Paper 2020/648

Ghostor: Toward a Secure Data-Sharing System from Decentralized Trust

Yuncong Hu, Sam Kumar, and Raluca Ada Popa


Data-sharing systems are often used to store sensitive data. Both academia and industry have proposed numerous solutions to protect user privacy and data integrity from a compromised server. Practical state-of-the-art solutions, however, use weak threat models based on centralized trust—they assume that part of the server will remain uncompromised, or that the adversary will not perform active attacks. We propose Ghostor, a data-sharing system that, using only decentralized trust, (1) hides user identities from the server, and (2) allows users to detect server-side integrity violations. To achieve (1), Ghostor avoids keeping any per-user state at the server, requiring us to redesign the system to avoid common paradigms like per-user authentication and user-specific mailboxes. To achieve (2), Ghostor develops a technique called verifiable anonymous history. Ghostor leverages a blockchain rarely, publishing only a single hash to the blockchain for the entire system once every epoch. We measured that Ghostor incurs a 4–5x throughput overhead compared to an insecure baseline. Although significant, Ghostor's overhead may be worth it for security- and privacy-sensitive applications.

Available format(s)
Publication info
Published elsewhere. Minor revision. 17th USENIX Symposium on Networked Systems Design and Implementation
data-sharing systemanonymityverifiable linearizabilityblockchain
Contact author(s)
yhu @ eecs berkeley edu
samkumar @ eecs berkeley edu
raluca @ eecs berkeley edu
2020-06-03: received
Short URL
Creative Commons Attribution


      author = {Yuncong Hu and Sam Kumar and Raluca Ada Popa},
      title = {Ghostor: Toward a Secure Data-Sharing System from Decentralized Trust},
      howpublished = {Cryptology ePrint Archive, Paper 2020/648},
      year = {2020},
      note = {\url{}},
      url = {}
Note: In order to protect the privacy of readers, does not use cookies or embedded third party content.