# Secure and Efficient Deduplication for Cloud Storage with Dynamic Ownership Management
## 5 The Proposed Secure Deduplication Protocol
### Ownership Delete  
Clients belonging to the owner group of the data can access the source data. If clients desire to delete the data and revoke ownership, they can initiate this process by sending a request to the CS at any time. In cases where there is a change in group information, it becomes imperative to update the group key and re-encrypted data. This is performed to prevent clients who have previously deleted their ownership from retaining access to the data, ensuring the security and integrity of data management. The process of deleting ownership is as follows:  
**Step 1. **: **Request ownership revocation. ** A client sends an ownership release request to the CS. * The client \(i\) submits an ownership revocation request to the CS, which includes \(h(M)^{\prime}\), \(r_{i}\), and \(GK^{\prime}_{N}\). The hash value \(h(M)^{\prime}\) specifies which data are owned. The random value \(r_{i}\) informs the client of who it is. The group key \(GK^{\prime}_{N}\) means that the client belongs to session \(N\) in progress. The small quotation mark \((^{\prime})\) on the values sent by the client visually indicates whether they match the values stored in the CS and the cloud storage. **Step 2. **: **Check ownership. ** The CS checks the client's ownership,  
* The CS checks whether \(h(M)^{\prime}\) and \(r_{i}\) are stored in the \(ACL\). If both \(h(M)^{\prime}\) and \(r_{i}\) are provided, the CS proceeds with the ownership deletion process. However, if either \(h(M)^{\prime}\) or \(r_{i}\) is missing, the CS sends an error message to the client. In cases where the client is the last owner of \(h(M)^{\prime}\) stored in \(ACL\), the CS additionally sends a group-key delete request to the cloud storage, ensuring proper data management and security. If the client is the last owner of the \(h(M)^{\prime}\) stored in the \(ACL\), the CS will also send a group key delete request to the cloud storage. * The CS sends a download request to the cloud storage, which includes \(h(M)^{\prime}\), \(GK^{\prime}_{N}\). The hash value \(h(M)^{\prime}\) is crucial for identifying information stored in the \(CTL\) of the cloud storage. The group key \(GK^{\prime}_{N}\) serves the purpose of decrypting the re-encrypted data in the cloud storage. **Step 3. Check group key. ** The cloud storage checks the client's group key. * The cloud storage performs a check to determine whether the stored group key \(GK_{N}\) matches the \(GK_{N}^{\prime}\) received from the CS. If these values match, the cloud storage sends a group key authentication success message to the CS. Otherwise, the cloud storage sends an error message to the CS. **Step 4. Revoke ownership. ** The CS revokes the client's ownership in \(ACL\). * If the message received from the cloud storage is successful, the CS removes the \(r_{i}\) from the \(ACL\), then forwards the results to the client. Conversely, in case of a failure message, an error message is sent to the client. **Step 5. Re-encrypt data. ** The cloud storage recreates re-encrypted data. After the completion of client \(i\)'s ownership revocation, two distinct scenarios emerge. 1. First, if remaining owners exist, the group key for the other owners is updated. * The cloud storage generates a group key, denoted as \(GK_{N+1}\), by encrypting the results of XOR operations on \(h(M)\) and session \((N+1)\) with the cloud storage's \(SK_{\mathbb{C}}\). * The cloud storage generates a distribution key \(RGK\), designed for the remaining owners. The \(RGK\) created in this process is referred to as \(RGK_{other}\). * The cloud storage sends \(RGK_{other}\) to the CS to request it to be sent to the data owner. 2. Second, if there are no remaining owners, all information stored in the cloud storage and the CS at \(h(M)\) is deleted. * The cloud storage deletes all data to optimize storage efficiency. * The cloud storage notifies the CS that all information regarding \(h(M)^{\prime}\) has been erased. **Step 6. Send refreshed group key. ** The CS sends the group key to the client based on the \(ACL\)\((h(M),r_{n})\).