Cloud Storage Deduplication Proof-of-Responsibility Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current deduplication systems in cloud storage are vulnerable to side-channel attacks, such as probing, CDN, and exfiltration attacks, which compromise data security and integrity, and existing countermeasures are complex, resource-intensive, and not always effective.
Innovation Solution
Implementing a proof-of-responsibility scheme by storing a secret index referencing a random block within each file, requiring clients to return the corresponding file block to prove ownership, thereby validating their entitlement to access and retrieve the file.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If a deduplication system stores only a single copy of repeating data and uses hash signatures for identification, then storage efficiency is improved, but the system becomes vulnerable to side-channel attacks that can reveal repository contents
Solution Approach 1:
The patent extracts the vulnerable hash signature verification process from the deduplication system and replaces it with a proof-of-ownership mechanism. Instead of relying solely on hash matching, the system now requires clients to provide cryptographic proof that they own the files they are accessing, thereby removing the security vulnerability while preserving storage efficiency.
Solution Approach 2:
The patent introduces cryptographic proof-of-ownership tokens as an intermediary between the hash signature and file access. These tokens serve as a mediator that verifies client authorization without exposing repository contents through side-channel attacks, bridging the gap between efficient deduplication and secure access control.
2Object-affected harmful factors
If the system requires clients to prove ownership through complex verification mechanisms, then security against side-channel attacks is improved, but system complexity and resource overhead increase
Solution Approach 1:
The patent implements preliminary action by generating proof-of-ownership tokens during the file upload phase. Instead of performing complex verification during each access operation, the system pre-computes and stores cryptographic proofs that can be quickly validated later, reducing both complexity and resource overhead during actual file access operations.
Solution Approach 2:
The patent uses cryptographic copying by creating proof-of-ownership tokens that are digital replicas of file ownership information. These tokens can be copied and distributed to authorized clients without increasing system complexity, as they are merely cryptographic representations that can be verified through simple mathematical operations.
3Reliability
If existing countermeasures are implemented to prevent side-channel attacks, then data security is improved, but resource overhead and operational complexity increase significantly
Solution Approach 1:
The patent changes the fundamental parameter of access verification from hash-based matching to cryptographic proof-based authorization. This parameter change achieves high data security through mathematically secure proof-of-ownership mechanisms while maintaining low resource overhead, as the cryptographic verification can be performed efficiently without requiring complex additional infrastructure.
Data Source
AI summary
An index-based proof-of-responsibility method and system for preventing side-channel attacks in data deduplication systems is described. A storage server computer creates a secret index referencing a specific random block in a file stored in a central data store. The server stores the hash value of the file along with the block referenced by the index. When a client computer submits a deduplication request regarding the file, server challenges the client to produce the block referenced by the index. If the proper file block is returned, the client has proven ownership of the file, and the request is granted. The server refreshes the index and associated challenge block after processing each request by a client computer.