Privacy-Preserving Audit and Extraction of Digital Contents

TLDR

Online services such as Google, Yahoo!, and Amazon now charge for storage, prompting customers to store valuable data like emails, photos, and backups, yet they must fully trust these services to preserve data integrity, which is not guaranteed. The authors propose protocols that enable a third‑party auditor to periodically verify stored data and help customers retrieve it intact, thereby holding storage services accountable for data loss. The protocols employ privacy‑preserving verification techniques that allow auditors to check data integrity without accessing content. The protocols are privacy‑preserving, offload verification from customers, reduce fears of data leakage, and enable independent arbitration of data retention contracts.

Abstract

A growing number of online services, such as Google, Yahoo!, and Amazon, are starting to charge users for their storage. Customers often use these services to store valuable data such as email, family photos and videos, and disk backups. Today, a customer must entirely trust such external services to maintain the integrity of hosted data and return it intact. Unfortunately, no service is infallible. To make storage services accountable for data loss, we present protocols that allow a thirdparty auditor to periodically verify the data stored by a service and assist in returning the data intact to the customer. Most importantly, our protocols are privacy-preserving, in that they never reveal the data contents to the auditor. Our solution removes the burden of verification from the customer, alleviates both the customer’s and storage service’s fear of data leakage, and provides a method for independent arbitration of data retention contracts.