Efficient Integrity Verification Research Articles

LiteHash: Hash Functions for Resource-Constrained Hardware

The global paradigm shift towards edge computing has led to a growing demand for efficient integrity verification. Hash functions are one-way algorithms which act as a zero-knowledge proof of a datum’s contents. However, it is infeasible to compute hashes on devices with limited processing power and memory. Hence, we propose four novel LiteHash functions which are architecturally similar to SHA-512 yet simpler. By using various approximation techniques, our implementations reduce the computational costs of digesting a message into a hash. On validating our proposed designs using the NIST PRNG Test Suite, we observe SHA-512 equivalent cryptographic security while satisfying all desired hash function property requirements. We observe a minimum of 9.41% reduction in area, 20.47% reduction in power and 22.05% increase in throughput. Our designs offer a throughput of upto 2 Gbps while reducing area and power by a maximum of 16.86% and 32.48% respectively. LiteHash functions also support the computation of the entire SHA-2 family of hash functions (SHA-224/256/384/512) with minor architectural modifications.

Efficient and Secure Data Sharing in Cloud Computing

With the development of big data and cloud computing, more and more enterprises prefer to store their data in cloud and share the data among their authorized employees efficiently and securely. So far, many different data sharing schemes in different fields have been proposed. However, sharing sensitive data in cloud still faces some challenges such as achieving data privacy and lightweight operations at resource constrained mobile terminals. Furthermore, most data sharing schemes have no integrity verification mechanism, which would result in wrong computation results for users. To solve the problems, we propose an efficient and secure data sharing scheme for mobile devices in cloud computing. Firstly, the scheme guarantees security and authorized access of shared sensitive data. Secondly, the scheme realizes efficient integrity verification before users share the data to avoid incorrect computation.

Public integrity verification for data sharing in cloud with asynchronous revocation

Cloud data sharing service, which allows a group of people to access and modify the shared data, is one of the most popular and efficient working styles in enterprises. Recently, there is an uprising trend that enterprises tend to move their IT service from local to cloud to ease the management and reduce the cost. Under the new cloud environment, the cloud users require the data integrity verification to inspect the data service at the cloud side. Several recent studies have focused on this application scenario. In these studies, each user within a group is required to sign a data block created or modified by him. While a user is revoked, all the data previously signed by him should be resigned. In the existing research, the resigning process is dependent on the revoked user. However, cloud users are autonomous. They may exit the system at any time without notifying the system admin and even are revoked due to misbehaviors. As the developers in the cloud-based software development platform, they are voluntary and not strictly controlled by the system. Due to this feature, cloud users may not always follow the cloud service protocol. They may not participate in generating the resigning key and may even expose their secret keys after being revoked. If the signature is not resigned in time, the subsequent verification will be affected. And if the secret key is exposed, the shared data will be maliciously modified by the attacker who grasps the key. Therefore, forcing a revoked user to participate in the revocation process will lead to efficiency and security problems. As a result, designing a practical and efficient integrity verification scheme that supports this scenario is highly desirable. In this paper, we identify this challenging problem as the asynchronous revocation, in which the revocation operations (i.e., re-signing key generation and resigning process) and the user's revocation are asynchronous. All the revocation operations must be able to be performed without the participation of the revoked user. Even more ambitiously, the revocation process should not rely on any special entity, such as the data owner or a trusted agency. To address this problem, we propose a novel public data integrity verification mechanism in which the data blocks signed by the revoked user will be resigned by another valid user. From the perspectives of security and practicality, the revoked user does not participate in the resigning process and the re-signing key generation. Our scheme allows anyone in the cloud computing system to act as the verifier to publicly and efficiently verify the integrity of the shared data using Homomorphic Verifiable Tags (HVTs). Moreover, the proposed scheme resists the collusion attack between the cloud server and the malicious revoked users. The numerical analysis and experimental results further validate the high efficiency and scalability of the proposed scheme. The experimental results manifest that re-signing 10,000 data blocks only takes 3.815 ​s and a user can finish the verification in 300 ​ms with a 99% error detection probability.

An efficient and secure data sharing scheme for mobile devices in cloud computing

With the development of big data and cloud computing, more and more enterprises prefer to store their data in cloud and share the data among their authorized employees efficiently and securely. So far, many different data sharing schemes in different fields have been proposed. However, sharing sensitive data in cloud still faces some challenges such as achieving data privacy and lightweight operations at resource constrained mobile terminals. Furthermore, most data sharing schemes have no integrity verification mechanism, which would result in wrong computation results for users. To solve the problems, we propose an efficient and secure data sharing scheme for mobile devices in cloud computing. Firstly, the scheme guarantees security and authorized access of shared sensitive data. Secondly, the scheme realizes efficient integrity verification before users share the data to avoid incorrect computation. Finally, the scheme achieves lightweight operations of mobile terminals on both data owner and data requester sides.

Merkle Tree and Blockchain-Based Cloud Data Auditing

Cloud computing is the fastest growing and most promising field in the service provisioning segment. It has become a challenging task to provide security in the cloud. The purpose of this article is to suggest a better and efficient integrity verification technique for data referred to as cloud audit. The deployment of cloud storage services has significant benefits in the management of data for users. However, this raises many security concerns, and one of them is data integrity. Though public verification techniques serve the purpose they are vulnerable to procrastinating auditors who may not perform verifications on time. In this article, a cloud data auditing system is proposed. The proposed cloud data auditing system integrates Merkle Tree-based Cloud audit and the blockchain-based audit recording system, thus the core idea is to record each verification result into a blockchain as a transaction. Utilizing the time-sensitive nature of blockchain, the verifications are time-stamped after the corresponding transaction is recorded into the blockchain, which enables users to check whether auditors have performed the verifications at the prescribed time. The proposed cloud data auditing system is experimentally validated. The investigations with varied dataset size revealed less time taken, on an average of 0.25 milliseconds with the use of Merkle Tree. Further results reveal consistency of the data integrity checking.

An Efficient Integrity Verification and Authentication Scheme over the Remote Data in the Public Clouds for Mobile Users

The digitalization of the modern world and its applications seem to be integrated more with the mobile phones than with any other communication devices. Since the mobile phones have become ubiquitous with applications for nearly all users, they have become a preferred choice for uploading the sensitive information to the cloud servers. Though the drive for data storage in cloud servers is implicit due to its pay-per-use policies, the manipulation of the data present in the cloud servers by hackers and hardware failure incidents, as happened in Amazon cloud servers in 2011, necessitates the demand for data verification at regular intervals over the data stored in the remote servers. In this line, modern day researchers have proposed many novel schemes for ensuring the remote data integrity, but they suffer from attacks or overheads due to computation and communication. This research paper provides solutions in three dimensions. Firstly, a novel scheme is introduced to verify the integrity of the data stored in the remote cloud servers in the context of mobile users. The second dimension is that of reducing the computational and communication overheads during the auditing process than the previous works. The third dimension securely authenticates the mobile user during the auditing process and the dynamic data operations such as block modification, insertion, and deletion. Moreover, the proposed protocol is provably secure exhibiting soundness, completeness, and data privacy making it an ideal scheme for implementation in the real-world applications.

Efficient HEVC Integrity Verification Scheme for Multimedia Cybersecurity Applications

Multimedia cybersecurity is a prevalent research topic in the digital world due to the rapid progress of digital multimedia and Internet applications. Watermarking, encryption, and steganography schemes are employed to attain multimedia data confidentiality and robustness. However, these schemes are externally applied on trusted computers, and there has been a lack of similar schemes that can be effectively and efficiently enabled through an untrusted transmission medium. In this work, a self-embedding-based High-Efficiency Video Coding (HEVC) transmission and integrity verification framework is presented. This framework is robust and reliable for verifying the integrity of HEVC frames transmitted through insecure communication channels. Firstly, the transmitted HEVC frames are divided into a number of blocks with a certain block size. After that, a discrete transform is used for self-embedding of watermarks from each block into another one depending on a predefined mechanism. The Discrete Wavelet Transform (DWT), Discrete Cosine Transform (DCT), and Discrete Fourier Transform (DFT) are tested for this task. The watermarked HEVC frames are transmitted through a wireless communication channel, and hence they become subject to different attacks and corruptions. At the receiver side, the secret watermarks in each block are sensed with a correlation-based method to discover dubious counterfeit operations. To verify the reliability of the suggested transmission framework and its ability to achieve high protection and robust content verification of the transmitted HEVC frames over insecure communication channels, different HEVC analyses and comparisons are performed. Simulation results demonstrate the suitability of the suggested transmission framework for different multimedia cybersecurity applications. Furthermore, the comparative analysis shows that the DFT is an efficient discrete transform that can be employed with the proposed transmission framework to guarantee a higher HEVC frame integrity. It allows higher sensitivity to simple modifications in the transmitted watermarked HEVC frames. This makes the suggested cybersecurity framework applicable, secure, and appropriate for multimedia integrity verification purposes.

A Secure and Lightweight Data Sharing Scheme for Internet of Medical Things

As cloud computing has many advantages such as large storage capacity, low cost and scalability, more and more patients prefer to store their health data in cloud to share with physicians, researchers or other users. However, storing shared data in remote cloud is out of patient's control and exposes to lots of security problems such as privacy and data integrity. So far, more and more data sharing schemes to preserve data security in health field have been put forward, but in most of them, data encryption and decryption are completely implemented by terminal devices, which increases the communication and computation burden of patient and user. Furthermore, most sharing schemes have no integrity verification mechanism, resulting in incomplete data for users to share. To solve the problems, we propose a secure and lightweight data sharing scheme for Internet of Medical Things. Firstly, the scheme guarantees the privacy and authorized access of shared data. Secondly, the scheme realizes efficient integrity verification before user downloads shared data to avoid incorrect query or computation result. Finally, the scheme achieves lightweight operations of patient and user.

A secure regenerating code‐based cloud storage with efficient integrity verification

SummaryCloud storage is gaining popularity as it relieves the data owners from the burden of data storage and maintenance cost. However, outsourcing data to third‐party cloud servers raise several concerns such as data availability, confidentiality, and integrity. Recently, regenerating codes have gained popularity because of their low repair bandwidth while ensuring data availability. In this paper, we propose a secure regenerating code‐based cloud storage (SRCCS) scheme, which utilizes the verifiable computation property of homomorphic encryption scheme to check the integrity of outsourced data. In this work, an error‐correcting code (ECC)–based homomorphic encryption scheme (HES) is employed to simultaneously provide data privacy as well as error correction while supporting efficient integrity verification. In SRCCS, server regeneration process is initiated on detection of data corruption events in order to ensure data availability. The ECC‐based HES significantly reduces the probability of server regeneration and minimizes the repair cost. Extensive theoretical analysis and simulation results validate the security, efficiency, and practicability of the proposed scheme.

Efficient and Scalable Integrity Verification of Data and Query Results for Graph Databases

Graphs are used for representing and understanding objects and their relationships for numerous applications such as social networks, Semantic Webs, and biological networks. Integrity assurance of data and query results for graph databases is an essential security requirement. In this paper, we propose two efficient integrity verification schemes—HMACs for graphs (gHMAC) for two-party data sharing, and redactable HMACs for graphs (rgHMAC) for third-party data sharing, such as a cloud-based graph database service. We compute one HMAC value for both the schemes and two other verification objects for rgHMAC scheme that are shared with the verifier. We show that the proposed schemes are provably secure with respect to integrity attacks on the structure and/or content of graphs and query results. The proposed schemes have linear complexity in terms of the number of vertices and edges in the graphs, which is shown to be optimal. Our experimental results corroborate that the proposed HMAC-based schemes for graphs are highly efficient as compared to the digital signature-based schemes—computation of HMAC tags is about 10 times faster than the computation of digital signatures.

Enhancing Big Data Auditing

The auditing services of the outsourced data, especially big data, have been an active research area recently. Many schemes of remotely data auditing (RDA) have been proposed. Both categories of RDA, which are Provable Data Possession (PDP) and Proof of Retrievability (PoR), mostly represent the core schemes for most researchers to derive new schemes that support additional capabilities such as batch and dynamic auditing. In this paper, we choose the most popular PDP schemes to be investigated due to the existence of many PDP techniques which are further improved to achieve efficient integrity verification. We firstly review the work of literature to form the required knowledge about the auditing services and related schemes. Secondly, we specify a methodology to be adhered to attain the research goals. Then, we define each selected PDP scheme and the auditing properties to be used to compare between the chosen schemes. Therefore, we decide, if possible, which scheme is optimal in handling big data auditing.

Efficient Integrity Verification Scheme for Medical Data Records in Cloud-Assisted Wireless Medical Sensor Networks

Wireless sensor networks (WSNs) have been widely used in many applications recently. As an important application of the WSNs, the wireless medical sensor networks (WMSNs) could improve health-care quality and have become significant in the modern medical system. WMSNs devices typically have limited computing, storage and communication capabilities. To enhance the capabilities of WSNs, cloud-assisted WMSNs have been introduced, and they can provide more efficient processing of cloud users’ medical data records stored in the cloud. The integrity of medical data records is very important since these data will be used to provide a medical diagnosis and other medical treatments. In this paper, we propose an efficient integrity verification scheme for medical data records in cloud-assisted WMSNs. Based on elliptic curve digital signature algorithm, we construct linearly homomorphic authenticator, so that the third party auditor (TPA) can verify the the integrity of medical data records without bringing in new security threats. TPA does not need to retrieve the entire medical data records, thus can dramatically reduce the communication and computation overhead. Moreover, we further extend our scheme to support batch integrity verification for multiple cloud users simultaneously. In particular, to achieve efficient medical data dynamic operations, using index hash tables, our scheme can execute dynamic operations efficiently. Performance comparison shows that our scheme is more light-weight, and can be used much more practically in cloud-assisted WMSNs.

Identity-Based Public Multi-Replica Provable Data Possession

Cloud storage has been gaining tremendous popularity, which provides facilitative data storage and sharing services for distributed clients. To maximize the availability and reliability, some customers may store multiple replicas of critical data on cloud servers. However, cloud servers may collude to make it look like they are storing multiple copies of data, whereas in fact they only store a single copy. Currently, several multi-replica provable data possession schemes have been proposed to provide verifications to ensure that all the outsourced copies are actually stored and maintained intact. For these schemes with third-party verifications, correctly choosing public keys of data owners relies on the public key infrastructure (PKI), which is complicated and resource consuming. In this paper, we propose a novel identity-based public multireplica provable data possession scheme (IDPMR-PDP) to provide third-party verification of outsourced data with multiple replicas without PKI. We also introduce a formal security model of identity-based public multi-replica PDP schemes and prove that the IDPMR-PDP is secure against malicious cloud servers and privacy-preserving against curious verifiers under this model. Meanwhile, our analyses and simulation results demonstrate that the IDPMR-PDP realizes efficient integrity verification.

Efficient integrity verification of replicated data in cloud computing system

Data owners can outsource their data to remote Cloud Servers (CSs) and enjoy on-demand high quality services. They rent Cloud Service Provider (CSP) facilities to store unlimited data by paying fees metered by month or gigabyte. For important sensitive data, data owners have increased availability, scalability and durability requirements. If the sensitive data hold these properties and can be stored correctly, the data owners will get great benefits. Thus, the data owners care about the confidentiality aspects as well. Therefore, they may store data replicas on multiple servers across multiple data centers. Data owners should have assurances that the stored copies are consistent with the most recent version updated by the data owner. This research proposed an efficient multi-copy Provable Data Possession (PDP) scheme that holds five characteristics: 1) the data owner uses the Fully Homomorphic Encryption (FHE) to generate data block replicas; 2) the scheme allows the data owner to perform dynamic update operations on the stored data blocks; 3) CSP cannot cheat the data owner; 4) the scheme supports the third party public verification; 5) authorized users can seamlessly access data copies from CSPs using a single secret key. The security analysis and experimental results demonstrate the proposed scheme could resist forge attack, replay attack and replace attack, and perform better than previous effors.

Efficient Dynamic Integrity Verification for Big Data Supporting Users Revocability

With the advent of the big data era, cloud data storage and retrieval have become popular for efficient data management in large companies and organizations, thus they can enjoy the on-demand high-quality cloud storage service. Meanwhile, for security reasons, those companies and organizations would like to verify the integrity of their data once storing it in the cloud. To address this issue, they need a proper cloud storage auditing scheme which matches their actual demands. Current research often focuses on the situation where the data manager owns the data; however, the data belongs to the company, rather than the data managers in the real situation which has been overlooked. For example, the current data manager is no longer suitable to manage the data stored in the cloud after a period and will be replaced by another one. The successor needs to verify the integrity of the former managed data; this problem is obviously inevitable in reality. In this paper, we fill this gap by giving a practical efficient revocable privacy-preserving public auditing scheme for cloud storage meeting the auditing requirement of large companies and organization’s data transfer. The scheme is conceptually simple and is proven to be secure even when the cloud service provider conspires with revoked users.

Cloud Audit: A Data Integrity Verification Approach for Cloud Computing

Cloud computing is the fastest growing and promising field in the sector of service provision. It is a very trendy situation for security implementation in the Cloud. Thus, security restrictions are increasing on users and service providers as the growth of Cloud environment. The purpose of this paper is to suggest a better and efficient integrity verification technique for data (referred as “Cloud Audit”). The building blocks of our technique are a variant of the Paillier homomorphic cryptography system with homomorphic tag and combinatorial batch codes. A Paillier Homomorphic Cryptography (PHC) system used to obtain homomorphic encryption on data blocks. Homomorphic tags along with the Paillier cryptography system assigns a special verifiable value to each data block, which helps us in unleashing data operations on this block. Combinatorial batch codes are used to assign and store integral data into different distributed cloud sever. To demonstrate our approach, we have implemented an application based on Hadoop and MapReduce framework. We have tested this application based on various parameters. Effectiveness of the proposed method has been shown by the experimental results. Our method has shown large improvement over the other modern methods.

Provable multiple replication data possession with full dynamics for secure cloud storage

SummaryCloud storage has been gaining tremendous popularity among individuals and corporations because of its low maintenance cost and on‐demand services for the clients. To improve the availability and the reliability of critical data, storing multiple replicas on multiple servers is a commonly used strategy. Currently, several provable data possession (PDP) protocols for multiple replicas of dynamic data have been proposed to ensure the integrity of outsourced multi‐copy data, but the efficiency of these protocols on verifying multiple replicas one by one is not satisfactory. In this paper, we propose a provable multiple replication data possession protocol with full dynamics, named MR‐DPDP. In MR‐DPDP, we utilize a novel authenticated data structure called Merkle hash tree with rank to support both full dynamic data updates and efficient integrity verification. In addition, our construction with RSA signature can support both variable‐sized file blocks and public verification. Through security proof and performance evaluation, we demonstrate that MR‐DPDP not only is sound but also incurs less communication overhead when updating data blocks as well as verifying a proof of the integrity of multiple replicas. Copyright © 2015 John Wiley & Sons, Ltd.

Freecursive ORAM

Oblivious RAM (ORAM) is a cryptographic primitive that hides memory access patterns as seen by untrusted storage. Recently, ORAM has been architected into secure processors. A big challenge for hardware ORAM schemes is how to efficiently manage the Position Map (PosMap), a central component in modern ORAM algorithms. Implemented naively, the PosMap causes ORAM to be fundamentally unscalable in terms of on-chip area. On the other hand, a technique called Recursive ORAM fixes the area problem yet significantly increases ORAM's performance overhead. To address this challenge, we propose three new mechanisms. We propose a new ORAM structure called the PosMap Lookaside Buffer (PLB) and PosMap compression techniques to reduce the performance overhead from Recursive ORAM empirically (the latter also improves the construction asymptotically). Through simulation, we show that these techniques reduce the memory bandwidth overhead needed to support recursion by 95%, reduce overall ORAM bandwidth by 37% and improve overall SPEC benchmark performance by 1.27x. We then show how our PosMap compression techniques further facilitate an extremely efficient integrity verification scheme for ORAM which we call PosMap MAC (PMMAC). For a practical parameterization, PMMAC reduces the amount of hashing needed for integrity checking by >= 68x relative to prior schemes and introduces only 7% performance overhead. We prototype our mechanisms in hardware and report area and clock frequency for a complete ORAM design post-synthesis and post-layout using an ASIC flow in a 32~nm commercial process. With 2 DRAM channels, the design post-layout runs at 1~GHz and has a total area of .47~mm2. Depending on PLB-specific parameters, the PLB accounts for 10% to 26% area. PMMAC costs 12% of total design area. Our work is the first to prototype Recursive ORAM or ORAM with any integrity scheme in hardware.

Freecursive ORAM

Oblivious RAM (ORAM) is a cryptographic primitive that hides memory access patterns as seen by untrusted storage. Recently, ORAM has been architected into secure processors. A big challenge for hardware ORAM schemes is how to efficiently manage the Position Map (PosMap), a central component in modern ORAM algorithms. Implemented naively, the PosMap causes ORAM to be fundamentally unscalable in terms of on-chip area. On the other hand, a technique called Recursive ORAM fixes the area problem yet significantly increases ORAM's performance overhead. To address this challenge, we propose three new mechanisms. We propose a new ORAM structure called the PosMap Lookaside Buffer (PLB) and PosMap compression techniques to reduce the performance overhead from Recursive ORAM empirically (the latter also improves the construction asymptotically). Through simulation, we show that these techniques reduce the memory bandwidth overhead needed to support recursion by 95%, reduce overall ORAM bandwidth by 37% and improve overall SPEC benchmark performance by 1.27x. We then show how our PosMap compression techniques further facilitate an extremely efficient integrity verification scheme for ORAM which we call PosMap MAC (PMMAC). For a practical parameterization, PMMAC reduces the amount of hashing needed for integrity checking by >= 68x relative to prior schemes and introduces only 7% performance overhead. We prototype our mechanisms in hardware and report area and clock frequency for a complete ORAM design post-synthesis and post-layout using an ASIC flow in a 32~nm commercial process. With 2 DRAM channels, the design post-layout runs at 1~GHz and has a total area of .47~mm2. Depending on PLB-specific parameters, the PLB accounts for 10% to 26% area. PMMAC costs 12% of total design area. Our work is the first to prototype Recursive ORAM or ORAM with any integrity scheme in hardware.

Efficient SSD Integrity Verification Program Based on Combinatorial Group Theory

In digital forensics, the issue of data integrity protection for increasingly widespread applied SSD (Solid State Disk, SSD) is to be resolved. Based on Combinatorial Group Theory, mapping data objects in SSD validation process and test object in combination group testing methods, using the non-adaptive mode to the initial calculation, stored procedures, and re-calculate, verify process, and carefully selecting the design parameters to construct the test matrix of Combinatorial Group Testing method in response to different application environments, we design testing group. The algorithm capabilities meet the requirements and that is higher efficiently by repeated tests. It is feasible for SSD integrity check based on the Combinatorial Group Theory.