TWC: Small: Oblivious Cloud Storage Systems, from Theory to Practice --- Simpler, More Efficient, More Robust

近年来，将存储外包到云计算已经变得越来越普遍;然而，云存储服务不断受到许多重要的对抗性威胁。这项工作解决了由访问模式泄漏引起的安全风险，这是对手检测存储服务器上重复访问同一项目时的能力，这已被证明会严重影响数据隐私。该项目开发了CloudORAM，这是第一个可证明安全的完全并发和异步的不经意存储系统，它依赖于简单的基于树的不经意RAM（ORAM）技术，这是用于隐藏访问模式的最先进的加密解决方案。CloudORAM的系统架构使用可信代理节点处理来自潜在多个客户端的对不可信服务器的并发访问以隐藏访问模式。CloudORAM在性能、存储需求和可扩展性方面也优于现有系统，同时由于基于树的ORAM结构，其描述和部署更加简单。 该项目开发了更好的组合技术，以减少基于ORAM的存储解决方案的带宽消耗，以及新的不经意存储系统的概念证明，而不需要一个可信的代理节点，并提出了第一个全面的正式框架，以形式化和证明不经意存储系统的安全性。

Outsourcing storage to the cloud has become more widespread in recent years; however, cloud storage services are constantly exposed to a number of non-trivial adversarial threats. This work addresses security risks arising from the leakage of access patterns, which is the ability of an adversary to detect when the same item is accessed repeatedly on a storage server, which has been shown to substantially impact data privacy. This project develops CloudORAM, the first provably-secure fully concurrent and asynchronous oblivious storage system that relies on simple tree-based Oblivious RAM (ORAM) techniques, the state-of-the-art cryptographic solution for hiding access patterns. CloudORAM's system architecture uses a trusted proxy node processing concurrent accesses, from potentially multiple clients, to an untrusted server to hide access patterns. CloudORAM also outperforms existing systems in terms of performance, storage requirements, and scalability, while being substantially simpler to describe and deploy due to the tree-based ORAM structure. This project develops better combinatorial techniques to reduce bandwidth consumption in ORAM-based storage solutions as well as proofs of concept for new oblivious storage systems without the need of a trusted proxy node, and presents the first comprehensive formal framework to formalize and prove security of oblivious storage systems.