Encrypted deduplication is attractive because it can provide high storage efficiency while protecting data privacy. Most existing schemes achieve encrypted deduplication against brute-force attacks (BFAs) based on server-aided encryption. Unfortunately, the centralized key server in server-aided encryption can potentially become a single point of failure. To this end, distributed server-aided encryption is presented, which splits a system-level master key into multiple shares and distributes them across several key servers. However, it is hard to improve security and scalability with this method simultaneously.This paper presents a secure and scalable encrypted deduplication scheme ScalaDep. ScalaDep achieves a new design paradigm centered on location-hiding secret sharing of data keys. As the number of deployed key servers increases, the attack cost of adversaries increases while the number of requests handled by each key server decreases, enhancing both scalability and security. Furthermore, we propose a two-phase duplicate detection method for our paradigm, which utilizes short hashes and key identifiers to achieve secure duplicate detection against BFAs. Additionally, based on the allreduce algorithm, ScalaDep enables all key servers to collaboratively record the number of client requests and resist online BFAs by enforcing rate limiting. Security analysis and performance evaluation demonstrate the security and efficiency of ScalaDep.

Individuals and companies increasingly adopt encrypted deduplication systems for their enhanced security and efficiency benefits. Server-aided encrypted deduplication systems are the state-of-the-art scheme to resist brute-force attacks. However, it is overly reliant on a single centralized key server and vulnerable to a single point of failure. To this end, existing schemes have implemented distributed key servers based on secret sharing of the master key to resist a single point of failure. Nevertheless, this design has some inherent limitations in balancing security and scalability. Secret sharing of the master key effectively mitigates single points of failure, while negatively impacting system scalability. To address the above limitations, we propose a scalable client-side encrypted deduplication with distributed key servers based on secret sharing of the data key. To resist brute-force attacks, we also design a double-layer matching mechanism to achieve secure and effective duplicate check and key delivery. Additionally, drawing inspiration from random oracle models, we put forward a pseudo-random response strategy for key servers to safeguard key privacy effectively. Rigorous theoretical analysis and extensive experiments demonstrate that our scheme achieves both security and scalability, which is well-suited for deployment in large-scale systems and offers robust protection against a single point of failure.

It is non-trivial to provide semantic security for user data while achieving deduplication in cloud storage. Some studies deploy a trusted party to store deterministic tags for recording data popularity, then provide different levels of security for data according to popularity. However, deterministic tags are vulnerable to offline brute-force attacks. In this paper, we first propose a popularity-based secure deduplication scheme with fully random tags, which avoids the storage of deterministic tags. Our scheme uses homomorphic encryption (HE) to generate comparable random tags to record data popularity and then uses the binary search in the AVL tree to accelerate the tag comparisons. Besides, we find the popularity tamper attacks in existing schemes and design a proof of ownership (PoW) protocol against it. To achieve scalability and updatability, we introduce the multi-key homomorphic proxy re-encryption (MKH-PRE) to design a multi-tenant scheme. Users in different tenants generate tags using different key pairs, and the cross-tenant tags can be compared for equality. Meanwhile, our multi-tenant scheme supports efficient key updates. We give comprehensive security analysis and conduct performance evaluations based on both synthetic and real-world datasets. The results show that our schemes achieve efficient data encryption and key update, and have high storage efficiency.

The encrypted deduplication can provide both storage savings and data confidentiality for cloud storage systems. Convergent encryption (CE) is a well-known solution for encrypted deduplication, but it brings huge computation and storage overheads for key management. MinHash encryption is an effective solution to this issue. It reduces the number of keys by grouping multiple consecutive chunks into segments and generating one key for each segment. However, MinHash encryption does not take full advantage of the segment similarity, which can be used to further reduce the overhead for key management. To this end, we augment MinHash encryption with Bloom filter and Locality Sensitivity Hash (LSH) to design an enhanced MinHash encryption scheme. Firstly, our scheme generates a sketch for each segment based on the Bloom filter, and projects sketches to the points in a hash table through LSH functions. Secondly, we detect the segment similarity by the distance between points, and similar segments are grouped into super-segments. Finally, we combine MinHash encryption and server-aided message-locked encryption to encrypt the super-segments for achieving encrypted deduplication. We conduct trace-driven experiments using a realworld dataset. Compared with MinHash encryption, our scheme has higher storage efficiency and better encryption performance.

App repackaging has raised serious concerns to the Android ecosystem with the repackage-proofing technology attracting attention in the Android research community. In this article, we first show that existing repackage-proofing schemes rely on a flawed security assumption, and then propose a new class ofactive warden attackthat intercepts and falsifies the metrics used by repackage-proofing for detecting the integrity violations during repackaging. We develop a proof-of-concept toolkit to demonstrate that all the existing repackage-proofing schemes can be bypassed by our attack toolkit. On the positive side, our analysis further identifies a new integrity metric in the Android ART runtime that can robustly and efficiently indicate bytecode tampering caused by either repackaging or active warden attacks. By associating this new metric with two supplemental verification mechanisms, we construct a multi-party verification framework that significantly raises the bar of repackage-proofing and identify conditions under which the proposed framework could detect app repackaging without getting compromised by active warden attacks.

It is difficult to provide semantic security for user data while using deduplication to save storage space in cloud storage. Some studies attempt to provide different levels of security for data according to their popularity for a reasonable trade-off between security and efficiency. However, existing schemes generally need a trusted third party to store deterministic data tags to record data popularity. If the trusted third party is compromised by adversaries, the deterministic tags will expose data information. In this paper, we propose a popularity-based secure deduplication scheme with fully random tags, which does not need to store deterministic tags. Our solution is using the homomorphic encryption to generate comparable random tags to record data popularity and using binary search to reduce time complexity of tag comparison to logarithmic time. Besides, we also design a proof of ownership protocol based on homomorphic encryption to prevent adversaries with only the data tag from tampering with the data popularity, which are not considered in the existing popularity-based schemes. We implement our scheme for system efficiency evaluation. Compared with the scheme of Stanek et al., our scheme has a slight improvement in encryption efficiency.