# Coupling Secret Sharing with Decentralized Server-Aided Encryption in Encrypted Deduplication
## 6 Related Work  
**Decentralized server-aided encryption in encrypted deduplication:** MLE-based encrypted deduplication are widely deployed in outsourced storage. Traditional encrypted deduplication storage systems realize the MLE construction via convergent encryption (CE), which is vulnerable to offline brute-force attacks. DupLESS proposes server-aided MLE to perform MLE key generation in a dedicated key server to defend against offline brute-force attacks. Follow-up studies enhance server-aided MLE with decentralized key generation. For example, [PERSON] [33] leverages RSA-based threshold signatures and generate convergence keys among multiple users to address single node failure and key leakage issues via eliminating centralized key servers. [PERSON] et al. [7] allow each key server to independently generate keys and calculate shared the keys to all other key servers via blind signature. GDH-Dedup is based on the Gap-Diffie-Hellman (GDH) group. It reduces the computational overhead by solving the decisional Diffie-Hellman problem, which is considered to be equivalent to the computational Diffie-Hellman problem, considered difficult in cryptography.  
However, all the above implementations of decentralized server-aided encryption build on expensive cryptographic primitives and incur high computational overhead or communication overhead. In this paper, we are the first to apply secret sharing to share the keys among decentralized key servers and achieve efficient decentralized server-aided encryption.  
**Secret sharing:** Secret sharing is first formalized by [PERSON] [34] to provide security and reliability for shared data. [PERSON]'s secret sharing scheme (SSSS) can be considered as Reed-Solomon (RS) codes, which encode \(k\) shares (including one data share and \(k-1\) random shares) into \(n\) shares to ensure the data confidentiality of the shared data. Ramp secret-sharing scheme (RSSS) [35] improves the storage efficiency atop SSSS via dividing a secret into \(k-r\) pieces and generate \(r\) additional random pieces for fault tolerance and security. [PERSON] [36] uses RSSS to disperse and store the convergent keys of data blocks in multiple key storage servers, which ensures the reliability of the keys while reducing the storage overhead of the keys. AONT-RS [15] combines [PERSON]'s all-or-nothing transform (AONT) [16] for confidentiality and RS codes for fault tolerance to further improve the storage efficiency while maintaining the highest confidentiality as SSSS. CAONT-RS [14]  
Figure 11: Exp 6: Comparison of upload and download performance of different encryption schemes.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Upload Time (s)** & **Download Time (s)** & **Verification Time (ms)** \\ \hline ECDedup & 79.05 & 67.86 & 9 \\ \hline \hline \end{tabular}
\end{table}
Table 3: Exp 7: Time breakdown of ECDedup on RDB dataset.  
uses a deterministic to replace the random key used in AONT-RS to enable deduplication on shared data.  
However, existing secret-sharing schemes only consider sharing data or keys among distributed servers. In this paper, we are the first to leverage secret sharing to realize decentralized server-aided encryption, aiming to achieve better performance and ensure data confidentiality.