[Paper Review] Don't Trust the Cloud, Verify: Integrity and Consistency for Cloud Object Stores

Marcus Brandenburger, Christian Cachin+1 more|arXiv (Cornell University)|Feb 16, 2015

Distributed systems and fault tolerance26 references4 citations

TL;DR

This paper proposes VICOS, a protocol for verifying data integrity and consistency in cloud object storage across multiple untrusted clients. It achieves fork-linearizability with constant communication overhead per operation, uses authenticated data structures to enable wait-free client operations, and outperforms prior systems by eliminating client-side state replication and reducing coordination costs.

ABSTRACT

Cloud services have turned remote computation into a commodity and enable convenient online collaboration. However, they require that clients fully trust the service provider in terms of confidentiality, integrity, and availability. Towards reducing this dependency, this paper introduces a protocol for verification of integrity and consistency for cloud object storage (VICOS), which enables a group of mutually trusting clients to detect data-integrity and consistency violations for a cloud object-storage service. It aims at services where multiple clients cooperate on data stored remotely on a potentially misbehaving service. VICOS enforces the consistency notion of fork-linearizability, supports wait-free client semantics for most operations, and reduces the computation and communication overhead compared to previous protocols. VICOS is based in a generic way on any authenticated data structure. Moreover, its operations cover the hierarchical name space of a cloud object store, supporting a real-world interface and not only a simplistic abstraction. A prototype of VICOS that works with the key-value store interface of commodity cloud storage services has been implemented, and an evaluation demonstrates its advantage compared to existing systems.

Motivation & Objective

• To address the lack of strong consistency and integrity guarantees in multi-client cloud object storage where clients cannot fully trust the cloud provider.
• To eliminate the need for clients to maintain local copies of system state, which contradicts the goal of data outsourcing.
• To achieve fork-linearizability—offering the strongest consistency guarantee in a multi-client, untrusted setting—without blocking or requiring trusted components.
• To reduce communication and computational overhead compared to prior protocols like SUNDR, FAUST, and Venus, which scale poorly with the number of clients.
• To support real-world cloud interfaces (e.g., hierarchical namespaces) rather than simplified abstractions, enabling practical deployment.

Proposed method

• VICOS is built on a generic authenticated data structure (ADS) to support arbitrary operations on cloud-stored data.
• It uses a two-phase protocol to verify both integrity and consistency, leveraging cryptographic hash chains for consistency checks.
• The protocol introduces the concept of 'compatible operations'—operations that do not interfere with each other’s effects or outputs—enabling wait-free execution.
• It maintains state remotely at the cloud server, avoiding the need for clients to store full copies of the system state, unlike BST or SPORC.
• Communication overhead is constant per operation, independent of the number of clients, unlike vector-clock-based systems (e.g., FAUST, Venus) that scale as Ω(n).
• The system is implemented on commodity cloud storage APIs and evaluated using a prototype, demonstrating low latency and high throughput.

Experimental results

Research questions

• RQ1 Can a practical system achieve fork-linearizable consistency in multi-client cloud object storage without requiring clients to store full state copies?
• RQ2 Is it possible to reduce communication and computation overhead in integrity and consistency verification protocols to be independent of the number of clients?
• RQ3 How can wait-free semantics be achieved for all compatible operations in a system with an untrusted server and multiple uncoordinated clients?
• RQ4 Can a protocol unify remote state management with cryptographic consistency verification using authenticated data structures?
• RQ5 What is the performance overhead of such a system when deployed on real cloud storage services?

Key findings

• VICOS achieves fork-linearizability, the strongest consistency guarantee in the multi-client untrusted model, ensuring that any inconsistency between clients is detectable upon communication.
• The protocol incurs only constant communication overhead per operation, independent of the number of clients, unlike prior systems that scale as Ω(n) or Ω(n²).
• VICOS supports wait-free client operations for all compatible operations, avoiding blocking even under concurrent execution.
• The prototype implementation on commodity cloud storage services shows significantly lower overhead compared to SUNDR, FAUST, and Venus, with measurable performance improvements in latency and throughput.
• By relying on remote state and hash chains instead of client-side state replication, VICOS enables clients to remain offline between operations without stalling the protocol.
• The system is compatible with real-world cloud interfaces, including hierarchical namespaces and key-value operations, making it suitable for practical deployment.