Dynamic provable data possession

Abstract

As storage-outsourcing services and resource-sharing networks have become popular, the problem of efficiently proving the integrity of data stored at untrusted servers has received increased attention. In the provable data possession (PDP) model, the client preprocesses the data and then sends it to an untrusted server for storage, while keeping a small amount of meta-data. The client later asks the server to prove that the stored data has not been tampered with or deleted (without downloading the actual data). However, the original PDP scheme applies only to static (or append-only) files.We present a definitional framework and efficient constructions for dynamic provable data possession (DPDP), which extends the PDP model to support provable updates to stored data. We use a new version of authenticated dictionaries based on rank information. The price of dynamic updates is a performance change from O(1) to O(log n) (or O(n ǫ log n)), for a file consisting of n blocks, while maintaining the same (or better, respectively) probability of misbehavior detection. Our experiments show that this slowdown is very low in practice (e.g., 415KB proof size and 30ms computational overhead for a 1GB file). We also show how to apply our DPDP scheme to outsourced file systems and version control systems (e.g., CVS).

Transparent, Distributed, and Replicated Dynamic Provable Data Possession

“…The first dynamic schemes were proposed simultaneously by Ateniese et al [3] and Erway et al [19]. Ateniese et al [3] proposed the Scalable PDP, where the client precomputes responses for pre-decided challenges and stores them on the server encrypted.…”

“…Erway et al [19] proposed a Dynamic PDP (DPDP) scheme in the standard model that supports provable unlimited updates (modify, delete, and insert) with O(log n) complexity. The scheme is based on rank-based authenticated skip list, in which, only the relative indexes of blocks are used, so it can efficiently support dynamism.…”

“…The tree-based scheme uses the Merkle hash tree [26], which is a binary tree used to authenticate the values of the data blocks via collision-resistant hash functions. In this scheme, each copy of the file is put into a Merkle hash tree, and their roots are used to construct another Merkle hash tree (the directory) whose root is the metadata stored at client, similar to the file system proposal of DPDP [19]. Again, the challenge-response mechanism is not transparent to the client; she must know this new structure is in place.…”

“…Erway et al [19] proposed an extension of their DPDP scheme to support version control. If the average number of blocks in a file for each version is n, and there are v versions, their VCS requires O(log n + log v) time and space for proofs, whereas our proposal requires only O(1+log n), which is independent of the number of versions (see [19,9,27,18,12] for optimality discussion).…”

“…When the data is large, it is not acceptable to require the client to retrieve the whole file in order to validate it, since this requires high bandwidth and time complexity [2]. This will be even more problematic if the client uses resource-constrained devices, or performs this check frequently [19].…”