Method and system for at least partially updating data encrypted with an all-or-nothing encryption scheme

Abstract

The present invention relates to a method for at least partially updating data encrypted with an all-or-nothing encryption scheme stored on one or more servers, comprising the steps of: a) Dividing the data comprising a first number of m plaintext blocks into a second number N of equal sized chunks, wherein the second number is based on the number of servers on which said data is to be stored, such that each chunk comprises m / N blocks of the plaintext blocks, b) Encrypting each of the chunks using an All-Or-Nothing Encryption scheme with an encryption key, wherein an additional randomness per chunk is embedded into the All-Or-Nothing Encryption scheme, and outputting a plurality of ciphertext blocks for each chunk, c) Storing the encrypted chunks on the N servers such that the i-th ciphertext block of each encrypted chunk is stored on the i-th server, and wherein a result of a predetermined function performed on said randomness for all encrypted chunks is stored with each encrypted chunk, d) Determining one or more parts of one or more chunks which need to be updated if any e) Reverting said function by accessing all the chunks to acquire the randomness of said determined one or more chunks, f) Decrypting said determined chunks based on the result of step e), g) Updating the decrypted chunks, h) Re-encrypting the updated chunks using said All-Or-Nothing Encryption scheme, and i) Storing the re-encrypted chunks according to step c).

Description

technical field

[0001] The present invention relates to a method for at least partially updating data stored on one or more servers encrypted using an all-or-none encryption scheme.

[0002] The invention also relates to a system for at least partially updating data stored on one or more servers encrypted using an all-or-none encryption scheme. Background technique

[0003] The invention will be described in relation to a cloud secure network infrastructure, although the invention is applicable to servers in any kind of network infrastructure.

[0004] Cloud security is increasingly important in many applications and services today. "All-or-Nothing Encryption" (All-or-NothingEncryption, referred to as AONE) has become one of the methods that can be used to strengthen data confidentiality. All-or-nothing encryption AONE provides semantic security of data while ensuring that data can be recovered if and only if all ciphertext blocks are downloadable for a given client. In t...

Examples

Embodiment Construction

[0056] figure 1 A conventional system is shown.

[0057] exist figure 1 In , a conventional system based on access control that implements partial updates of files is presented.

[0058] exist figure 1 In , the update entity UE wants to update the file F partially. File F has been encrypted and stored on multiple servers SV1-SV4 through the following steps:

[0059] In the first step and assuming they are N servers, here in figure 1 In N=4 servers SV1-SV4, the original plaintext file F is divided into original m plaintext blocks, which are then divided into N equal-sized data slices, so that each data slice contains m / N original plaintext blocks, And where N is the number of servers, 4 here.

[0060] In a second step, an all-or-none encryption AONE is applied to each individual piece of data C, preferably by using Ghassan Karame as available at http: / / eprint.iacr.org / 2014 / 556.pdf , ClaudioSoriente, Krzysztof Lichota, Srdjan Capkun's technical reports disclosed in the al...

technical field

[0001] The present invention relates to a method for at least partially updating data stored on one or more servers encrypted using an all-or-none encryption scheme.

[0002] The invention also relates to a system for at least partially updating data stored on one or more servers encrypted using an all-or-none encryption scheme. Background technique

[0003] The invention will be described in relation to a cloud secure network infrastructure, although the invention is applicable to servers in any kind of network infrastructure.

[0004] Cloud security is increasingly important in many applications and services today. "All-or-Nothing Encryption" (All-or-NothingEncryption, referred to as AONE) has become one of the methods that can be used to strengthen data confidentiality. All-or-nothing encryption AONE provides semantic security of data while ensuring that data can be recovered if and only if all ciphertext blocks are downloadable for a given client. In t...

Examples

Embodiment Construction

[0056] figure 1 A conventional system is shown.

[0057] exist figure 1 In , a conventional system based on access control that implements partial updates of files is presented.

[0058] exist figure 1 In , the update entity UE wants to update the file F partially. File F has been encrypted and stored on multiple servers SV1-SV4 through the following steps:

[0059] In the first step and assuming they are N servers, here in figure 1 In N=4 servers SV1-SV4, the original plaintext file F is divided into original m plaintext blocks, which are then divided into N equal-sized data slices, so that each data slice contains m / N original plaintext blocks, And where N is the number of servers, 4 here.

[0060] In a second step, an all-or-none encryption AONE is applied to each individual piece of data C, preferably by using Ghassan Karame as available at http: / / eprint.iacr.org / 2014 / 556.pdf , ClaudioSoriente, Krzysztof Lichota, Srdjan Capkun's technical reports disclosed in the al...

Images