KATENA: a verifiable governance architecture for encrypted cloud storage systems

Modern data-intensive infrastructures increasingly rely on cloud storage and client-controlled encryption to protect the confidentiality of outsourced information. However, while encryption prevents providers from accessing plaintext data, governance operations such as sharing, revocation, and policy updates typically remain opaque to users and auditors. This creates a structural gap between strong data confidentiality and verifiable governance in cloud environments that manage large volumes of sensitive information. This paper introduces KATENA (Key Architecture for Trustworthy Encrypted Networked Archives), an architectural model that enables client-verifiable governance in encrypted cloud storage systems. The proposed approach combines hierarchical key orchestration, transparency-based governance logging, and cryptographically verifiable governance artifacts so that clients can independently validate governance events without relying on provider-side trust. By integrating accountability mechanisms directly into encrypted storage architectures, the work provides a governance-by-design framework that bridges client-controlled encryption with verifiable data governance in modern data-intensive cloud systems.