Secure retrieval of cloud-based sensitive data by obfuscating data access patterns
Cloud-based data is securely retrieved by obfuscating access patterns. A cloud storage system receives a request for data from a remote client that specifies a key. Thereafter, the cloud storage system iterates through an index to identify all locations corresponding to the specified key. Such index is generated by applying a series of j hash functions to each key resulting in a j different tables forming part of the index. Using the index, the cloud storage system returns data from the identified locations to the client. As each write operation works by using non-deterministic encryption, the write operation changes the records stored in this data structure, and when the record is not changed, the algorithm simply rewrites the data which is stored in the data structure by rewriting the same value back again. However since, a nondeterministic encryption is utilized, it makes it indistinguishable as to when new data was written and when existing data is rewritten.
1. A method for securely retrieving cloud-based data by obfuscating access patterns, the method comprising:
receiving, by a cloud storage system from a remote client, a request for data, the request including a key of a plurality of keys;
iterating, by the cloud storage system, an index to identify all data value locations corresponding to the key included in the request, the index being generated by applying a series of j hash functions to each key of the plurality of keys resulting in a j different tables forming part of the index; and
returning, by the cloud storage system to the client and based on the iterating, data from the identified value locations;
decrypting and re-encrypting any memory locations implicated by the request using at least one non-deterministic encryption algorithm which causes the stored data at such memory locations of the cloud system to change, the stored data being made indistinguishable as to when new data is written and when existing data is rewritten.
2. The method of claim 1 , wherein each location within the index stores a count of keys mapping to such location.
3. The method of claim 2 , wherein each location within the index further stores a sum field specifying a sum of the keys, the sum field being encrypted.
4. The method of claim 3 , wherein each location within the index further comprises a sum of values corresponding to the keys, the sum of values being encrypted.
5. The method of claim 4 , wherein each location within the index further comprises a sum field containing a sum of the corresponding hash of the key, the sum field being encrypted.
6. The method of claim 5 , wherein each location within the index further comprises a sum of the value, the sum of the value being encrypted.
7. A system for securely retrieving cloud-based data by obfuscating access patterns, the system comprising:
at least one data processor; and
memory storing instructions which, when executed by at least one data processor, result in operations comprising:
receiving, by a cloud storage system from a remote client, a request for data, the request including a key of a plurality of keys;
iterating, by the cloud storage system, an index to identify all data value locations corresponding to the key included in the request, the index being generated by applying a series of j hash functions to each key of the plurality of keys resulting in a j different tables forming part of the index; and
returning, by the cloud storage system to the client and based on the iterating, data from the identified value locations;
decrypting and re-encrypting any memory locations implicated by the request using at least one non-deterministic encryption algorithm which causes the stored data at such memory locations of the cloud system to change, the stored data being made indistinguishable as to when new data is written and when existing data is rewritten.
8. The system of claim 7 , wherein each location within the index stores a count of keys mapping to such location.
9. The system of claim 8 , wherein each location within the index further stores a sum field specifying a sum of the keys, the sum field being encrypted.
10. The system of claim 9 , wherein each location within the index further comprises a sum of values corresponding to the keys, the sum of values being encrypted.
11. The system of claim 10 , wherein each location within the index further comprises a sum field containing a sum of the corresponding hash of the key, the sum field being encrypted.
12. The system of claim 11 , wherein each location within the index further comprises a sum of the value, the sum of the value being encrypted.
13. A non-transitory computer program product for securely retrieving cloud-based data by obfuscating access patterns, the computer program product storing instructions which, when executed by at least one data processor forming part of at least one computing device, result in operations comprising:
receiving, by a cloud storage system from a remote client, a request for data, the request including a key of a plurality of keys;
iterating, by the cloud storage system, an index to identify all data value locations corresponding to the key included in the request, the index being generated by applying a series of j hash functions to each key of the plurality of keys resulting in a j different tables forming part of the index; and
returning, by the cloud storage system to the client and based on the iterating, data from the identified value locations;
decrypting and re-encrypting any memory locations implicated by the request using at least one non-deterministic encryption algorithm which causes the stored data at such memory locations of the cloud system to change, the stored data being made indistinguishable as to when new data is written and when existing data is rewritten.
14. The computer program product of claim 13 , wherein each location within the index stores a count of keys mapping to such location.
15. The computer program product of claim 14 , wherein each location within the index further stores a sum field specifying a sum of the keys, the sum field being encrypted.
16. The computer program product of claim 15 , wherein each location within the index further comprises a sum of values corresponding to the keys, the sum of values being encrypted.
17. The computer program product of claim 16 , wherein each location within the index further comprises a sum field containing a sum of the corresponding hash of the key, the sum field being encrypted; and wherein each location within the index further comprises a sum of the value, the sum of the value being encrypted.