Proofs of ownership in remote storage systems

Cloud storage systems are becoming increasingly popular. A promising technology that keeps their cost down is deduplication, which stores only a single copy of repeating data. Client-side deduplication attempts to identify deduplication opportunities already at the client and save the bandwidth of uploading copies of existing files to the server. In this work we identify attacks that exploit client-side deduplication, allowing an attacker to gain access to arbitrary-size files of other users based on a very small hash signatures of these files. More specifically, an attacker who knows the hash signature of a file can convince the storage service that it owns that file, hence the server lets the attacker download the entire file. (In parallel to our work, a subset of these attacks were recently introduced in the wild with respect to the Dropbox file synchronization service.) To overcome such attacks, we introduce the notion of proofs-ofownership (PoWs), which lets a client ef�...

• Type: Journal
• Year: 2011
• Where: CCS
• Authors: Shai Halevi, Danny Harnik, Benny Pinkas, Alexandra Shulman-Peleg
• Keywords: CCS 2011, Deduplication, Performance Measurements, Security Privacy, Synchronization Service