This article has been accepted for publication in a future issue of this journal, but has not been
fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
Towards Encrypted Cloud Media Center with
Secure Deduplication
Yifeng Zheng, Xingliang Yuan, Xinyu Wang, Jinghua Jiang, Cong Wang, and Xiaolin Gui
Abstract—The explosive growth of multimedia contents, espe-
cially videos, is pushing forward the paradigm of cloud-based
media hosting today. However, the wide attacking surface of the
public cloud and the growing security awareness from the society
are both calling for data encryption before outsourcing to cloud.
Under the circumstance of encrypted videos, how to still preserve
all the service benefits of cloud media centre remains to be fully
explored. In this paper, we present a secure system architecture
design as our initial effort towards this direction, which bridges
together the advancements of video coding techniques and secure
deduplication. Our design enables the cloud with the crucial
deduplication functionality to completely eliminate the extra
storage and bandwidth cost, which would have been incurred by
hosting encrypted videos from different entities. The design is also
carefully tailored to the scalable video coding (SVC) techniques
to support heterogeneous networks and devices for high quality
adaptive video dissemination. We show fully functional system
implementations with structure-aware encryption design and
structure-aware deduplication strategies that are both completely
compliant with the video format in SVC. Extensive security
analysis and experiments via our prototype deployed on Azure
cloud platform show the practicality of the design. Our work can
also be easily extended to support other media applications that
employ media files with scalable structures.
Index Terms—Cloud media center, secure deduplication, scal-
able video coding, layer-level deduplication.
I. I NTRODUCTION
The explosive growth of multimedia contents, especially
videos, is pushing forward the paradigm of cloud-based media
hosting today. Towards such trend, many emerging media
applications, such as media live streaming [2], media coding
[3], media transcoding [4], and media contrast enhancement
[5], are being increasingly deployed at the cloud for the well-
understood service benefits [6].
While leveraging the cloud media center is quite promising,
the wide attacking surface of the public cloud and the growing
security awareness from the society are both calling for data
encryption before outsourcing to cloud. On the one hand,
public cloud might be vulnerable to security breaches, and
unauthorised data disclosure incidents occur from time to time
in recent years [7], [8]. On the other hand, semantically rich
Y. Zheng, X. Yuan, X. Wang, J. Jiang, and C. Wang are with the
Department of Computer Science, City University of Hong Kong, Kowloon,
Hong Kong, and J. Jiang is also with the Department of Computer
Science and Technology, Xi’an Jiaotong University, Xi’an, China (e-
mail: yifeng.zheng@my.cityu.edu.hk, xinglyuan3-c@my.cityu.edu.hk, xiny-
wang@cityu.edu.hk, jinghua2-c@my.cityu.edu.hk, congwang@cityu.edu.hk).
X. Gui is with the Department of Computer Science and Technology, Xi’an
Jiaotong University, Xi’an, China (e-mail: xlgui@mail.xjtu.edu.cn).
A preliminary version [1] of this paper was presented at the 10th ACM
Symposium on Information, Computer and Communications Security (ASI-
ACCS’15).
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
1
media data such as videos can easily reveal content-sensitive
information. For guaranteed confidentiality, data encryption is
considered by many as the only viable approach that needs
to be adopted, when building privacy-assured cloud based
applications [9].
Despite quite effective to address the security concerns,
directly applying data encryption to multimedia data would
explicitly invalidate many benefits of deploying the cloud-
based media applications. Accordingly, in the literature there
have been recent endeavors on investigating how to enable
the cloud to support various desirable functionalities over
encrypted multimedia data, such as encrypted feature extrac-
tion [10], [11], encrypted watermark detection [12], encrypted
scalable sharing [13], [14], encrypted social discovery [15],
etc. Under the circumstance of encrypted videos, how to still
preserve all the service benefits of cloud media centre remains
to be fully explored.
In this work, we show a secure system design along this
direction, which aims to bring together the advancements of
video coding techniques and secure deduplication. We target
the crucial deduplication functionality at cloud, which can
eliminate the burdensome storage and bandwidth overhead
when storing encrypted videos from different entities. Our
design is also fully tailored to the scalable video coding
(SVC) techniques from the very beginning, and supports the
ubiquitous adaptive video dissemination in the context of
heterogeneous networks and devices.
Specifically, for deduplication over encrypted data,
message-locked encryption (MLE) [16] is known as
the state-of-the-art approach, which generally uses keys
deterministically derived from the data (e.g., the hash value)
to generate tags for duplicate checking in the encrypted
domain. But directly applying MLE over videos would not
be suitable, as MLE is known to be vulnerable to off-line
brute-force guessing attacks, when the target plaintext is
from a small space or considered as predictable [17]. In
video applications, popular videos, trending searches, and
near-duplicate videos, might all fall into this predictable
space category, and could be the easy breach point of such
off-line guessing attacks, threatening the video confidentiality
guarantee. Besides, for proper video dissemination, the
encrypted deduplication design must also prevent malicious
users from illegitimately accessing unauthorised videos by
simply using the checking tags [18].
We propose a non-trivial secure deduplication framework
that will address the above problems completely and suit
the needs of cloud-based video applications. Specifically, it
supports secure deduplication with strong video protection
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
against malicious users and untrusted cloud. Building on top
of recent advancements on secure deduplication, it supports
secure deduplication with resistance to bounded data leakage,
and with defense against off-line brute-force attacks over
predictable videos, respectively. Meanwhile, we provide de-
signs for our secure framework in both the centralized and
decentralized settings, respectively, where the decentralized
setting provides stronger security than the centralized one. To
our best knowledge, no prior works enable an encrypted cloud
media center with such comprehensive protection.
Under this encrypted framework, we then consider how to
facilitate the fast-growing demand of adaptively disseminating
videos to heterogeneous networks and devices, such as PCs,
smart mobile devices, and SmartTVs [19]. One direct approach
is to store multiple encrypted versions of the same video
content at the cloud. However, it will incur a considerable
amount of storage and bandwidth overhead [20], increasing the
capital cost of using cloud services. To further mitigate such
burden while preserving the adaptive delivery functionality, we
resort to the SVC techniques [21]. With the special structure
of layers, including one base layer and several enhancement
layers, SVC enables multiple versions of the same video
content to be contained in a single video file, which can
greatly improve the storage efficiency and dissemination scal-
ability [22]. In light of these benefits, we carefully tailor our
secure deduplication design to be compatible with the inherent
characteristics of SVC videos. The proposed structure-aware
layer-level deduplication strategies effectively enable the en-
crypted SVC video deduplication, while efficiently supporting
the adaptive video delivery.
Aiming for a fully functional system implementation, we
also present a structure-aware encryption mechanism for SVC
videos, similar to the works in [23], [24], with further op-
timisations on the storage part to support efficient video
retrieval and dissemination. The structure-aware encryption
mechanism and the structure-aware deduplication strategies
are both completely compliant with the video format in SVC.
Thorough security analysis shows our system design achieves
strong protection of the video confidentiality. We conduct
experiments through an end-to-end prototype implementation
deployed on Azure, with about 17,000 lines of codes. Various
performance measures justify the effectiveness and efficiency
of our system. To cover a wide range of encrypted cloud media
applications, we also show how to extend our work to support
other media files that are inherently with scalable structures.
The rest of this paper is organized as follows. Section II
describes the related work. Section III presents our problem
formulation. Section IV presents the preliminaries. Section V
formulates the general system framework for secure dedupli-
cation. Section VI provides the construction of adaptive video
delivery with structure-aware secure deduplication. Section
VII presents the security analysis. Section VIII gives the
experiment results. Section IX concludes the whole paper.
II. R ELATED W ORK
A. Secure Deduplication
To support encrypted deduplication, Douceur et al. [25]
first propose convergent encryption (CE), which encrypts
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
2
data with a convergent key derived via computing the hash
value of the data content. CE has been deployed in many
systems [26]–[29]. Later, Bellare et al. [16] formalize CE
under the notion of message-locked encryption (MLE). Abadi
et al. [30] strengthen the security definitions of MLE by
considering plaintext distributions that may depend on the
public system parameters. Bellare et al. [31] further consider
privacy for messages that are both correlated and dependent on
the public system parameters, and extend MLE to interactive
MLE (iMLE), which is a theoretical construction that mainly
relies on extremely complex fully homomorphic encryption. In
[32], Li et al. leverage secret sharing and distribute the secret
shares of the convergent keys across multiple key management
servers, allowing users not to manage the keys on their own.
In [33], Stanek et al. study secure deduplication that provides
differential security for popular and unpopular data. They use
CE to encrypt popular data and design a two-layer encryption
scheme for the deduplication of encrypted unpopular data.
Although MLE and its variants ( [30]–[33]) support cross-
user deduplication in the encrypted domain, they are not
resistant to off-line brute-force attacks over predictable data
[17]. Moreover, they do not consider a strong security model
in which bounded data leakage might occur [18], i.e., the data
hash might be disclosed.
In order to defend off-line brute-force attacks in secure
destination-based deduplication, Bellare et al. [17] propose to
use a key server to obliviously provide message-derived keys
for encryption. They also adopt rate-limiting strategies on the
key server to mitigate online brute-force attacks in practice.
Later, Duan [34] resort to threshold signatures and extend the
framework of [17] to the setting of distributed key servers. In
[35], Puzio et al. [35] resorts to a server to further encrypt
the CE-encrypted data collected from users. Very recently,
Liu et al. [36] propose a scheme capable of defending offline
brute-force attacks without introducing additional independent
server. However, their scheme requires a number of online
users to actively assist the cloud to perform duplicate check
and help transfer encryption keys.
Despite useful in defending off-line brute-force attacks,
all these work do not consider any bounded data leakage
setting, in which the data encryption key might be leaked [18].
Very recently, Xu et al. [18] propose a secure source-based
deduplication scheme that is resilient to bounded data leakage.
However, the scheme does not offer the defense against off-
line brute-force attacks over predictable data.
Different from existing work, in this paper we carefully
design the encrypted cloud media center with comprehensive
protection. It supports secure deduplication with the resilience
to bounded data leakage, and with the defense against off-line
brute-force attacks, respectively. Moreover, our system bridges
the gap between adaptive video delivery and structure-aware
secure deduplication.
B. SVC Video Security
Our proposed research also relates to the branch of work
on SVC video security. In [23], Wei et al. propose a format-
compliant SVC encryption scheme, considering the scenario
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
when SVC videos is delivered through an open network.
The scheme achieves format compliance by constructing new
network abstract layer units to substitute the original ones,
so after encryption the video ciphertext still has the standard
SVC structure. Deng et al. [37] propose an efficient block-
based SVC encryption scheme. Their target scenario is that a
pay TV broadcaster wants to offer all users with the base layer
of the broadcast program, but requires that the enhancement
layers are only accessible to authorized users. Therefore, the
proposed scheme leaves the base layer in the cleartext and
adopts secure pseudorandom permutations on macroblocks
and subblocks to encrypt the enhancement layers. In [13],
Wu et al. investigate scalable access control on SVC videos
in cloud computing. They propose a new scalable access
control scheme based on ciphertext policy attribute-based
encryption (CP-ABE), which can embed multiple messages
into one ciphertext. The scheme enables users with different
privileges to derive the corresponding layer keys and further
the corresponding layers. Later, Ma et al. [14] propose a two-
dimensional scalable access control scheme for SVC. Unlike
[13] which uses hash chains to generate access keys, the
scheme adopts a CP-ABE based approach so as to resist user
collusion. In [38], Wei et al. present a hybrid authentication
scheme for SVC videos. The scheme uses message authenti-
cation code (MAC) to authenticate the base layer, and verifies
the enhancement layers via extracted video features. Different
from the above work, in this paper we investigate structure-
aware secure deduplication over encrypted SVC videos.
Portions of the work presented in this paper have previously
appeared as an extended abstract in [1]. We have revised the
article a lot and improved many technical details as compared
to [1]. The primary improvements are as follows: Firstly, we
provide a new Section V-C to extend the proposed system
framework to the decentralized setting of multiple agency
servers, enhancing the security and reliability. The security of
this new design is analyzed in detail in Section VII. We also
add Section V-D to show how our system framework can be
adapted to meet other security notions in secure deduplication.
Secondly, we add Section VI-C to generalize the construction
of secure SVC video deduplication, and also discuss structure-
aware secure deduplication over other scalable media in a new
Section VI-D. We also elaborate the encryption for both the
SVC video header and content in Section VIII-A. Thirdly, we
provide security evaluation in a new Section VIII-D to measure
the effectiveness of rate limiting in slowing down online brute-
force attacks. Finally, we redo all the experiments and extend
the performance evaluation.
III. P ROBLEM S TATEMENT
A. System Architecture
We consider an encrypted cloud video hosting service
involving three different entities, as illustrated in Fig. 1: the
cloud media center (abbr. cloud), the user, and the agency
server. Cloud serves as a video hosting platform that stores
encrypted videos outsourced by users. It enforces deduplica-
tion so as to eliminate the storage and bandwidth redundancy,
and is required to adaptively disseminate the encrypted videos
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
3
Encrypted Cloud Media Center
Agency Server
Encrypted Adaptive
Deduplication Delivery
Defense against
Off-line Attacks
User Devices
Fig. 1. Illustration of our system architecture.
to heterogeneous devices and networks. After the outsourcing
of encrypted videos, the user may delete them at local, and
later access her own videos at cloud. The agency server, hosted
by a third party, facilitates our system to defend off-line brute-
force attacks. In practice, it can be hosted by an independent
economical cloud service provider whose services are getting
cheaper [39], [40], or be a gateway server located within the
boundary of a large corporate customer of the cloud video
hosting service [17]. Specifically, the agency server provides
assistance to support secure deduplication in a controllable
fashion, and supports users to properly encrypt videos in a
way that enables secure deduplication. We note that the multi-
server model has been commonly adopted in the literature to
facilitate various security-aware cloud applications [11], [41]–
[44].
B. Threat Model
Our security goal is to provide strong protection for the
video confidentiality. In our system, two types of adversaries
are considered, i.e., external adversary and internal adversary.
The external adversary may refer to a user who might obtain
some knowledge of a video (e.g., a hash value) via some public
channel [18], [32], and attempt to cheat the video ownership
from cloud. For example, file hashes are widely used over
the Internet for integrity verification of downloaded files, and
they are not really meant to be secret [45]. We assume that the
external adversary will not upload a fake video to compromise
the integrity of other users’ videos. Video tampering detection
is not the focus of our work, and it can be handled by various
orthogonal mechanisms such as proof of storage [46].
The internal adversary is honest-but-curious, which may
refer to cloud or the agency server. First, cloud honestly
executes the designated deduplication protocols, yet intends to
extract the video content underlying users’ encrypted videos.
In particular, cloud may try to launch off-line brute-force
attacks over target predictable videos so as to recover the
video contents. Second, the third-party agency server honestly
executes the assigned functions, but also tries to infer useful
information about users’ videos. We will consider the settings
of a single agency server and decentralized agency servers,
respectively. In the former case, it is assumed that there is no
collusion between cloud and the agency server. In the latter
case, cloud is allowed to corrupt a certain number of agency
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
Algorithm 1 The RSA-OPRF protocol
Input: Message: M ; Secret key of the agency server: d.
Output: PRF result z.
User: // Blind message
1:
$
γ ← Z∗N ;
2: h ← H(M );
3: x ← h · γ e modN ;
4: Send x to the agency server.
Agency server: // Sign
5: y ← xd modN ;
6: Send y to the user.
User: // Produce the PRF output
7: z ← y · γ −1 modN ;
8: Ret G(z).
servers. Note that in this paper, we do not consider that cloud
modifies or deletes users’ videos.
IV. P RELIMINARIES
A. Oblivious Pseudorandom Function
An oblivious pseudorandom function (OPRF) protocol en-
ables two parties, say A holding an input x and B holding a
secret key sk, to jointly and securely compute a pseudorandom
function (PRF) fk (x). The protocol is executed obliviously
in the sense that A only learns the output value, while B
learns nothing from the process [47]. In our system, the user
interacts with the agency server via an OPRF protocol similar
to [17], which is built from blind RSA signatures [48]. Let
(N, e) and (N, d) be the agency server’s public key and secret
key, respectively, which are as in the RSA cryptosystem. Let
H : {0, 1}∗ → Z∗N and G : Z∗N → {0, 1}λ be two hash
functions. Algorithm 1 shows the RSA-OPRF protocol. Given
a message M (the PRF input), the user produces a blinded
hash x of the message and sends it to the agency server. The
agency server signs x with its secret key d (the PRF key)
and returns the signature y to the user, who then removes the
blinding to derive the actual signature and computes the hash
of the signature, i.e., G(H(M )d mod N ), as the PRF output.
B. Scalable Video Coding
SVC enables multiple representations of the same video
content to be contained in a single video file. A SVC video
consists of one base layer and several enhancement layers.
The base layer renders the basic visual quality, while the
enhancement layers can enhance the basic quality by sup-
plementing the base layer via different scalability dimensions
such as resolution, which we are particularly interested in
as the first instantiation. Note that during the decoding of a
SVC video, if a higher layer exists, a lower layer must be
present, but not the other way around. In other words, if the
SVC layers are discarded from the highest one, the remaining
layers are still decodable for visual rendering. Thus, using a
single SVC video, a user is able to adaptively enjoy different
representations of the same video content by using different
number of layers. Besides, SVC eliminates the redundancy
between multiple representations of the same video content
via various inter-layer prediction techniques [49]. In a word,
in terms of storage efficiency and dissemination scalability,
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
4
it is beneficial to store SVC videos at the cloud media
center to achieve adaptive video dissemination. Without loss
of generality, we can denote a SVC video SV with l layers as
SV = (m1 , m2 , . . . , ml ), where m1 is the base layer and mi
is the (i − 1)th enhancement layer for i ∈ [2, l] [13]. Table I
gives the description of the notations used in this paper.
V. S ECURE S YSTEM F RAMEWORK FOR T HE E NCRYPTED
C LOUD M EDIA C ENTER
In this section, we study secure deduplication in the en-
crypted cloud media center. In order to strongly protect the
video confidentiality while supporting the crucial deduplica-
tion functionality, we formulate a secure system framework
supporting secure deduplication with resistance to off-line
brute-force attacks over predictable videos by cloud, and
ownership cheating attacks by the user. Note that we do
not explicitly consider the underlying video structure when
designing the framework, and defer structure-aware secure
video deduplication to Section VI. Such treatment makes the
system framework also suitable for generic data, e.g., textual
files and images. We start with describing our design rationale
to address the threats mentioned in Section III-B. Then, we
present the secure system framework in detail. For simplicity
of exposition, we consider a single agency server during the
framework design. Subsequently, we will provide extension to
a decentralized setting of multiple agency servers, enhancing
the security and reliability. Finally, we investigate how the
system framework can be adapted to meet other security
notions in secure deduplication.
A. Design Rationale
Deduplication is crucial for the encrypted cloud media
center to eliminate the burdensome storage and bandwidth
overhead when storing encrypted videos from different users.
Our system targets secure source-based deduplication1 , where
the video redundancy is eliminated at the source side. More
precisely, duplicate check is performed before users upload
their encrypted videos so that the transmission of duplicate
videos would be saved. Our security design focused on ad-
dressing potential security threats by building on top of the
recent advancements on secure deduplication [17], [18].
First, we consider a strong security model of secure dedupli-
cation, i.e., the bounded leakage setting first proposed by Xu
et al. in [18], in which a certain amount of deterministically
and efficiently extractable information of the plaintext data
could be leaked. Under such model, MLE is not suitable for
use in our system as its key for encryption is not leakage
resilient. In particular, the key is generated from the data in
a deterministic way and might already be leaked before the
encryption process in practice [18]. For similar reasons, under
such model, simply using the plaintext video hash as a proxy
for the video ownership could also be insecure.
To resist the threats from bounded data leakage, we note
that the following treatment inspired from [18] could be used.
1 Destination-based deduplication requires all data to be uploaded to cloud
for the duplicate check.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
TABLE I
N OTATIONS USED IN THIS PAPER
Notations Description
V Video
SV SVC video
mi A SVC layer
u Initial user
u0 Subsequent user
L No. of layers of a SVC video of the initial user
L0 No. of layers of a SVC video of the subsequent user
Lc No. of layers of a SCV video stored at cloud
α Message-derived tag
β Message-derived label
r Masked key
H(V ) Hash value of a video
k1 Signing key for generating message-derived tag
k2 Signing key for generating message-derived label
τ Video encryption key
Cτ Ciphertext of encryption key
CV Video ciphertext
First, duplicate check is achieved at cloud via the hash value
H(V ) of the video V sent by the user. Second, the key τ
for encrypting videos is randomly selected by the user that
initially uploads that video. And she also hides τ by a one-
time message-derived mask via a keyed hash function, i.e.,
hs (·), where s is a random string. In this way, even the video
hash value H(V ) is possibly leaked, the video is still well
protected since τ is randomly generated. Moreover, the mask
enables all the subsequent users owning the duplicate videos
to extract the key τ , and further prove to cloud that they indeed
have the videos via a proofs-of-ownership (PoW) protocol.
The above treatment, however, is not directly suitable for
use in the encrypted cloud media center to strongly protect
the video confidentiality. Specifically, the above treatment
is vulnerable to off-line brute-force attacks over predictable
videos. More precisely, if such treatment is adopted for secure
deduplication, given the video ciphertext CV and knowing
that its underlying video V is from a dictionary DV =
{V1 , V2 , . . . , Vn }, cloud is able to recover V via launching
the following two kinds of off-line brute-force attacks. In the
first attack, cloud can first compute the hash for each candidate
Vi (i ∈ [1, n]) in DV , and then make comparisons between the
computed hashes and the received (stored) hash H(V ). When
two hashes are found equal, the target video V is recovered. In
the second attack, cloud may first produce a set of candidate
keys µset = {µ1 , µ2 , . . . , µn } by using each Vi in DV to
decrypt the masked random key. Then, cloud can try to use
each candidate key µi to decrypt the target video ciphertext,
and compare the decryption result with the candidate Vi in the
dictionary DV . When a match is found, then the target video
is recovered.
In order to provide strong video protection in the encrypted
cloud media center, we resort to an agency server for as-
sistance in our system (inspired by [17] ), maintaining the
security strength of the above treatment while avoiding its
vulnerability. Specifically, we leverage the agency server to
obliviously embed secrets in the video hash value H(V ).
An OPRF protocol is initiated between the user and the
agency server, producing a message-derived tag α and label
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
5
β, i.e., α = OPRFRSA RSA
k1 (H(V )) and β = OPRFk2 (H(V )),
where k1 and k2 are two different secret keys of the agency
server for signing. The tag α, instead of the plaintext hash,
is used for duplicate check at cloud. And the label β is
embedded in the one-time message-derived mask during the
initial upload of a new video, and assists the recovery of the
random key τ during the subsequent upload of a duplicate
video. We note that through this careful enhancement design,
our system can protect predictable videos against the off-line
brute-force attack by cloud, and thus strongly protect the video
confidentiality, which will be analyzed in detail in Section VII.
B. The Proposed Secure System Framework
Based on the above design intuition, we are now ready to
present our secure system framework for the encrypted cloud
media center. The service flow of our system framework con-
sists of three phases, i.e., initial upload, subsequent upload and
video retrieval. Let SE = (KGen, Enc, Dec) be a deterministic
symmetric encryption scheme with λ bits long key length and
hK : {0, 1}∗ → {0, 1}λ be a key-ed hash function. Each phase
is elaborated as follows:
Initial Upload. Suppose user u is the initial one who uploads
the video V . The protocol of initial upload consists of the
following steps:
(1) User u runs the RSA-OPRF protocol (see Algorithm 1)
with the agency server and derives the message-derived tag α
and label β;
(2) User u sends α to cloud for duplicate check and gets a
“non-duplicate” response;
(3) User u then encrypts V with a random key τ to produce
the video ciphertext CV ← Encτ (V ), and generates a masked
key r ← hs (V k β) ⊕ τ , where s is a random string. Besides,
u encrypts τ under her private key sk, which is pre-generated
via KGen, to produce the ciphertext Cτ ← Encsk (τ ). Finally,
u sends {CV , s, r, Cτ } to cloud;
(4) Cloud computes H(CV ) for the later use in ownership
verification in the phase of subsequent upload.
Subsequent Upload. Suppose u0 is a subsequent user who also
tries to upload V . The protocol of subsequent upload consists
of the following steps:
(1) User u0 derives the message-derived tag α and label β via
the RSA-OPRF protocol with the agency server;
(2) User u0 sends α to cloud for duplicate check and gets
a “duplicate” response along with (s, r), which indicates the
requirement of running a PoW protocol;
(3) User u0 recovers the encryption key τ via τ ← hs (V k
β) ⊕ r. Then u0 encrypts V with τ to produce the ciphertext
CV . Finally, u0 computes H(CV ) and sends it to cloud for
equality verification;
(4) After successful verification, u0 is admitted as the owner of
CV and encrypts the recovered τ under her private key sk 0 to
produce the ciphertext Cτ0 ← Encsk0 (τ ), which is then stored
at cloud.
Video Retrieval. Suppose now user u wants to access her
video V . The protocol of video retrieval consists of the
following steps:
(1) User u sends the request for CV to cloud;
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
(2) Cloud checks whether u is an owner of CV . If it is, cloud
returns {CV , Cτ } to u. Otherwise, cloud rejects the request;
(2) Upon receiving {CV , Cτ }, u uses her private key sk to
recover the decryption key τ from Cτ . Finally, u decrypts
CV with the recovered τ and derives the video V , i.e., V ←
Decτ (CV ).
C. Decentralized Secure System Framework - Multiple Agency
Servers
In the above proposed system framework, we consider a
single agency server for the defense against off-line brute-
force attacks. Sometimes, from the perspective of security and
reliability, one agency server might not be enough. Specifi-
cally, a single agency server is not able to provide compromise
resilience and fault tolerance. On the one hand, when the single
agency server is corrupted, the defense will be invalidated. On
the other hand, when the single agency server breaks down,
the system is not able to run normally since the user cannot
derive α and β. Therefore, to address the limitations of the
centralized setting of a single agency server, we also consider
extending the proposed framework to the decentralized setting
of multiple agency servers. Note that introducing decentralized
agency servers is affordable in practice. As mentioned before,
the agency service can be provided by other independent
economical cloud service providers and the multi-server model
has been widely used in the literature for secure applications.
One heuristic approach in the decentralized setting can be
considered as follows. Each agency server holds its own secret
keys. When a user needs to derive α and β, she runs the
RSA-OPRF protocol with each agency server. Then she uses
the concatenation of each PRF output from each RSA-OPRF
protocol to derive α and β, respectively. In this way, the system
can provide compromise resilience since now the defense line
against off-line brute-force attacks are established by multiple
agency servers. However, this approach does not help with
the reliability issue. Particularly, once an agency server breaks
down, the user is not able to derive valid α and β any more.
In order to simultaneously improve the system security and
reliability, we resort to threshold cryptography. Such treatment
also appears in existing work [32], [34].
In the decentralized setting, we replace the underlying RSA
signature scheme of the OPRF protocol with a threshold
version [50]. Let n be the number of signers and t < n
a threshold parameter, a (t, n)-threshold signature scheme
allows any subset of t signers to produce a valid signature,
but prohibits any t − 1 or less signers from doing so. Recall
that the agency server in our system framework plays the role
of a signer. It assists in generating the message-derived tag α
and label β, via signing the blinded input. Therefore, applying
the (t, n)-threshold RSA signature scheme in the decentralized
setting of n agency servers enables a user to derive α and β
from any subset of t agency servers. In this way, if an attacker
wants to break the defense line against off-line brute-force
attacks, it must corrupt at least t out of n agency servers.
Meanwhile, the system now is running without relying on a
single point any more. Hence, both the security and reliability
are boosted.
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
6
Algorithm 2 The Threshold RSA-OPRF protocol
Input: Message: M ; Secret key of agency server i: si .
Output: PRF output: z.
User: // Blind message
$
1: γ ← Z∗N ;
2: h ← H(M );
3: x ← h · γ e modN ;
4: Send x to a subset S of t agency servers.
Agency server i: // Sign
5: yi ← x2∆si mod N ; // ∆ = n!
6: Send yi to the user.
User: // Compute the PRF output.
7: λS
Q j
0,i = ∆ j∈S\{i} j−i , for each i ∈ S;
S
2λ
8: w = i∈S yi 0,i ;
Q
9: y = wa xb ; // a, b ∈ Z such that 4∆2 a + eb = 1
10: z ← y · γ −1 modN ;
11: Ret G(z).
Algorithm 2 illustrates how the threshold RSA-OPRF pro-
tocol2 works in the setting of n agency servers. Note that here
we do not explicitly differentiate the generation of α and β.
Different from Algorithm 1 in the centralized setting, the PRF
key d now is split into n secret shares and each secret share
si is held privately by agency server i. The splitting is based
on Shamir’s secret sharing method so that the PRF key d can
be reconstructed from any subset of t shares. The threshold
RSA-OPRF protocol consists of the following steps:
(1) Upon the input of a message M (the PRF input), the user
produces a blinded hash x of the message M , and sends it to
a subset S of t agency servers;
(2) Upon receiving the blinded hash, agency server i ∈ S signs
it with the secret key si , and returns the blind signature share
yi to the user;
(3) After receiving t blind signature shares, the user first
computes the value λS0,i for each i ∈ S, through the standard
Lagrange interpolation formula;
(4) The user performs combination of the blind signature
shares and produces a final blind signature y, from which she
further removes the blinding to derive the valid signature z.
(5) The user computes the hash of z as the PRF output.
D. Further Investigation
The proposed general secure system framework focuses on
defending the threats posed by data predictability and bounded
data leakage. We now show that this general framework can
be flexibly adapted to meet other security notions proposed
by existing work on secure deduplication. In particular, we
investigate how to support the security for lock-dependent
messages as defined in [30].
In [30], Abadi et al. consider the case of plaintext distribu-
tions that may depend on the public parameters of the schemes
in secure deduplication. Such inputs are referred to as lock-
dependent messages. They propose that when considering the
security of lock-dependent messages, using deterministic tags
for duplicate check in secure deduplication may not satisfy
the security for them. Specifically, if an adversary is allowed
2 We assume the setup process of threshold RSA signatures is properly done.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
to specify a distribution of plaintexts, it may use the fact that
the tags are deterministic for leaking unnecessary information
on the messages. For example, the adversary may select a
distribution that is concentrated on messages whose tags share
a particular property, such as that they all start with a zero bit.
To avoid using deterministic tags for duplicate check and
achieve the security for lock-dependent messages, they design
a randomized tag generation scheme that supports equality
testing. Specifically, a tag for the message M for duplicate
check is computed as ε = (g r , g rF (M ) ), where g is a generator
of a group, r is a random number, and F is a hash function.
And the equality testing is based on the use of bilinear map.
If considering the security for lock-dependent data, our gen-
eral system framework can seamlessly integrate this technique
to avoid using deterministic tags. Let e : G × G → GT be a
bilinear map, where G and GT are groups of prime order p,
and G is generated by the generator g. The bilinear map has
the following bilinearity property: e(g a , g b ) = e(g, g)ab , where
a, b ∈ Zp . Further, let F : {0, 1}∗ → Zp be a hash function.
We can adopt this technique as follows. After deriving α
from the agency server(s), the user produces the tag as ε =
(g r , g rF (α) ), which is sent to cloud for duplicate check. Given
two tags ε1 = (g r1 , g r1 F (α1 ) ) and ε2 = (g r2 , g r2 F (α2 ) ), cloud
? it is also not a desirable choice to directly split a SVC video
tests eb(g r1 , g r2 F (α) ) = eb(g r2 , g r1 F (α) ) to check duplicates.
E. Discussion on Near-duplicate Video Detection
We note that there are some plaintext works (e.g., [51])
studying near-duplicate video detection for storage reduction.
However, our system framework does not consider supporting
near-duplicate video detection to eliminate encrypted near-
duplicate video copies for the following reasons.
First, our target service setting is different from that of near-
duplicate video detection, which usually aims to discover the
near-exact video copies among the videos of a content provider
like YouTube [51], [52]. Second, the limitation of existing
plaintext techniques of near-duplicate video detection prevents
our design from eliminating encrypted near-duplicate video
copies from different users. The general principle of identify-
ing near-duplicate videos in the plaintext domain is measuring
the distance-based similarity of a compact representation of
videos call video signatures [53], which inevitably incur false-
positives [51], [52]. In particular, two videos that are identified
as near-duplicates under certain similarity measures may not
be perceptually similar, i.e. not really near-duplicate copies. If
we directly eliminate encrypted near-duplicate video copies
identified based on existing plaintext techniques, it would
cause the loss of user videos, seriously impacting the system
service and user experience.
VI. A DAPTIVE V IDEO D ELIVERY WITH
S TRUCTURE - AWARE S ECURE D EDUPLICATION
In this section, we illustrate how to bridge the gap between
video coding and secure deduplication, enabling the encrypted
cloud media center with efficient adaptive dissemination while
supporting structure-aware secure deduplication. In particular,
we exploit the SVC technique to support efficient adaptive
video delivery, and show how to perform effective structure-
aware deduplication over encrypted SVC videos. First, we
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
7
motivate the importance of layer-level deduplication for SVC
videos. Then, based on some important observations, we
present the detailed construction for secure SVC video dedu-
plication, under the above designed system framework. Note
that for the simplicity of exposition, we only present the
construction in the setting of single agency server, and it
can be extended accordingly in the setting of multiple agency
servers, as described in Section V-C. Further, we show how to
generalize the construction of secure SVC video deduplication.
Finally, we discuss structure-aware secure deduplication over
other file types with scalable structures.
A. Layer-level Deduplication
The common deduplication strategies, i.e., file-level dedu-
plication and block-level deduplication, are not suitable for
SVC videos. Consider a realistic scenario: A user has the
base layer and an enhancement layer for a source content,
while another user only has the same base layer. And both of
them use some cloud data hosting platform with deduplication.
At the file level, the two SVC videos are different as their
contents are not identical. Thus, by file-level deduplication, the
two SVC videos cannot be deduplicated. On the other hand,
into blocks and perform block-level deduplication, because the
layers in a SVC video are formatted in a special structure [21],
[38]. Hence, applying block-level deduplication may destroy
that structure and is not suitable for SVC. To address the above
challenges, we propose to exploit the layered nature of SVC
videos to enforce structure-aware layer-level deduplication,
which treats each SVC layer as a unit for deduplication.
B. Secure SVC Video Deduplication
Before going into the details of our construction of secure
SVC video deduplication, we describe two vital observations
which facilitate our design. First, we note that the base
layer in a SVC video plays a critical role. It serves as the
foundation of a SVC video and as the reference basis for
higher enhancement layers [21]. Such observation indicates
that if two SVC videos do not have the same based layer,
they can hardly have duplicate layers. It inspires us to utilize
the base layer for the duplicate check for a given SVC video.
Second, for the same source content, users who have the same
base layer may own different number of enhancement layers,
under their heterogeneous devices and network environments.
This indicates that we only need to store a single copy of SVC
video with the highest quality (i.e., with the highest number
of layers) for adaptive dissemination.
With the above observations, the main idea of secure SVC
video deduplication in our system design can be described as
follows. To upload a SVC video, a user first sends the message-
derived tag α1 of the base layer and the number of layers to
cloud for duplicate check. If there is not a match for α1 at
cloud, it is considered that the user has a new SVC video and
all layers should be uploaded. Otherwise, cloud has already
stored a SVC version with the same base layer and thus the
version of the user may contain a certain number of duplicate
layers. In this case, if the user’s SVC version has fewer layers
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
than that one at cloud, she has to run the PoW protocol over
all her layers with cloud. Otherwise, the PoW protocol only
needs to be run over the duplicate layers, while the additional
layers should be uploaded.
We are now ready to present our construction of secure
layer-level deduplication over encrypted SVC videos. It also
consists of three phases, i.e., initial upload, subsequent upload,
and SVC video retrieval. Let SV = {m1 , m2 , . . . , ml } denote
the SVC video to be uploaded, where l is the number of layers.
Each phase is elaborated as follows:
Initial Upload. Suppose the initial user u has L layers (i.e.,
l = L) to upload. The protocol of initial upload consists of
the following steps:
(1) User u interacts with the agency server to derive the
message-derived tag α1 of the base layer and a message-
derived label set {βi }1≤i≤L for all layers, where α1 =
OPRFRSA RSA
k1 (H(m1 )) and βi = OPRFk2 (H(mi )). Then, the
user sends α1 and the number L of layers to cloud;
(2) Cloud performs duplicate check based on α1 . As α1 does
not exist, cloud returns a “non-duplicate” response to u;
(3) User u encrypts each layer following the way as specified
in the proposed framework. For each layer mi , u produces a
layer ciphertext Ci , a masked layer key ri along with a random
string si , and a layer key ciphertext Cτi , where τi is the layer
key. Then u sends {Ci , (si , ri ), Cτi }1≤i≤L to cloud;
(4) Cloud computes H(Ci ) over each layer ciphertext Ci for
the later use of PoW protocol.
Subsequent Upload. Suppose the subsequent user u0 has L0
layers (i.e., l = L0 ) and the already stored SVC version
in cloud has Lc layers. The protocol of subsequent upload
consists of the following steps:
(1) User u0 derives the message-derived tag α1 of the base
layer and a message-derived label set {βi }1≤i≤L0 for all layers.
Then, the user sends α1 and the number L0 of layers to cloud;
(2) Cloud first performs duplicate check via α1 and finds
a match. It then checks the relation between L0 and Lc .
If L0 ≤ Lc , it returns a “duplicate” response along with
{(si , ri )}1≤i≤L0 . Otherwise, it returns a “duplicate” response
along with {(si , ri )}1≤i≤Lc ;
(3) If L0 ≤ Lc , user u runs the PoW protocol over all
layers to earn the ownership from cloud. Recall that the layer
keys {τi }1≤i≤L0 are recovered during the PoW process. Then
u0 encrypts each τi using her private key sk 0 and stores
{Cτ0 i }1≤i≤L0 in cloud;
(4) If L0 > Lc , for the Lc preceding (duplicate) layers
{mi }1≤i≤Lc of the SVC video, u0 runs the PoW protocol over
each of them to earn the ownership, and produces the cipher-
texts {Cτ0 i }1≤i≤Lc of the recovered layer keys {τi }1≤i≤Lc .
For each additional layer mi (Lc < i ≤ L0 ), u0 produces
a layer ciphertext Ci , a masked layer key ri along with a
random string si , and a layer key ciphertext Cτ0 i , where τi
is the layer key. Finally, u0 stores {Ci , (si , ri )}Lc <i≤L0 along
with {Cτ0 i }1≤i≤L0 in cloud.
Note that when L0 > Lc , cloud will update Lc as L0
only when user u0 passes the PoW protocol enforced over
all duplicate layers. If the number of layers actually owned by
user u0 is less than the claimed one, cloud would not update
Lc and only marks u0 as the owner of the duplicate layers,
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
8
over which she passes the PoW protocol successfully. That
is, during the subsequent upload, regardless of the number of
layers claimed by a user, she is marked as the owner of a
duplicate layer only when she passes the PoW protocol over
it.
SVC Video Retrieval. Suppose now user u wants to access
her SVC video. The protocol of SVC video retrieval consists
of the following steps:
(1) User u sends the request of lreq layers for SV to cloud;
(2) Cloud check whether u is an owner of all the requested
layers. If it is, cloud returns the corresponding layer and
key ciphertexts {Ci , Cτi }1≤i≤lreq . Otherwise, cloud rejects the
request or only returns the ones owned by u;
(3) Upon receiving the layer and key ciphertexts, user u uses
her private key to recover each layer key τi and then recover
each layer mi .
C. Generalized Secure SVC video Deduplication
The above construction of secure SVC video deduplication
is based on the assumption that the duplicate layers of different
users originate from the same source SVC video, considering
that duplicate usually comes from the same source in prac-
tice. Therefore, if a match for the base layer is found, the
succeeding layers are considered as identical. However, we
are also able to relax such assumption to accommodate the
more complicated cases, by slightly changing the construction
and generalizing it .
We now show how to generalize the above construction
by describing the main modifications. The main idea is to
perform duplicate check not only over the base layer, but
also over the enhancement layers. In particular, to generalize
the construction, some changes need to be made for the two
upload phases, which can be summarized as follows:
(1) To upload a SVC video with l layers, before the user
interacts with the cloud, she runs the RSA-OPRF protocol with
the agency server to derive a tag set {αi }1≤i≤l and a label
set {βi }1≤i≤l . Then the user sends the tag set {αi }1≤i≤l to
cloud for duplicate check;
(2) If the tag α1 of the base layer does not exist at cloud, it is
considered that the SVC video does not contain any duplicate
layers. Thus, cloud informs the user that all layers should be
uploaded;
(3) If the tag α1 of the base layer exists at cloud, it is
considered that a SVC version with the same base layer
has be stored. In this case, cloud first locates all stored
enhancement layers that are related with the matched base
layer, and forms a candidate set of duplicate layers, which
also includes the base layer. Then, by using the tags {αi }2≤i≤l
of the enhancements layers, cloud checks whether there exist
duplicate enhancement layers. In particular, cloud sequentially
performs duplicate check from tag α2 to αl , and stops as long
as no match for a certain tested tag is found;
(4) After the sequential duplicate check, cloud outputs a final
set of duplicate layers, over which the user is required to run
the PoW protocol to derive the ownership. Note that the user
also needs to upload the non-duplicate layers if she has.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
D. Secure Deduplication over Other Scalable Media
Although our proposed structure-aware secure deduplication
focuses on encrypted SVC videos, we emphasize that the
underlying design can also be flexibly extended to support
other media applications that employ media files with scalable
structures.
In real-world media applications, files of almost all formats
could be exchanged [13]. Specifically, the content of various
media file formats, e.g., text, JPEG 2000, H.26x and presen-
tations, can be divided into logical units. Each unit itself is
meaningful, and as more units are supplemented, more infor-
mation can be provided. Such media content can be referred
to as scalable media content [13]. It is obvious that the SVC
video studied in this paper is one kind of such scalable media,
which in turn indicates that the proposed idea/construction for
SVC is also able to embrace other scalable media.
Based on our design, we now summarize the core points
to perform structure-aware secure deduplication over other
scalable media. First, the deduplication design should take into
account the underlying structures of scalable media. It should
be designed at the logic unit level for scalable media so as
to achieve effectiveness, rather than at the file level or block
level. Second, utilize the message-derived tags of the basis
units for duplicate check, if they are the references units of
such scalable media. This can help the storage server shrink
the range of duplicate check and fast locate the duplicate.
VII. S ECURITY A NALYSIS
In this section, formal security analysis is provided to show
that our system design meets the security goals. In particular,
we will show that our system design is able to address the
threats from the external adversary (i.e., the user) and internal
adversary (i.e., cloud or the agency server), as mentioned in
Section III-B. More precisely, our system design is able to
address the threats of bounded data leakage and off-line brute-
force attacks over predictable videos, respectively.
We first prove that the proposed secure video deduplication
scheme, denoted by SVD, is secure in the bounded leak-
age setting. For simplicity of description, we denote with
(E, D,<PowP ,PoWV >) the three components of our SVD
scheme, where E is the user-side algorithm of encoding
a video V , which takes as input a video V , and outputs
(α, s, r, CV , τ ); D is user-side algorithm of decrypting a video
ciphertext CV , which takes as input a video ciphertext CV
and the key τ , and outputs V ; and <PoWP , PoWV > is the
prover algorithm and verifier algorithm in the PoW protocol,
respectively, where P takes as input V and output x0 ∈{τ, ⊥},
and V takes as input (α, s, r) and outputs x1 ∈{Accept, Reject}
and x2 ∈ {H(CV ), ⊥}. Our security proof will follow the
security framework in [18].
We now give the security formulation. In particular, the
formulation will address the protection of any physical bit of
a video from the external adversary user and the honest-but-
curious internal adversary cloud. Roughly speaking, a prob-
abilistic polynomial time (PPT) external/internal adversary is
not able to learn any new information on any physical bit of a
video V from the secure source-based deduplication process
beyond the side channel leakage.
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
9
The SVD security game GSVD A (η0 , η1 ) between a PPT
adversary A and a challenger w.r.t. SVD scheme is defined as
below, where η0 > η1 ≥ λ. Here, η0 denotes the lower bound
of min-entropy of the challenged video V at the beginning
of the game, and the adversary is allowed to learn at most
(η0 − η1 ) bits information of video V from the challenger.
Setup. Make the description of (E, D,<PoWP ,PoWV >)
public, and let V be sampled from any distribution over
{0, 1}B with min-entropy ≥ η0 , where the public integer
parameter B≥η0 is polynomially bounded in λ. The challenger
sends H(V ) to the adversary A.
Learning-I The adversary A can make a Leak-Query to the
challenger as follows:
• Leak-Query(F): This query is constituted of a PPT-
computable function F. To response this query, the challenger
computes w:=F(V) and sends w to the adversary, where the
bit-length of output w is required to be smaller than (η0 − η1 ).
Commit. The adversary A chooses a subset of f indices
i1 , i2 , · · · , if from [1, |V |], where f ≥ 1 and f +|w| ≤ η0 −η1 .
The challenger finds the sub bitstream γ ∈ {0, 1}f of V , such
that, for each j ∈ [1, f ], γ[j] = V [j]. The challenger chooses
$
a random bit b ∈ {0, 1} and sets γb := γ and γ1−b ← {0, 1}f .
The challenger sends (γ0 , γ1 ) to the adversary A.
Guess-I. Denote with ViewCommit A the view of the adver-
sary A. Given ViewCommit A as input, another PPT algorithm
called “extractor” A∗ outputs a guess bA∗ of value b.
Learning-II. The adversary A can adaptively make the
following queries to the challenger, where concurrent queries
are not allowed and each query is described as follows:
• Encode-Query: In response to the Encode-Query, the
challenger runs the probabilistic encoding algorithm on V to
generate (C0 , CV , τ, ) := E(V, 1λ ), where C0 = (α, s, r).
Then, the challenger sends (C0 , CV ) to the adversary. The
adversary can make exactly one query in this type.
• Verify-Query: The challenger running the
prover algorithm PoWP with input V , obtains
(x0 ; x1 , x2 ) :=<PoWP (V ), A> via interacting with adversary
A which replaces the verifier algorithm V. The adversary
knows the values of x1 and x2 , and can make polynomially
many queries in this type.
• Prove-Query: The challenger running the verifier al-
gorithm PoWV with input C0 , obtains (x0 ; x1 ; x2 ) :=<
A, PoWV (C0 ) via interacting with the adversary A which
replaces the prover algorithm PoWP . The adversary A knows
the value of x0 , and can make polynomially many queries in
this type.
Guess-II. The adversary A outputs a guess bA ∈ {0, 1} of
value b.
Definition 1. (Secure SVD). Let λ be the security parameter
and η0 >η1 ≥ λ. We say a SVD scheme(E, D,<PowP ,PoWV >
) is (η0 , η1 )-secure, if for any (internal or external) PPT
adversary A, there exists some PPT extractor algorithm A∗ ,
such that in the security game GSVD
A (η0 , η1 )
P r[bA = b] ≤ P r[bA∗ = b] + negl(λ) (1)
The above definition requires P r[bA = b] ≤ P r[bA∗ =
b] + negl(λ), which means that the adversary A essentially
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
cannot learn any new information on physical bits of the video
V during Learning-II phase.
Theorem 1. Let η0 > η1 = 2λ + Ω(λ), and the hash function
H be a collision-resistant full domain hash function. If the
encryption scheme SE is semantically secure and the hash
function family {hs (·)} is a universal hash, the SVD scheme
is (η0 , η1 )-secure.
Proof. For any PPT adversary ASVD against the proposed
SVD scheme, we show that we can construct a PPT adversary
ASE against the underlying semantically secure symmetric
encryption scheme SE.
Construction of ASE : The adversary ASE is given a cipher-
text CV = SE.Encτ (V ), where the encryption key τ and the
input video V are unknown and V has at least η0 bits min-
entropy. The adversary ASE is allowed to learn any output of
F(V ) from the oracle OV , where the PPT-computable function
Func is chosen by ASE .
The adversary ASE can simulate a security game G Sim as
below, where ASE plays the role of challenger and ASVD plays
the role of adversary:
Setup. The adversary ASE learns the hash value H(V ) from
the oracle OV , and sends α = OPRF(k1 , H(V )) to ASVD .
Learning-I. The adversary ASE simply forwards Leak-
Query made by ASVD to the oracle OV and forwards the
response given by the oracle to ASVD .
Commit. The adversary ASE learns the value of the chal-
lenged sub bitstream γ = V [i1 ]||V [i2 ]|| · · · ||V [if ] from the
oracle OV and then exactly follows the rest part of Commit
phase in the real game GSVD A .
Guess-I. Denote with bSim A∗ ∈ {0, 1} the output of the
SVD
extractor A∗SVD .
Learning-II. Challenger ASE answers the queries made by
A∗SVD as follows:
• Encode-Query: To respond to the encode query,
the challenger ASE independently and randomly chooses
$ $
τb ← KGen(1λ ), and s1 , s2 ← {0, 1}λ , and set Cτb :=
(s1 , s2 , α). Let (C0 , C1 ) = (Cτb, CV ), and sends (C0 , C1 ) to
ASVD . Recall that ASE is given the ciphertext CV , and α is
obtained from the oracle OV and OPRF protocol in the Setup
phase.
• Verify-Query: The adversary ASE runs the prover al-
gorithm and ASVD replaces the verifier algorithm. Denote
the message received from ASVD as (y1 , y2 ). If (y1 , y2 ) =
(s1 , s2 ), then send H(CV ) to ASVD ; otherwise, send a random
$
value H ← {0, 1}λ to ASVD .
• Prove-Query: The adversary ASE runs V(C0 ) to interact
with adversary A∗SVD which replaces the prover algorithm,
following the description in game GSVD A exactly.
Guess-II. The adversary ASVD outputs a guess bSim
ASVD ∈
{0, 1} of b. The game GSim simulated by ASE completes.
Finally, ASE outputs γbSim ∈ {γ0 , γ1 }, and wins
ASVD
the semantic-security game w.r.t. encryption scheme SE if
γbSim =γ=V [i1 ]||V [i2 ]|| · · · ||V [if ]. So far, ASE has received
ASVD
at most (λ+η0 −η1 ) bits (in term of length) message about the
unknown video V from the oracle OV . Therefore, according to
Lemma 2.2 in [54], after leakage from the oracle, the unknown
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
10
video V should have at least (η1 − λ) = λ + Ω(λ) bits min-
entropy.
Claim 1. Suppose that SE is a semantically secure symmetric
key encryption scheme and {hs (·)} is a universal hash family.
The simulated game GSim is computationally indistinguish-
able with the real game GReal = GSVDASVD (η0 , η1 ) to the view
of adversary ASVD .
Proof. All messages that the adversary ASVD obtain in game
GReal from the challenger are (QReal , α, s, hs (V ||β)⊕τ, CV ),
where QReal = (w, γ) and w is the output of Leak-Query and
γ is computed in Commit phase. Similarly, the counterpart in
game GSim is (QSim , α, s1 , s2 , CV ). For the same adversary
ASVD with the same random coin, QReal = QSim . So for
simplicity we just write them as Q.
Sample a video V 0 from {0, 1}|V | following the same
distribution from which V is sampled. Generate a key τ 0 =
SE.KGen(1λ ) and encrypt V 0 with key τ 0 to obtain video ci-
phertext CV 0 = SE.Encτ 0 (V 0 ). Let Y ≈ind Z denote that ran-
dom variable Y and Z are computationally-indistinguishable.
We have
(Q, α, s, hs (V ||β) ⊕ τ, CV ) (2)
≈ind (Q, α, s, hs (V ||β) ⊕ τ, CV 0 ) (3)
≈ind (Q, α, s1 , s2 , CV 0 ) (4)
≈ind (Q, α, s1 , s2 , CV ). (5)
The above equations can be explained as follows. First, Eq
(2)≈ind Eq (3) is because SE is a ciphertext-indistinguishable
symmetric encryption scheme. In particular, given information
(Q, α, s, hs (V ||β) ⊕ τ ) about video V , the unknown video V
still has at least Ω(λ) entropy, hence its encryption CV is
computationally indistinguishable from an encryption CV 0 of
a random video V 0 ∈ {0, 1}|V | under a random encryption
key τ 0 , where V 0 is sampled following the same distribution
from which V is sampled. Second, Eq (3) ≈ind Eq (4) follows
directly from the leftover hash lemma [55] which applies to
the universal hash {hs }. Note that CV 0 is independent of the
other terms in these two equations. Finally, Eq (4) ≈ind Eq (5)
again relies on the ciphertext-indistinguishability property of
the encryption scheme SE. Note that s1 , s2 are independent
of the other terms in these two equations. This completes the
proof for Claim 1.
Claim 2. There exists some PPT extractor A∗SVD , such that
P r[bSim
ASVD = b
Sim
] ≤ P r[bSim
A∗ = bSim ] + negl(λ).
SVD
Proof. During the Learning-II phase of the simulated game
GSim , the challenger ASE does not make any new queries
to OV , and all responses that AE provided to ASVD are
computed from randomly sampled values and information that
ASVD has already known before Learning-II (i.e. the hash
value H(V )), except the ciphertext CV . Straightforwardly, we
have
V
P r[AO Sim
SE (CV , |V |) = γ] = P r[bASVD = b
Sim
]
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
11

the agency server, cloud is not able to generate the message-

As the underlying symmetric encryption scheme SE is derived label β for each candidate in the dictionary. And
semantically secure, there exists a PPT algorithm C, such that thus for each trial, cloud is required to interact with the
V V agency server to get β and unmask the key via xoring a
P r[AO
SE (CV , |V |) = γ] ≤ P r[C
O
(|V |) = γ] + negl(λ) mask derived from β and V . In a word, our design effectively
prevents off-line brute-force attacks over predictable videos in
An extractor A∗SVD can be constructed based on algorithm C a controllable fashion.
as follows. Let γC be the output of C. If γC = γbb ∈ {γ0 , γ1 } for We now further analyze the security against the agency
some bb ∈ {0, 1}, then A∗SVD outputs bSim := bb; otherwise server in both the centralized and decentralized settings:
A∗ SVD
$ The case of single agency server. We also consider that
ASVD outputs a random bit bSim
A∗ ← {0, 1}. We have the agency server is semi-trusted. It faithfully assists in the
SVD

V generation of the message-derived tag α and label β via its

P r[bSim
ASVD = b
Sim
] = P r[AO
SE (CV , |V |) = γ] private keys, but is interested in H(V ). Accordingly, our
V
≤ P r[C O (|V |) = γ] + negl(λ) (6) system adopts the RSA-OPRF protocol, so the input H(V )
≤ P r[bSim =b Sim
] + negl(λ) is protected against to the agency server.
A∗
CSD
The case of decentralized agency servers. Recall that in the
Hence, there exists some PPT extractor A∗SVD , such that setting of decentralized agency servers, we resort to threshold
P r[bSim Sim
] ≤ P r[bSim = bSim ] + negl(λ). cryptography and replace the underlying RSA scheme of the
ASVD = b A∗SVD
Moreover, it is implied by Claim 1 that OPRF protocol with a threshold one. During the interaction
with different agency servers, the input H(V ) is still blinded
|P r[bSim
ASVD = b
Sim
] − P r[bReal
ASVD = b
Real
]| ≤ negl(λ) (7) to each agency server. Therefore, each involved agency server
is also not able to learn any information about the H(V ).
|P r[bSim
A∗
CSD
= bSim ] − P r[bReal
A∗
SVD
= bReal ]| ≤ negl(λ) (8) Besides, we note that the decentralization of agency servers
significantly enhances the security strength of our system
We have the following by combining Eq (6), Eq (7) and Eq framework. In particular, the security of threshold RSA sig-
(8): nature guarantees that the attacker has to corrupt up to a
threshold number of agency servers so as to break the defense
P r[bReal
ASVD = b
Real
] ≤ P r[bReal
A∗
SVD
= bReal ] + negl(λ) (9) line against off-line brute-force attacks. This indicates that
the defense line becomes much stronger as the attack now
demands much more efforts, compared with the centralized
Therefore, the proposed secure video deduplication scheme setting of a single agency server.
SVD is (η0 , η1 )-secure according to Definition 1. This com- It should be noted that even if collusion attacks between
pletes the proof. agency servers could be possible, the security of our decen-
tralized scheme against off-line brute-force attacks will not be
In the above security analysis, we show that our proposed compromised. In particular, the collusion between a threshold
secure video deduplication scheme is secure in the bounded number of agency servers will just reveal the signing keys
leakage setting. We now analyze the security against off-line to themselves. As analyzed above, as long as cloud does
brute-force attacks over predictable videos. not have access to the signing keys, it is prevented from
Theorem 2. For a predictable video that falls in a dictio- launching off-line brute-force attacks. In a word, from the
nary D = {V1 , V2 , · · · , Vn }, our design prevents cloud from security perspective, leveraging multiple agency servers avoids
launching off-line brute-force attacks in our design. the problem of single point of failure, significantly enhancing
the security of our system.
Proof. As described in Section V-A, if cloud knows that Note that the proposed construction of secure SVC video
the plaintext underlying a target video ciphertext is from deduplication is built under the secure deduplication frame-
a relatively small message space (or a dictionary), it can work. And ownership verification via the PoW protocol is
compute the hashes of all candidates in the dictionary. We enforced over each duplicate layer, ensuring that only the user
note that leveraging the agency server in our system design who indeed owns the duplicate layers can earn the ownership.
can effectively prevent off-line brute-force attacks. Discussion. With the assistance of the agency server, cloud
Firstly, instead of directly exposing the hash H(V ) to cloud is prevented from launching off-line brute-force attacks over
for duplicate check, we leverage the agency server to assists predictable videos. Hence, if cloud intends to recover a target
the generation of the message-derived tag α. Without the predictable video, it is forced to mount online brute-force
private key of the agency server, cloud is not able to produce attacks, i.e., each trial is required to access the agency server
α for each candidate in the dictionary by itself. Hence, for to obtain the tag α or the label β 3 . In this case, several proper
each trial, it is required to interact with the agency server to rate-limiting strategies, e.g., fixed delay and bounded query,
obtain α. Secondly, cloud may also try to recover the video can be adopted at the agency server side to effectively slow
encryption key and then obtain the video plaintext, as it owns
the video ciphertext CV and the masked key τ ⊕ hs (V ||β) 3 The tag-based method can be easier than the label-based one as it only
(along with a random string s). Likewise, without accessing requires tag equality testing.

1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
SPS SSPS
SVC File Header
Frame 1 ...
NALU
Frame 2 ...
NALU
...
(a) SVC structure
NALU Header SVC Extension Header
F NRI Type R I PRID N DID QID TID U D O RR
(b) NALU structure
Fig. 2. Structures of SVC and NALU. Note that the SVC extension header
is specified for the NALUs of enhancement layers.
down the online brute-force rates [17]. We will show the
effectiveness of rate-limiting in the following section.
VIII. E XPERIMENTS
A. SVC Video Encryption
We now first illustrate how to perform proper encryption
over SVC videos in our system, including the video header
and content (layers). Fig. 2 illustrates the underlying structure
of a SVC video. At a high level, a SVC video consists of
a file header and a number of frames. In the file header,
the indispensable information includes sequence parameter
set (SPS), subset sequence parameter set (SSPS), and picture
parameter set (PPS). The base layer refers to the SPS, while
each enhancement layer refers to a corresponding SSPS. And
each layer relates to a corresponding PPS [56]. Each parameter
set is in the format of a network abstraction layer unit (NALU),
which is composed of a NALU header and payload, as shown
in Fig. 2 (b). Different kinds of parameter sets can be identified
by the Type field in the NALU header, while each parameter
set of the same type (i.e., SSPS and PPS) can be identified to
a corresponding layer by the NALU payload.
To encrypt the SVC video header, one straightforward way
is to treat the parameter sets as a whole and encrypt it.
However, such treatment is not scalable as it requires the
user to retrieve the whole encrypted header information each
time when requesting a SVC video, regardless of the number
of layers requested. Instead, we adopt a separate encryption
mechanism, i.e., encrypting each parameter set independently.
In this way, upon receiving the request of a certain number of
layers of a SVC video, cloud can just return the corresponding
encrypted parameter sets along with the encrypted video
content. Note that the parameter sets are encrypted by the
user’s secret key and thus do not get involved in deduplication.
Regarding the SVC video content, each frame at a high
level, as shown in Fig. 2 (a), consists of a base layer and
several enhancement layers [21]. To encrypt the SVC video
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Multimedia
12
... PPS ...
content, one straightforward method is to encrypt each layer
per frame. However, this method is not directly compatible
Frame i
Base with the underlying SVC structure [23], [24]. Specifically,
NALU
Layer in the SVC standard each layer is also divided into it own
Enhancement NALUs. A NALU pair (Type 14, Type 1) or (Type 14, Type
NALU
Layer1
5), is used together to represent the base layer, while NALUs
...
of Type 20 are used for the enhancement layers, and each
of them can be identified by the dependency id (DID) in the
SVC extension header of the NALU. If the whole layer is
encrypted, a user client requesting a SVC video is not able
Payload to perform timely decryption until the whole layer ciphertext
is downloaded, which in turn affects the timely decoding for
playback.
Instead of performing layer-level encryption for the SVC
video content, we adopt the NALU-level encryption mech-
anism inspired from [23], in which the payload of each
NALU is encrypted individually and the header information
is left in cleartext. Consequently, the client is able to perform
decryption and then decoding as long as one encrypted NALU
is received. The processing of each layer can be executed in a
pipelined fashion at the user client. Regarding the implemen-
tation, the user client extracts the NALUs belonging to the
same layer per frame, encrypts them one by one, and uploads
them to cloud.
B. Implementation
We implement our system prototype with roughly 7,000
lines of C++ code and 10,000 lines of Java code. It is deployed
at Azure D4 instances. For cryptographic primitives, we use
the GMP library 4 and the Openssl library 5 to implement blind
signature, symmetric encryption (AES/CBC-256), and full-
domain hash function (SHA-256). For video coding, we collect
videos from the VIRAT [57] and DASH [58] benchmarks,
encode them into SVC videos with the JSVM software6 . And
the decoding of SVC videos is done with the Open SVC
decoder [59]. Besides, we integrate the Open SVC decoder
library to a open source video player MPlayer7 and re-compile
it to play the SVC videos.
Entity Implementation. The implementation of each entity
is presented as follows. (1) User Client: it is developed in
C++ and processes user’s requests. To generate the tag α
and label β, the user client communicates with the agency
server. We also implement a basic access control mechanism,
which includes user login and register operations; (2) Agency
server: it is also developed in C++. The agency server will
sign the blinded input received from the user client and return
the result; (3) Application server: it is implemented with Java
and has three functions. Firstly, it handles the request from the
user client for duplicate check, queries the storage server, and
then query result to the user client. Secondly, it processes the
PoW protocol. Lastly, it verifies the access permission upon
receiving the request of video download from the user client,
and returns the corresponding SVC videos; (4) Storage server:
4 The CNU Multiple Precision Arithmetic Library: https://gmplib.org
5 OpenSSL Project: http://www.openssl.org
6 Joint Video Team: SVC reference software(jsvm soft- ware), 2011.
7 MPlayer: http://www.mplayerhq.hu/design7/dload.html
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
(a) 144P (b) 240P
Fig. 3. Visual experience of different qualities for a given SVC video after
the decryption and decoding at the user client.
it stores SVC video ciphertexts along with tags for duplicate
check and ciphertext hashes for PoW, and the user profiles with
encrypted private keys and video ownerships. Note that we
use Thrift with cross-language Remote Process Call (RPC)8
to create network services between the entities.
Storage Optimization. In our implementation, the NALUs
belonging to the same layer are grouped as a layer block
at the storage server. During the download of SVC videos,
the storage server needs to fast locate the corresponding layer
blocks and their NALUs. In the SVC standard [21], a start
code prefix 0x00000001 is added between each NALU for
separation. Regarding our NALU-based encryption, using the
start code to fetch NALUs may not meet the performance
requirements for fast NALU fetching during video retrieval.
To address this issue, we utilize the Key-Length-Value
(KLV) encoding standard9 to package the NALUs, optimizing
the storage of SVC. In particular, each NALU is encoded into
a Key-Length-Value triplet, where Key identifies the NALU
(its frame ID), Length specifies the NALU’s length, and
Value is the NALU itself. Consequently, the storage server
can efficiently distinguish each encrypted NALU. And upon
receiving the request of SVC video download, the storage
server can efficiently fetch the encrypted NALUs by the help
of Length, and combine them with the same frame ID.
C. Visual Experience
Fig. 3 displays the different qualities for a given SVC
video after the decryption and decoding at the user client.
It is observed that the results are consistent with the inherent
characteristics of SVC. In particular, the more layers the video
has, the higher quality the video is. Therefore, our security
design does not affect the visual scalability of SVC.
D. Security Evaluation
The Case of Single Agency Server. In our system, we first
consider an agency server to enforce that brute-force attacks
over predictable videos can only be launched online. We now
show that with some proper rate-limiting strategy, online brute-
force attacks can be slowed down effectively. In particular, we
adopt one of the common rate-limiting strategies called fixed
delay [17], which works by introducing a artificial delay tD
before the agency server responds to a query. Since the process
of accessing the agency server is indispensable for each trial of
8 Apache
Thrift: http://thrift.apache.org
9 BT.1563: Data encoding protocol using
http://www.itu.int/rec/R-REC-BT.1563-1-201103-I/en
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Multimedia
13
TABLE II
E FFECTIVENESS EVALUATION OF FIXED - DELAY (1 SECOND ) RATE
LIMITING . T HE N ONE COLUMN CORRESPONDS TO NO RATE LIMITING .
Space Off-line t1 (s) None t2 (s) Fixed delay t3 (s)
215 33.76 167.28 32934.28
(c) 1080P 220 1080.61 5352.98 1053927.98
225 34579.52 171295.38 33725726.38
brute-force attacks, the increased time cost of tag generation
slows down the attack.
To demonstrate the effectiveness, we simulate the brute-
force attack and estimate the required time. As assumed, the
attacker can narrow the video spaces via the sizes of SVC
layers, the SVC structure, etc. Thus, the number of trials of
brute-force attacks can be greatly reduced. We use the off-line
brute-force attack as our baseline, and evaluate its costs under
two situations, i.e., introducing the agency server with and
without the fixed delay strategy. We note that the time cost of
off-line brute-force attacks can be just considered as the SHA-
256 computing time. And we use a single-layer SVC video
with a size of 100 KB as the attacker’s target, and evaluate
the attack under three different message spaces, i.e., 215 , 220
and 225 . Table II shows the results, where the “None” column
corresponds to no rate limiting. We can observe that by just
introducing 1 second delay for response at the agency server,
the attack can be slowed down significantly. For example,
under the 220 message space, the off-line attack only needs
roughly 18 minutes to succeed, while using the fixed delay,
more than 12 days are required. Overall, the fixed-delay rate
limiting can slow down brute-force attacks by 975 times.
The Case of Decentralized Agency Servers. We now further
analyze the effectiveness of rate limiting in the setting of
decentralized agency servers. Recall that in such setting, the
tag α can be successfully produced with the assistance of any
subset of t out of n agency servers. Hence, the online brute-
force rate will be increased by a factor of n/t. We remark
that compared with single agency server, the effectiveness
of rate limiting in the decentralized setting is lowered but
controllable, via properly selecting the parameters of the
(t, n)-threshold signature scheme. On another hand, recall that
the decentralization of agency servers avoids single point of
failure from the perspective of both security and reliability.
E. Performance Evaluation
Storage Consumption. We measure the increase in storage at
cloud to support the proposed secure deduplication design. To
store a SVC video with l layers, the storage overhead includes
the tag α1 (32 bytes) for duplicate check, l masked key r with
seed s (64 bytes per one), l owner key ciphertexts (32 bytes
per one) and l hashes of the layer ciphertexts (32 bytes per
one). Recall that the message-derived tag of the base layer
is used for duplicate check, as two SVC videos which do not
have the same base layer can hardly have duplicate layers [38].
Totally, the storage overhead for a SVC video with l layers
is 32 + 128l bytes, which is roughly in linear to the number
key-length-value: of layers and independent of the video size. Fig. 4 shows the
relation between the storage overhead and the sizes of SVC
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
14

−3 1.2
10 tGen
1 layer
1 vEnc
3 layers
rGen
−4 5 layers
Storage overhead ratio 10 7 layers 0.8

Time (sec)
0.6
−5
10
0.4

−6 0.2
10
0
1 2 3
−7 Number of Layers
10
0 50 100 150 200
SVC video size (MB)
Fig. 5. Computation costs for initial upload of different number of layers of
a SVC video with size 70MB. There are totally three layers.
Fig. 4. Ratio of the storage overhead to the SVC video size.

10
tGen
vEnc
8
videos with different number of layers. It is observed that rGen

our security design incurs little storage overhead, compared

Time (sec)
6
with the video sizes under different number of layers. For
4
example, given a SVC video with 1MB size and 7 layers, the
storage overhead is only 928 bytes, just 0.09% of the video 2

size. And for a fixed number of layers, the ratio quickly drops 0
70 113 207 324 462 669
and becomes negligible as the video size gets larger. SVC video size (MB)

Computation Performance. We measure the performance of

Fig. 6. Computation costs for initial upload of SVC videos with the same
different computation components during the initial upload. number (three) of layers but different sizes.
Recall that there are four computation components: (1) gener-
ation of tag α1 via RSA-OPRF; (2) encryption of SVC video; 0.8
(3) generation of the masked key r (label β via RSA-OPRF 0.7
included); (4) encryption of key τ . We note that the time of key 0.6

encryption is negligible compared to others, so we focus on 0.5

Time (ms)

0.4
the first three ones, which are denoted as tGen, vEnc and rGen,
0.3
respectively. Besides, vEnc is regarded as the necessary opera- 0.2
tion to protect the video confidentiality. Thus, the computation 0.1
overhead for secure deduplication lies in the components tGen 0
0 2 4 6 8 10 12
and rGen. We evaluate the computation performance for both t

the centralized and decentralized settings.

The case of single agency server: Fig. 5 shows the
time costs of the three components tGen, vEnc and rGen,
when different number of layers of a 70MB SVC video is
uploaded. The network delays in the RSA-OPRF protocol are
not considered. It is shown that the time consumed by vEnc
and rGen linearly increases with the number of layers, as
the relevant operations should be conducted for each layer. In
contrast, the time consumed by tGen remains constant since it
is only related to the base layer. Fig. 6 further illustrates the
time costs of the three components tGen, vEnc and rGen for
SVC videos with different sizes but with the same number of
layers. When the video sizes increase, the layer sizes increase
as well, so each computation component will take more time
to complete. For SVC video sizes ranging from 70MB to
669MB, on average, the total computation costs of the three
components vary from 1.047 seconds to 9.6207 seconds.
The case of decentralized agency servers: The decentral-
ization of agency servers only affects the tGen and rGen
components, since they proceed under the agency server’s
assistance. Recall that the threshold RSA-OPRF protocol
requires the user to perform the combination of blind signature
shares, which is the extra computation compared with the
non-threshold one. Hence, we focus on measuring the time
consumed by the user to perform blind signature share com-
Fig. 7. Time to combine the shares of blind signatures for varying the
threshold t out of totally sixteen agency servers.
bination. Fig. 7 shows the time to combine the shares of blind
signatures, for varying the threshold t when there are totally
16 agency servers. It is observed that time grows linearly with
t. Moreover, the cost is only at the order of milliseconds.
Time Savings from Secure Deduplication. Similar to
prior work on secure source-based deduplication [18], we
also measure the time savings provided by our customized
secure deduplication design, compared with a basic policy
Enc+No-Dedup in which that the encrypted duplicate SVC
videos (layers) are always sent to cloud. The running time
of that policy includes the encryption time and the network
transfer time, while in our system it includes the time of all
customized computation and network interactions for a user
to obtain ownership of duplicates. We consider two network
scenarios, i.e., a fast network (20Mbps) and an extremely
fast network (100Mbps) [60]. Note that for the simplicity
of presentation, we only evaluate the case of single agency
server. As illustrated above, the additional time costs in the
decentralized setting would be trivial.
Fig. 8 compares the running time between our system and
the Enc+No-Dedup policy over different number of duplicate

1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
30
Our system (20Mbps)
25 Our system (100Mbps)
Enc+No−Dedup (20Mbps)
Enc+No−Dedup (100Mbps)
20
Time (sec)
15
10
5
0
1 2
Number of layers
3 R EFERENCES
Fig. 8. Running time of our system and Enc+No-Dedup policy, over different
number of duplicate layers for a 70MB SVC video with totally three layers.
300
Our system (20Mbps)
250 Our system (100Mbps)
Enc+No−Dedup (20Mbps)
200 Enc+No−Dedup (100Mbps)
Time (sec)
150
100
50
0 on Multimedia, vol. PP, no. 99, p. 1, 2015.
70 113 207 324 462
SVC video size (MB)
Fig. 9. Running time of our system and Enc+No-Dedup setting, over SVC
videos in different sizes but with the same number (three) of duplicate layers.
layers of a 70MB SVC video. It is observed that in both
network scenarios, our system always consumes much less
time than the compared policy. The reason is that our system
enforces source-based deduplication, and thus network transfer
of duplicate layers is saved. Although some specific security
mechanisms such as the RSA-OPRF and PoW protocols are
involved in our system, their impact on the time savings
rendered by deduplication is modest. In Fig. 9, we further
compare the running time between our system and the policy
over SVC videos of sizes from 70MB to 669MB, but with the
same number of duplicate layers. As shown, for the 70MB
SVC video in the 20 Mbps network scenario, the compared
policy takes 28.9431 seconds, while the time for our system
is only 1.7065 seconds; in the 100 Mbps network scenario,
the compared policy takes 6.0296 seconds, while the time
for our system is only 1.7061 seconds. On average, the time
savings via our secure system can achieve about 94.37 % in the
20Mbps network and about 72.92% in the 100Mbps network,
respectively. Note that although the time savings naturally
decrease as the network speed increases, storage savings still
matter to cloud and are independent on the network conditions.
IX. C ONCLUSION
In this paper, we have designed and implemented an en-
crypted cloud media center hosting encrypted SVC videos.
We have first formulated a secure system framework sup-
porting secure deduplication while strongly protecting the
video confidentiality. It is resistant to the adversaries in the
bounded leakage setting, and the adversaries launching brute-
force attacks over predictable videos, respectively We then
have leveraged the layered structure of SVC and proposed a
1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Transactions on Multimedia
15
customized design of layer-level secure SVC video deduplica-
tion. We have provided thorough security analysis to show the
security strengths of our system design. Our implementations
have adopted a format-compliant SVC encryption strategy, and
optimized the storage of encrypted SVC videos for efficient
dissemination. The extensive experiments have demonstrated
the practicality of our system.
[1] Y. Zheng, X. Yuan, X. Wang, J. Jiang, C. Wang, and X. Gui, “Enabling
encrypted cloud media center with secure deduplication,” in Proc. of
ACM ASIACCS, 2015.
[2] F. Chen, C. Zhang, F. Wang, J. Liu, X. Wang, and Y. Liu, “Cloud-assisted
live streaming for crowdsourced multimedia content,” IEEE Trans. on
Multimedia, vol. 17, no. 9, pp. 1471–1483, 2015.
[3] H. Yue, X. Sun, J. Yang, F. Wu et al., “Cloud-based image coding for
mobile devices-toward thousands to one compression,” IEEE Trans. on
Multimedia, vol. 15, no. 4, pp. 845–857, 2013.
[4] G. Gao, W. Zhang, Y. Wen, Z. Wang, and W. Zhu, “Towards cost-
efficient video transcoding in media cloud: Insights learned from user
viewing patterns,” IEEE Trans. on Multimedia, vol. 17, no. 8, pp. 1286–
1296, 2015.
[5] S. Wang, K. Gu, S. Ma, W. Lin, X. Liu, and W. Gao, “Guided image
contrast enhancement based on retrieved images in cloud,” IEEE Trans.
669
[6] W. Zhu, C. Luo, J. Wang, and S. Li, “Multimedia cloud computing,”
IEEE Signal Processing Magazine, vol. 28, no. 3, pp. 59–69, 2011.
[7] BBC, “Apple to tighten iCloud security after celebrity leaks,” http://
www.bbc.com/news/technology-29076899, 2014.
[8] K. Vinton, “Data Breach Bulletin: Staples, NeedMyTranscript, iCloud,
Sourcebooks,” http://www.forbes.com/sites/katevinton/2014/10/24/data-
breach-bulletin-staples-needmytranscript-com-icloud-sourcebooks/,
2014.
[9] C. Wang, K. Ren, W. Lou, and J. Li, “Toward secure and effective data
utilization in public cloud,” IEEE Network Magazine, vol. 26, no. 6, pp.
69–74, 2012.
[10] C.-Y. Hsu, C.-S. Lu, and S.-C. Pei, “Image feature extraction in
encrypted domain with privacy-preserving sift,” IEEE Trans. on Image
Processing, vol. 21, no. 11, pp. 4593–4607, 2012.
[11] Z. Qin, J. Yan, K. Ren, C. W. Chen, and C. Wang, “Towards efficient
privacy-preserving image feature extraction in cloud computing,” in
Proc. of ACM MM, 2014.
[12] Q. Wang, W. Zeng, and J. Tian, “A compressive sensing based secure
watermark detection and privacy preserving storage framework,” IEEE
Trans. on Image Processing, vol. 23, no. 3, pp. 1317–1328, 2014.
[13] Y. Wu, Z. Wei, and R. H. Deng, “Attribute-based access to scalable
media in cloud-assisted content sharing networks,” IEEE Trans. on
Multimedia, vol. 15, no. 4, pp. 778–788, 2013.
[14] C. Ma and C. W. Chen, “Secure media sharing in the cloud: Two-
dimensional-scalable access control and comprehensive key manage-
ment,” in Proc. of IEEE ICME, 2014.
[15] X. Yuan, X. Wang, C. Wang, A. Squicciarini, and K. Ren, “Enabling
privacy-preserving image-centric social discovery,” in Proc. of IEEE
ICDCS, 2014.
[16] M. Bellare, S. Keelveedhi, and T. Ristenpart, “Message-locked encryp-
tion and secure deduplication,” in Proc. of EUROCRYPT, 2013.
[17] ——, “Dupless: Server-aided encryption for deduplicated storage,” in
Proc. of USENIX Security, 2013.
[18] J. Xu, E. Chang, and J. Zhou, “Weak leakage-resilient client-side
deduplication of encrypted data in cloud storage,” in Proc. of ACM
AISACCS, 2013.
[19] Y. Zhou, T. Z. J. Fu, D. M. Chiu, and Y. Huang, “An adaptive cloud
downloading service,” IEEE Trans. on Multimedia, vol. 15, no. 4, pp.
802–810, 2013.
[20] Y. Sanchez, T. Schierl, C. Hellge, T. Wiegand, D. Hong, D. D.
Vleeschauwer, W. V. Leekwijck, and Y. L. Louedec, “idash: improved
dynamic adaptive streaming over http using scalable video coding,” in
Proc. of ACM MMSys, 2011, pp. 257–264.
[21] H. Schwarz, D. Marpe, and T. Wiegand, “Overview of the scalable video
coding extension of the h.264/avc standard,” IEEE Trans. on Circuits and
System for Video Technology, vol. 17, no. 9, pp. 1103–1120, 2007.
[22] S. Xiang, “Scalable streaming,” https://sites.google.com/site/
svchttpstreaming/storagesaving.
This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TMM.2016.2612760, IEEE
Transactions on Multimedia
16

[23] Z. Wei, Y. Wu, X. Ding, and R. H. Deng, “A scalable and format- [52] Y. H. W. W. Yixin Chen, Wenbo He, “Compoundeyes: Near-duplicate
compliant encryption scheme for h.264/svc bitstreams,” Signal Process- detection in large scale online video systems in the cloud,” in Proc. of
ing: Image Communication, vol. 27, no. 9, pp. 1011–1024, 2012. IEEE INFOCOM, 2016.
[24] T. Stutz and A. Uhl, “A survey of h. 264 avc/svc encryption,” IEEE [53] J. Song, Y. Yang, Z. Huang, H. T. Shen, and J. Luo, “Effective multiple
Trans. on Circuits and Systems for Video Technology, vol. 22, no. 3, pp. feature hashing for large-scale near-duplicate video retrieval,” IEEE
325–339, 2012. Trans. on Multimedia, vol. 15, no. 8, pp. 1997–2008, 2013.
[25] J. R. Douceur, A. Adya, W. J. Bolosky, D. Simon, and M. Theimer, [54] Y. Dodis, R. Ostrovsky, L. Reyzin, and A. D. Smith, “Fuzzy extractors:
“Reclaiming space from duplicate files in a serverless distributed file How to generate strong keys from biometrics and other noisy data,”
system,” in Proc. of IEEE ICDCS, 2002. SIAM J. on Computing, vol. 38, no. 1, pp. 97–139, 2008.
[26] P. Anderson and L. Zhang, “Fast and secure laptop backups with [55] B. Barak, Y. Dodis, H. Krawczyk, O. Pereira, K. Pietrzak, F. Standaert,
encrypted de-duplication,” in Proc. of USENIX LISA, 2010. and Y. Yu, “Leftover hash lemma, revisited,” in Proc. of CRYPTO, 2011.
[27] Z. Wilcox-O’Hearn and B. Warner, “Tahoe: the least-authority filesys- [56] IETF, “RTP payload format for scalable video coding,” https://tools.ietf.
tem,” in Proc. of ACM StorageSS, 2008. org/html/rfc6190#page-8.
[28] Gnunet, “GNU’s framework for secure peer-to-peer networking,” https: [57] S. Oh, A. Hoogs, A. Perera, N. Cuntoor, C.-C. Chen, J. T. Lee,
//gnunet.org/. S. Mukherjee, J. Aggarwal, H. Lee, L. Davis et al., “A large-scale
[29] Freenet, “The Free Network,” http://freenetproject.org/. benchmark dataset for event recognition in surveillance video,” in Proc.
[30] M. Abadi, D. Boneh, I. Mironov, A. Raghunathan, and G. Segev, of IEEE CVPR, 2011.
“Message-locked encryption for lock-dependent messages,” in Proc. of [58] S. Lederer, C. Müller, and C. Timmerer, “Dynamic adaptive streaming
Crypto, 2013. over http dataset,” in Proc. of ACM MMSys, 2012.
[31] M. Bellare and S. Keelveedhi, “Interactive message-locked encryption [59] M. Blestel and M. Raulet, “Open svc decoder: a flexible svc library,” in
and secure deduplication,” in Proc. of PKC, 2015. Proc. of ACM MM, 2010.
[32] J. Li, X. Chen, M. Li, J. Li, P. P. Lee, and W. Lou, “Secure deduplication [60] Akamai, “The Akamai State of the Internet Report,” http://www.akamai.
with efficient and reliable convergent key management,” IEEE Trans. on com/stateoftheinternet/.
Parallel and Distributed Systems, vol. 25, no. 6, pp. 1615–1625, 2014.
[33] J. Stanek, A. Sorniotti, E. Androulaki, and L. Kencl, “A secure data
deduplication scheme for cloud storage,” in Proc. of FC, 2014.
[34] Y. Duan, “Distributed key generation for encrypted deduplication:
achieving the strongest privacy,” in Proc. of ACM CCSW, 2014.
[35] P. Puzio, R. Molva, M. Önen, and S. Loureiro, “Cloudedup: secure
deduplication with encrypted data for cloud storage,” in Proc. of IEEE
CloudCom, 2013.
[36] J. Liu, N. Asokan, and B. Pinkas, “Secure deduplication of encrypted
data without additional independent servers,” in Proc. of ACM CCS,
2015.
[37] R. H. Deng, X. Ding, Y. Wu, and Z. Wei, “Efficient block-based
transparent encryption for h.264/svc bitstreams,” Multimedia Systems,
vol. 20, no. 2, pp. 165–178, 2014.
[38] Z. Wei, Y. Wu, R. H. Deng, and X. Ding, “A hybrid scheme for
authenticating scalable video codestreams,” IEEE Trans. on Information
Forensics and Security, vol. 9, no. 4, pp. 543–553, 2014.
[39] Fortune.com, “Cloud Price Cutting Isn’t Dead Yet,”
http://fortune.com/2016/01/15/cloud-price-cuts-continue/.
[40] Infoworld.com, “Faster and cheaper: The cloud is becoming harder to
resist,” http://www.infoworld.com/article/2865212/cloud-computing/the-
cloud-is-getting-both-faster-and-cheaper.html.
[41] E. Stefanov and E. Shi, “Multi-cloud oblivious storage,” in Proc. of
ACM CCS, 2013.
[42] Q. Wang, J. Wang, S. Hu, Q. Zou, and K. Ren, “Sechog: Privacy-
preserving outsourcing computation of histogram of oriented gradients
in the cloud,” in Proc. of ACM AsiaCCS, 2016.
[43] V. Nikolaenko, S. Ioannidis, U. Weinsberg, M. Joye, N. Taft, and
D. Boneh, “Privacy-preserving matrix factorization,” in Proc. of ACM
CCS, 2013.
[44] V. Nikolaenko, U. Weinsberg, S. Ioannidis, M. Joye, D. Boneh, and
N. Taft, “Privacy-preserving ridge regression on hundreds of millions of
records,” in Proc. of IEEE S&P, 2013.
[45] Apache OpenOffice, “How to verify the integrity of the downloaded
file?” https://www.openoffice.org/download/checksums.html.
[46] C. Wang, S. S. M. Chow, Q. Wang, K. Ren, and W. Lou, “Privacy-
preserving public auditing for secure cloud storage,” IEEE Trans. on
Computers, vol. 62, no. 2, pp. 362–375, 2013.
[47] S. Jarecki and X. Liu, “Efficient oblivious pseudorandom function with
applications to adaptive ot and secure computation of set intersection,”
in Proc. of Theory of Cryptography Conference, 2009, pp. 577–594.
[48] M. Bellare, C. Namprempre, D. Pointcheval, and M. Semanko, “The
one-more-rsa-inversion problems and the security of chaum’s blind
signature scheme,” Journal of Cryptology, vol. 16, no. 3, pp. 185–215,
2003.
[49] Y. Sanchez, T. Schierl, C. Hellge, T. Wiegand, D. Hong, D. D.
Vleeschauwer, W. V. Leekwijck, and Y. L. Louédec, “Efficient http-
based streaming using scalable video coding,” Signal Processing: Image
Communication, vol. 27, no. 4, pp. 329–342, 2012.
[50] V. Shoup, “Practical threshold signatures,” in Proc. of EUROCRYPT,
2000.
[51] A. Katiyar and J. B. Weissman, “Videdup: An application-aware frame-
work for video de-duplication,” in Proc. of USENIX HotStorage, 2011.

1520-9210 (c) 2016 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.