Client-side Storage Research Articles

Waffle: An Online Oblivious Datastore for Protecting Data Access Patterns

We present Waffle, a datastore that protects an application's data access patterns from a passive persistent adversary. Waffle achieves this without prior knowledge of the input data access distribution, making it the first of its kind to adaptively handle input sequences under a passive persistent adversary. Waffle maintains a constant bandwidth and client-side storage overhead, which can be adjusted to suit the application owner's preferences. This flexibility allows the owner to fine-tune system parameters and strike a balance between security and performance. Our evaluation, utilizing the Yahoo! Cloud Serving Benchmark (YCSB) benchmark and Redis as the backend storage, demonstrates promising results. The insecure baseline outperforms Waffle by a mere 5-6x, whereas Waffle outperforms Pancake-a state-of-the-art oblivious datastore under passive persistent adversaries-by 45-57%, and a concurrent ORAM system, TaoStore, by 102x.

A Searchable Encryption with Forward/Backward Security and Constant Storage

Dynamic searchable encryption satisfies users’ needs for ciphertext retrieval on semi-trusted servers, while allowing users to update server-side data. However, cloud servers with dynamically updatable data are vulnerable to information abuse and file injection attacks, and current public key-based dynamic searchable encryption algorithms are often complicated in construction and high in computational overhead, which is not efficient for practical applications. In addition, the client’s storage costs grow linearly with the number of keywords in the database, creating a new bottleneck when the size of the keyword set is large. To solve the above problems, a dynamic searchable encryption scheme that uses a double-layer structure, while satisfying forward and backward security, is proposed. The double-layer structure maintains a constant client-side storage cost while guaranteeing forward and backward security and further reduces the algorithm overhead by avoiding bilinear pairings in the encryption and decryption operations. The analysis results show that the scheme is more advantageous in terms of security and computational efficiency than the existing dynamic searchable encryption scheme under the public key cryptosystem. It is also suitable for the big data communication environment.

Microsoft Teams desktop application forensic investigations utilizing IndexedDB storage

While the COVID-19 virus remolded the routines of the establishments, remote collaboration and distant communication gained more popularity. As the way electronic communications are handled changes drastically, new applications and storage mechanisms are introduced. Microsoft Teams is an application offered within the scope of Microsoft Office 365 that offers services for hosting virtual meetings, team communication, and comprehensive team resource management. It is prevalently used by organizations and indicates a great potential to be a source of digital forensic investigations. This paper scrutinizes the artifacts created by Microsoft Teams in IndexedDB persistent storage. IndexedDB is a fast-growing client-side storage technology that is relatively new as a source for digital forensic investigations. A single-case pretest-posttest quasi experiment was conducted to produce artifacts in Microsoft Teams IndexedDB storage. The artifacts were extracted without user credentials indicating security flaws in the application. Extracted artifacts were processed based on signature patterns and evaluated for their significance. Traditional database queries were utilized to link and present the information clustered according to their relevancy. A time-frame analysis was constructed to display information in a suitable format for investigators. The results indicate that Microsoft Teams IndexedDB storage artifacts contain significant potential for digital investigations with extraction of complete contents of private chat messages, voice mails, and team extensions with efficient time-frame analysis.

Forward and Backward-Secure Range-Searchable Symmetric Encryption

Abstract Dynamic searchable symmetric encryption (DSSE) allows a client to query or update an outsourced encrypted database. Range queries are commonly needed. Previous range-searchable schemes either do not support updates natively (SIGMOD’16) or use file indexes of many long bit-vectors for distinct keywords, which only support toggling updates via homomorphically flipping the presence bit. (ESORICS’18). We propose a generic upgrade of any (inverted-index) DSSE to support range queries (a.k.a. range DSSE), without homomorphic encryption, and a specific instantiation with a new trade-off reducing client-side storage. Our schemes achieve forward security, an important property that mitigates file injection attacks. Moreover, we identify a variant of injection attacks against the first somewhat dynamic scheme (ESORICS’18). We also extend the definition of backward security to range DSSE and show that our schemes are compatible with a generic upgrade of backward security (CCS’17). We comprehensively analyze the computation and communication overheads, including implementation details of client-side index-related operations omitted by prior schemes. We show high empirical efficiency for million-scale databases over a million-scale keyword space.

VBTree: forward secure conjunctive queries over encrypted data for cloud computing

This paper concerns the fundamental problem of processing conjunctive keyword queries over an outsourced data table on untrusted public clouds in a privacy-preserving manner. The data table can be properly implemented with tree-based searchable symmetric encryption schemes, such as the known Keyword Red---Black tree and the Indistinguishable Bloom-filter Tree in ICDE'17. However, as for these trees, there still exist many limitations to support sub-linear time updates. One of the reasons is that their tree branches are directly exposed to the cloud. To achieve efficient conjunctive queries while supporting dynamic updates, we introduce a novel tree data structure called virtual binary tree (VBTree). Our key design is to organize indexing elements into the VBTree in a top-down fashion, without storing any tree branches and tree nodes. The tree only exists in a logical view, and all of the elements are actually stored in a hash table. To achieve forward privacy, which is discussed by Bost in CCS'16, we also propose a storage mechanism called version control repository (VCR), to record and control versions of keywords and queries. VCR has a smaller client-side storage compared to other forward-private schemes. With our proposed approach, data elements can be quickly searched while the index can be privately updated. The security of the VBTree is formally proved under the IND-CKA2 model. We test our scheme on a real e-mail dataset and a user location dataset. The testing results demonstrate its high efficiency and scalability in both searching and updating processes.

Performance Characterization of Low-Latency Adaptive Streaming From Video Portals

News-based websites and portals provide significant amounts of multimedia content to accompany news stories and articles. In this context, the HTTP adaptive streaming is generally used to deliver video over the best-effort Internet, allowing smooth video playback and an acceptable Quality Of Experience (QoE). To stimulate the user engagement with the provided content, such as browsing between videos, reducing the videos’ startup time has become more and more important: while the current median load time is in the order of seconds, research has shown that the user waiting times must remain below two seconds to achieve an acceptable QoE. In this paper, four complementary components are optimized and integrated into a comprehensive framework for low-latency delivery of news-related video content: 1) server-side encoding with short video segments; 2) HTTP/2 server push at the application layer; 3) server-side user profiling to identify relevant content for a given user; and 4) client-side storage to hold proactively delivered content. Using a large data set of a major Belgian news provider, containing millions of text- and video-based article requests, we show that the proposed framework reduces the videos’ startup time in different mobile network scenarios by over 50%, thereby improving the user interaction and skimming available content.

SqueakJS

We report our experience in implementing SqueakJS, a bit-compatible implementation of Squeak/Smalltalk written in pure JavaScript. SqueakJS runs entirely in the Web browser with a virtual filesystem that can be directed to a server or client-side storage. Our implementation is notable for simplicity and performance gained through adaptation to the host object memory and deployment leverage gained through the Lively Web development environment. We present several novel techniques as well as performance measurements for the resulting virtual machine. Much of this experience is potentially relevant to preserving other dynamic language systems and making them available in a browser-based environment.

Leveraging client-side storage techniques for enhanced use of multiple consumer cloud storage services on resource-constrained mobile devices

Despite high adoption rate among consumers, cloud storage services still suffer from many functional limitations and security issues. Recent studies propose utilization of RAID-like techniques in addition to multiple cloud storage services as an effective solution, but to the best of our knowledge, there is no research work done on applying this approach to resource-constrained mobile devices. In this paper, we propose a solution for mobile devices that unifies storage from multiple cloud providers into a centralized storage pool that is better in terms of availability, capacity, performance, reliability and security. First, we explore the feasibility of applying various storage technologies to address the aforementioned issues. Then, we validate our solution in comparisons with single cloud storage by implementation of a working prototype on mobile device. Our results show that it can improve the usage of consumer cloud storage at zero monetary cost, while the minimal overheads incurred are actually compensated by the performance gained.

IBM Secure Enterprise Desktop

Using software-only approaches makes it is practically impossible to completely secure software applications, as well as corporate information, against determined cyber-criminals. Therefore, in an era where any general-purpose operating system (OS) with end-user access can be hacked, we propose using dedicated security hardware to ensure that only authorized people obtain access to sensitive information. The fundamental principle involves booting the end-user computer from such a trusted mobile device without trusting any software installed on the computer. The device establishes a secure connection to the back-end infrastructure to provide access to the user's OS, e.g., through a remote terminal access or provisioned on the local computer. The solution is very simple to operate, as many corporate employees are not necessarily IT (information technology) savvy. In this paper, we discuss the combination of our dedicated tamper-resistant security boot-token operating user credentials with known defense mechanisms, such as OS virtualization, trusted boot, establishment of client-side and server-side authenticated secure channels to trustworthy back-ends, and client-side storage encryption. This novel combination forms an easy-to-use and highly mobile security solution that addresses security challenges of the BYOD (bring-your-own-device) approach. As a proof point for the latter claims, we report on initial real-world usability tests.