Password-Based Outsourced Data Protection for Cloud Storage Against Backdoor Attacks

Updatable oblivious key management (UOKMS) allow users to outsource encrypted data along with a symmetric key-generating token to a cloud server. The designated recipient uses this token and interacts with multiple key servers to derive the decryption key and then access the data. To ensure secure access and prevent impersonation attacks, users must authenticate to each key server using distinct credentials during key derivation. This introduces computational overhead that scales linearly with the number of key servers, especially posing challenges for resource-constrained devices. Moreover, UOKMS assumes that users' devices are fully trustworthy, but real-world cases show that they may be embedded with backdoors that covertly exfiltrate cryptographic secrets. To address these challenges, we propose a secure re-randomized password-derived public/secret key pairs generation mechanism that protects the symmetric key-generating token, eliminates interactive authentication with key servers, and resists password-guessing attacks. Our design incorporates a protocol-aware reverse firewall that mitigates backdoor threats by generating unbiased randomness and transforming interactive messages through re-randomization and de-randomization. Building on this, we develop ATTEST, a password-based data protection scheme for cloud storage against backdoor attacks. Security and performance evaluations demonstrate that ATTEST offers strong security with practical efficiency.