Differential Privilege based Secure Authorized Deduplication Using Public Private Cloud

Data deduplication is one of important data compression techniques for eliminating duplicate copies of repeating data, and has been widely used in cloud storage to reduce the amount of storage space and save bandwidth. To protect the confidentiality of sensitive data while supporting deduplication, the convergent encryption technique has been proposed to encrypt the data before outsourcing. To better protect data security, this paper makes the first attempt to formally address the problem of authorized data deduplication. Different from traditional deduplication systems, the differential privileges of users are further considered in duplicate check besides the data itself. We also present several new deduplication constructions supporting authorized duplicate check in a hybrid cloud architecture. Security analysis demonstrates that our scheme is secure in terms of the definitions specified in the proposed security model. As a proof of concept, we implement a prototype of our proposed authorized duplicate check scheme and conduct testbed experiments using our prototype. We show that our proposed authorized duplicate check scheme incurs minimal overhead compared to normal operations. INTRODUCTION Cloud computing provides many “virtualized” resources to users as services across the entire Internet, while hiding platform and implementation details. Nowadays cloud service providers offer both highly available storage and massively parallel computing resources at relatively low costs. GMAIL is one of the best examples of cloud storage which is used by most of us regularly. One of the major issues of cloud storage services is the management of the everincreasing volume of data. To make data management scalable in cloud computing, deduplication [5] has been a well-known technique which is being used by most of the users. Data Deduplication is one of the specialised data compression techniques which is used to eliminate duplicate copies of data. Deduplication can take place at file level or either block level. For file level deduplication, it eliminates duplicate copies of the same file. Deduplication can also take place at the block level, which eliminates duplicate blocks of data that occur in non-identical files. Although there are several advantages of data deduplication security and privacy concerns arise as users’ sensitive data are susceptible to both insider and outsider attacks. Encryption techniques which were used traditionally were not compatible with data deduplication while providing data confidentiality. Traditional encryption requires different users to encrypt their data with their own keys by which identical data copies of different users will lead to different cipher texts, making deduplication impossible. Convergent encryption [4] has been proposed to enforce data confidentiality while making deduplication feasible. It encrypts/decrypts a data copy with a convergent key, which is obtained by computing the cryptographic hash value of the content of the data copy. Whenever the key is generated users retain the keys and send the cipher text to the cloud. In order to prevent unauthorized access, a secure proof of ownership protocol [2] is also needed to provide the proof that the user indeed owns the same file when a duplicate is found. Hence convergent encryption allows the cloud to perform deduplication on the ciphertexts and the proof of ownership prevents the unauthorized user to access the file. Traditional deduplication systems based on convergent encryption, although providing confidentiality to some extent; do not support the duplicate check with differential privileges. Contradiction occurs when we try to realize both deduplication and differential authorization duplicate check at the same time. 1.1 CONTRIBUTION For solving the problems of deduplication we consider a hybrid cloud architecture consisting of a public cloud and a private cloud. Different privilege levels have been allocated to securely RESEARCH ARTICLE OPEN ACCESS International Journal of Engineering Research and Applications (IJERA) ISSN: 2248-9622 NATIONAL CONFERENCE on Developments, Advances & Trends in Engineering Sciences (NCDATES09 th & 10 th January 2015) CMR Engineering College 39|P a g e perform duplicate check in private cloud. A new deduplication system supporting differential duplicate check is proposed under this hybrid cloud architecture where the S-CSP resides in the public cloud. The user is only allowed to perform the duplicate check for files marked with the corresponding privileges. Finally, we implement a prototype of the proposed authorized duplicate check and conduct tested experiments to evaluate the overhead of the prototype and show that the overhead is minimal compared to the normal convergent encryption. In this section, we first define the notations used in this paper, review some secure primitives used in our secure deduplication. Symmetric encryption. Symmetric encryption uses a common secret key to encrypt and decrypt information. A symmetric encryption scheme consists of three Primitive functions:  KeyGenSE(1_) ! κ is the key generation algorithm that generates κ using security parameter 1;  DecSE(κ,C) ! M is the symmetric decryption algorithm that takes the secret κ and ciphertext C and then outputs the original message M.   EncSE(κ,M) ! C is the symmetric encryption algorithm that takes the secret κ and message M and then outputs the ciphertext C. Convergent encryption. Convergent encryption [3], [4] provides data confidentiality in deduplication. A data owner derives a convergent key from each original data copy and encrypts the data copy with the convergent key.  KeyGenCE(M) ! K is the key generation algorithm that maps a data copy M to a convergent key K  EncCE(K,M) ! C is the symmetric encryption algorithm that takes both the convergent key K and the data copy M as inputs and then outputs a ciphertext C.   DecCE(K,C) ! M is the decryption algorithm that takes both the ciphertext C and the convergent key K as inputs and then outputs the original data copy M; and  TagGen(M) ! T(M) is the tag generation algorithm that maps the original data copy M and outputs a tag T(M).  DecSE(κ,C) ! M is the symmetric decryption algorithm that takes the secret κ and ciphertext C and then outputs the original message M. Proof of ownership. The notion of proof of ownership (PoW) [2] enables users to prove their ownership of data copies to the storage server. However PoW is implemented as an interactive algorithm (denoted by PoW) run by a prover (i.e., user) and a verifier (i.e.storage server). Identification Protocol. An identification protocol can be described with two phases: Proof and Verify. In the stage of Proof, a prover/user U can demonstrate his identity to a verifier by performing some identification proof related to his identity. The input of the prover/user is his private key skU that is sensitive information such as private key of a public key in his certificate or credit card number etc. that he would not like to share with the other users. SYSTEM ARCHITECTURE: System Model 3.1 Hybrid Architecture for Secure Deduplication At a high level, our setting of interest is an enterprise network, consisting of a group of affiliated clients (for example, employees of a company) who will use the S-CSP and store data with deduplication technique. The S-CSP performs deduplication by checking if the contents of two files are the same and stores only one of them. Each privilege is represented in the form of a short message called token. Each file is associated with some file tokens, which denote the tag with specified privileges. Role of the private cloud server will be explained in the paper. block-level deduplication can be easily deduced from file-level deduplication, which is similar to [5]. Specifically, to upload a file, a user first performs the file-level duplicate check. If the file is a duplicate, then all its blocks must be duplicates as well. International Journal of Engineering Research and Applications (IJERA) ISSN: 2248-9622 NATIONAL CONFERENCE on Developments, Advances & Trends in Engineering Sciences (NCDATES09 th & 10 th January 2015) CMR Engineering College 40|P a g e S-CSP. This is an entity that provides a data storage service in public cloud. The S-CSP provides the data outsourcing service and stores data on behalf of the users.  Data Users. A user is an entity that wants to outsource data storage to the S-CSP and access the data later. In a storage system supporting deduplication, the user only uploads unique data but does not upload any duplicate data to save the upload bandwidth, which may be owned by the same use or different users. Every single file is protected with the convergent encryption key and privilege keys to realize the authorized deduplication with differential privileges.  Private Cloud. Compared with the traditional deduplication architecture in cloud computing, this is a new entity introduced for facilitating user’s secure usage of cloud service. Private Keys are managed by private cloud in order to give them privileges as per their designation. 3.2 Design Goals We have proposed a new deduplication system for the following:  Differential Authorization. Each authorized user is able to get his/her individual token of his file to perform duplicate check based on his privileges. Under this assumption, any user cannot generate a token for duplicate check out of his privileges or without the aid from the private cloud server.  Authorized Duplicate Check. Authorized user is able to use his/her individual private keys to generate query for certain file and the privileges he/she owned with the help of private cloud, while the public cloud performs duplicate check directly and tells the user if there is any duplicate.  Unforgeability of file token/duplicatecheck token. Unauthorized users without appropriate privileges or file should be prevented from getting or generat