Cuckoo Filter Research Articles

Private membership test protocol with low communication complexity

We introduce a practical method to perform private membership tests. In this method, clients are able to test whether an item is in a set controlled by the server without revealing their query item to the server. After executing the queries, the content of the server's set remains secret. One use case for a private membership test is to check whether a file contains any malware by checking its signature against a database of malware samples in a privacy-preserving way. We apply the Bloom filter and the Cuckoo filter in the membership test procedure. In order to achieve privacy properties, we present a novel protocol based on some homomorphic encryption schemes. In our protocol, we rearrange the data in the set into N-dimensional hypercubes. We have implemented our method in a realistic scenario where a client of an anti-malware company wants to privately check whether a hash value of a given file is in the malware database of the company. The evaluation shows that our method is feasible for real-world applications. We also have tested the performance of our protocol for databases of different sizes and data structures with different dimensions: 2-dimensional, 3-dimensional, and 4-dimensional hypercubes. We present formulas to estimate the cost of computation and communication in our protocol.

Cluster-based distributed dynamic cuckoo filter system for Redis

ABSTRACTWith the exponential growth of network data storage scale, the issue of uniform distribution and efficient retrieval of data in the distributed storage systems such as the Redis cluster has received increasing attention in recent years. In view of the existing problems in scalability, usability and other aspects of the solution in current researches, we propose the distributed dynamic cuckoo filter system based on Redis cluster. On one hand, we introduce an efficient hash indexing structure–dynamic cuckoo filter (DCF), which only stores the fingerprint information of data, and has the automatically scalable capacity to meet the demand of data storage on a dynamic scale. On the other hand, we use an improved consistent hashing algorithm to construct Redis cluster and use the thorough communication mechanism of Redis cluster to achieve the data sharing and efficient utilisation of multi-machine filters. The scheme proposed in this paper can take the time and space efficiency into account, greatly promote the retrieval performance of massive data, and improve the reliability and availability of Redis cluster.

Cuckoo filter-based many-field packet classification using X-tree

Software-defined networking (SDN) is a new paradigm which emerged in the networking area. Packet classification is an interesting topic that has considered in both traditional and SDN networks. Packet classification involves inspection of multiple fields against a set of thousands of rules called rule-set. With the increasing throughput demands in modern networks and the growing size of rule-sets, performing wire-speed packet classification has become challenging and an important topic in recent years. Packet classification is called as many-field packet classification in the SDN because of increasing the number of header fields. In this paper, a scalable many-field packet classification by employing the extended tree (X-tree) integrated with an efficient probabilistic data structure called Cuckoo filter is proposed. X-tree has high performance from the lookup, insertion, and update aspects. However, X-tree has a high memory requirement, Cuckoo filter as a probabilistic data structure is integrated within each X-tree node to outperform memory requirements and providing more classification throughput. Our experiment results show that the proposed approach achieves high throughput while requiring low memory. In addition, the proposed approach improves latency 2.4 $$\times $$ , 6.15 $$\times $$ and 4.75 $$\times $$ in comparison with DBAMCP, BSOL-RC and BF-AQT for 64 k rule-set, respectively.

CuCoTrack: Cuckoo filter based connection tracking

This paper introduces CuCoTrack, a cuckoo hash based data structure designed to efficiently implement connection tracking. The proposed scheme exploits the fact that queries always match one existing connection to compress the 5-tuple that identifies the connection. This significantly reduces the amount of memory needed to store the connections and also the memory bandwidth needed for lookups. CuCoTrack uses a dynamic fingerprint to avoid collisions thus ensuring that queries are completed in at most two memory accesses and facilitating a hardware implementation. The proposed scheme has been analyzed theoretically and validated by simulation. The results show that using 16 bits for the fingerprint is enough to avoid collisions in practical configurations.

Toward Privacy-Preserving Valet Parking in Autonomous Driving Era

Automated valet parking, deemed as a key milestone on the way to autonomous driving, has great potential to improve the “last-mile” driving experience for users. On the other hand, it triggers serious risks on vehicle theft and location privacy leakage. To address these issues, we propose a secure and privacy-preserving automated valet parking protocol for self-driving vehicles. The proposed protocol is characterized by extending anonymous authentication to support two-factor authentication with mutual traceability for reducing the risks of vehicle theft and preventing the privacy leakage of users in automated valet parking. Specifically, based on one-time password and secure mobile devices, two-factor authentication is achieved between vehicles and smartphones to ensure vehicle security in remote pickup. By exploiting the BBS+ signature and the Cuckoo filter, user location privacy is protected against the curious parking lots and service providers. In addition, the traceable tags are designed to enable a trusted authority to identify the vehicles and users for localizing a stolen or missing vehicle and preventing the slandering of greedy users. Finally, formal security analysis on the proposed protocol is given to show that the authentication, anonymity, and traceability can be reduced to standard hard assumptions, and performance evaluation demonstrates the proposed protocol is efficient and practical to be implemented in autonomous driving era.

Efficient L-Diversity Algorithm for Preserving Privacy of Dynamically Published Datasets

Although most conventional methods of preserving data privacy focus on static datasets, which remain unchanged after processing, real-world datasets may be dynamically modified often. Therefore, privacy-preservation methods must maintain data privacy after dataset modification. Re-anonymization of entire datasets is inefficient when large datasets are frequently modified. Although several previous studies have addressed data privacy for incremental data updates (i.e., record insertions), they have not adequately it for dynamic changes made to existing datasets (i.e., record updates and deletions). Therefore, we identified limitations of data-privacy preservation for dynamically evolving datasets and used anatomy instead of generalization and suppression to develop a more efficient l-diversity algorithm for preserving privacy of such datasets. We also used a Cuckoo filter, a new probabilistic data structure for approximate set-membership tests, to improve data-processing efficiency. Experimental results demonstrated that our proposed data-anonymization algorithm processed data more efficiently than other conventional algorithms, requiring much less running time than conventional re-anonymization of entire datasets. The Cuckoo-filtered algorithm was especially efficient, dramatically reducing operation execution times while maintaining privacy of dynamically evolving datasets.

Performance-optimal filtering

We define the concept of performance-optimal filtering to indicate the Bloom or Cuckoo filter configuration that best accelerates a particular task. While the space-precision tradeoff of these filters has been well studied, we show how to pick a filter that maximizes the performance for a given workload. This choice might be "suboptimal" relative to traditional space-precision metrics, but it will lead to better performance in practice. In this paper, we focus on high-throughput filter use cases, aimed at avoiding CPU work, e.g., a cache miss, a network message, or a local disk I/O - events that can happen at rates of millions to hundreds per second. Besides the false-positive rate and memory footprint of the filter, performance optimality has to take into account the absolute cost of the filter lookup as well as the saved work per lookup that filtering avoids; while the actual rate of negative lookups in the workload determines whether using a filter improves overall performance at all. In the course of the paper, we introduce new filter variants, namely the register-blocked and cache-sectorized Bloom filters. We present new implementation techniques and perform an extensive evaluation on modern hardware platforms, including the wide-SIMD Skylake-X and Knights Landing. This experimentation shows that in high-throughput situations, the lower lookup cost of blocked Bloom filters allows them to overtake Cuckoo filters.

Efficient Privacy-Preserving Access Control Scheme in Electronic Health Records System

The sharing of electronic health records (EHR) in cloud servers is an increasingly important development that can improve the efficiency of medical systems. However, there are several concerns focusing on the issues of security and privacy in EHR system. The EHR data contains the EHR owner’s sensitive personal information, if these data are obtained by a malicious user, it will not only cause the leakage of patient’s privacy, but also affect the doctor’s diagnosis. It is a very challenging problem for the EHR owner fully controls over own EHR data as well as preserves the privacy of himself. In this paper, we propose a new privacy-preserving access control (PPAC) scheme for EHR. To achieve fine-grained access control of the EHR data, we utilize the attribute-based signcryption (ABSC) mechanism to signcrypt data based on the access policy for the linear secret sharing schemes. Employing the cuckoo filter to hide the access policy, it could protect the EHR owner’s privacy information. In addition, the security analysis shows that the proposed scheme is provably secure under the decisional bilinear Diffie-Hellman exponent assumption and the computational Diffie-Hellman exponent assumption in the standard model. Furthermore, the performance analysis indicates that the proposed scheme achieves low costs of communication and computation compared with the related schemes, meanwhile preserves the EHR owner’s privacy. Therefore, the proposed scheme is better suited to EHR system.

QCF for deep packet inspection

Deep packet inspection (DPI) acts as a tool to control and classify incoming network traffic depending on users,content, applications and becomes a very important aspect of every network today. Instead of utilising only incoming packet header information, Internet service providers utilise DPI for security purposes, flow management, and routing. The high-performance challenges that face DPI techniques to manage line-speed packet processing with restricted available memory are the increasing traffic volumes and link rates. Bloom (BF) and quotient (QF) filters are effective randomised data structures for performing approximate membership queries. They have been employed in many networking applications including DPI. Nevertheless, they consume more calculations which degrade the system performance. Consequently, in this paper, the authors propose a new variant of membership query data structure, called quotient-based Cuckoo filter (QCF), that reflects a merging process between QF and CF to minimise the calculation overhead and employing it in a DPI system. QCF employs only two hash functions and consumes less calculation overhead than BF, QF, and CF. The implementation results show that using QCF as an identification tool in a DPI system result in a time improvement up to 77% over CF and up to 98% over BF and QF.

Keyword-based private searching on cloud data along with keyword association and dissociation using cuckoo filter

Outsourcing of data is a very common scenario in the present-day world and quite often we need to outsource confidential data whose privacy is of utmost concern. Performing encryption before outsourcing the data is a simple solution to preserve privacy. Preferably a public-key encryption technique is used to encrypt the data. A demerit of encrypting data is that while requesting the data from the cloud we need to have some technique which supports search functionality on encrypted data. Without the searchable encryption technique, the cloud is forced to send the whole database, which is highly inefficient and impractical. To address this problem, we consider the email scenario, in which the sender of the email will encrypt email contents using receiver’s public key; hence, only the receiver can decrypt email contents. We propose a scheme that will have encrypted emails stored on the cloud and have capabilities that support searching through the encrypted database. This enables the cloud to reply to a request with a more precise response without compromising any privacy in terms of email contents and also in terms of access patterns. We provide a solution for the email scenario in which we can tag or associate emails with some keywords, and during retrieval, the email owner can request all the emails associated with a particular keyword. Although attempts are seen in the literature to solve this issue they do not have the flexibility of dissociating keywords from an email. Keyword dissociation is essential to modify the association between keywords and emails to enable better filtering of emails. Our technique also supports the functionality of keyword dissociation. The solution allows single-database private information retrieval writing in an oblivious way with sublinear communication cost. We have theoretically proved the correctness and security of our technique.

Parallel multiple pattern matching schemes based on cuckoo filter for deep packet inspection on graphics processing units

A large amount of data now being transferred through networks has made deep packet inspection (DPI) an essential part of security activities. Several DPI systems are developed based on Bloom filters to defend against malicious worm attacks through the Internet. These approaches have achieved significant performance. However, they do not permit deletion of items from the set of target patterns. This study proposes two multiple pattern matching schemes for DPI to exploit high parallelism capacity of graphics processing units (GPUs). Firstly, a GPU-based Cuckoo filter scheme is proposed by adopting a new approximate set membership, called Cuckoo filter, for parallel multiple pattern matching. The Cuckoo filter has many advantages over the Bloom filter such as higher insert performance, higher lookup throughput, less memory consumption, less false positive rate, and delete operation support. Secondly, an implementation of the GPU-based Cuckoo filter, called GPUshared-based Cuckoo filter is proposed. This scheme can efficiently distribute input string and pre-processing data in the hierarchical memory of GPUs to optimise the performance of the GPU-based Cuckoo filter scheme. Experiments show that the proposed schemes offer better performance than the previous approaches based on the Bloom filter.

SPACF: A Secure Privacy-Preserving Authentication Scheme for VANET With Cuckoo Filter

Vehicular ad-hoc networks (VANETs) have been emerging based on the state-of-art technologies in wireless and network communications. The message authentications between vehicles and roadside units are essential for the security of VANETs. Messages should be signed and verified before they could be trusted. The real identity of vehicles should not be revealed, but which is only traceable by authorized parties. Existing solutions either rely heavily on a tamper-proof hardware device or cannot satisfy the security requirement. Communication overhead as another issue has also not been well addressed in previously reported studies. To address these issues, in this paper, we propose the SPACF scheme that is based on software without relying on any special hardware. We use the Cuckoo filter and the binary search methods to achieve higher success rate than the previous schemes in the batch verification phase. In order to guarantee that it can satisfy message authentication requirement, existential unforgeability of underlying signature against adaptively chosen-message attack is proved under the elliptic curve discrete logarithm problem in the random oracle model. The evaluation results show that our proposed scheme is more efficient than the previous schemes since it is pairing free and does not use map-to-point hash functions, and it satisfies security and privacy requirements of vehicular ad hoc networks.

An outer join algorithm based on Cuckoo filter

An outer join algorithm based on Cuckoo filter

A method to protect Cuckoo filters from soft errors

Soft errors that corrupt the value of bits stored in registers or memories are a major issue for modern electronic systems. To ensure that they do not cause failures, error detection and correction codes are commonly used to protect memories. When memories are used for a specific application, sometimes it is possible to optimize the protection based on the knowledge of the application. One example is the memories used in network devices for packet processing. In particular, the protection of approximate membership check structures such as Bloom filters has been recently studied showing that it is possible to optimize the protection. Cuckoo filters are an alternative to Bloom filters for approximate membership check that has been recently proposed. Cuckoo filters are interesting as they are competitive in terms of memory usage for low false positive rates and also support the removal of elements. In this paper, the protection of Cuckoo filters against soft errors is studied showing that it can be enhanced by exploiting its structure and using the knowledge of the effects on an error in a Cuckoo filter.