Secure and Lightweight Deduplicated Storage via Shielded Deduplication...
summary
DEBE implements deduplication-before-encryption inside an Intel SGX enclave, using a count‑min sketch + top‑K heap to remove hot chunks in‑enclave and a protected full index outside, then compresses and encrypts only non‑duplicates. Prototype in C++ with LZ4 and xxHash shows up to 30x faster uploads versus state‑of‑the‑art DaE, reduces key metadata by ~93%, and leverages the observation that the top 5% of chunks yield ~97% of duplicates.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:29Outsourced Storage
- 1:13Data Deduplication
- 1:54Deduplication-after-Encryption
- 2:53Limitations of DaE
- 4:25Deduplication-before-Encryption
- 5:54Contributions
- 6:33Intel SGX Basics
- 7:37Overview
- 8:40Main Idea
- 10:07Architecture
- 10:58Frequency Tracking
- 12:04First-Phase Deduplication
- 13:21Second-Phase Deduplication
- 14:11Experimental Setup
- 14:47Overall Performance
- 15:58Trace-Driven Performance
- 17:16Storage Efficiency
- 18:21Security
- 19:35Conclusion
related talks
17mShieldReduce: Fine-Grained Shielded Data Reduction
15mAccelerating Encrypted Deduplication via SGX
18mSimEnc: A High-Performance Similarity-Preserving Encryption Approach for...
15mDUPEFS: Leaking Data Over the Network With Filesystem Deduplication Side Channels
31mRemote Memory-Deduplication Attacks
51mWhere should I be encrypting my data
38mHardware-based KMS Plug-in to Protect Secrets in Kubernetes
57mFast encrypted backups with Rust