[Paper Review] Generic Secure Repair for Distributed Storage

Wentao Huang, Jehoshua Bruck|arXiv (Cornell University)|Jun 1, 2017

Advanced Data Storage Technologies14 references4 citations

TL;DR

This paper proposes a generic, two-round secure repair protocol for linear secret sharing schemes that eliminates the need for a trustworthy third-party dealer. By leveraging secure multi-party computation principles, the scheme ensures that any colluding $ z $ nodes learn nothing about the secret, while achieving optimal repair bandwidth up to a constant factor under typical conditions.

ABSTRACT

This paper studies the problem of repairing secret sharing schemes, i.e., schemes that encode a message into $n$ shares, assigned to $n$ nodes, so that any $n-r$ nodes can decode the message but any colluding $z$ nodes cannot infer any information about the message. In the event of node failures so that shares held by the failed nodes are lost, the system needs to be repaired by reconstructing and reassigning the lost shares to the failed (or replacement) nodes. This can be achieved trivially by a trustworthy third-party that receives the shares of the available nodes, recompute and reassign the lost shares. The interesting question, studied in the paper, is how to repair without a trustworthy third-party. The main issue that arises is repair security: how to maintain the requirement that any colluding $z$ nodes, including the failed nodes, cannot learn any information about the message, during and after the repair process? We solve this secure repair problem from the perspective of secure multi-party computation. Specifically, we design generic repair schemes that can securely repair any (scalar or vector) linear secret sharing schemes. We prove a lower bound on the repair bandwidth of secure repair schemes and show that the proposed secure repair schemes achieve the optimal repair bandwidth up to a small constant factor when $n$ dominates $z$, or when the secret sharing scheme being repaired has optimal rate. We adopt a formal information-theoretic approach in our analysis and bounds. A main idea in our schemes is to allow a more flexible repair model than the straightforward one-round repair model implicitly assumed by existing secure regenerating codes. Particularly, the proposed secure repair schemes are simple and efficient two-round protocols.

Motivation & Objective

• Address the challenge of repairing lost shares in distributed storage systems without relying on a trustworthy third-party repair dealer.
• Maintain information-theoretic security such that any $ z $ colluding nodes—including failed or replacement nodes—cannot learn any information about the secret during or after repair.
• Design a repair protocol that is generic and applicable to any scalar or vector linear secret sharing scheme without requiring modifications to the underlying scheme.
• Achieve near-optimal repair bandwidth by relaxing the traditional one-round repair model to allow a two-round communication protocol.
• Formalize and prove information-theoretic bounds on repair bandwidth under secure repair constraints.

Proposed method

• Introduce a two-round repair protocol where helper nodes first exchange information among themselves before transmitting to the failed node.
• Use secure multi-party computation techniques to ensure that any $ z $ colluding nodes receive only independent randomness, preserving security.
• Allow $ d > z $ nodes to receive signals during the first round, enabling them to collectively reconstruct useful information about the lost share.
• In the second round, transmit only the necessary information about the lost share from the $ d $ nodes to the failed node, ensuring it learns only its own share.
• Formalize the repair process using information-theoretic tools, including entropy and mutual information, to analyze security and bandwidth.
• Prove that the repair bandwidth is bounded below by $ \frac{(n-1)W}{2(n-z-1)} $, establishing a fundamental limit for secure repair.

Experimental results

Research questions

• RQ1 Can secure repair of linear secret sharing schemes be achieved without a trustworthy third-party dealer?
• RQ2 What is the fundamental lower bound on repair bandwidth for secure repair protocols in distributed storage systems?
• RQ3 How does relaxing the one-round repair model to a two-round protocol affect the efficiency and security of repair?
• RQ4 Can a generic repair scheme be designed that works for any linear secret sharing scheme without modifying the original scheme?
• RQ5 What is the tradeoff between repair bandwidth and security when $ n $ dominates $ z $ or when the secret sharing scheme has optimal rate?

Key findings

• The proposed two-round secure repair protocol achieves repair bandwidth within a constant factor of the theoretical lower bound of $ \frac{(n-1)W}{2(n-z-1)} $.
• The repair bandwidth of the proposed constructions is upper bounded by $ \frac{(W+1)n}{n-z} $, matching the lower bound up to a factor of approximately 2.
• The scheme is generic and applies to any scalar or vector linear secret sharing scheme without requiring modifications to the original scheme.
• Security is preserved because any $ z $ colluding nodes receive only independent randomness, while the full set of $ d > z $ nodes collectively reconstructs useful information.
• The two-round model enables significant efficiency gains over one-round models by allowing intermediate communication among helper nodes.
• The information-theoretic analysis confirms that the repair process does not leak information to any colluding set of $ z $ nodes, satisfying the security requirement.