Towards subversion-resistant password-protected encryption for deduplicated cloud storage

Message-Locked Encryption (MLE) enables encrypted deduplication by deriving keys directly from data. Servers-aided MLE extends this model with a master secret shared across key servers, and is widely used for secure deduplicated storage. However, existing servers-aided MLE schemes require users to locally store a separate MLE key for each data item, thereby imposing significant key management burdens. To address this, Zhang et al. introduced SPADE, a password-protected encryption scheme that enables users to manage MLE keys using only a human-memorable password. It applies two-layer encryption: data is encrypted with the MLE key, which is then encrypted with a symmetric key derived from a password-based seed and the user’s identity. The seed is generated via a distributed oblivious pseudorandom function using the data and a password-hardening key shared across key servers. SPADE also supports password-based authentication with both key servers and the cloud server, while preserving encrypted deduplication and servers-aided security. However, it faces three limitations: (i) high storage overhead from per-user credentials and password-hardening keys; (ii) high computational cost due to per-key server authentication; and (iii) vulnerability to subversion attacks if user devices are compromised.

In this paper, we propose SR-PPE, a subversion-resistant password-protected encryption scheme for deduplicated cloud storage. In SR-PPE, we present a signature-based authentication mechanism where public/secret key pairs are derived from a password-based seed, so servers can perform challenge–response authentication without storing per-user credentials. To enable secure key generation and resist password-guessing attacks, we design an enhanced distributed partially oblivious pseudorandom function that binds computation to users’ identities. We further propose a Merkle tree-based challenge–response mechanism for efficient authentication across multiple servers. A reverse firewall is deployed between users and externals to prevent subversion attacks by generating unbiased randomness and re-randomizing outgoing messages. Security analysis under multiple adversary models and evaluation of communication, computation, and storage costs show that SR-PPE provides strong security with practical efficiency.