LT Codes-based Secure and Reliable Cloud Storage Service

Transcription

1 2012 Proceedings IEEE INFOCOM LT Codes-based Secure and Reiabe Coud Storage Service Ning Cao Shucheng Yu Zhenyu Yang Wenjing Lou Y. Thomas Hou Worcester Poytechnic Institute, Worcester, MA, USA University of Arkansas, Litte Rock, AR, USA Amazon Web Services LLC, Seatte, WA, USA Virginia Poytechnic Institute and State University, VA, USA Abstract With the increasing adoption of coud computing for data storage, assuring data service reiabiity, in terms of data correctness and avaiabiity, has been outstanding. Whie redundancy can be added into the data for reiabiity, the probem becomes chaenging in the pay-as-you-use coud paradigm where we aways want to efficienty resove it for both corruption detection and data repair. Prior distributed storage systems based on erasure codes or network coding techniques have either high decoding computationa cost for data users, or too much burden of data repair and being onine for data owners. In this paper, we design a secure coud storage service which addresses the reiabiity issue with near-optima overa performance. By aowing a third party to perform the pubic integrity verification, data owners are significanty reeased from the onerous work of periodicay checking data integrity. To competey free the data owner from the burden of being onine after data outsourcing, this paper proposes an exact repair soution so that no metadata needs to be generated on the fy for repaired data. The performance anaysis and experimenta resuts show that our designed service has comparabe storage and communication cost, but much ess computationa cost during data retrieva than erasure codes-based storage soutions. It introduces ess storage cost, much faster data retrieva, and comparabe communication cost comparing to network coding-based distributed storage systems. I. INTRODUCTION The many advantages of coud computing are increasingy attracting individuas and organizations to move their data from oca to remote coud servers [1]. In addition to major coud infrastructure providers [2], such as Amazon, Googe, and Microsoft, more and more third-party coud data service providers are emerging which are dedicated to offering more accessibe and user friendy storage services to coud customers. Exampes incude Dropbox [3] which aready has miions of users. It is a cear trend that coud storage is becoming a pervasive service. Aong with the widespread enthusiasm on coud computing, however, concerns on data security with coud storage are arising due to unreiabiity of the service. For exampe, recenty more and more events on coud service outage or server corruption with major coud service providers are reported [4], [5], be it caused by Byzantine faiures and/or maicious attacks. Such a reaity demands for reiabe data storage to toerate certain outage/corruption. In particuar, the coud storage service shoud offer coud customers with capabiities of: 1) timey detection of any server (and hence data) corruption event, 2) correct retrieva of data even if a imited number of servers are corrupted, and 3) repair of corrupted data from uncorrupted data. Athough existing techniques have provided soutions for them individuay, the main chaenge for coud storage service is to simutaneousy provide these capabiities at minima cost. This is because in coud computing both data storage and transmission are charged in the pay-as-you-use manner. Soutions of high cost wi discourage user engagement and be of ess practica use. Moreover, it is important to set coud customers free by minimizing the compexity imposed on them in terms of computation/communication cost and burden of being onine. Existing soutions address the reiabiity issue by adding data redundancy to mutipe servers. These techniques can be categorized into repication-based soutions and erasure codes-based ones. Data repication is the most straightforward way of adding redundancy. The advantage of repication is its simpicity in data management. Repair of data on corrupted servers is aso straightforward by simpy copying the entire data from a heathy server. The main drawback of repication is its high storage cost. Moreover, repication-based soutions cannot satisfy the high-throughput requirement in distributed storage service ike coud computing, where a arge number of users may access the service concurrenty. This is because different users may want to access different pieces of data on a server, which woud cause ess cache hits but frequent disk I/O requests. [6] provides a detaied anaysis on this drawback. As compared to its repication-based counterparts, erasure codes-based soutions can achieve the required reiabiity eve with much ess data redundancy [7]. Different from repication-based soutions, erasure codes-based ones are more suitabe for distributed storage systems with concurrent user access. This is because every bock of data on a server is usefu for decoding the origina data, which eads to a high cache hit rate of the system. There have been a arge number of reated works on erasure codes-based distributed storage systems [6], [8], [9]. The main drawback of existing optima erasure codes-based systems, however, is the high communication cost needed for repairing a corrupted storage server. It is commony beieved that the communication cost is equa to the size of the entire origina data [10]. For exampe, Reed-Soomon codes [11] usuay need to reconstruct a the origina packets in order to generate a fragment of encoded packets. Taking into consideration the arge amount of data outsourced, the entire /12/$ IEEE 693

2 data reconstruction is expensive which makes this soution ess attractive. Simiary, existing distributed storage systems based on near-optima erasure codes [6] do not have an efficient soution for the data repair probem or pay no attention to it. Recenty Chen et a. [12] proposed a network codingbased storage system which provides a decent soution for efficient data repair. This scheme, based on previous work [10], [13] [15], reduces the communication cost for data repair to the information theoretic minimum. This is achieved by recoding encoded packets in the heathy servers during the repair procedure. However, as network coding utiizes Gaussian eimination for decoding, the data retrieva in terms of computation cost is more expensive than erasure codesbased systems. Moreover, [12] adopts so-caed functiona repair for data repair, i.e., corrupted data is recovered to a correct form, but not the exact origina form. Whie this is good for reducing data repair cost, it requires the data owner to produce new verification tags, e.g., cryptographic message authentication code, for newy generated data bocks. As the computationa cost of generating verification tags is inear to the number of data bocks, this design wi inevitaby introduce heavy computation/communication cost on the data owner. Moreover, the data owner has to stay onine during data repair. In this paper, we expore the probem of secure and reiabe storage in the pay-as-you-use coud computing paradigm, and design a coud storage service with the efficiency consideration of both data repair and data retrieva. By utiizing a nearoptima erasure codes, specificay LT codes, our designed storage service has faster decoding during data retrieva than existing soutions. To minimize the data repair compexity, we empoy the exact repair method to efficienty recover the exact form of any corrupted data. Such a design aso reduces the data owner s cost during data repair since no verification tag needs to be generated (od verification tags can be recovered as data recovery). By enabing pubic integrity check, our designed LT codes based secure coud storage service (LTCS) competey reeases the data owner from the burden of being onine. Our contributions are summarized as foows, 1) We are among the first to expore the probem of secure and reiabe coud storage with the efficiency consideration for both data repair and data retrieva. 2) Our proposed coud storage service provides a better overa efficiency of data retrieva and repair than existing counterparts. It aso greaty reduces cost and burden of being onine for the data owner by enabing pubic integrity check and exact repair. 3) The advantages of our proposed service are vaidated via both numerica anaysis and experimenta resuts. II. PROBLEM FORMULATION A. The System Mode Considering a coud data storage service which provides both secure data outsourcing service and efficient data retrieva and repair service, incuding four different entities: the data owner, the data user, the coud server, and the third party server. The data owner outsources the encoded fragments of the fie M to n coud servers denoted as storage servers. If the data owner requires to keep the data content confidentia, the fie M can be first encrypted before encoding. Outsourced data are attached by some metadata ike verification tags to provide integrity check capabiity. After the data outsourcing, a data user can seect any k storage servers to retrieve encoded segments, and recover the fie M, which can be further decrypted in case the fie is encrypted. Meanwhie, the third party server periodicay checks the integrity of data stored in coud servers. Faied coud servers can be repaired with the hep of other heathy coud servers. B. The Threat Mode The coud server is considered as curious-and-vunerabe. Specificay, the coud server is vunerabe to Byzantine faiures and externa attacks. Whie Byzantine faiures may be made by hardware errors or the coud maintenance personne s misbehaviors, externa attacks coud be ranging from natura disasters, ike fire and earthquake, to adversaries maicious hacking. After the adversary gains the contro of the coud server, it may aunch the poution attack or the repay attack which aims to break the inear independence among encoded data, by repacing the data stored in corrupted coud server with od encoded data. If the coud server is not corrupted, it correcty foows the designated protoco specification, but it wi try to infer and anayze data in its storage and interactions during the protoco execution so as to earn additiona information. This represents a threat to the privacy of coud users data stored on the server. C. Design Goas To provide secure and reiabe coud data storage services, our design shoud simutaneousy achieve performance guarantees during data retrieva and repair. Avaiabiity and Reiabiity: By accessing any kcombination of n storage servers, the data user coud successfuy retrieve encoded data and recover a the o- rigina data. The data retrieva service remains functiona when up to n k storage servers are corrupted in one round, and corrupted servers can be repaired from other heathy servers. Security: The designed storage service protects the data confidentiaity and periodicay checks the integrity of data in coud servers to prevent data dropout or corruption. Offine Data Owner: Data owners can go offine immediatey after data outsourcing, which means they are not required to be invoved in tasks such as data integrity check and repair at a ater stage. Efficiency: Above goas shoud be achieved with ow storage, computation and communication cost for the data owner, data users and coud servers. D. Notations M : the outsourced fie, consisting of m origina packets, M =(M 1,...,M m ). 694

3 S :the-th storage server, 1 n. C i :thei-th encoded packet stored in the -th storage server, 1 i α. Δ i : the coding vector of the encoded packet C i. φ : the coding tag, used to verify a the coding vectors Δ i in S. φ i : the retrieva tag, used to verify C i in the retrieva and repair. σ ij : the verification tag, used to verify C i in the integrity check, 1 j t. E. Preiminary on LT Codes LT codes [16] has a typica property that the encoding procedure can generate unimited number of encoded packets, each of which is generated by conducting bitwise XOR operation on a subset of origina packets. LT codes can recover m origina packets from any m + O( m n 2 (m/δ)) coded packets with probabiity 1 δ. The decoding procedure is performed by the efficient Beief Propagation decoder [17] with compexity O(m n(m/δ)). Code degree d is defined as the number of origina packets that are combined into one coded packet. In LT codes, the distribution of code degree is defined by Idea Soiton distribution or Robust Soiton distribution. The Idea Soiton distribution is ρ(i), i.e., P {d = i}, where m i=1 ρ(i) =1and { 1/m if i =1 ρ(i) =P {d = i} = 1/i(i 1) if i =2,...,m. (a) Repication (b) Optima Erasure codes Robust Soiton distribution is μ(i), where μ(i) = (ρ(i) + τ(i))/β and β = m i=1 ρ(i)+τ(i). LetR = c n(m/δ) m, and define τ(i) as foows, R/im if i =1,...,m/R 1 τ(i) = R n(r/δ)/m if i = m/r 0 if i = m/r +1,...,m. III. LTCS: DESIGN RATIONALE A. Enabing Reiabiity and Avaiabiity To ensure the data reiabiity in distributed storage systems, various data redundancy techniques can be empoyed, such as repication, erasure codes, and network coding. Repication as shown in Fig. 1(a) is the most straightforward way of adding data redundancy where each of n storage servers stores a compete copy of the origina data. Data users can retrieve the origina data by accessing any one of the storage servers, and the corrupted server can be repaired by simpy copying the entire data from a heathy server. Given the same eve of redundancy, the optima erasure codes based distributed storage system as shown in Fig. 1(b) is more reiabe by many orders of magnitude than the repication-based system [7]. Data users can recover the entire m origina packets by retrieving the same number of encoded packets from any k-combination of n servers, and therefore every server ony needs to store m/k encoded packets which is regarded as the property of optima redundancy-reiabiity (c) Network coding Fig. 1: Distributed storage systems based on different redundancy techniques. tradeoff. However, its quadratic decoding compexity makes it very inefficient for data users to recover data during data retrieva. Moreover, the communication cost to repair a faied storage server is equa to the size of the entire origina data in the optima erasure codes-based distributed storage system [10], [15]. For exampe, as a typica optima erasure codes, Reed-Soomon codes [11] usuay need to reconstruct a the origina packets in order to generate a fragment of encoded packets. In other words, one has to retrieve m encoded 695

4 Data avaiabity (%) # of repairs Fig. 2: Data avaiabity after functiona repair as in LTNC. packets in order to generate ony m/k encoded packets for the corrupted server. Network coding-based storage codes [10], [13] [15] reduce the repair communication cost to the information theoretic minimum by combining encoded packets in the heathy servers during the repair procedure, where ony m/k recoded packets are needed to generate the corrupted m/k encoded packets. Each server needs to store 2m/(k +1) encoded packets, which is more than optima erasure codes, to guarantee that data users can retrieve m ineary independent encoded packets from any k-combination of n servers. Besides, the network coding-based storage codes have the simiar inefficient decoding probem as optima erasure codes due to the utiization of Gaussian eimination decoder. To meet the efficient decoding requirement in the coud data storage scenario where the data owner outsources huge amount of data for sharing with data users, our design is based on the near-optima erasure codes, specificay LT codes, to store ow-compexity encoded packets over n distributed servers. The fast Beief Propagation decoding for LT codes can be used during data retrieva in our LT codes based secure coud storage service (LTCS). Data users can efficienty recover a the m of origina packets from any m(1 + ε) encoded packets which can be retrieved from any k-combination of n servers. To achieve so, every server needs to store at east m(1 + ε)/k encoded packets which is arger than the erasure codes but smaer than the network coding based storage codes. B. Reducing Maintenance Cost To prevent data dropout or corruption, the integrity of data stored in each server needs to be periodicay checked. In [12], the data owner raises a chaenge for every encoded packet to coud servers. Taking into consideration the arge number of encoded packets with substantia data redundancy in coud servers, the cost of such private integrity check is somehow burdensome in terms of both computation and communication for data owners. LTCS utiizes the pubic integrity verification which enabes the data owner to deegate the integrity check task to a third party server. Once there is a server faiing to pass the integrity check, the third party server immediatey reports it to the administrator of the coud server who wi then activate the repair process. The repair task in our LT codes based storage service is accompished by generating the exacty same packets as those previousy stored in corrupted storage servers. Such repair method does not introduce any additiona inear dependence among newy generated packets and those packets stored in heathy storage servers, and therefore maintains the data avaiabiity. Furthermore, we run the decoding over the encoded packets before outsourcing to guarantee the reiabe data retrieva and recovery. Unike the exact repair in our designed service, the functiona repair is the other category of data repair, where the repair procedure generates correct encoded packets, but not the exacty same packets as those corrupted. Attempts to appy functiona repair in the LT codes based distributed storage shoud first sove how to recode packets, because the random inear recoding in the functiona repair of network coding-based storage codes cannot satisfy the degree distribution in LT codes. It seems that this probem can be soved by utiizing the recenty proposed LT network codes (LTNC) which provides efficient decoding at the cost of sighty more communication in the singe-source broadcasting scenario [18]. However, after severa rounds of repair with same recoding operations reguated in LT network codes, data users experience decoding faiure with high probabiity, as iustrated in Fig. 2, where data avaiabiity is the probabiity that data users coud recover origina data from any k-combination of n storage servers. The major reason is that recoding operations with the degree restriction in LT network codes introduce innegectabe inear dependence among recoded packets and existing packets in LT codes based storage service. Therefore, the functiona repair is not suitabe for LT codes-based storage service. C. Offine Data Owner In the repair procedure, network coding-based storage systems with functiona repair generate new encoded packets to substitute corrupted data in the faied server. The data owner needs to stay onine for generating necessary tags for these new packets [12]. In LTCS, a newy generated packets for the corrupted storage server in the repair procedure are exacty the same as od ones previousy stored in the server, which means their corresponding metadata are aso same. Like the distributed storage of data packets, these metadata can be stored in mutipe servers and recovered in case of repairing corrupted servers. The repication or erasure codes (ike Reed- Soomon codes) can be adopted to reiaby backup these metadata. Hence, without the burden of generating tags and checking integrity, the data owner can stay offine immediatey after outsourcing the data which makes LTCS more practica to be depoyed in the coud paradigm. IV. LTCS: THE PROPOSED SECURE AND RELIABLE CLOUD STORAGE SERVICE In this section, we present the LT codes-based secure and reiabe coud storage service (LTCS), where n storage servers {S } 1 n are utiized to provide the data storage service for 696

5 data owner and data users. Our data integrity technique is partiay adapted from the BLS signature in POR [19]. A. Setup Let e : G G G T be a biinear map, where g is the generator of G, with a BLS hash function H : {0, 1} G. The data owner generates a random number η Z p and s random numbers u 1,...,u s G. The secret key sk is {η}, and the pubic key is pk = {u 1,...,u s,v}, where v g η. B. Data Outsourcing The data outsourcing is to pre-process data and distribute them to mutipe coud servers. The fie M is first equay spit into m origina packets, M 1,...,M m, with the same size of M m bits. Foowing the Robust Soiton degree distribution in LT codes, m origina packets are combined by excusive-or (XOR) operations to generate nα encoded packets, where α is the number of packets outsourced to each storage server and set to m/k (1 + ε). For protecting data confidentiaity, sensitive data coud be encrypted before the encoding process. Existing data access contro mechanisms [20] can be empoyed to prevent the coud server from prying into outsourced data. According to LT codes, a the m origina packets can be recovered from any m(1 + ε) of encoded packets with probabiity 1 δ by on average O(m n(m/δ)) packet operations. However, the avaiabiity requirement specifies that data recovery shoud be aways successfu by accessing any k of heathy storage servers. To achieve this goa, the data owner checks the decodabiity of these encoded packets before outsourcing by executing the decoding agorithm. Specificay, a the nα encoded packets are divided into n groups, each of which consists of α packets, {{C i } 1 i α } 1 n. The Beief Propagation decoding agorithm is then run on every k-combination of n groups. If the decoding fais in any combination, the data owner re-generates encoded packets and rechecks the decodabiity unti every k-combination can recover a the m origina packets. Once the encoding configuration successfuy passes the decodabiity detection, it can be reused for a the storage services that specifies the same n and k. For each encoded packet C i, 1 n, 1 i α, three kinds of auxiiary data are attached, i.e., the coding vector, the retrieva tag, and verification tags. The coding vector Δ i is a m-bit vector, where each bit represents whether the corresponding origina packet is combined into C i or not. The retrieva tag φ i, computed by Eq. 1, is to verify the encoded packet C i in data retrieva, and aso in data repair if necessary. φ i (H( i C i )) η G (1) To generate the verification tag for the purpose of integrity check, each encoded packet C i is spit into t segments, {C i1,...,c it }. Each segment C ij incudes s symbos in Z p : {C ij1,...,c ijs }. For each segment C ij, we generate a verification tag σ ij, 1 j t, in Eq. 2. σ ij (H( i j) u C ij ) η G (2) These data are outsourced to the -th storage server in the form of {, {i, C i, Δ i,φ i, {σ ij } 1 j t } 1 i α,φ }, where φ is the coding tag to vaidate a the previousy coding vectors. The computation of φ is shown in Eq. 3. φ (H( Δ 1... Δ α )) η G (3) C. Data Retrieva Data users can recover origina data by accessing any k of n coud servers in the data retrieva. The data user first retrieves a the coding vectors and the coding tags stored in the seected k coud servers, and performs the verification in Eq. 4. If the verification operation on any coding tag fais, the data user sends reports to the third party server and accesses one substitutive storage server. e(φ,g)? = e(h( Δ 1... Δ α ),v) (4) Once a the coding tags from k storage servers pass the vaidation, the data user partiay executes the Beief Propagation decoding agorithm ony with coding vectors, and records ids of coding vectors that are usefu for the decoding. Meanwhie, the data user retrieves those corresponding usefu encoded packets and their retrieva tags from corresponding storage servers, and verifies the integrity of encoded packets as shown in Eq. 5. e(φ i,g)? = e(h( i C i ),v) (5) A the origina packets in M can be recovered by performing the same XOR operations on encoded packets as those on coding vectors. Finay, the data user can decrypt the M and get the paintext data if the fie is encrypted before encoding. Note that if there exist some verification tags that fai in the integrity check procedure, the data user aso reports them to the third party server and retrieves data from one substitutive storage server. When the third party server receives any faiure reports from data users about either coding tags or verification tags, it wi immediatey chaenge the corresponding server (detais on chaenge wi be given in the foowing section). D. Integrity Check To monitor the integrity of data stored in the storage servers, the third party server periodicay performs the integrity check over every storage server. The third party server first randomy picks α + t numbers, a 1,...,a α,b 1,...,b t Z p, and then sends them to every storage server. The -th storage server wi compute s integrated symbos {μ } 1 s and one integrated tag ς in Eq. 6. Note that a i corresponds to the i-th encoded packet in every storage server, and b j corresponds to the j-th segment in each encoded packet. α t μ = a i b j C ij, ς = σ aibj ij (6) The third party server verifies these received integrated symbos {μ } 1 s and the integrated verification tag ς,as 697

6 Fig. 3: LT codes-based coud storage service (LTCS). shown in Eq. 7. e(ς,g) =? e( H( i j) aibj u μ,v) (7) If the verification fais, the third party server reports it to the data center, and the administrator of the storage server wi reset the server software and start the data repair procedure. E. Data Repair It is commony beieved that a existing coding constructions must access the origina data to generate coded packets, which means the communication cost of data repair for erasure codes is equa to the size of the entire origina data [10]. A s- traightforward data repair method is therefore to recover a the origina data packets whenever a storage server is corrupted. But such method wi introduce much cost of both computation and communication. In LTCS as iustrated in Fig. 3, one repair server S n+1 is depoyed to efficienty repair corrupted storage servers. Athough other storage services based on optima erasure codes or network coding can aso integrate the repair server, they sti introduce more computationa cost during data retrieva (and storage cost for network coding-based service) than LTCS, which wi be vaidated in section VI. To accommodate the repair server, the data owner outsources a the origina packets to the repair server S n+1 during data outsourcing. Each origina packet is aso attached by the verification tag which is generated in the same way as shown in Eq. 2. Besides, a the auxiiary data of storage servers are stored in the repair server as a backup. Simiary with the distributed data storage, the metadata incuding verification tags for origina packets need to be reiaby stored in n storage servers. Compared with the arge size of encoded data, auxiiary data are quite sma such that we can empoy the simpe repication or erasure codes to add redundancy. To dea with the faiure on the -th storage server, the repair server uses a the corresponding coding vectors {Δ i } 1 i α to generate encoded packets {C i } 1 i α. Specificay, C i is generated by the XOR combination of Δ i origina packets, as iustrated in Eq. 8, where j i1,...,j i Δi {1,...,m} correspond to the nonzero bits in the coding vector Δ i.the repair server sends to S a the encoded packets with their tags in the form of {, {i, C i, Δ i,φ i, {σ ij } 1 j t } 1 i α,φ }. C i = M ji1... M ji Δi (8) The repaired server S authenticates received encoded packets {C i } 1 i α and auxiiary tags as in the data retrieva and integrity check. If the authentication fais, the repair server itsef may be corrupted and need repair. The third party server aso chaenges the repair server S n+1 to check the integrity of origina packets. Since there are m packets stored in S n+1, instead of α in storage servers, the third party server shoud generate m + t random numbers, a 1,...,a m,b 1,...,b t Z p. The integrated symbos {μ (n+1) } 1 s are then generated from the m origina packets, μ (n+1) = m t a i b j C (n+1)ij, where C (n+1)i = M i. There are simiar changes in the generation of the integrated verification tag, ς n+1 = m a σ ib j. The repair server (n+1)ij is ess ikey to be corrupted than storage servers, since it does not participate in the data retrieva service for data users. Even when the repair server is found to be corrupted and needs repair, a the origina packets and auxiiary data can be recovered by performing data retrieva from any d of heathy storage servers. Therefore, there is no singe point of faiure. V. SECURITY ANALYSIS A. Protection of Data Confidentiaity and Integrity For protecting data confidentiaity, existing encryption techniques or data access contro schemes [20] can be utiized before the encoding process, which prevent the coud server from prying into outsourced data. With respect to the data integrity, LTCS utiizes various cryptographic tags to resist the poution attack during the data repair and retrieva procedures. LTCS is aso secure against the repay attack which is presented in the network coding-based distributed storage system [12]. To unch the repay attack, the adversary first corrupts some storage servers and backups encoded packets stored in these servers. After severa rounds of data repair, the adversary corrupts the same storage servers as before, and then substitutes new encoded packets with specific od packets. Since the verification tag ony binds the storage server id and the packet id, not the freshness of the packet, the substituted od packets coud pass the integrity verification. As a resut, such substitution makes encoded packets stored in specific kcombinations of n storage servers ineary dependabe, and the data recovery woud fai when a other n k storage servers are corrupted. Actuay, if the data repair mechanism is designed to generate new packets which are different from the od packets stored in the same storage server, any codingbased distributed storage system is somehow vunerabe to such kind of attack. In other words, the functiona repair itsef 698

7 TABLE I: Performance compexity anaysis of storage services based on different redundancy techniques. Network Coding Reed-Soomon LTCS Tota server storage O((2n/(k +1)) M ) O((1 + n/k) M ) O((1 + n(1 + ε)/k) M ) Encoding computation O(2nm 2 /(k +1)) O(nm 2 /k) O((nm(1 + ε)nm)/k) Retrieva communication O( M ) O( M ) O( M ) Retrieva computation O(m 2 ) O(m 2 ) O(m n m) Repair communication O(2T/(k +1) M ) O(T (1/k +1/n) M ) O(T ((1 + ε)/k +1/n) M ) has the possibiity to break the decodabiity. By contrast, LTCS empoys the exact repair method where the newy generated packets are the same as those previousy stored packets. The repay attack becomes invaid since there is no difference between od and new packets in the same storage server. Furthermore, LTCS examines the data decodabiity from any k-combination of storage servers before outsourcing, which guarantees that origina data coud be recovered even when the adversary corrupts both the repair server and at most n k storage servers in one round. B. Verification Correctness in Integrity Check The verification correctness in Eq. 7 is proved in Eq. 9. e(ς,g) = e( = e( = e( = e( σ a ib j ij,g) (H( i j) a ib j H( i j) a ib j = e( H( i j) a ib j H( i j) a ib j u a ib j C ij ),g) η u a ib j C ij,v) α t a i b j C ij u,v) u μ,v). (9) VI. PERFORMANCE ANALYSIS In this section, we demonstrate the performance of storage services based on different redundancy techniques by both theoretica compexity anaysis and experimenta evauation. We set the same desired reiabiity eve as network codingbased distributed storage system RDC-NC [12], where n =12, k =3. Other parameters are set from the consideration of specific properties of network coding (NC), Reed-Soomon codes (RS), and LT codes. For LTCS, m = 3072,α = m(1 + ε)/k, d s = 1,d r = k, β = α, δ = 1,c = 0.1, where ε O(n 2 (m/δ)/ m) is the LT overhead factor. d s and d r represent the number of coud servers participating in the repair of corrupted storage server and corrupted repair server, respectivey. β represents the number of packets retrieved from each participating server during repair. For Reed- Soomon codes based storage system, m = 6 or 12,α = m/k, d = k, β = α; for network coding based storage system, m = 6 or 12,α = 2m/(k +1),d = k, β = α/d. The whoe experiment system is impemented by C anguage on a Linux Server with Inte Xeon Processor 2.93GHz. Besides, the performance of network coding and Reed-Soomon codes is optimized by empoying tabe ookup in the mutipication and division over GF (2 8 ), and we evauate their performance with or without repair server (rs), respectivey. The performance compexity comparison among storage services based on different redundancy techniques with repair server is shown in Tab. I, where T is the number of corrupted storage servers in one round, 0 T n k. A. Outsourcing As described in section 4.2, the data owner detects the decodabiity in the encoding procedure to guarantee data avaiabiity. To check a k-combinations of n groups, the data owner has to execute ( n k ) times of the Beief Propagation decoding agorithm. For the efficiency purpose, this decoding process can be partiay executed where ony coding vectors foow the decoding steps and data packets are not invoved. If there exists a combination that cannot recover a the origina packets, the data owner wi re-generate nα coding vectors according to LT codes and re-detect them, where α is equa to m(1 + ε)/k. Once a the ( n k ) combinations successfuy pass the decodabiity detection, corresponding coding vectors can be reused for a the storage services that specifies the same n and k. As iustrated in Fig. 4(a), the arger ε makes the decodabiity detection more costy because of the inear reation between ε and α, namey the number of coding vectors in each group. Considering that the arger ε eads to more storage cost and repair communication cost, the foowing evauations are conducted by setting ε to the smaest one as , which corresponds to α = Once one set of nα coding vectors pass the decodabiity detection, encoding operations are performed on rea data packets via the XOR combination. Athough the number of encoded packets in LTCS, nα, is severa hundreds times arger than in other storage service based on network coding or Reed- Soomon codes, the computationa cost of encoding in LTCS is much ess than the ater, as iustrated in Fig. 5(a). The main reason for such big advantage is that the average degree of encoded packets is O(n(m/δ)) and O(m) in two services, respectivey. Furthermore, the combination for encoding is the efficient XOR in LTCS whie the inear combination in network coding or Reed-Soomon codes invoves the mutipication operations with coefficients. The tota number of encoded packets in Reed-Soomon codes-based service is ess than network coding-based one so the encoding procedure introduces different computationa cost in two services. As for the data storage in LTCS, every storage server stores 699

8 Time of decodabiity detection (s) LT overhead factor ε (a)time of detecting decodabiity (b)data storage cost Fig. 4: Outsourcing performance with different ε. n = 12, k = 3, m = Encoding time (s) NC, m=12 RS, m=12 NC, m=6 RS, m=6 LTCS, m= Fie size (MB) (a)encoding Decoding time (s) NC, m=12 RS, m=12 NC, m=6 RS, m=6 LTCS, m= Fie size (MB) (b)decoding Fig. 5: Encoding and decoding time for different size of fie. n=12, k=3. α encoded packets, each of which has the size of M /m. And the repair server stores a the m origina packets with the same size. The tota data storage in coud servers is the sum of a encoded packets in n storage servers and a origina packets in the repair server, which is O(nα M /m + M ), i.e., O([1 + n(1 + ε)/k] M ). The data storage cost in LTC- S is arger than Reed-Soomon codes-based storage service because LT codes is a near-optima erasure codes in terms of redundancy-reiabiity tradeoff. By contrast, the tota data storage in existing network coding-based storage service is O( M [2n/(k +1)]) as iustrated in Fig. 4(b). If we integrate the repair server into this service, the storage cost wi be O( M [1 + 2n/(k +1)]) which is much arger than LTCS. B. Data Retrieva The avaiabiity in data retrieva is guaranteed by the decodabiity detection before data outsourcing and the exact repair of corrupted data. Reca that the data user first retrieves kα, i.e. m(1 + ε), of coding vectors from k storage servers, and then ony retrieve m of encoded packets that are usefu for decoding. Therefore, the communication cost during data retrieva in LTCS is the same O( M ) as the network codingbased storage system where any m of encoded packets are ineary independent with high probabiity. The computationa compexity of Beief Propagation decoding in LTCS is O(m n(m/δ)) for the data user, where δ is set to 1. By contrast, the other storage services based on network coding or Reed-Soomon codes usuay use the costy decoding agorithms with higher computationa compexity, O(m 2 ). Athough the tota number of origina packets, m,may be smaer in the other two storage services than in LTCS, the decoding process for the data user in LTCS performs at east two times faster than in the other two storage services, as iustrated in 5(b). This efficient decoding process demonstrates that LTCS is more appropriate than other redundancy-based storage services in the coud storage paradigm, where data retrieva is a routine task for data users. C. Integrity Check To check the integrity of data stored in a storage server, the third party server needs to perform one integrated chaenge in LTCS, which means ony two biinear maps in Eq. 7 are executed in order to check α encoded packets. Network Repair communication cost ( M ) RS w/o rs NC w/ rs NC w/o rs LTCS RS w/ rs # of corrupted storage servers Fig. 6: Communication cost of repair. n=12, k=3. coding-based service has to perform α times of chaenges for each storage server where 2α biinear maps are executed to check α of encoded packets. Simiary, the communication cost between the third party server and each storage server during one round of Integrity Check in network codingbased service is amost α times more than that in LTCS. D. Data Repair When the repair server is corrupted, LTCS first retrieve β encoded packets from each of d r heathy storage servers to recover a the origina packets. In such case, the communication compexity from d r heathy storage servers to the repair server is O(d r β M /m), i.e., O((1 + ε) M ), where d r = k, β = α. If the repair server is not corrupted or has been repaired, the data repair of storage servers in LTCS is simpy accompished by the repair server generating β encoded packets for each corrupted storage server, where d s =1, β = α. Assume the number of corrupted storage servers in one round is T, 0 T n k. The repair communication compexity in such scenario is O(Tα M /m), i.e., O(T (1+ε)/k M ), where M /m is the size of each encoded packet. Assume the corruption probabiity of the repair server is the same as storage servers, i.e., T/n. The tota repair communication compexity is then cacuated as O(T (1 + ε)/k M + T/n M ), i.e., O(T ((1+ε)/k+1/n) M ). As iustrated in Fig. 6, to repair different number of corrupted storage servers T, the communication cost in LTCS is ony 15 percent more than Reed-Soomon codes-based service integrated with repair server, but smaer than that in network coding-based service. 700

9 VII. RELATED WORK Network Coding-based Distributed Storage As a new data transmitting technique, network coding is different with traditiona store-and-forward methods. Instead of simpy forwarding previousy received packets, network coding aows intermediate nodes to recode received packets before forwarding. It has been proved that random inear network coding over a sufficienty arge finite fied can achieve the muticast capacity [21], [22]. Since the data repair probem in the distributed storage is caimed to be mapped to a muticasting probem on the information fow graph [10], many network coding-based storage codes [10], [13] [15], [23], [24] have been proposed to take advantage of this property of capacity achievabiity. By recoding encoded packets in heathy servers during the repair procedure, the repair communication cost is reduced to the information theoretic minimum. The achievabe region of functiona repair is characterized in [12], but a arge part of the achievabe region of exact repair remains open [15]. Furthermore, since network coding utiizes Gaussian eimination decoding agorithm, the data retrieva is more expensive than erasure codes-based system [12]. Therefore, these designs are ony suitabe in read-rarey storage scenarios, and cannot be efficienty depoyed in the coud storage system where data retrieva is a routine operation. Remote Data Integrity Check The remote data integrity check probem is first expored in [25] which aso checks the data avaiabiity and gives a forma security definition of proof of retrievabiity. Subsequent works [19], [26], [27] improve this work by providing unimited number of data integrity checking, taking ess communication, or supporting secure and efficient dynamic data operations. Reated works on proof of data possession [28], [29] focus on the data integrity check and perform more efficienty at the cost of security eve. However, existing works based on proof of retrievabiity or proof of data possession do not have an efficient soution for the data repair probem or pay no attention to it. VIII. CONCLUSIONS In this paper, for the first time, we expore the probem of secure and reiabe coud storage with the efficiency consideration of both data repair and data retrieva, and design a LT codes-based coud storage service (LTCS). To enabe efficient decoding for data users in the data retrieva procedure, we adopt a ow compexity LT codes for adding data redundancy in distributed coud servers. Our proposed LTCS provides efficient data retrieva for data users by utiizing the fast Beief Propagation decoding agorithm, and reeases the data owner from the burden of being onine by enabing pubic data integrity check and empoying exact repair. The performance anaysis and experimenta resuts show that LTCS has a comparabe storage and communication cost, but a much faster data retrieva than the erasure codes-based soutions. It introduces ess storage cost, much faster data retrieva, and comparabe communication cost comparing to network coding-based storage services. Our future wi address how to detect decodabiity more efficienty. ACKNOWLEDGMENT This work was supported in part by the US Nationa Science Foundation under grants CNS , CNS , and CNS REFERENCES [1] S. Kamara and K. Lauter, Cryptographic coud storage, in RLCPS, [2] M. Armbrust, A. Fox, and et a., Above the couds: A berkeey view of coud computing, University of Caifornia, Berkeey, Tech. Rep. UCB- EECS [3] [4] Summary of the amazon ec2 and amazon rds service disruption in the us east region, [5] Microsoft coud data breach herads things to come, coud data breach herads things come/. [6] H. Xia and A. A. Chien, Robustore: a distributed storage architecture with robust and high performance, in Proc. of Supercomputing, [7] H. Weatherspoon and J. D. Kubiatowicz, Erasure coding vs. repication: A quantitative comparison, in IPTPS, [8] J. Kubiatowicz, D. Binde, Y. Chen, and et a, OceanStore: an architecture for goba-scae persistent storage, in ASPLOS. New York, NY, USA: ACM, [9] R. B. Kiran, K. Tati, Y. chung Cheng, S. Savage, and G. M. Voeker, Tota reca: System support for automated avaiabiity management, in Proc. of NSDI, [10] A. Dimakis, P. Godfrey, Y. Wu, M. Wainwright, and K. Ramchandran, Network coding for distributed storage systems, ITIT, [11] I. Reed and G. Soomon, Poynomia codes over certain finite fieds, Journa of the SIAM, [12] B. Chen, R. Curtmoa, G. Ateniese, and R. Burns, Remote data checking for network coding-based distributed storage systems, in Proc. of CCSW 10, [13] Y. Wu, A construction of systematic mds codes with minimum repair bandwidth, in IEEE Trans. Inf. Theory, [14] K. V. Rashmi, N. B. Shah, P. V. Kumar, and K. Ramchandran, Exact regenerating codes for distributed storage, in Proc. Aerton Conf. Contro Comput. Commun., 2009, pp [15] A. G. Dimakis, K. Ramchandran, Y. Wu, and C. Suh, A survey on network codes for distributed storage, CoRR, vo. abs/ , [16] M. Luby, Lt codes, in Proc. of FoCS, 2002, pp [17] M. G. Luby, M. Mitzenmacher, M. A. Shokroahi, and D. A. Spieman, Efficient erasure correcting codes, ITIT, no. 2, pp , [18] M.-L. Champe, K. Huguenin, A.-M. Kermarrec, and N. L. Scouarnec, Lt network codes, Proc. of ICDCS, pp , [19] H. Shacham and B. Waters, Compact proofs of retrievabiity, in Proceedings of Asiacrypt, [20] S. Yu, C. Wang, K. Ren, and W. Lou, Achieving secure, scaabe, and fine-grained data access contro in coud computing, in Proc. of INFOCOM, [21] T. Ho, M. Medard, R. Koetter, D. Karger, M. Effros, J. Shi, and B. Leong, A random inear network coding approach to muticast, ITIT, [22] P. Sanders, S. Egner, and L. Tohuizen, Poynomia time agorithms for network information fow, in Proc. of SPAA, 2003, pp [23] J. Li, S. Yang, X. Wang, X. Xue, and B. Li, Tree-structured data regeneration in distributed storage systems with regenerating codes, in Proc. of IWQoS, Juy [24] A. Duminuco and E. Biersack, A practica study of regenerating codes for peer-to-peer backup systems, in Proc. of ICDCS, June [25] A. Jues and B. S. Kaiski, Jr., Pors: proofs of retrievabiity for arge fies, in Pro. of CCS. New York, NY, USA: ACM, 2007, pp [26] C. Wang, Q. Wang, K. Ren, and W. Lou, Ensuring data storage security in coud computing, in Proc. of IWQoS, [27] K. D. Bowers, A. Jues, and A. Oprea, Hai: a high-avaiabiity and integrity ayer for coud storage, in Proc. of CCS, [28] G. Ateniese, R. Burns, R. Curtmoa, J. Herring, L. Kissner, Z. Peterson, and D. Song, Provabe data possession at untrusted stores, in Proceedings of CCS. New York, NY, USA: ACM, [29] R. Curtmoa, O. Khan, R. Burns, and G. Ateniese, Mr-pdp: Mutiperepica provabe data possession, in Proc. of ICDCS,