Method and system for preventing encrypted data duplication

Abstract

The present invention provides a method for preventing duplicate data from being stored in a memory. The method involves mutually untrusted hosts. The method comprises: the memory comprises an encrypted data block, the network further comprises a distributed ledger, and the distributed ledger is accessible by each of two or more hosts. The method comprises steps performed by a first host when it wishes to store a new data block: obtaining a first hash value of the new data block, determining whether the first hash value is found in the ledger. If the first hash value is not found in the ledger, creating a confirmation data set, encrypting the new data block using a block unique encryption key, and storing a first ownership record in the ledger. If the first hash value is found in the ledger, obtaining information about a second host that has stored a previous block identical to the new data block, entering a key request in the ledger, receiving a key transfer record from the ledger, and sending a new ownership record to the ledger.

Description

Technical Field

[0001] The present invention generally relates to the field of data protection and storage, and more specifically to a method and computer system for preventing duplication of encrypted data in a network. Furthermore, the present invention also relates to a computer program product for performing the above method. Furthermore, the present invention also relates to a host or computing device associated with the above network. Background Art

[0002] Data backup is used to protect and recover data in the event of data loss in the primary storage system. Examples of data loss events may include, but are not limited to, data corruption, hardware or software failures in the primary storage device, accidental deletion of data, hacker attacks, or malicious attacks. Therefore, for safety reasons, a separate backup system or storage system is used to store a backup of the data in the primary storage system. Currently, traditional backup systems usually read changes to data or obtain data directly from the storage system where the data is stored. Some traditional backup systems store all changed data. Therefore, over time, since the changed data occupies a large amount of storage space in the traditional backup system, the storage space of the backup system is also occupied. This will reduce the performance of the backup system, so this situation is not desirable. Moreover, the cost of data storage and all associated costs including the cost of storage hardware remain a problem.

[0003] Currently, there are many technologies that can be used for data reduction, such as deduplication technology. However, this traditional technology is inefficient and generally involves reducing the amount of data to be stored by eliminating duplicate data. For example, deduplication technology stores data in the form of chunks, and when new data is received, the new data is also divided into chunks of variable or fixed size. Afterwards, the new data associated with each chunk of the new data is checked (by comparison), that is, it is checked whether the same data has been written to the storage system. If the new data has been written, only a pointer (or reference) to the data is used. In this way, deduplication technology solves the problem of duplication of the same data in the storage system. However, if the new data is stored through encryption, deduplication is only possible if there is mutual trust between the primary storage system and the backup system. Therefore, if there is no mutual trust between the various systems (computing devices) associated with the encrypted data storage system or network, deduplication technology may not achieve data reduction because the encrypted data will be considered to be new data (or changed data), resulting in inefficient data storage.

[0004] Therefore, in view of the above discussion, it is necessary to solve the above-mentioned problems associated with traditional password data storage systems. Summary of the invention

[0005] The present invention aims to provide a method and system for preventing duplicate encrypted data in a memory, and a first host and a second host in the system. The memory is arranged in a network, and two or more hosts can store data in the network in the memory. The present invention aims to provide a technical solution to solve the existing problem of low efficiency in deleting duplicate data between mutually untrusted computing devices (i.e., hosts). The purpose of the present invention is to provide a technical solution that at least partially solves the problems encountered in the prior art, and to provide an improved method for preventing duplicate data from being stored in a cryptographic data storage system. The method involves two or more mutually untrusted computing devices (i.e., hosts).

[0006] The objects of the present invention are achieved by the technical solutions provided in the attached independent claims. Advantageous implementations of the present invention are further defined in the dependent claims.

[0007] On the one hand, the present invention provides a method for preventing duplicate encrypted data in a memory. The memory is set in a network, and two or more hosts can store data in the network in the memory, the memory includes one or more encrypted data blocks, and the network also includes a distributed ledger, which can be accessed by each of the two or more hosts and saves a first hash value identifying the data block for each of the one or more encrypted data blocks. The method includes the following steps performed by the first host of the two or more hosts when it wants to store a new data block in the memory: obtaining the first hash value of the new data block; determining whether the first hash value is found in the ledger; if the first hash value is not found in the ledger, creating a confirmation data set, wherein the confirmation data set constitutes evidence that the first host has ownership of the data, encrypting the new data block using a block unique encryption key, and storing the encrypted new data block in the memory using a key equal to the first hash value, and storing a first ownership record in the ledger, wherein the first ownership record includes the identification of the first host, the unencrypted first hash value and the confirmation data set encrypted using a key known only to the first host; if the first hash value is found in the ledger, obtaining information about a second host from the ledger, wherein the second host has stored a previous block identical to the new data block in the memory, inputting a key request for the key of the previous block in the ledger, wherein the key request includes the confirmation data set encrypted using the public key of the second host, receiving a key transfer record stored by the second host from the ledger, wherein the key transfer record includes the key of the data encrypted using the public key of the first host, and sending a new ownership record to the ledger that the first host has obtained ownership of the data block.

[0008] The present invention provides an improved method for deduplicating data stored in a memory (e.g., in an encrypted data storage system). The memory is shared by two or more hosts that may not trust each other. In the present invention, data blocks are stored in the memory in an encrypted form, and the first hash value is used to identify each data block. Therefore, when the first host wants to store the new data block, the first hash value of the new data block is compared with the first hash value of the data block already stored in the memory. If the two first hash values ​​are the same, the new data block is not stored, and the ownership of the stored data block (similar to the new data block) is transferred to the first host. If the two first hash values ​​are not the same, the new data block is stored, and the ownership of the new data block is transferred to the first host. Therefore, before the new data block is stored in a memory shared by two or more hosts that may not trust each other, it is confirmed whether the new data block already exists in the memory.

[0009] In one implementation, the key request includes the unencrypted first hash value and the confirmation data set encrypted with data about the requesting host using a public key of the second host.

[0010] The first hash value in unencrypted form enables other hosts in the network to easily access the first hash value. In addition, the data about the requesting host in the key request can save a record of the requesting host (i.e., the first host) and the second host in the ledger.

[0011] In another implementation, the key transmission record also includes a hash value of the data and an identifier of the first host.

[0012] Through the key transmission record, the record of the key request of the first host and the corresponding hash value of the new data block are stored in the ledger for future use.

[0013] In another implementation, the first ownership record and the new ownership record further include a private key encrypted using a public key of the first host.

[0014] In this way, other hosts in the network can communicate with the first host regarding the first ownership record using the first host's public key while maintaining access to the new data block data with the first host.

[0015] In another implementation, the confirmation data set calculated by the second host is stored in the ledger and encrypted using a private key of the second host.

[0016] Encrypting the confirmation data set using a key known only to the second host enables the ledger to maintain ownership of the previous block with the second host.

[0017] In another implementation, the confirmation data set includes a second hash value.

[0018] The second hash value is stored in an encrypted form and is available upon confirmation that the first hash value of the new data block is the same as the first hash value of the previously stored data block. Thus, duplicate data storage between mutually untrusted hosts is prevented.

[0019] On the other hand, the present invention provides a method for preventing data duplication in a memory. The memory is set in a network, two or more hosts can store data in the network in the memory, the memory includes one or more encrypted data blocks, and the network also includes a distributed ledger, the distributed ledger can be accessed by each of the two or more hosts and saves a hash identifying the data block for each of the one or more encrypted data blocks. The method includes the following steps performed by a second host among the two or more hosts when a first host wants to store a new data block in the memory, wherein the new data block is the same as a previous data block stored in the memory by the second host: receiving a key request for a key of the previous block stored in the account book by the first host from the account book, wherein the key request includes evidence that the new data block is the same as the previous data block; evaluating the evidence; if it is found that the new block is the same as the previous block, providing a key transmission record from the account book to the first host, wherein the key transmission record includes a key of the data encrypted using the public key of the first host.

[0020] The present invention provides an improved method for deduplicating data stored in a memory. The memory is shared by two or more hosts that may not trust each other. In the present invention, when the first host wants to store the new data block, the first hash value of the new data block is compared with the first hash value of the data block already stored in the memory. The present invention evaluates whether the new data block is the same as the previously stored data block. If the two first hash values ​​are the same, the new data block is not stored, and the ownership of the stored data block (similar to the new data block) is given to the first host. Therefore, before the new data block is stored in a memory shared by two or more hosts that may not trust each other, it is confirmed whether the new data block already exists in the memory.

[0021] In one implementation, the key request includes a first hash value and a second hash value calculated by the first host according to the new data block, the first hash value is unencrypted, and the second hash value is encrypted using a public key of the second host.

[0022] The first hash value in unencrypted form enables other hosts in the network to easily access the first hash value. In addition, the data about the requesting host in the key request can save a record of the requesting host (i.e., the first host) and the second host in the ledger.

[0023] In another implementation, the step of evaluating the evidence includes: comparing the second hash value with the second hash value calculated by the second host; if the two second hash values ​​are the same, determining that the new block is the same as the previous block.

[0024] Based on the comparison, data duplication is prevented. Thus, data deduplication is performed between two mutually untrusted hosts.

[0025] In another implementation, the key transmission record indicates a hash value of the data, an identification of the first host, and a key for the data encrypted using a public key of the first host.

[0026] Through the key transmission record, the record of the key request of the first host and the corresponding hash value of the new data block are stored in the ledger for future use.

[0027] In another implementation, the second hash value calculated by the second host is stored in the ledger and encrypted using a private key of the second host.

[0028] The second hash value is stored in an encrypted form to prevent the second hash value from being accessed by an unauthorized user. Therefore, the present invention protects data from unauthorized access and also prevents data from being duplicated between mutually untrusted hosts.

[0029] In another aspect, the present invention provides a method for preventing duplicate encrypted data in a memory. The memory is set in a network, two or more hosts can store data in the network in the memory, the memory includes one or more encrypted data blocks, and the network also includes a distributed ledger, the distributed ledger can be accessed by each of the two or more hosts and saves a hash value identifying the data block for each of the one or more encrypted data blocks. When a first host among the two or more hosts attempts to store a new data block in the memory, the method includes the following steps: by comparing the hash value calculated for the new data block with at least one hash value found in the ledger, determining whether the new data block is the same as a block already stored in the memory; if the same hash value is found, identifying a second host storing the data block with the same hash value and its identification, the second host providing a key to enable the first host to access the key of the stored block calculated to the same hash value; if the same hash value is not found, causing the first host to store the encrypted new data block in the memory and store the hash value calculated for the new data block in the ledger.

[0030] The present invention provides an improved method for deduplicating data stored in a memory. The memory is shared by two or more hosts that may not trust each other. When the first host wants to store the new data block, the first hash value of the new data block is compared with the first hash value of the data block already stored in the memory. If the two first hash values ​​are the same, the new data block is not stored, and the ownership of the stored data block (similar to the new data block) is handed over to the first host. If the two first hash values ​​are not the same, the new data block is stored, and the ownership of the new data block is handed over to the first host. Therefore, before the new data block is stored in the memory shared by two or more hosts that may not trust each other, it is confirmed whether the new data block already exists in the memory.

[0031] In one implementation, the method comprises the following steps: obtaining the new data block by dividing the data set into two or more blocks of the same size or variable size.

[0032] The data to be stored is divided into a plurality of data blocks. It is further checked whether the data blocks already exist in the memory to prevent any duplicate data blocks from being stored between two or more hosts that do not trust each other.

[0033] In yet another implementation, the ledger is a blockchain.

[0034] The blockchain is capable of keeping a record of the data blocks stored in the memory, thereby preventing duplicate data blocks from being stored in the memory.

[0035] In yet another implementation, the blockchain is a hyperledger.

[0036] The hyperledger keeps a record of the data blocks stored in the memory, thereby preventing duplicate data blocks from being stored in the memory.

[0037] In another aspect, the present invention provides a computer program product comprising a set of computer readable codes that, when executed in a processor of a host in a computer network, causes the host to perform the method performed by the first host in the above aspects, wherein the computer network includes a memory storing encrypted data, the memory being accessible by the host and one or more other hosts.

[0038] The present invention provides an improved computer program product for deduplicating data stored in a memory executed on a first host side. The memory is shared by two or more hosts that may not trust each other. Advantageously, before storing the new data block in the memory shared by the two or more hosts that may not trust each other, it is confirmed whether the new data block already exists in the memory.

[0039] In yet another aspect, the present invention provides a computer program product comprising a set of computer readable codes that, when executed in a processor of a host in a computer network, causes the host to perform the method performed by the second host in the above aspects, wherein the computer network includes a memory storing encrypted data, the memory being accessible by the host and one or more other hosts.

[0040] The present invention provides an improved computer program product for deduplicating data stored in a memory device executed on a second host side. The memory device is shared by two or more hosts that may not trust each other. Advantageously, before storing the new data block in the memory device shared by the two or more hosts that may not trust each other, it is confirmed whether the new data block already exists in the memory device.

[0041] In one implementation, the computer program product includes a non-transitory storage module having the set of computer readable codes thereon.

[0042] An improved computer program product is provided through the non-transitory memory having a set of computer readable codes, which can perform data deduplication on data stored in the memory, wherein the memory is shared by two or more hosts that may not trust each other.

[0043] In another aspect, the present invention provides a first host for use in a data network, the data network comprising a memory storing encrypted data, the memory being accessible by the host and one or more other hosts, the first host comprising a program memory and a processor for executing a program found in the program memory, the program memory comprising a computer program product.

[0044] Even when two or more hosts that may not trust each other (e.g., the first host, the second host, the third host, etc.) access the same memory, the present invention enables the first host to store data in the memory in a manner that confirms the deletion of duplicate data that the first host may store in the memory.

[0045] In yet another aspect, the present invention provides a second host for use in a data network, the data network comprising a memory storing encrypted data, the memory being accessible by the host and one or more other hosts, the host comprising a program memory and a processor for executing a program found in the program memory, the program memory comprising a computer program product.

[0046] Even when two or more hosts that may not trust each other (e.g., the first host, the second host, the third host, etc.) access the same memory, the present invention enables the second host to store data in the memory in a manner that confirms the deletion of duplicate data that the first host may store in the memory.

[0047] In another aspect, the present invention provides a computer system comprising a memory storing encrypted data and at least first and second hosts, wherein the memory is accessible by the first host and the second host.

[0048] The present invention provides an improved computer system for deduplicating data stored in the memory, wherein the memory is shared by two or more hosts (eg, the first host and the second host) that may not trust each other.

[0049] It can be understood that all the above implementations can be combined together.

[0050] It should be noted that all devices, elements, circuits, units and modules described in this application can be implemented in software elements or hardware elements or any type of combination thereof. All steps performed by various entities described in this application and the described functions to be performed by various entities are intended to indicate that the corresponding entities are suitable for or used to perform the corresponding steps and functions. Although in the description of the following specific embodiments, the specific functions or steps performed by external entities are not reflected in the description of the specific elements of the entity that performs the specific steps or functions, it should be clear to the technician that these methods and functions can be implemented in corresponding hardware elements or software elements or any type of combination thereof. It is understandable that the features of the present invention are easy to be combined in various combinations without departing from the scope of the present invention as defined by the appended claims.

[0051] Other aspects, advantages, features and objects of the present invention will become apparent from the accompanying drawings and detailed description of illustrative implementations interpreted in conjunction with the following appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] When read in conjunction with the accompanying drawings, the above summary of the invention and the following specific embodiments can be better understood. In order to illustrate the present invention, exemplary structures of the present invention are shown in the accompanying drawings. However, the present invention is not limited to the specific methods and tools disclosed herein. In addition, it will be understood by those skilled in the art that the drawings are not drawn to scale. Whenever possible, similar elements are represented by the same numerals.

[0053] The embodiments of the present invention are described below by way of example only and in conjunction with the following drawings.

[0054] Figure 1 A flowchart of a method for preventing duplicate encrypted data in a memory provided for one embodiment of the present invention, wherein the method is executed by a first host arranged in a network, and two or more hosts can store data in the network in the memory.

[0055] Figure 2 A flowchart of a method for preventing duplicate encrypted data in a memory provided for one embodiment of the present invention, wherein the method is executed by a second host arranged in a network, and two or more hosts can store data in the network in the memory.

[0056] Figure 3 A flowchart of a method for preventing duplicate encrypted data in a memory provided by an embodiment of the present invention, wherein the memory is set in a network, and two or more hosts can store data in the network in the memory.

[0057] Figure 4AA diagram of a network environment of a computer system for preventing duplicate encrypted data in a memory provided by one embodiment of the present invention.

[0058] Figure 4B A block diagram of various exemplary components for a first host in a data network is provided for one embodiment of the present invention.

[0059] Figure 4C A block diagram of various exemplary components for a second host in a data network is provided for one embodiment of the present invention.

[0060] Figure 5A A diagram of exemplary messages in a method for preventing duplicate encrypted data in a cloud storage according to an embodiment of the present invention.

[0061] Figure 5B A diagram of exemplary messages in a method for preventing duplicate encrypted data in a cloud storage according to another embodiment of the present invention.

[0062] Figure 5C is a diagram of exemplary messages in a method for preventing duplicate encrypted data in a cloud storage provided by yet another embodiment of the present invention.

[0063] In the accompanying drawings, underlined numbers are used to indicate the item in which the underlined number is located or the item to which the underlined number is adjacent. The item to which a non-underlined number refers is identified by a line connecting the non-underlined number to the item. When a number is not underlined and is accompanied by an associated arrow, the non-underlined number is used to identify the general item to which the arrow points. DETAILED DESCRIPTION

[0064] The following detailed description describes embodiments of the invention and how they may be implemented. Although some modes of carrying out the invention have been disclosed, those skilled in the art will recognize that other embodiments for carrying out or implementing the invention are possible.

[0065] Figure 1 A flowchart of a method 100 for preventing duplicate encrypted data in a memory provided by an embodiment of the present invention, wherein the method 100 is executed by a first host set in a network, and two or more hosts can store data in the network in the memory. The method 100 includes steps 102 to 116 executed by the first host among the two or more hosts when the first host wishes to store a new data block in the memory. The method 100 is executed on the first host side, and the first host Figure 4A Shown and explained in detail in .

[0066] Method 100 prevents the encrypted data from being repeated in the memory. Repeating the encrypted data refers to storing specific data (e.g., original data / same data) multiple times in the memory. Duplication causes one or more duplicate copies of the same data to unnecessarily occupy storage space and also degrade the performance of the memory. Moreover, the cost of data storage and all associated costs, including storage hardware costs, continue to increase as duplicate copies of the original data increase. The method of the present invention avoids degradation of the performance of the memory by preventing the duplication of the encrypted data. Encrypted data refers to data stored in the memory in an encrypted form, so that the data can only be accessed using an encryption key. The data is encrypted using an encryption algorithm. The data stored in the network can be referred to as any information stored as a text document, picture, video, etc., which needs to be securely stored to prevent any unauthorized user from accessing it. In other words, method 100 prevents the encrypted data from being repeated to the cryptographic data storage system.

[0067] The method 100 further involves: the memory includes one or more encrypted data blocks, the network also includes a distributed ledger, the distributed ledger can be accessed by each of the two or more hosts and saves a first hash value identifying the data block for each of the one or more encrypted data blocks. The memory here refers to a centralized cloud storage, which can be an object storage, for example, a key / value storage. The memory is used to reliably store the data in the form of one or more encrypted data blocks provided by the two or more hosts. Each of the one or more encrypted data blocks includes data of a fixed size. In addition, the two or more hosts do not trust the memory, that is, the two or more hosts trust that the memory will store the data without losing the data, but the data may be leaked (that is, accessed by unauthorized users). The network here refers to a group of hosts (that is, two or more hosts) that are interconnected to share and store data in a common memory. The above-mentioned host (also referred to as a computing device) includes suitable logic, circuits, interfaces and / or codes, which are used to store, process and / or share data with one or more hosts through the network. The host is described in detail in the following description. The distributed ledger is a database shared and synchronized with multiple parties (eg, the first host, the second host, etc.) to store the one or more encrypted data blocks. The distributed ledger may be simply referred to as a ledger.

[0068] According to one embodiment, the ledger is a blockchain. The blockchain is an open distributed ledger that can efficiently record transactions (i.e., changes) between two hosts in a verifiable and permanent manner. The blockchain is a ledger that is immutable and can be used with non-trusted hosts, one of which may not trust another host in the network. For use as a distributed ledger, the blockchain is typically managed by a peer-to-peer network that jointly adheres to a protocol for communication between nodes and new blocks of data for verification of data. Although blockchain records are not immutable, the blockchain can be considered secure by design and exemplifies a distributed computing system with high Byzantine fault tolerance. Therefore, decentralized consensus is achieved through the blockchain.

[0069] According to one embodiment, the blockchain is a hyperledger. In one example, the blockchain or any distributed ledger (e.g., a hyperledger) can be used to store metadata of the encrypted data stored in the memory.

[0070] Each of the one or more encrypted data blocks stored in the memory includes a first hash value identifying the corresponding data block. A hash value refers to a fixed-size value of data of any size generated using a hash function or a hashing algorithm. In other words, a hash value refers to a fixed-size value representing raw data of any size. In one example, a hash value is a hexadecimal string consisting of several characters representing data. Examples of hash algorithms include, but are not limited to, SHA-2, MD5. Advantageously, a hash value enables comparison between two data blocks without the need for actual comparison between the data of the two data blocks. The first hash value refers to a hash value generated for a data block by a specific host in the network for the first time. The first hash value can confirm and prevent the host from storing duplicate data blocks.

[0071] According to one embodiment, the method comprises the following steps: obtaining the new data block by dividing the data set into two or more blocks of equal size or variable size. The first host is used to divide the data to be stored in the memory into pieces of variable (or fixed) size, i.e., one or more data blocks, using a data chunking algorithm. According to the data chunking algorithm, the first host organizes the data into data blocks. In one embodiment, the new data block is generated by the first host.

[0072] In step 102, the method 100 further includes obtaining a first hash value of the new data block. The first host is configured to obtain the first hash value by applying a hash function or a hash algorithm to the new data block. The first hash value can clearly identify the new data block compared to one or more encrypted data blocks already stored in the memory. Obviously, no matter which host applies the hash algorithm, a similar hash value will be generated for a given data block.

[0073] In step 104, method 100 also includes determining whether the first hash value is found in the ledger. The determining whether the first hash value is found in the ledger is performed by comparing the first hash value generated for the new data block with each hash value of one or more encrypted data blocks stored in the memory. In one example, the method may employ a comparator function to compare the above hash values. In another example, when comparing the above hash values, if the first hash value is found in the ledger, a true signal (yes) is generated, and if the first hash value is not found in the ledger, a false signal (no) is generated. Advantageously, the determining whether the first hash value is found in the ledger enables the method to prevent duplication of already existing data in the memory.

[0074] If the first hash value is not found in the ledger according to the determination, steps 106, 108 and 110 are performed. If the first hash value is found in the ledger according to the determination, steps 112, 114, 116 and 118 are performed.

[0075] In step 106, method 100 further includes creating a confirmation data set, wherein the confirmation data set constitutes proof that the first host has ownership of the data. Since the new block of data is not found in the ledger, the confirmation data set is created to enable the first host to have ownership of the new block of data to be added to the ledger. The confirmation data set may indicate that the new block of data to be added to the blockchain was created by the first host. The creation of the confirmation data set may verify that another host holds the same data.

[0076] According to one embodiment, the confirmation data set includes a second hash value. The second hash value is created by applying a hash algorithm known in the art. The second hash value provides enhanced security for the new data block, while the first hash value can identify duplicate data blocks in the ledger.

[0077] In step 108, method 100 further includes encrypting the new data block using a block unique encryption key and storing the encrypted new data block in the memory using a key equal to the first hash value. The block unique encryption key used to encrypt the new data block is created by the first host. The new data block is stored in the memory in an encrypted form to prevent any unauthorized user or host in the network from accessing the new data block. According to one embodiment, the new data block may include confidential information associated with the first host. Encrypting the new data block can prevent unauthorized users from stealing such confidential information. The new data block is encrypted using an encryption algorithm known in the art with the block unique encryption key. The block unique encryption key is a unique encryption key specifically used to encrypt a corresponding data block (e.g., the new data block). Therefore, the new data block can only be accessed using the block unique encryption key. The key equal to the first hash value is also stored in the memory together with the encrypted new data block. This enables other hosts in the network to determine whether a given new data block associated with a given other host exists in the ledger.

[0078] According to one embodiment, the first host is further configured to store private metadata about the new data block using a secret key known only to the first host, so as to be able to recover (by decrypting) the new data block when needed.

[0079] In step 110, method 100 further includes storing a first ownership record in the ledger, wherein the first ownership record includes an identification of the first host, the unencrypted first hash value, and the confirmation data set encrypted using a key known only to the first host. In one example, the first ownership record includes an identification of the first host, such as a serial number of a computing device. In addition, the first ownership record may include any identification provided to the first host when joining the network. The identification of the first host must essentially be unique relative to other hosts in the network. In one example, the first hash value is stored in plain text. The first hash value is stored in plain text (in an unencrypted manner) so that other hosts in the network can read the first hash value without the permission of the first host. In addition, the first ownership record may include the block-unique encryption key used by the first host to encrypt the new data block. The confirmation data set is encrypted using the key to prevent any host from accessing the confirmation data set without the permission of the first host. In one example, the key is created by the first host. The first ownership record enables the new data block to be restored from the memory when needed based on the identification of the first host, the unencrypted first hash value, and the confirmation data set.

[0080] According to one embodiment, the first ownership record also includes the secret key encrypted using the public key of the first host, which is known only to the first host. In other words, the secret key known to the first host may also be stored in the ledger and encrypted using the public key of the first host. The secret key is encrypted using the public key to prevent the secret key from being accessed by any unauthorized user and further prevent access to the confirmation data set associated with the new data block of the first host. The public key has been published and is therefore known to all hosts. In addition, encrypting the secret key using the public key of the first host allows other hosts in the network to access the public key of the first host. This will allow other hosts in the network to communicate with the first host regarding the first ownership record using the public key of the first host.

[0081] In step 112, method 100 further includes obtaining information about a second host from the ledger, wherein the second host has stored a previous block identical to the new data block in the memory. Once the first hash value of the new data block is found in the ledger, the second host that owns the previous block is identified, wherein the previous block is likely to carry a hash value identical to the first hash value. The ledger information about the second host that has the previous block is obtained based on an ownership record associated with the second host that has ownership of the previous block, which was previously stored in the ledger. Typically, the first hash value of the new data block is compared with one or more hash values ​​for one or more existing previous blocks in the ledger to identify the second host that stores or owns the previous block identical to the new data block. In one example, the ledger information about the second host includes an identification of the second host, an unencrypted hash value of the previous block (equivalent to the first hash value of the new data block), a confirmation data set (for the previous block) encrypted using a key known only to the second host, and a block-unique encryption key used by the second host to encrypt the previous block. In addition, the key used to encrypt the confirmation data set of the previous block is encrypted using the public key of the second host. It is worth noting that after determining that the first hash value of the new data block is found in the ledger, the first host requests the ledger information about the second host.

[0082] In step 114, method 100 further includes inputting a key request for the key of the previous block in the ledger, wherein the key request includes the confirmation data set encrypted using the public key of the second host. Once the first hash value of the new data block is found in the ledger, the first host issues a key request for the key of the previous block to the second host. Typically, the key request indicates or relates to a communication (or business) between the first host and the second host regarding the key request for the previous block. In one example, the key request may be stored in the blockchain, indicating a possible communication or business between the first host and the second host regarding requesting the key of the previous block. The key request is input by the first host in the ledger to receive the confirmation data set encrypted using the public key of the second host from the second host. The key request enables the first host to confirm that the new data block already exists in the ledger after determining that the first hash value of the new data block is found in the ledger.

[0083] According to one embodiment, the key request includes the unencrypted first hash value and the confirmation data set encrypted with the public key of the second host together with data about the requesting host. The key request includes the unencrypted first hash value because this allows the ledger to keep a record of the communication or business between the first host and the second host regarding the request for the key of the previous block. In addition, the unencrypted nature of the first hash value relative to the key request allows the ledger to confirm such a key request by other hosts in the network. In addition, the key request includes the confirmation data set, i.e., ownership data about the data contained in the previous block is owned by the second host. The key request also includes data about the requesting host, i.e., the first host requests the key from the second host. Based on the confirmation data set encrypted with the public key of the second host, the first host checks that the confirmation data set sent by the second host is the same as the confirmation data set calculated by the first host. Therefore, it is confirmed that the new data block already exists in the ledger.

[0084] According to one embodiment, the confirmation data set calculated by the second host is stored in the account book and encrypted using the private key of the second host. The confirmation data set (or ownership data) is created by the second host so that the second host can have ownership of the previous block in the account book. Creating the confirmation data set can prevent any other host in the network from adding duplicate data blocks similar to the previous block. In addition, encrypting the confirmation data set using the private key enables the second host to prevent any unauthorized user from accessing the previous block stored in the account book. According to one embodiment, the confirmation data set calculated by the second host includes a second hash value.

[0085] In step 116, the method 100 further includes receiving a key transfer record stored by the second host from the ledger, wherein the key transfer record includes a key for the data encrypted using the public key of the first host. As described above, the first host requests the key for the previous block from the second host, so the second host accepts the request of the first host and shares the key for the previous block with the first host. Therefore, the key transfer record, i.e., the communication or business between the first host and the second host regarding the key exchange, is stored in the ledger or blockchain. Typically, the second host adds the key transfer record to the ledger after sharing the request key for the previous block with the first host. The key transfer record includes a key for the data encrypted using the public key of the first host, because in this way, only the first host (excluding other hosts in the network) can access the key (shared by the second host) using the private key of the first host.

[0086] According to one embodiment, the key transmission record also includes a hash value of the data and an identification of the first host. According to an example, the hash value of the data relates to the details of the business conducted between the first host and the second host regarding the exchange of the request key. The hash value of the data is stored in the ledger to save a record of the second host sharing the request key of the previous block with the first block. The key transmission record also includes an identification of the first host, indicating that the key request was issued by the first host. In one example, the identification of the first host can be a unique serial number of the first host. In addition, the first ownership record can include any identification provided to the first host when joining the network.

[0087] In step 118, method 100 further includes sending a new ownership record to the ledger that the first host has obtained ownership of the data block. Once the key transfer record is entered (stored or recorded) in the ledger by sharing the request key with the first host by the second host, the new ownership record is entered in the ledger. The new ownership record generally includes information that the first host has obtained ownership of the previous block, which was earlier owned by the second host. The sending of the new ownership record to the ledger enables the ledger to provide ledger information about the first host to other hosts in the network when they wish to store a data block similar to the new data block already stored in the ledger. In one example, the new ownership record includes an identification of the first host, the unencrypted first hash value, and the confirmation data set encrypted using a key known only to the first host. Transferring the ownership data of the previous block can prevent the first host from adding the new data block (similar to the previous block and owned by the second host) to the memory. This can achieve data deduplication, thereby saving space in the memory.

[0088] According to one embodiment, the new ownership record further comprises a secret key encrypted using a public key of the first host. The private key is encrypted using the public key to prevent the private key from being accessed by any unauthorized user and further prevent access to the confirmation data set associated with the new data block of the first host.

[0089] Steps 102 to 118 are merely illustrative, and other optional steps may be provided, wherein one or more steps are added, one or more steps are removed, or one or more steps are provided in a different order without departing from the scope of the claims herein.

[0090] In one aspect, a computer program product comprising a set of computer readable codes is provided. When executed in a processor of a host in a computer network, the set of computer readable codes causes the host to perform method 100, wherein the computer network includes a memory for storing encrypted data, the memory being accessible by the host and one or more other hosts. In one example, the computer readable code is executed by a first host in the network, and the network may be a cryptographic data storage network, etc. In addition, an example of a computer readable memory for providing a non-transitory memory in the computer program product may include, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above storage devices.

[0091] According to one embodiment, the computer program product includes a non-transient storage module having the computer readable code module thereon. Examples of implementations of the non-transient computer readable storage module include, but are not limited to, an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Random Access Memory (RAM), a Read Only Memory (ROM), a Hard Disk Drive (HDD), a flash memory, a Secure Digital (SD) card, a Solid-State Drive (SSD), a computer readable storage medium, and / or a CPU cache.

[0092] Reference now Figure 2 , shows a flow chart of a method 200 for preventing duplicate encrypted data in a memory provided by an embodiment of the present invention, wherein the method 200 is executed by a second host set in a network, and two or more hosts can store data in the network in the memory. The method 200 includes steps 202 to 206 executed by the second host among the two or more hosts when the first host wants to store a new data block in the memory, wherein the new data block is the same as the previous block stored in the memory by the second host. The method 200 is executed on the second host side, such as Figure 4B Shown and explained in more detail.

[0093] The method 200 further involves: the memory includes one or more encrypted data blocks, the network also includes a distributed ledger, the distributed ledger is accessible by each of the two or more hosts and stores a hash identifying the data block for each of the one or more encrypted data blocks. The method 200 also includes the following steps 202 to 206 performed by the second host of the two or more hosts when the first host wants to store a new data block in the memory, wherein the new data block is the same as a previous data block stored in the memory by the second host.

[0094] In step 202, the method 200 further includes receiving from the ledger a key request for a key of the previous block stored in the ledger by the first host, wherein the key request includes evidence that the new data block is the same as the previous data block. When the first hash value of the new data block is determined to be found in the ledger by comparing the first hash value of the new data block with the first hash value of the previous data block, the first host is used to provide the key request to the ledger. The first host provides the key request to obtain ownership of the previous block that is similar to the new data block. The key request involves a communication (or transaction) between the first host and the second host regarding the key request for the previous block. The key request is input into the ledger by the first host to receive a confirmation data set encrypted using the public key of the second host from the second host. The key request enables the first host to confirm that the new data block already exists in the ledger after determining that the first hash value of the new data block is found in the ledger.

[0095] According to one embodiment, the key request includes a first hash value and a second hash value calculated by the first host based on the new data block, the first hash value is unencrypted, and the second hash value is encrypted using a public key of the second host. The first hash value can clearly identify the new data block compared to one or more encrypted data blocks already stored in the memory. In one example, the first host receives the public key of the second host from the ledger when determining that the first hash value of the new data block is found in the ledger. The first hash value and the second hash value can evaluate whether the new data block is similar to a previous data block stored in the ledger. The first hash value is obtained by the first host, such as Figure 1 The first hash value and the second hash value can provide evidence that the new data block is the same as the previous data block.

[0096] In step 204, method 200 further includes evaluating the evidence. The second host is configured to receive the key request from the ledger. Based on the received key request, the second host evaluates the evidence to determine that the new data block is the same as the previous data block. The evaluating the evidence is performed by comparing hash values.

[0097] According to one embodiment, the step of evaluating the evidence includes comparing the second hash value with the second hash value calculated by the second host, and if the two second hash values ​​are the same, determining that the new block is the same as the previous block. The second hash value of the new data block calculated by the first host is compared with the second hash value of the previous block calculated by the second host. In one example, if the two second hash values ​​are the same, the new data block of the first host is similar to the previous block of the second host. In another example, if the two second hash values ​​are not the same, the new data block of the first host is not similar to the previous block of the second host.

[0098] According to one embodiment, the second hash value calculated by the second host is stored in the account book and encrypted by the private key of the second host. The second hash value enables the second host to prevent any unauthorized access to the previous block stored in the account book. Calculating the second hash value can prevent any other host in the network from adding a duplicate data block similar to the previous block.

[0099] In step 206, the method 200 further includes: if the new block is found to be the same as the previous block, providing a key transfer record from the ledger to the first host, wherein the key transfer record includes the key for the data encrypted using the public key of the first host. The first host requests the key for the previous block from the second host, so the second host accepts the request of the first host and shares the key for the previous block with the first host. Therefore, the key transfer record, i.e., the communication or transaction between the first host and the second host regarding the key exchange, is stored in the ledger or blockchain. Typically, the second host adds the key transfer record to the ledger after sharing the requested key for the previous block with the first host. The key transfer record includes the key for the data encrypted using the public key of the first host, because this allows only the first host to access the key using the private key of the first host.

[0100] According to one embodiment, the key transmission record indicates a hash value of the data, an identification of the first host, and a key for the data encrypted using a public key of the first host. In other words, the key transmission record includes a hash value of the previous data block, an identification value of the first host accessing the previous block, and the key used to encrypt the previous block. According to one example, the hash value of the data relates to details of a transaction conducted between the first host and the second host regarding the exchange of the requested key. The key transmission record also includes an identification of the first host, indicating that the key request was issued by the first host.

[0101] Steps 202 to 206 are merely illustrative, and other optional steps may be provided, wherein one or more steps are added, one or more steps are removed, or one or more steps are provided in a different order without departing from the scope of the claims herein.

[0102] In another aspect, the present invention provides a computer program. The computer program is used to perform method 200 when executed on a second host. In another aspect, a computer program product including a set of computer readable codes is provided. When running in a processor of a host in a computer network, the set of computer readable codes causes the host to perform method 200, wherein the computer network includes a memory for storing encrypted data, and the memory is accessible by the host and one or more other hosts. In one example, the computer readable code is executed by a second host in the network, and the network can be a cryptographic data storage network, etc.

[0103] According to one embodiment, the computer program product comprises a non-transitory storage module having the computer readable code module thereon.

[0104] Reference now Figure 3 , a flowchart of a method 300 for preventing duplicate encrypted data in a memory provided by an embodiment of the present invention is shown, wherein the memory is set in a network, and two or more hosts can store data in the network in the memory. The method 300 includes steps 302 to 308. The method 300 includes steps 302 to 308 that are executed when a first host among two or more hosts attempts to store a new data block in the memory.

[0105] The method 300 further involves: the memory includes one or more encrypted data blocks, the network also includes a distributed ledger, the distributed ledger is accessible by each of the two or more hosts and stores a hash value identifying the data block for each of the one or more encrypted data blocks. The method 300 also includes the following steps 302 to 308 performed when a first host among the two or more hosts attempts to store a new data block in the memory.

[0106] In step 302, method 300 further includes determining whether the new data block is identical to a block already stored in the memory by comparing the hash value calculated for the new data block with at least one hash value found in the ledger. In other words, the first hash value of the new data block is compared with the first hash value of the data block already stored in the ledger (i.e., the previous data block). Based on the comparison, if the two hash values ​​are similar, the new data block is identical to the block already stored in the memory, and a true signal (yes) is generated, and if the two hash values ​​are not similar, the new data block is not identical to any block already stored in the memory, and therefore a false signal (no) is generated.

[0107] According to the determination, if the new data block is the same as the block already stored in the memory, then step 304 and step 306 are performed. If the new data block is not the same as the block already stored in the memory, then step 308 is performed.

[0108] In step 304, method 300 also includes: if the same hash value is found, identifying a second host storing the data block with the same hash value and its identification. Once the hash value of the new data block is found in the ledger, the second host that owns the (already stored) previous block is identified, and the previous block is likely to carry the same hash value as the hash value. The ledger information about the second host with the previous block is obtained based on the ownership record associated with the second host with ownership of the previous block, and the previous block was previously stored in the ledger. The hash value of the new data block is compared with one or more hash values ​​for the existing one or more previous blocks in the ledger to identify the second host that stores or owns the previous block that is the same as the new data block.

[0109] In step 306, the method 300 further includes the second host providing a key to enable the first host to access the stored block calculated to the same hash value. The key enables the first host to obtain ownership of the stored block. In one example, the first host enters a key request for the key of the stored block (i.e., the previous block) in the ledger, the key request including a confirmation data set encrypted using the public key of the second host. In addition, the first host receives a key transfer record stored by the second host from the ledger, wherein the key transfer record includes the key of the data encrypted using the public key of the first host. Once the key transfer record is entered (stored or recorded) in the ledger by sharing the request key with the first host by the second host, the new ownership record is entered in the ledger. The new ownership record generally includes information that the first host has obtained ownership of the previous block, which was previously owned by the second host. Therefore, the first host sends an ownership record to the ledger that the first host has obtained ownership of the data block. In one example, the ownership record may include an identification number of the first host, a first hash value of the stored data block, and a key encrypted using the public key of the first host.

[0110] In step 308, method 300 further includes, if the same hash value is not found, causing the first host to store the encrypted new data block in the memory and store the hash value calculated for the new data block in the ledger. If the new data block of the data is not found in the ledger, creating a confirmation data set so that the first host has ownership of the new data block of data to be added to the ledger. The new data block is encrypted using a block unique encryption key, and the encrypted new data block is stored in the memory. The ownership record includes the identification of the first host, the unencrypted hash value, and the confirmation data set encrypted using a key known only to the first host, and stored in the ledger.

[0111] Steps 302 to 308 are merely illustrative, and other optional steps may be provided, wherein one or more steps are added, one or more steps are removed, or one or more steps are provided in a different order without departing from the scope of the claims herein.

[0112] In another aspect, the present invention provides a computer program for performing the method 300. In yet another aspect, a computer program product is provided that includes a set of computer readable codes that, when executed in a processor of a host in a computer network, causes the host to perform the method 300, wherein the computer network includes a memory storing encrypted data, the memory being accessible by the host and one or more other hosts.

[0113] Reference now Figure 4A , which shows a network environment diagram of a computer system for preventing duplicate encrypted data in a memory provided by an embodiment of the present invention. Figure 4A , a computer system 400 is shown. The computer system 400 includes a first host 402, a second host 404, a third host 406, and a fourth host 408. The computer system 400 also includes a memory 410 and a distributed ledger 412. The first host 402, the second host 404, the third host 406, and the fourth host 408 can access encrypted data and store the encrypted data in the memory 410, and access the distributed ledger 412.

[0114] The term "host (also referred to as host device)" includes suitable logic, circuitry, interfaces and / or code for storing, processing and / or sharing information with one or more hosts in memory 410 through distributed ledger 412. Examples of the host include, but are not limited to, a host server, a host production environment system, a thin client connected to a host server, a primary storage system, and a user device (e.g., a cellular phone, a personal digital assistant (PDA), a handheld device, a laptop, a personal computer, an Internet of Things (IoT) device, a smartphone, a machine type communication (MTC) device, a computing device, a drone, or any other portable or non-portable electronic device). In one example, the first host 402 of the present invention wishes to store a new data block in memory 410, and the second host 404 is able to confirm whether the new data block already exists in memory 410. In one example, the third host 406, the fourth host 408, etc. are also able to confirm whether the new data block already exists in memory 410.

[0115] The computer system 400 provides a memory 410 for storing encrypted data. The memory 410 is accessible by the first host 402 and the second host 404. The term "memory 410" as used herein refers to a volatile or permanent medium, such as a circuit, a disk, a virtual memory, or an optical disk, in which a host can store data in the form of encrypted data blocks for any duration. In other words, the memory 410 includes one or more encrypted data blocks. In one example, the memory 410 is a centralized cloud storage.

[0116] According to one embodiment, the memory 410 is a non-volatile mass storage, such as a physical storage medium. In addition, a single memory may be included, and in a scenario where the computing system is distributed, the processing, memory and / or storage capabilities may also be distributed. The memory 410 may be a cloud storage including one or more encrypted data blocks. In one example, the cloud storage is used to store objects. In one example, the cloud storage includes an object storage that describes a new data block that the first host wishes to store and an encrypted storage that stores the data block in an encrypted form. Advantageously, the cloud storage provides an improved storage for deduplicating data that is common to all hosts stored in the cloud storage.

[0117] The distributed ledger 412 is a database shared and synchronized by multiple parties (e.g., the first host 402, the second host 404, etc.) to store the one or more encrypted data blocks. In other words, the distributed ledger 412 can be accessed by each of the two or more hosts (e.g., the first host 402, the second host 404) and saves a first hash value identifying the data block for each of the one or more encrypted data blocks. The distributed ledger 412 enables the business (i.e., change) of the data stored in the ledger 412 only through the mutual consensus of all parties, thereby preventing any unauthorized participants from making any changes or preventing any authorized participants from making any unauthorized changes. All information stored in the distributed ledger 412 is securely stored by cryptography so that the information can only be accessed using authorized cryptographic keys that are only available to authorized users.

[0118] According to one embodiment, the ledger 412 is a blockchain. The first host 402, the second host 404, the third host 406, and the fourth host 408 can all access the blockchain. The blockchain stores a hash value identifying the data block for each of the one or more encrypted data blocks. According to one embodiment, the blockchain is a hyperledger.

[0119] In operation, when a first host 402 of the two or more hosts attempts to store a new data block in the memory 410, the system 400 is configured to perform the following steps. The system 400 is configured to determine whether the new data block is identical to a block already stored in the memory 410 by comparing the hash value calculated for the new data block with at least one hash value found in the distributed ledger 412. In addition, if an identical hash value is found, the system 400 is configured to identify a second host 404 storing a data block with the same hash value and its identification, the second host 404 presenting a key that enables the first host 402 to access the stored block calculated to the same hash value. However, if an identical hash value is not found, the system 400 is configured to cause the first host 402 to store the encrypted new data block in the memory 410 and store the hash value calculated for the new data block in the ledger 412.

[0120] Reference now Figure 4B , a block diagram showing various exemplary components of a first host in a data network provided by one embodiment of the present invention. Figure 4B Combination Figure 4A Describe. Figure 4B , a first host 402 is shown. The first host 402 includes a processor 414, a first transceiver 416, and a program memory 418. The processor 414 may be communicatively coupled to the first transceiver 416 and the first memory 418. The first host 402 is connected to the second host 404 via the memory 410 and the distributed ledger 412.

[0121] The figure shows a first host 402 used in a data network, including a memory 410 for storing encrypted data. The memory 410 is accessible by the host 402 and one or more other hosts, and the first host 402 includes a program memory 418 and a processor 414 for executing a program found in the program memory 418, the program memory including a computer program product.

[0122] The processor 414 of the first host 402 is used to provide data in the form of data blocks to be stored in the memory 410. In one implementation, the processor 414 is used to execute instructions stored in the program memory 418. In one example, the processor 414 can be a general-purpose processor. Other examples of the processor 414 can include, but are not limited to, a microprocessor, a microcontroller, a complex instruction set computing (CISC) processor, an application-specific integrated circuit (ASIC) processor, a reduced instruction set (RISC) processor, a very long instruction word (VLIW) processor, a central processing unit (CPU), a state machine, a data processing unit, and other processors or control circuits. In addition, the processor 414 can refer to one or more separate processors, processing devices, and processing units as part of a machine, for example, the first host 402.

[0123] The first transceiver 416 includes suitable logic, circuitry, and interfaces that may be operable to communicate with one or more external devices such as the memory 410 and the distributed ledger 412. Examples of the first transceiver 416 may include, but are not limited to, an antenna, a telematics unit, a radio frequency (RF) transceiver, one or more amplifiers, one or more oscillators, a digital signal processor, a codec (CODEC) chipset, and / or a subscriber identity module (SIM) card.

[0124] The program memory 418 refers to the main storage system of the first host 402. The program memory 418 includes suitable logic, circuits and interfaces, which can be used to store instructions that can be executed by the processor 414. Implementation examples of the program memory 418 may include, but are not limited to, an Electrically Erasable Programmable Read-Only Memory (EEPROM), a Random Access Memory (RAM), a Read Only Memory (ROM), a Hard Disk Drive (HDD), a flash memory, a Solid-State Drive (SSD) and / or a CPU cache. The program memory 418 can store an operating system and / or other program products (including one or more operating algorithms) to operate the first host 402.

[0125] In one aspect, in operation, the processor 414 of the first host 402 wishes to store a new data block in the memory 410. The processor 414 is configured to obtain a first hash value of the new data block, and further determine whether the first hash value is found in the ledger 412. If the first hash value is not found in the ledger 412, the processor 414 is configured to: create a confirmation data set, wherein the confirmation data set constitutes evidence of the ownership of the data by the first host 402; encrypt the new data block using a block-unique encryption key, and store the encrypted new data block in the memory 410 using a key equal to the first hash value; and store a first ownership record in the ledger 412. If the first hash value is found in the ledger 412, the first host 402 is used to: obtain ledger information about the second host 404 from the ledger, wherein the second host 404 has stored a previous block identical to the new data block in the memory 410; input a key request for the key of the previous block in the ledger 412; receive a key transfer record stored by the second host 404 from the ledger 412; and send a new ownership record to the ledger 412 indicating that the first host 402 has obtained ownership of the data block.

[0126] According to one embodiment, the key request includes the unencrypted first hash value and the confirmation data set encrypted with the public key of the second host 404 together with data about the requesting host (i.e., the first host 402). Based on the confirmation data set encrypted with the public key of the second host 404, the first host 402 checks whether the confirmation data set sent by the second host 404 is the same as the confirmation data set calculated by the first host 402.

[0127] According to one embodiment, the key transfer record also includes a hash value of the data and an identification of the first host 402. In other words, the key transfer record includes a hash value of the previous block and an identification of the first host 402 accessing the previous block. The identification of the first host can assign ownership of the previous block to the first host 402. The hash value of the data is stored in the ledger 412 to save a record that the second host 404 shares the request key of the previous block with the first block.

[0128] According to one embodiment, the first ownership record and the new ownership record further include a private key encrypted using the public key of the first host 402. The private key is encrypted using the public key to prevent the private key from being accessed by any unauthorized user and further prevent access to the confirmation data set associated with the new data block of the first host 402.

[0129] According to one embodiment, the confirmation data set calculated by the second host 404 is stored in the ledger 412 and encrypted by the private key of the second host 404. The confirmation data set enables the second host 404 to prevent any unauthorized user from accessing the previous block stored in the ledger. The confirmation data set is created so that the second host 404 has ownership of the previous block added to the ledger.

[0130] According to one embodiment, the confirmation data set includes a second hash value. The second hash value is created by applying a hash algorithm. In one example, the second hash value is not accessible to all hosts in the network compared to the first hash value. The second hash value provides enhanced security for the new data block.

[0131] Reference now Figure 4C , showing a block diagram of various exemplary components of a second host provided by an embodiment of the present invention. Figure 4C Combination Figure 4A and Figure 4B Describe. Figure 4C , a second host 404 is shown. The second host 404 includes a processor 420, a second transceiver 422, and a program memory 424. The processor 420 may be communicatively coupled to the second transceiver 422 and the program memory 424. The second host 404 is connected to the first host 402 via a memory 410 and a distributed ledger 412.

[0132] The figure shows a second host 404 used in a data network, including a memory for storing encrypted data. The memory 410 is accessible by the host and one or more other hosts, the host includes a program memory 424 and a processor 420 for executing a program found in the program memory 424, the program memory 424 including a computer program product.

[0133] The processor 420 of the second host 404 is used to execute instructions stored in the program memory 424 of the second host 404. The example of the processor 420 of the second host 404 is similar to that of the first host 402 ( Figure 4B ) is similar to the processor 414 of the embodiment. Similarly, the implementation examples of the second transceiver 422 and the program memory 424 are respectively Figure 4B The first transceiver 416 and the program memory 418 are similar.

[0134] In one aspect, in operation, according to a new data block that the first host 402 wishes to store, the processor 420 of the second host 404 is used to receive a key request for a key of a previous block stored in the ledger 412 by the first host 402 from the ledger 412. The second processor is also used to evaluate evidence. In addition, if it is found that the new block is the same as the previous block, the second host 404 provides a key transfer record from the ledger 412 to the first host 402.

[0135] According to one embodiment, the key request includes a first hash value and a second hash value calculated by the first host 402 according to the new data block, the first hash value is unencrypted, and the second hash value is encrypted using a public key of the second host 404. The first hash value and the second hash value can provide evidence that the new data block is the same as the previous data block.

[0136] According to one embodiment, the step of evaluating the evidence includes comparing the second hash value with the second hash value calculated by the second host 404, and if the two second hash values ​​are the same, determining that the new block is the same as the previous block. The second hash value of the new data block calculated by the first host 402 is compared with the second hash value of the previous block calculated by the second host 404.

[0137] According to one embodiment, the key transfer record indicates a hash value of the data, an identification value of the first host 402, and a key for encrypting the data using a public key of the first host 402 to transfer ownership of the previous block to the first host 402. In other words, the key transfer record includes a hash value of the previous data block, an identification value of the first host 402 accessing the previous block, and the key used to encrypt the previous block.

[0138] According to one embodiment, the second hash value calculated by the second host 404 is stored in the ledger 412 and encrypted by the private key of the second host 404. The second hash value enables the second host 404 to prevent any unauthorized access to the previous block stored in the ledger 412.

[0139] Reference now Figure 5A , which shows an exemplary message diagram in a method for preventing duplicate encrypted data in a cloud storage provided by an embodiment of the present invention. Figure 5A , shows an exemplary message 500A in a method for preventing duplicate encrypted data in a cloud storage. The exemplary message 500A includes an ownership record 502.

[0140] Ownership record 502 includes an identification of a first host 504, an unencrypted first hash value 506, a confirmation data set 508 encrypted using a key known only to the first host, and an encryption key for a data block 510 (i.e., a new data block of data) encrypted using a key known only to the first host. Ownership record 502 may also be referred to as a data ownership message.

[0141] Figure 5B A diagram of exemplary messages in a method for preventing duplicate encrypted data in a cloud storage provided by another embodiment of the present invention. Figure 5B , shows an exemplary message 500B in a method for preventing duplicate encrypted data in a cloud storage. The exemplary message 500B includes a key request 512.

[0142] The key request 512 includes an identification of the second host 514, the unencrypted first hash value 506, and a confirmation data set 516 encrypted using the second host's public key. The key request 512 may also be referred to as a request data key message.

[0143] Figure 5C A diagram of exemplary messages in a method for preventing duplicate encrypted data in a cloud storage provided by another embodiment of the present invention. Figure 5C , shows an exemplary message 500C in a method for preventing duplicate encrypted data in a cloud storage. The exemplary message 500C includes a key transmission record 518.

[0144] The key transfer record 518 includes the identification of the first host 504, the identification of the second host 514, the unencrypted first hash value 506, and the key 520 of the data encrypted using the public key of the first host. The key transfer record 518 may also be referred to as a transfer data key message.

[0145] According to one embodiment, exemplary messages 502, 512, and 518 are examples only, and any protocol that enables the second host to prove that the new data block already exists in memory may be used.

[0146] Without departing from the scope of the invention as defined by the appended claims, the embodiments of the invention described above may be modified. Expressions such as "including / comprising", "combined with", "having", "is" and the like used to describe and claim the present invention are intended to be interpreted in a non-exclusive manner, that is, to allow the existence of various items, components or elements that are not explicitly described. References to the singular should also be interpreted as being related to the plural. The word "exemplary" used herein means "as an example, instance or illustration". Any embodiment described as "exemplary" is not necessarily interpreted as taking precedence over or superior to other embodiments and / or does not exclude the features of combining other embodiments. The word "optionally" used herein means "provided in some embodiments and not provided in other embodiments". It should be understood that certain features of the present invention described in the context of a separate embodiment for the sake of clarity may also be provided in a single embodiment by combination. Conversely, the various features of the present invention described in the context of a single embodiment for the sake of clarity may also be provided individually or by any suitable combination or as any other described embodiment of the present invention.

Claims

1. A method (100) for preventing duplicate encrypted data in a memory (410), characterized in that: The memory (410) is set in a network, and two or more hosts can store data in the network in the memory (410); The memory (410) includes one or more encrypted data blocks, the network further including a distributed ledger (412) accessible by each of the two or more hosts and storing, for each of the one or more encrypted data blocks, a first hash value identifying the data block; The method comprises the following steps performed by a first host (402) of the two or more hosts when it wishes to store a new data block in the memory (410): Obtaining a first hash value of the new data block; Determining whether the first hash value is found in the ledger; If the first hash value is not found in the ledger, then creating a confirmation data set, wherein the confirmation data set constitutes evidence that the first host (402) has ownership of the data; encrypting the new data block using a block-unique encryption key, and storing the encrypted new data block in the memory using a key equal to the first hash value (410); storing a first ownership record in the ledger, wherein the first ownership record includes an identification of the first host (402), an unencrypted first hash value, and the confirmation data set encrypted using a key known only to the first host (402); If the first hash value is found in the ledger, then Retrieving information about a second host (404) from the ledger, wherein the second host (404) has stored a previous data block identical to the new data block in the memory (410); Entering a key request for the key of the previous data block in the ledger, wherein the key request includes the confirmation data set encrypted using the public key of the second host (404); Receiving a key transfer record stored by the second host (404) from the ledger, wherein the key transfer record includes a key for the data encrypted using a public key of the first host (402); A new ownership record is sent to the ledger that the first host (402) has obtained ownership of the data block.

2. The method (100) according to claim 1, characterized in that The key request includes the unencrypted first hash value and the validation data set encrypted with data about the requesting host using a public key of the second host (404).

3. The method (100) according to claim 1, characterized in that: The key transmission record also includes a hash value of the data and an identification of the first host (402).

4. The method (100) according to claim 2, characterized in that: The key transmission record also includes a hash value of the data and an identification of the first host (402).

5. The method (100) according to any one of the preceding claims, characterized in that The first ownership record and the new ownership record also include a private key encrypted using a public key of the first host (402).

6. The method (100) according to any one of claims 1 to 4, characterized in that: The confirmation data set calculated by the second host (404) is stored in the ledger (412) and encrypted using a private key of the second host (404).

7. The method (100) according to claim 5, characterized in that: The confirmation data set calculated by the second host (404) is stored in the ledger (412) and encrypted using a private key of the second host (404).

8. The method (100) according to any one of claims 1 to 4 and 7, characterized in that: The confirmation data set includes a second hash value.

9. The method (100) according to claim 5, characterized in that: The confirmation data set includes a second hash value.

10. The method (100) according to claim 6, characterized in that The confirmation data set includes a second hash value.

11. A method (200) for preventing duplication of data in a memory (410), characterized in that: The memory (410) is set in a network, and two or more hosts can store data in the network in the memory (410); The memory (410) includes one or more encrypted data blocks, the network further including a distributed ledger (412) accessible by each of the two or more hosts and storing, for each of the one or more encrypted data blocks, a hash identifying the data block; The method comprises the following steps performed by a second host (404) of the two or more hosts when the first host (402) wishes to store a new data block in the memory (410), wherein the new data block is the same as a previous data block stored in the memory (410) by the second host (404): receiving from the ledger a key request for a key of a previous data block stored in the ledger by the first host (402), wherein the key request includes evidence that the new data block is the same as the previous data block; evaluate the evidence; If the new data block is found to be the same as the previous data block, a key transfer record is provided from the ledger to the first host (402), wherein the key transfer record includes a key for the data encrypted using a public key of the first host (402).

12. The method (200) according to claim 11, characterized in that The key request includes a first hash value and a second hash value calculated by the first host according to the new data block, the first hash value is unencrypted, and the second hash value is encrypted using a public key of the second host (404).

13. The method (200) according to claim 11, characterized in that The step of evaluating the evidence includes: comparing the second hash value with the second hash value calculated by the second host (404); if the two second hash values ​​are the same, determining that the new data block is the same as the previous data block.

14. The method (200) according to claim 12, characterized in that The step of evaluating the evidence includes: comparing the second hash value with the second hash value calculated by the second host (404); if the two second hash values ​​are the same, determining that the new data block is the same as the previous data block.

15. The method (200) according to any one of claims 11 to 14, characterized in that The key transfer record indicates a hash value of the data, an identification of the first host (402), and a key for the data encrypted using a public key of the first host (402).

16. The method (200) according to any one of claims 11 to 14, characterized in that The second hash value calculated by the second host (404) is stored in the ledger (412) and encrypted using the private key of the second host (404).

17. The method (200) according to claim 15, characterized in that The second hash value calculated by the second host (404) is stored in the ledger (412) and encrypted using the private key of the second host (404).

18. A method (300) for preventing duplicate encrypted data in a memory (410), characterized in that: The memory (410) is set in a network, and two or more hosts can store data in the network in the memory (410); The memory (410) includes one or more encrypted data blocks, the network further includes a distributed ledger (412), the distributed ledger (412) is accessible by each of the two or more hosts and stores, for each of the one or more encrypted data blocks, a hash value identifying the data block; When a first host (402) of the two or more hosts attempts to store a new data block in the memory (410), the method comprises the following steps: determining whether the new data block is identical to a block already stored in the memory (410) by comparing a hash value calculated for the new data block with at least one hash value found in the ledger (412); If an identical hash value is found, then identifying a second host storing the identical hash value and the data block it identifies (404), The second host (404) provides a key to enable the first host (402) to access the stored block calculated to the same hash value; If the same hash value is not found, the first host (402) stores the encrypted new data block in the memory (410) and stores the hash value calculated for the new data block in the ledger (412).

19. The method (300) according to claim 18, characterized in that The method (300) comprises the following steps: obtaining the new data block by dividing the data set into two or more blocks of the same size or of variable size.

20. The method (300) according to any one of the preceding claims, characterized in that The ledger (412) is a blockchain.

21. The method (300) according to claim 20, characterized in that The blockchain is a hyperledger.

22. A computer program product comprising a set of computer readable codes, characterized in that: When executed in a processor of a host in a computer network, the set of computer readable codes causes the host to perform a method according to any one of claims 1 to 10, wherein the computer network includes a memory storing encrypted data, the memory being accessible by the host and one or more other hosts.

23. A computer program product comprising a set of computer readable codes, characterized in that: When executed in a processor of a host in a computer network, the set of computer readable codes causes the host to perform a method according to any one of claims 11 to 17, wherein the computer network includes a memory storing encrypted data, the memory being accessible by the host and one or more other hosts.

24. The computer program product according to claim 22 or 23, characterized in that The computer program product includes a non-transitory storage module having the set of computer readable codes thereon.

25. A first host (402) used in a data network, characterized in that: The data network comprises a memory storing encrypted data, the memory (410) being accessible by the host and one or more other hosts, the first host comprising a program memory (418) and a processor (414) for executing a program found in the program memory (418), the program memory (418) comprising a computer program product according to claim 22.

26. A second host (404) used in a data network, characterized in that: The data network comprises a memory storing encrypted data, the memory (410) being accessible by the host and one or more other hosts, the host comprising a program memory (424) and a processor (420) for executing a program found in the program memory (424), the program memory (414) comprising a computer program product according to claim 23.

27. A computer system (400), characterized in that: The computer system (400) comprises a memory (410) storing encrypted data and at least a first and a second host, the memory being accessible by the first host (402) and the second host (404), the first host (402) being the first host (402) according to claim 25, and the second host (404) being the second host (404) according to claim 26.

Images