Deleting Secret Data with Public Verifiability
Deleting Secret Data with Public Verifiability
复制标题
DOI：
10.1109/tdsc.2015.2423684
复制
发表时间：
2016-11
影响因子：
7.3
通讯作者：
Feng Hao;Dylan Clarke;A. Zorzo
中科院分区：
文献类型：
--
作者：
Feng Hao;Dylan Clarke;A. Zorzo
现有的基于软件的数据擦除程序可以概括为遵循相同的一位返回协议：删除程序执行数据擦除并返回成功或失败。然而，这样的一位返回协议将数据删除系统变成了一个黑盒子-用户必须信任结果，但不能轻易地验证它。当删除程序封装在可信协议（TPM）中，并且用户无法访问其中的代码时，这尤其成问题。在本文中，我们提出了一个加密解决方案，旨在使数据删除过程更加透明和可验证。与关于TPM的传统黑/白色假设（即，或者完全信任或者不信任），我们引入介于两者之间的第三个假设：即“信任但验证”。我们的解决方案使用户能够验证TPM内部两个重要操作的正确实现，而无需访问其源代码：即，数据的正确加密和密钥的忠实删除。最后，我们提出了一个验证的概念实现SSE系统的资源受限的Java卡，以证明其实际可行性。据我们所知，这是第一个基于“信任但验证”范式的安全数据删除问题的系统解决方案，以及具体的原型实现。
Existing software-based data erasure programs can be summarized as following the same one-bit-return protocol: the deletion program performs data erasure and returns either success or failure. However, such a one-bit-return protocol turns the data deletion system into a black box-the user has to trust the outcome but cannot easily verify it. This is especially problematic when the deletion program is encapsulated within a Trusted Platform Module (TPM), and the user has no access to the code inside. In this paper, we present a cryptographic solution that aims to make the data deletion process more transparent and verifiable. In contrast to the conventional black/white assumptions about TPM (i.e., either completely trust or distrust), we introduce a third assumption that sits in between: namely, “trust-but-verify”. Our solution enables a user to verify the correct implementation of two important operations inside a TPM without accessing its source code: i.e., the correct encryption of data and the faithful deletion of the key. Finally, we present a proof-of-concept implementation of the SSE system on a resource-constrained Java card to demonstrate its practical feasibility. To our knowledge, this is the first systematic solution to the secure data deletion problem based on a “trust-but-verify” paradigm, together with a concrete prototype implementation.