Client Storage Research Articles

CoD-DSSE: A practical efficient dynamic searchable symmetric encryption with lightweight clients

Dynamic searchable symmetric encryption(DSSE) combines dynamic update with searchable encryption, allowing users to not only achieve keyword retrieval, but also dynamically update encrypted data stored on semi-trusted cloud server, effectively protecting user’s privacy. However, the majority of existing DSSE schemes exhibit inefficiencies in practical applications because of their complex structure. In addition, to store the status of keywords, the storage requirements of the client increase proportionally with the number of keyword/document pairs. Therefore, the client storage will be overwhelmed when confronted with a substantial increase in the volume of keyword/document pairs. To solve these issues, we propose a practical efficient dynamic searchable symmetric encryption scheme with lightweight clients—CoD-DSSE. A novel index structure similar to a chest of drawers is proposed in CoD-DSSE, which allows users to efficiently search all document indexes through XOR operations and keeps the keyword status on the server to lightweight clients. Furthermore, we use a random number generator to construct new search tokens for forward security and achieve backward security by using a Bloom filter to store the deleted document index, which can significantly reduce communication costs. The experimental and security analyses show that CoD-DSSE is efficient and secure in practice.

Design of storage benchmark kit framework for supporting the file storage retrieval

An open-source software framework called the storage benchmark kit (SBK) is used to store the system benchmarking performance framework. The SBK is designed to perform any storage client or device using any data type as a payload. SBK simultaneously helps number of readers as well as writes to the storage system of large amounts of data as well as allows end-to-end latency benchmarking for multiple writers and readers. The SBK uses standardized performance measures for comparing and evaluating various storage systems and their combinations. Distributed file systems, distributed database systems, single or local node databases, systems of object storage, platforms of distributed streaming and messaging, and systems of key-value storage are the storage solutions supported by SBK. The SBK supports various storage systems like XFS, Kafka streaming storage systems, and Hadoop distributed file system (HDFS) performance benchmarking. The experimental results show that a proposed method achieves execution time of 65.530 s, 40.826 s and 30.351 s for the 100k, 500k and 1000k files respectively which ensures better improvement than the existing methods such as simple data interface and distributed data protection system.

Non-Interactive Multi-Client Searchable Symmetric Encryption With Small Client Storage

Non-Interactive Multi-Client Searchable Symmetric Encryption With Small Client Storage

On Min–Max Storage for Resource-Restricted Clients in Coded Blockchain Systems

Blockchain is the foundation of emerging applications such as smart contracts, Non-fungible token (NFT) and metaverse. A key issue is that blockchain requires massive storage space, which limits its deployment in resource limited end devices, e.g., Internet of Things. Recently, coded blockchain is proposed to reduce the storage requirement of blockchain whilst guaranteeing its security and data integrity. Coded blockchain encodes blocks into coded symbols, which are then distributively stored by clients. A key challenge when applying coded blockchain in resource restricted networks is to ensure all clients store the same, and also the minimum, number of coded blocks. To this end, this paper addresses a novel problem that minimizes the maximum (min-max) storage requirement of clients. It formulates the said problem as an integer linear program (ILP). It then proposes centralized algorithms to improve the computational efficiency of storage assignments. Moreover, it presents distributed algorithms that satisfy the distributive property of blockchain. Numerical results show that the proposed distributed algorithm with a short length code reduces the min-max storage of clients by 80% compared with traditional blockchain. In addition, the computational complexity of distributed algorithms is significantly lower than centralized algorithms.

Forensic investigation of small-scale digital devices: a futuristic view

Small-scale digital devices like smartphones, smart toys, drones, gaming consoles, tablets, and other personal data assistants have now become ingrained constituents in our daily lives. These devices store massive amounts of data related to individual traits of users, their routine operations, medical histories, and financial information. At the same time, with continuously evolving technology, the diversity in operating systems, client storage localities, remote/cloud storages and backups, and encryption practices renders the forensic analysis task multi-faceted. This makes forensic investigators having to deal with an array of novel challenges. This study reviews the forensic frameworks and procedures used in investigating small-scale digital devices. While highlighting the challenges faced by digital forensics, we explore how cutting-edge technologies like Blockchain, Artificial Intelligence, Machine Learning, and Data Science may play a role in remedying concerns. The review aims to accumulate state-of-the-art and identify a futuristic approach for investigating SSDDs.

VESPo: Verified Evaluation of Secret Polynomials (with application to dynamic proofs of retrievability)

Proofs of Retrievability are protocols which allow a Client to store data remotely and to efficiently ensure, via audits, that the entirety of that data is still intact. Dynamic Proofs of Retrievability (DPoR) also support efficient retrieval and update of any small portion of the data. We propose a novel protocol for arbitrary outsourced data storage that achieves both low remote storage size and audit complexity. A key ingredient, that can be also of intrinsic interest, reduces to efficiently evaluating a secret polynomial at given public points, when the (encrypted) polynomial is stored on an untrusted Server. The Server performs the evaluations and also returns associated certificates. A Client can check that the evaluations are correct using the certificates and some pre-computed keys, more efficiently than re-evaluating the polynomial. Our protocols support two important features: the polynomial itself can be encrypted on the Server, and it can be dynamically updated by changing individual coefficients cheaply without redoing the entire setup. Our methods rely on linearly homomorphic encryption and pairings, and our implementation shows good performance for polynomial evaluations with millions of coefficients, and efficient DPoR with terabytes of data. For instance, for a 1TB database, compared to the state of art, we can reduce the Client storage by 5000x, communication size by 20x, and client-side audit time by 2x, at the cost of one order of magnitude increase in server-side audit time.

RELATIONAL VS NON-RELATIONAL DATABASES

In this paper we’re going to talk about the difference between relational and non-relational databases. These are two different ways in which clients store the data that they have and operationalize it. And we know there is so much data that is coming into every single company today that it’s important that customers have options for how they want to store that data.

Data Integrity on the Cloud Computing using Algebraic Signature

Abstract: The Trends of Cloud Computing, the cloud security work must be important because the huge number of data with specialized connections to distribute data processing among the various servers. Client stores their data on cloud server to maintain their data privacy and data security. The popular data security method which is called cryptography taking more time and space to encrypt and decrypt for data auditing processes. The existing method is Provable Data Possession which is dynamically operates the data and gives the high computation space and time complexity. So to avoid that complexity the proposed method is called as Algebraic Signature to used low computation performance time and low data space for large data set. It is based on data integrity method for providing good data security on the cloud for large organization also. This proposed method is used the Third Party Auditing method which is to provide large data file security with the Hashing technique using Algebraic Signature method. The conclusion of this paper is providing the data integrity and time efficiency of the process using TPA method also provides the dynamic operation.

Lattice-based public-key encryption with equality test supporting flexible authorization in standard model

As cloud computing has developed rapidly, outsourcing data to cloud servers for remote storage has become an attractive trend. However, when cloud clients store their data in the cloud, the security and privacy of cloud data would be threatened due to accidental corruptions or purposive attacks caused by a semi-trusted cloud server. The widely used method of addressing the security and privacy of cloud data is to store encrypted data instead of plain data. As the resulting system is unusable, since the cloud can no longer search throughout the data, new cryptographic primitive such as public-key encryption with equality test (PKEET) has been introduced. PKEET has many interesting applications such as keyword search on encrypted data, encrypted data partitioning for efficient encrypted data management, personal health record systems, spam filtering in encrypted email systems and so forth. PKEET allows checking whether two ciphertexts encrypted under different public keys contain the same message or not. However, unrestricted access to equality tests can reveal information about the underlying data. This is not acceptable in respect of users' privacy. In 2015, Ma et al. introduce the notion of PKEET with flexible authorization (PKEET-FA) which strengthens privacy protection. Since 2015, there are several follow-up works on PKEET-FA. However, all are secure in the random oracle model and vulnerable to quantum attacks. In this paper, we provide two constructions of quantum-safe PKEET-FA secure in the standard model based on the hardness assumptions of integer lattices and ideal lattices. Finally, we implement the PKEET-FA scheme over ideal lattices.

A rORAM scheme with logarithmic bandwidth and logarithmic locality

Oblivious Random Access Machine (ORAM) is a kind of cryptographic primitive that allows a client to access its private data from the server without disclosing the access pattern. To deal with consecutive requested blocks at a time efficiently, range ORAM (rORAM) is presented. In the previous rORAM scheme, the locality, namely, the number of discontinuous seeks to complete a request, is reduced to O(log2 N), nevertheless, the bandwidth cost is increased to the poly-logarithmic level. Hence, there exists an open question, that is, whether rORAM can be constructed with the same bandwidth efficiency as a regular ORAM, that is, O(log N)-block? In this paper, we propose a new rORAM scheme, called L2-rORAM. In our scheme, a compatible superblock technique is proposed, and it is combined together with an eviction technique for range blocks, so that it avoids duplication of multiple copies and extra dummy access. As a result, it obtains O(log N)-block bandwidth cost, which affirmatively answers the above open question. Meanwhile, the data locality is reduced to O(log N). In addition, the client storage is maintained at the small level of O(log N)-block, and the server storage is maintained at the unexpanded level of O(N)-block. Finally, experimental results show that the average response time of our L2-rORAM is reduced by one order of magnitude over the state-of-the-art rORAM scheme.

Secure Cloud Data Storage Using Hybrid Cryptography

Abstract: Nowadays a huge number of organizations use the cloud for storing Big data. And some of the sectors have sensitive data, for example, Military, Agencies, Colleges, Industries, etc. The data can be retrieved when the user requests it. And others can also access the data. Cloud computing provides a lot of features with affordable prices and knowledge accessibility by using the Internet. Security is the main concern in the cloud computing environment as clients store secret information with cloud providers, but sometimes these providers may not be trustful. Splitting data in a safe approach while protecting data from an untrusted cloud is still a demanding topic. In this paper we ensure the right approach for data security and privacy, using Blowfish, and RSA/SRNN algorithms. Keywords: Cloud Computing, Data storage, RSA/SRNN algorithm, Blowfish algorithm, Data storage.

A Secure Searchable Encryption Framework for Privacy-Critical Cloud Storage Services

Searchable encryption has received a significant attention from the research community with various constructions being proposed, each achieving asymptotically optimal complexity for specific metrics (e.g., search, update). Despite their elegance, the recent attacks and deployment efforts have shown that the optimal asymptotic complexity might not always imply practical performance, especially if the application demands a high privacy. In this article, we introduce a novel Dynamic Searchable Symmetric Encryption (DSSE) framework called Incidence Matrix (IM)-DSSE, which achieves a high level of privacy, efficient search/update, and low client storage with actual deployments on real cloud settings. We harness an incidence matrix along with two hash tables to create an encrypted index, on which both search and update operations can be performed effectively with minimal information leakage. This simple set of data structures surprisingly offers a high level of DSSE security while achieving practical performance. Specifically, IM-DSSE achieves forward-privacy, backward-privacy and size-obliviousness simultaneously. We also create several DSSE variants, each offering different trade-offs that are suitable for different cloud applications and infrastructures. We fully implemented our framework and evaluated its performance on a real cloud system (Amazon EC2). We have released IM-DSSE as an open-source library for wide development and adaptation.

Frequency-hiding order-preserving encryption with small client storage

The range query on encrypted databases is usually implemented using the order-preserving encryption (OPE) technique which preserves the order of plaintexts. Since the frequency leakage of plaintexts makes OPE vulnerable to frequency-analyzing attacks, some frequency-hiding order-preserving encryption (FH-OPE) schemes are proposed. However, existing FH-OPE schemes require either the large client storage of size O ( n ) or O (log n ) rounds of interactions for each query, where n is the total number of plaintexts. To this end, we propose a FH-OPE scheme that achieves the small client storage without additional client-server interactions. In detail, our scheme achieves O ( N ) client storage and 1 interaction per query, where N is the number of distinct plaintexts and N ≤ n . Especially, our scheme has a remarkable performance when N ≪ n . Moreover, we design a new coding tree for producing the order-preserving encoding which indicates the order of each ciphertext in the database. The coding strategy of our coding tree ensures that encodings update in the low frequency when inserting new ciphertexts. Experimental results show that the single round interaction and low-frequency encoding updates make our scheme more efficient than previous FH-OPE schemes.

Exploiting user preferences to reduce bandwidth requirements for VoD services with client caching

Internet traffic is already dominated by video streaming applications. The quality of transmitted videos and the number of content available online is expected to increase in the upcoming years, which will further pressure the available network infrastructures. In this scenario, Video-on-Demand services require that distribution mechanisms improve the efficiency of video transmission, which impacts the network performance and system scalability. The efficiency of distribution is strongly related to the operating costs of the providers of such services. The most efficient methods available for Video-on-Demand distribution use strategies that combine multicast transmission and the storage capacity of the user's equipment. This paper presents a new method for Video-on-Demand distribution that explores the client storage capabilities by modelling the users' preferences with a Hidden Markov Model. The efficiency of the proposed method is demonstrated through computational simulations of different scenarios, including a sample of real users' activity. Our results indicate that the proposed scheme substantially outperforms the current Video-on-Demand distribution mechanisms in terms of network bandwidth consumption, significantly reducing operation costs by improving the system scalability.

Secure Dynamic Searchable Symmetric Encryption With Constant Client Storage Cost

Dynamic Searchable Symmetric Encryption (DSSE) enables users to search on the encrypted database stored on a semi-trusted server while keeping the search and update information under acceptable leakage. However, most existing DSSE schemes are not efficient enough in practice due to the complex structures and cryptographic primitives. Moreover, the storage cost on the client side grows linearly with the number of keywords in the database, which induces unaffordable storage cost when the size of keyword set is large. In this article, we focus on secure dynamic searchable symmetric encryption with constant client storage cost. Our framework is boosted by fish-bone chain, a novel two-level structure which consists of Logical Keyword Index Chain (LoKIC) and Document Index Chain (DIC). To instantiate the proposed framework, we propose a forward secure DSSE scheme, called CLOSE-F, and a forward and backward secure DSSE scheme, called CLOSE-FB. Experiments showed that the computation cost of CLOSE-F and CLOSE-FB are as efficient as the state-of-the-art solutions, while the storage costs on the client side are constant in both CLOSE-F and CLOSE-FB, which are much smaller than existing schemes.

An Efficient Two-Factor Authentication Scheme Based on the Merkle Tree.

The Time-based One-Time Password (TOTP) algorithm is commonly used for two-factor authentication. In this algorithm, a shared secret is used to derive a One-Time Password (OTP). However, in TOTP, the client and the server need to agree on a shared secret (i.e., a key). As a consequence, an adversary can construct an OTP through the compromised key if the server is hacked. To solve this problem, Kogan et al. proposed T/Key, an OTP algorithm based on a hash chain. However, the efficiency of OTP generation and verification is low in T/Key. In this article, we propose a novel and efficient Merkle tree-based One-Time Password (MOTP) algorithm to overcome such limitations. Compared to T/Key, this proposal reduces the number of hash operations to generate and verify the OTP, at the cost of small server storage and tolerable client storage. Experimental analysis and security evaluation show that MOTP can resist leakage attacks against the server and bring a tiny delay to two-factor authentication and verification time.

Data Partitioning and Reduplication for Providing Integrity to Data in the Cloud

Cloud Computing is a boon to the field of information and technology. The two major elements of client worries are Data security and Privacy Protection. Data may be revised and improved when client stores the information in the cloud so there might be danger of data loss. Therefore client information is moved to the data hub which cannot be controlled by the clients. Hence high safety efforts are required to secure data inside the cloud. Here data is divided into fragments and they are converted into encrypted file. This encrypted file is issued to arbitrarily chosen cloud service providers by the cloud data owners. Even after the successful attack, attackers do not get the meaning full information. If cloud data clients access to get any document that relating to encrypted file is regenerated from the fragments and clients must download it. When the applicant coordinates the strategy with the original details, then only file can be decoded. Therefore it demonstrates that prospective strategy improves the data integrity and confidentiality.

ThinORAM: Towards Practical Oblivious Data Access in Fog Computing Environment

Oblivious RAM (ORAM) is important for applications that require hiding of access patterns. However, most of existing implementations of ORAM are very expensive, which are infeasible to be deployed in lightweight devices, like the terminal equipment for Internet of Things (IoT). In this article, we focus on how to apply the expensive ORAM to protect access pattern in IoT devices and propose an ORAM scheme supporting thin-client, called “ThinORAM”, under non-colluding clouds. Our proposed scheme removes complicated computations in the client side and requires only O(1) communication cost with a reasonable response time. We further show how to securely deploy ThinORAM in the fog computing environment to achieve oblivious data access with minimum client cost. Experiments show that our scheme can eliminate most of the client storage and reduce the cloud-cloud bandwidth by 2×, with 3× faster response time, when compared to the best scheme that aims at reducing client side overheads.

A Multi-server ORAM Framework with Constant Client Bandwidth Blowup

Oblivious Random Access Machine (ORAM) allows a client to hide the access pattern when accessing sensitive data on a remote server. It is known that there exists a logarithmic communication lower bound on any passive ORAM construction, where the server only acts as the storage service. This overhead, however, was shown costly for some applications. Several active ORAM schemes with server computation have been proposed to overcome this limitation. However, they mostly rely on costly homomorphic encryptions, whose performance is worse than passive ORAM. In this article, we propose S 3 ORAM, a new multi-server ORAM framework, which features O (1) client bandwidth blowup and low client storage without relying on costly cryptographic primitives. Our key idea is to harness Shamir Secret Sharing and a multi-party multiplication protocol on applicable binary tree-ORAM paradigms. This strategy allows the client to instruct the server(s) to perform secure and efficient computation on his/her behalf with a low intervention thereby, achieving a constant client bandwidth blowup and low server computational overhead. Our framework can also work atop a general k -ary tree ORAM structure ( k ≥ 2). We fully implemented our framework, and strictly evaluated its performance on a commodity cloud platform (Amazon EC2). Our comprehensive experiments confirmed the efficiency of S 3 ORAM framework, where it is approximately 10× faster than the most efficient passive ORAM (i.e., Path-ORAM) for a moderate network bandwidth while being three orders of magnitude faster than active ORAM with O (1) bandwidth blowup (i.e., Onion-ORAM). We have open-sourced the implementation of our framework for public testing and adaptation.

Privacy preserving integrity checking of shared dynamic cloud data with user revocation

In Cloud computing, storage and maintenance of the data are provided as service to the client. Traditionally, when the clients store and maintain their data at their own server, the data are dynamic in nature and are often shared among groups of users. The clients desire the traditional flexibility when they shift their data to the Cloud. Introducing the flexibility of sharing dynamic data with storage outsourced to the Cloud needs addressing new security challenges and requires the provision for user revocation. This paper presents a secure and effective scheme for storage of shared dynamic data in untrusted cloud servers with provisions for privacy preserving integrity check by third-party auditor and for addition and revocation of users. This proposed scheme is based on CDH-based ring signature and vector commitment.