(a total of N*M) has its own set of users and authentication implemented.
- All services have REST API's for read/write to their folders.
- On a local app on setup an master password is given and a key file is generated the master password is passed through an KDF(say to give masterkey) and then KDF(keyfile+masterkey) gives key encryption key(kek).
- A set of accounts for each storage bucket is created to 1 randomly chosen service per bucket and the accounts are registered with the service
- The data of all accounts is encrypted and stored locally by a database encryption key(dek) which is by itself encrypted by kek for storage.
- On a file to be uploaded it is broken down by (N,N) secret sharing scheme and N files are created which now is useless without all N being present.Each of this N files are uploaded to the buckets by the services mapped for this user.
- On a file read all N files are read and used. This might be overkill but I just wanted to use all schemes as a whole.Can somebody tell me if there are any critical vulnerabilities in this scheme?