Outsourced Files Research Articles

Ownership-hidden group-oriented proofs of storage from pre-homomorphic signatures

In this paper, we study the problem of secure cloud storage in a multi-user setting such that the ownership of outsourced files can be hidden against the cloud server. There is a group manager for initiating the system, who is also responsible for issuing private keys for the involved group members. All authorized members are able to outsource files to the group’s storage account at some cloud server. Although the ownership of outsourced file is preserved against the cloud server, the group manager could trace the true identity of any suspicious file for liability investigation. To address this issue, we introduce and formalize a notion of ownership-hidden group-oriented proofs of storage (OPoS). We present a generic OPoS construction from pre-homomorphic signatures, and propose an OPoS instantiation by employing the Boneh–Boyen short signature. We show that the OPoS instantiation can be optimized using a polynomial commitment technique, so that the integrity auditing protocol would only take constant-size communication overheads by the cloud server. Theoretical and experimental analyses show that our OPoS instantiations are efficient and practical for enterprise-oriented cloud storage applications. Also, we show that the OPoS instantiations can be enhanced to safeguard against a dynamic set of corrupted members, as well as support batch integrity auditing mechanism.

Privacy preserving cloud data auditing with efficient key update

Data integrity is extremely important for cloud based storage services, where cloud users no longer have physical possession of their outsourced files. A number of data auditing mechanisms have been proposed to solve this problem. However, how to efficiently update a cloud user’s secret auditing key as well as the authenticators those keys are associated with when the digital certificate expires in the PKI system is a critical issue. In this paper, we propose a key-updating and authenticator-evolving mechanism with zero-knowledge privacy of the stored files for secure cloud data auditing, which incorporates zero knowledge proof systems, proxy re-signatures and homomorphic linear authenticators. We instantiate our proposal with the state-of-the-art Shacham–Waters auditing scheme. When the cloud user needs to update his key, instead of downloading the entire file and re-generating all the authenticators, the user can simply download one single file tag, work out a re-signing key with the new private key and upload the new file tag together with some verification information to the cloud server, in which the user undertakes the least amount of the workload in the updating phase. This approach dramatically reduces the communication and computation cost while maintaining the desirable security. We formalize the security model of zero knowledge data privacy for auditing schemes in the key-updating context and prove the soundness and zero-knowledge privacy of the proposed construction. Finally, we develop a prototype implementation of the protocol which demonstrates the practicality of the proposal.

Batch Attribute-Based Encryption for Secure Clouds

Cloud storage is widely used by organizations due to its advantage of allowing universal access with low cost. Attribute-based encryption (ABE) is a kind of public key encryption suitable for cloud storage. The secret key of each user and the ciphertext are associated with an access policy and an attribute set, respectively; in addition to holding a secret key, one can decrypt a ciphertext only if the associated attributes match the predetermined access policy, which allows one to enforce fine-grained access control on outsourced files. One issue in existing ABE schemes is that they are designed for the users of a single organization. When one wants to share the data with the users of different organizations, the owner needs to encrypt the messages to the receivers of one organization and then repeats this process for another organization. This situation is deteriorated with more and more mobile devices using cloud services, as the ABE encryption process is time consuming and may exhaust the power supplies of the mobile devices quickly. In this paper, we propose a batch attribute-based encryption (BABE) approach to address this problem in a provably-secure way. With our approach, the data owner can outsource data in batches to the users of different organizations simultaneously. The data owner is allowed to decide the receiving organizations and the attributes required for decryption. Theoretical and experimental analyses show that our approach is more efficient than traditional encryption implementations in computation and communication.

Dynamic Provable Data Possession

As storage-outsourcing services and resource-sharing networks have become popular, the problem of efficiently proving the integrity of data stored at untrusted servers has received increased attention. In the Provable Data Possession (PDP) model, the client preprocesses the data and then sends them to an untrusted server for storage while keeping a small amount of meta-data. The client later asks the server to prove that the stored data have not been tampered with or deleted (without downloading the actual data). However, existing PDP schemes apply only to static (or append-only) files. We present a definitional framework and efficient constructions for Dynamic Provable Data Possession (DPDP), which extends the PDP model to support provable updates to stored data. We use a new version of authenticated dictionaries based on rank information. The price of dynamic updates is a performance change from O (1) to O (log n (or O ( n ε log n )) for a file consisting of n blocks while maintaining the same (or better, respectively) probability of misbehavior detection. Our experiments show that this slowdown is very low in practice (e.g., 415KB proof size and 30ms computational overhead for a 1GB file). We also show how to apply our DPDP scheme to outsourced file systems and version control systems (e.g., CVS).

A lightweight possession proof scheme for outsourced files in mobile cloud computing based on chameleon hash function

In mobile cloud computing, mobile users usually upload working documents into cloud servers to facilitate pervasively accessing via mobile devices and ubiquitously cooperating among members in a mobile group. During periods between uploading and downloading files, the possession of original file at cloud servers needs to be proofed to mobile requesters upon file retrieval. Any mobile user or device can verify that cloud servers indeed possess the designated uploading file before any concrete downloading procedure. Moreover, such verification procedure should not induce much overhead in terms of computation, storage and communication for mobile devices. In this paper, we propose a family of schemes to address this problem without relying on any third party auditor or authority. They are named as randomly sampling check protocol, random commitment check protocol, and chameleon hash function-based protocol. All schemes are lightweight in terms of computation, storage and communication. The evaluation of security and performance is extensively analysed, justifying the applicability of the proposed schemes. We finally propose a general protocol model for remote possession proof to reveal the fundamental components in the protocols for dedicated security goal. Such general protocol unveils a uniform framework for possession proof protocols.

Secure Overlay Cloud Storage with Access Control and Assured Deletion

We can now outsource data backups off-site to third-party cloud storage services so as to reduce data management costs. However, we must provide security guarantees for the outsourced data, which is now maintained by third parties. We design and implement FADE, a secure overlay cloud storage system that achieves fine-grained, policy-based access control and file assured deletion. It associates outsourced files with file access policies, and assuredly deletes files to make them unrecoverable to anyone upon revocations of file access policies. To achieve such security goals, FADE is built upon a set of cryptographic key operations that are self-maintained by a quorum of key managers that are independent of third-party clouds. In particular, FADE acts as an overlay system that works seamlessly atop today's cloud storage services. We implement a proof-of-concept prototype of FADE atop Amazon S3, one of today's cloud storage services. We conduct extensive empirical studies, and demonstrate that FADE provides security protection for outsourced data, while introducing only minimal performance and monetary cost overhead. Our work provides insights of how to incorporate value-added security features into today's cloud storage services.

Comparing General Paradigms on Data Secrecy Protection for Outsourced Files in Mobile Cloud Computing

The data secrecy of outsourced files in cloud server should be protected even though cloud servers are untrustworthy. In this paper, we extensively analyze the techniques on data privacy protection for secure cloud storage. We propose and compare several general paradigms on data secrecy protection including ID-based scheme, CLPKCbased scheme, key-escrow-based scheme, ID-based threshold decryption scheme, and trusted third party based scheme. After the analysis and comparison, ID-based threshold decryption scheme has the most advantages with respect to no constraints such as certificate and key escrow.