Cloud Storage Obfuscating Data Access Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based data retrieval reveals access patterns, compromising security and privacy as devices with limited memory struggle to process encrypted data, and existing solutions fail to obscure access patterns effectively.
Innovation Solution
A cloud storage system uses a series of hash functions to generate an index, allowing secure retrieval of data by obfuscating access patterns through non-deterministic encryption, ensuring that memory locations implicated by requests are decrypted and re-encrypted, thus masking access patterns from cloud providers and hackers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Power
If data is transferred to client device for processing, then data processing capability is improved, but device memory requirements worsen
Solution Approach 1:
The system segments the data processing workflow between cloud storage system and client device. The cloud storage system performs decryption and data retrieval operations, while the client device only receives and processes the specific data needed, avoiding the need to transfer and store large amounts of encrypted data locally.
Solution Approach 2:
The cloud storage system acts as an intermediary between the data storage and the client device. It handles the decryption and data retrieval processes, allowing the client device to access processed data without needing to handle the full encrypted data set or perform complex decryption operations locally.
2Speed
If cloud provider accesses data storage locations, then data retrieval speed is improved, but access pattern security worsens
Solution Approach 1:
The system changes the parameter of encryption determinism to non-deterministic encryption. This ensures that the same plaintext data location is encrypted differently each time, making it impossible for the cloud provider to identify access patterns by observing encryption/decryption operations, while still allowing rapid data retrieval through the use of cryptographic indexes.
Solution Approach 2:
The system performs preliminary setup of cryptographic indexes during data ingestion, organizing data by encrypted keys and maintaining sorted structures. This preliminary action enables rapid data retrieval operations without requiring real-time analysis of encrypted data, thus maintaining both speed and security.
3Reliability
If encryption is applied to protect data, then data security is improved, but data access pattern visibility worsens
Solution Approach 1:
The system changes the encryption parameter from deterministic to non-deterministic, ensuring that identical plaintext values produce different ciphertext values each time encryption is applied. This maintains strong data security while completely obscuring access patterns, as the cloud provider cannot determine which encrypted values correspond to the same plaintext data.
Data Source
AI summary
Cloud-based data is securely retrieved by obfuscating access patterns. A cloud storage system receives a request for data from a remote client that specifies a key. Thereafter, the cloud storage system iterates through an index to identify all locations corresponding to the specified key. Such index is generated by applying a series of j hash functions to each key resulting in a j different tables forming part of the index. Using the index, the cloud storage system returns data from the identified locations to the client. As each write operation works by using non-deterministic encryption, the write operation changes the records stored in this data structure, and when the record is not changed, the algorithm simply rewrites the data which is stored in the data structure by rewriting the same value back again. However since, a nondeterministic encryption is utilized, it makes it indistinguishable as to when new data was written and when existing data is rewritten.