Secure Deduplication with Efficient and Reliable Convergent Key Management

Secure deduplication using convergent encryption eliminates duplicate data and stores only one copy to save storage costs while preserving the security of the outsourced data. However, convergent encryption produces a number of encryption keys, of which size is linear to the number of different data. Although a deduplication scheme has been proposed for efficient convergent key management recently, it has drawbacks in terms of scalability and key management security. In order to solve these problems, we propose a novel secure deduplication scheme with scalable and reliable key management based on paring-based cryptography. The proposed scheme does not require additional secure channels to distribute key components while still guaranteeing secure key management as opposed to the previous schemes.

A key-sharing based secure deduplication scheme in cloud storage

Nowadays, many customers and enterprises backup their data to cloud storage that performs deduplication to save storage space and network bandwidth. Hence, how to perform secure deduplication becomes a critical challenge for cloud storage. According to our analysis, the state-of-the-art secure deduplication methods are not suitable for cross-user finegrained data deduplication. They either suffer brute-force attacks that can recover files falling into a known set, or incur large computation (time) overheads. Moreover, existing approaches of convergent key management incur large space overheads because of the huge number of chunks shared among users. Our observation that cross-user redundant data are mainly from the duplicate files, motivates us to propose an efficient secure deduplication scheme SecDep. SecDep employs User-Aware Convergent Encryption (UACE) and Multi-Level Key management (MLK) approaches. (1) UACE combines cross-user file-level and inside-user chunk-level deduplication, and exploits different secure policies among and inside users to minimize the computation overheads. Specifically, both of file-level and chunk-level deduplication use variants of Convergent Encryption (CE) to resist brute-force attacks. The major difference is that the file-level CE keys are generated by using a server-aided method to ensure security of cross-user deduplication, while the chunk-level keys are generated by using a user-aided method with lower computation overheads. (2) To reduce key space overheads, MLK uses file-level key to encrypt chunk-level keys so that the key space will not increase with the number of sharing users. Furthermore, MLK splits the file-level keys into share-level keys and distributes them to multiple key servers to ensure security and reliability of file-level keys. Our security analysis demonstrates that SecDep ensures data confidentiality and key security. Our experiment results based on several large real-world datasets show that SecDep is more time-efficient and key-space-efficient than the state-of-the-art secure deduplication approaches.

A secure deduplication technique removes duplicate data and stores only single copy to efficiently utilize the storage while guaranteeing the privacy of the data. Thus, it is a necessary technology for resource-limited for devices to save storages. However, most of the existing deduplication schemes based on convergent encryption suffer from 1) a convergent encryption key management problem and 2) a dynamic ownership management problem. In key management, convergent encryption generates a number of encryption keys whose size increases linearly with the number of distinct data. In terms of dynamic ownership management, although the ownership of data in a fog device or cloud storage frequently changes in real-world applications, supporting ownership changes are difficult because the convergent encryption keys are only bound to the data. In order to solve these problems, we present a secure deduplication scheme that features reliable and scalable key management based on pairing-based cryptography and supports dynamic ownership management. The proposed scheme avoids additional costs associated with distributing key components on secure channels and ownership keys on the user side yet guarantees secure key and ownership management.

Data deduplication is a technique for eliminating duplicate copies of data, and has been widely used in cloud storage to reduce storage space and upload bandwidth. However, there is only one copy for each file stored in cloud even if such a file is owned by a huge number of users. As a result, deduplication system improves storage utilization while reducing reliability. Furthermore, the challenge of privacy for sensitive data also arises when they are outsourced by users to cloud. Aiming to address the above security challenges, this paper makes the first attempt to formalize the notion of distributed reliable deduplication system. We propose new distributed deduplication systems with higher reliability in which the data chunks are distributed across multiple cloud servers. The security requirements of data confidentiality and tag consistency are also achieved by introducing a deterministic secret sharing scheme in distributed storage systems, instead of using convergent encryption as in previous deduplication systems. Security analysis demonstrates that our deduplication systems are secure in terms of the definitions specified in the proposed security model. As a proof of concept, we implement the proposed systems and demonstrate that the incurred overhead is very limited in realistic environments.

Secure deduplication aims to efficiently eliminate redundant data in cloud storage system, where convergent encryption (CE) is widely-used to provide the data confidentiality. As the number of convergent keys (CKs) in CE will increase dramatically with enlarging data, there is a critical issue that how to safely manage the CKs. Previous works usually introduce a fully-trusted key management server (KS) to ensure the CKs security, resulting in data leakage by KS in reality. In this paper, we propose a blockchain-based secure deduplication scheme with reliable CK management, denoted as BDKM, which introduces different secret information to CE to enhance the data confidentiality in different level deduplications. To realize secure and reliable CK management, the CK will be divided into key segments by using secret sharing scheme and distributed on blockchain as transactions. Therefore, only the valid data owner can recover the CK from the blockchain and the original data will be protected even if the adversaries have colluded with cloud service provider. Security analysis and performance evaluation demonstrate that our proposed scheme can remain secure under the proposed security models with a limited overhead.

Data deduplication is a methodology for eliminating duplicate copies of data by keeping the single copy of data with proper access policies, instead of maintaining duplicates of the same data. It reduces cloud storage slot and communication bandwidth. Secure deduplication is a challenge in multi-user cloud setup, where each user uses their key to secure their data, resulting in different enciphered data for the same unencrypted data. Convergent Encryption (CE) addresses this issue by fixing the single hash value of the file as the key for enciphering the content of the file. The challenge now is to store the key in the cloud by multiple users. The existing key management system that uses an encoding scheme suffers in the realistic environment. To overcome this issue, in the proposed work ABCEKM (Attribute-Based Convergent Encryption Key Management), the file key is enciphered by specifying access policies for the attributes of the file. The proposed approach is efficient and reliable for cloud storage.

Minimizing Storage space and bandwidth is a challenging task in cloud computing, duplication is the main key term in cloud computing because of large and multiples of digital data stored in single cloud server. Because of rapid usage and expansion of high amount of data, data de-duplication is a challenging task for removing replica related data which has been stored in cloud to reduce storage and space of bandwidth. Secure de-duplication is also a challenging task in cloud storage environment. Convergent encryption based secure de-duplication approach is used traditionally to explore and identify duplicates from multiple users data with de-duplication sharing and uploading data in cloud environment. Because of large volume data, conventional approaches have not meet practical implementation of de-duplication requirements in cloud storage. So we aim that block chain based cloud storage with data de-duplication is the main problem in distributed file storage environment. For predicting dynamic file de-duplication in file sharing of distributed environment, propose a Novel Block chain based Secure De- duplication Authentication scheme (NBSDAS) with high reliability and confidentiality in which the files are distributed to multiple servers and the information of files is recorded on the time-stamped block chain whose central authorities are replaced to automatically decentralize cloud contracts. This proposed approach combined with genetic algorithm to predict and de-duplication with respect to processing dynamic files individually in cloud computing. Security analysis demonstrates that our de-duplication scheme can achieve the proposed security goals while it has limited overhead proved by simulation experiments with comparison to traditional approaches.

With the increasing sensing and communication in cyber physical social system (CPSS), the data volume is growing much rapidly in recent years. Secure deduplication has attracted considerable interests of storage provider for data management efficiency and data privacy preserving. One of the most challenging issues in secure deduplication is how to manage data and the convergent key when users frequently update it. To solve this problem, D. Koo et al. use bilinear paring as the key method. However, bilinear paring requires high computation cost for implementations. In this paper, we propose a session-key-based convergent key management scheme, named SKC, to secure the dynamic update in the data deduplication. Specifically, each data owner in SKC can verify the correctness of the session key and dynamically change it with the data update. Furthermore, to enable group combination and remove the aid of gateway (GW), a convergent key sharing scheme, named CKS, is presented. Security analysis demonstrates that both SKC and CKS can protect the confidentiality of the data and the convergent key in the case of dynamic updates. The simulation results show that our SKC and CKS can significantly reduce computation complexity and communication during the data uploading phase.

Data deduplication is broadlyfor maintaining asole copy of user’s data in cloud storage servers. Data Deduplication is a process of verify that whether the data are already stored in the cloud storage or not and maintain a single copy of data in the cloud. Deduplication is possible in cloud only with the use of convergent encryption (CE) technique. This technique is used to generate convergent encryption key from the user data which is to be uploaded to the cloud and the user’s data are encrypted with this convergent encryption key. This CE is exposed to different cryptography attacks. To maintain secure deduplication with convergent encryption in cloud, this paper proposes enhanced convergent encryption key generation technique. The paper introduces scheme with Key Generation and Management as a Service (KGMaaS) mechanism for generating and maintaining key for convergent encryption and deduplication process. Generation of convergent encryption key takes place in user’s side. In this process, a key is used for generating the convergent encryption key unlike existing method. Key used to generate convergent encryption key is received from KGMaaS. KGMaaS is assumed to be a trusted party for key generation and sharing. The proposed technique is analyst for security vulnerability, and it is ensure the security and efficient deduplication by procedure used in the overall data deduplication process.

Secure data deduplication using secret sharing schemes over cloud

Along with the arrival of the age of big data, lots of data processing must rely on distributed processing of cloud computing, and the amount of data stored in the cloud is sharply increasing. Therefore, the management of massive data has become a noticeable challenge. One of the crucial challenges is how to delete the duplicate data while ensuring data privacy, wherefore the secure deduplication techniques appeared on the scene. In this paper, we first present three different mainstream secure deduplication strategies, convergent encryption, proof of ownership and twin data centre architecture, and make a brief description of their work process. Some variants on top of the three strategies which extend their functions or remedy old deficiencies and analysis of their own performance efficiency or their advantages and disadvantages are given. This paper also includes some state-of-the-art deduplication systems which are not based on the three above-mentioned strategies such as DupLESS, etc. They provide some new design ideas about secure deduplication in cloud data centre and may inspire people to design a better system.

With the continuous and exponential increase of the number of users and the size of their data, data deduplication becomes more and more a necessity for cloud storage providers. By storing a unique copy of duplicate data, cloud providers greatly reduce their storage and data transfer costs. The advantages of deduplication unfortunately come with a high cost in terms of new security and privacy challenges. We propose ClouDedup, a secure and efficient storage service which assures block-level deduplication and data confidentiality at the same time. Although based on convergent encryption, ClouDedup remains secure thanks to the definition of a component that implements an additional encryption operation and an access control mechanism. Furthermore, as the requirement for deduplication at block-level raises an issue with respect to key management, we suggest to include a new component in order to implement the key management for each block together with the actual deduplication operation. We show that the overhead introduced by these new components is minimal and does not impact the overall storage and computational costs.

With the continuous increase of the number of users and the size of their data, data deduplication becomes a necessity for cloud storage providers. By storing a unique copy of duplicate data, cloud providers greatly reduce their storage and data transfer costs. The advantages of deduplication unfortunately come with a high cost in terms of new security and privacy challenges. In this chapter we propose ClouDedup, a secure and efficient storage service which assures block-level deduplication and data confidentiality at the same time. Although ClouDedup is based on convergent encryption, it remains secure thanks to the definition of a component that implements an additional encryption operation. Furthermore, as the requirement for deduplication at block-level raises an issue with respect to key management, we suggest to include a new component in order to implement the key management for each block together with the actual deduplication operation. In this chapter we show how we have implemented the proposed architecture, the challenges we have met and our solutions to these challenges.

As the core of the blockchain, reliable key management is the necessary guarantee for the security of the blockchain business. However, existing key management methods of blockchain mainly include local storage, offline storage, and wallet storage, and cannot meet the requirements of security, ease of use, and cost at the same time. Moreover, the key management scheme of the blockchain itself lacks a secure and efficient solution to manage the user’s key. In addition, the situation of collaborative signatures should be considered in the blockchain to meet the needs of users. To this end, secure multi-party computation (SMPC) is the most used technology, and the security of these schemes can be further improved. In order to improve the security and efficiency of blockchain key management and meet the needs of collaborative work, key hierarchical management and collaborative signature schemes incorporating SMPC and feature encryption are proposed. In this scheme, the keys are divided into three layers, and the keys of the upper layer are used to encrypt the keys of the lower layer, thus ensuring the security of all keys. Moreover, the processes of key generation, recovery, revocation and update, and multi-party signature are designed in detail. Compared with other schemes through theory analysis and experiment, our schemes can reduce the file-sharing time and the storage overhead of the user. This can improve the utilization of system resources and system efficiency, while ensuring a high level of security.KeywordsBlockchainKey hierarchical managementMulti-party signatureData sharing