Modeling the side-channel attacks in data deduplication with game theory

Abstract

The cross-user data deduplication improves disk space efficiency of cloud storage by keeping only one copy of same files among all service users. As a result, the cloud storage service is able to offer a considerable amount of storage at an attractive price. Therefore, people begin to use cloud storage such as Dropbox and Google Drive not only as data backup but also as their primary storage for everyday usage. However, the cross-user data deduplication also rises data privacy concerns. A side-channel attack called “confirmation-of-a-file” and its variant “learn-the-remaining-information” breach the user data privacy through observing the deduplication operation of the cloud storage server. These attacks allow malicious users to pinpoint specific files if they exist in the cloud. The existing solutions sacrifice either the network bandwidth efficiency or the storage efficiency to defend the side-channel attacks without analyzing the defensive cost from the standpoint of cloud storage providers. Because profit is the key factor that motivates cloud service providers, the question that how to defend the side-channel attacks efficiently in terms of cost is not only important but also practical. However, this question remains unanswered. In this paper, we try to address this problem using game theory. We model the interaction between the attacker and the defender, i.e., the cloud storage server, using a game-theoretic framework. Our framework captures underlying complexity of the side-channel attack problem under several practical assumptions. We prove there exists a unique solution of the problem, i.e., a mixed-strategy Nash equilibrium. Our simulation results show the efficiency of our scheme.