What If Keys Are Leaked? towards Practical and Secure Re-Encryption in Deduplication-Based Cloud Storage

Abstract

By only storing a unique copy of duplicate data possessed by different data owners, deduplication can significantly reduce storage cost, and hence is used broadly in public clouds. When combining with confidentiality, deduplication will become problematic as encryption performed by different data owners may differentiate identical data which may then become not deduplicable. The Message-Locked Encryption (MLE) is thus utilized to derive the same encryption key for the identical data, by which the encrypted data are still deduplicable after being encrypted by different data owners. As keys may be leaked over time, re-encrypting outsourced data is of paramount importance to ensure continuous confidentiality, which, however, has not been well addressed in the literature. In this paper, we design SEDER, a SEcure client-side Deduplication system enabling Efficient Re-encryption for cloud storage by (1) leveraging all-or-nothing transform (AONT), (2) designing a new delegated re-encryption (DRE), and (3) proposing a new proof of ownership scheme for encrypted cloud data (PoWC). Security analysis and experimental evaluation validate security and efficiency of SEDER, respectively.

EnclavePoSt: A Practical Proof of Storage-Time in Cloud via Intel SGX

“…You et al [49] proposed the rst deduplicationfriendly watermarking scheme for multimedia data in public clouds, in which the data integrity can be checked by the cloud server without having access to the original data. A proof of ownership for encrypted les is proposed [50] by recruiting the rst data owner to assist later data integrity checking. However, in order to continuously check data integrity, the users must keep online and perform data integrity checking frequently via PoS protocols, which is cumbersome for users and unrealistic in practice.…”

Secure and Efficient Proof of Ownership Scheme for Client-Side Deduplication in Cloud Environments

“…Data deduplication techniques can benefit from convergent encryption (CE) to achieve security smoothly and more easily [10,15]. Convergent encryption is a cryptographic concept that ensures security in the cloud by achieving confidentiality and data privacy.…”

“…Data deduplication is an effective mechanism that aims at reducing the required storage space of the cloud storage servers by avoiding storing several copies of the same data. There are two main types of deduplication [9,10] namely, server-side deduplication and client-side deduplication. The server-side deduplication schemes [11,12] remove duplicated copies of the same files after uploading them to the server.…”

“…The server-side deduplication schemes [11,12] remove duplicated copies of the same files after uploading them to the server. On the other hand, In client-side deduplication [10,13], duplicated copies are identified on the client side and not uploaded to the server. Hence, in contrary to server-side deduplication, client-side deduplication can not only save storage space and uploading time but also reduce network bandwidth.…”