Refined game-theoretic approach to improve authenticity of outsourced databases

The verifiable database (VDB) model is characterized by the fact that the database owner, a computationally weak client, delegates the database management to a database service provider on the cloud, which is considered untrusted third party. In this model, users can query the data and verify the integrity of query results. Motivated by the desire to reduce the computational cost and communication overhead of such a verification process, and to support sophisticated query types, such as aggregated queries, some recent VDB approaches used randomized periodic verifications. These new approaches dedicate a new entity called verifier, whose responsibility is to perform the verification process instead of database users. To improve the randomization effectiveness of the verification operations, our previous work has employed game theory and modeled the VDB problem as a leader–follower Stackelberg security game. The model aimed to randomize what database tables to verify at each verification moment. The main problem of this work is its limitation to only one attacker type, which limits its deployment in real and open cloud environments. In this paper, we extend and refine the Stackelberg security game to be a Bayesian security game which further optimizes the mixed strategy of the verifier by considering multiple follower types. Moreover, we analyze the need for randomization of verification moments and identify the best method allowing us to achieve this randomization. Furthermore, we describe and discuss in detail the implementation settings of each component involved in the model. We have implemented and tested the performance of the Bayesian game model against the single follower-type model and the uniform randomization model. Experiment results show that the Bayesian game model performs better when dealing with multiple attacker types.

[1]  Shucheng Yu,et al.  Flexible and publicly verifiable aggregation query for outsourced databases in cloud , 2013, 2013 IEEE Conference on Communications and Network Security (CNS).

[2]  Gene Tsudik,et al.  DSAC: integrity for outsourced databases with signature aggregation and chaining , 2005, CIKM '05.

[3]  Reihaneh Safavi-Naini,et al.  Verifiable Delegation of Computations with Storage-Verification Trade-off , 2014, ESORICS.

[4]  H. Stackelberg,et al.  Marktform und Gleichgewicht , 1935 .

[5]  Jianfeng Ma,et al.  Verifiable Computation over Large Database with Incremental Updates , 2016, IEEE Transactions on Computers.

[6]  Sarit Kraus,et al.  Playing games for security: an efficient exact algorithm for solving Bayesian Stackelberg games , 2008, AAMAS.

[7]  Yin Yang,et al.  Authenticated join processing in outsourced databases , 2009, SIGMOD Conference.

[8]  Ilsun You,et al.  Special issue on security and privacy techniques in mobile cloud computing , 2016, J. Ambient Intell. Humaniz. Comput..

[9]  Gene Tsudik,et al.  Authentication and integrity in outsourced databases , 2006, TOS.

[10]  Robert H. Deng,et al.  Authenticating Query Results in Data Publishing , 2005, ICICS.

[11]  Sarit Kraus,et al.  Efficient Algorithms to Solve Bayesian Stackelberg Games for Security Applications , 2008, AAAI.

[12]  Bo An,et al.  Refinement of Strong Stackelberg Equilibria in Security Games , 2011, AAAI.

[13]  Ilsun You,et al.  Verifiable Auditing for Outsourced Database in Cloud Computing , 2015, IEEE Transactions on Computers.

[14]  Ralph C. Merkle,et al.  A Certified Digital Signature , 1989, CRYPTO.

[15]  Jamal Bentahar,et al.  A Stackelberg game for distributed formation of business-driven services communities , 2016, Expert Syst. Appl..

[16]  Mehmet Sabır Kiraz,et al.  A comprehensive meta-analysis of cryptographic security mechanisms for cloud computing , 2016, Journal of Ambient Intelligence and Humanized Computing.

[17]  Gene Tsudik,et al.  Authentication of Outsourced Databases Using Signature Aggregation and Chaining , 2006, DASFAA.

[18]  Kyriakos Mouratidis,et al.  Scalable Verification for Outsourced Dynamic Databases , 2009, Proc. VLDB Endow..

[19]  Stephen S. Yau,et al.  Dynamic Audit Services for Outsourced Storages in Clouds , 2013, IEEE Transactions on Services Computing.

[20]  Roberto Tamassia,et al.  Time and Space Efficient Algorithms for Two-Party Authenticated Data Structures , 2007, ICICS.

[21]  Jamal Bentahar,et al.  Verifiable outsourced database in the cloud using game theory , 2017, SAC.

[22]  Stuart Haber,et al.  Privacy-Preserving Computation and Verification of Aggregate Queries on Outsourced Databases , 2009, Privacy Enhancing Technologies.

[23]  Michael Gertz,et al.  Authentic Third-party Data Publication , 2000, DBSec.

[24]  Vincent Conitzer,et al.  Complexity of Computing Optimal Stackelberg Strategies in Security Resource Allocation Games , 2010, AAAI.

[25]  Michael T. Goodrich,et al.  Super-Efficient Verification of Dynamic Outsourced Databases , 2008, CT-RSA.

[26]  Adi Shamir,et al.  A method for obtaining digital signatures and public-key cryptosystems , 1978, CACM.

[27]  Jianfeng Ma,et al.  New Publicly Verifiable Databases with Efficient Updates , 2015, IEEE Transactions on Dependable and Secure Computing.

[28]  Sarit Kraus,et al.  Deployed ARMOR protection: the application of a game theoretic model for security at the Los Angeles International Airport , 2008, AAMAS 2008.

[29]  Godwin Ansa,et al.  Security framework for RESTful mobile cloud computing Web services , 2016, J. Ambient Intell. Humaniz. Comput..

[30]  Xiaofeng Meng,et al.  Integrity Auditing of Outsourced Data , 2007, VLDB.

[31]  Jamal Bentahar,et al.  Scheduling Reputation Maintenance in Agent-based Communities Using Game Theory , 2012, J. Softw..

[32]  Jacques Stern,et al.  Security Arguments for Digital Signatures and Blind Signatures , 2015, Journal of Cryptology.