METHOD AND DEVICE FOR DISTRIBUTED ONLINE FILE STORAGE IN A ZERO TRUST CONTEXT

Abstract

The present invention relates to a method and a zero-knowledge secure storage system managed by a relay server connected to a plurality of online storage services, the file to be stored being divided into a plurality of fragments backed up on the plurality of online storage services. The file to be backed up is subjected to an all-or-nothing transformation function and at least partial fully homomorphic encryption before being transmitted for backup to the relay server.

Description

Title of the invention: METHOD AND DEVICE FOR ONLINE DISTRIBUTED FILE STORAGE IN A ZERO TRUST CONTEXT

[0001] The present invention relates to the field of online computer file storage with a plurality of storage services in a context where the security of the service does not imply a relationship of trust between the different actors.

[0002] Online computer file storage services have developed in recent years. Almost all the major players in the IT industry offer their own services. Alongside these major players, numerous companies have also developed their own services for both individuals and businesses. Many businesses are now adopting these services to back up their data.

[0003] Using an online storage service eliminates the need for setting up and managing on-the-job storage, backups, and security. It also allows the service costs to be shared among different clients.

[0004] Information security is also an increasingly sensitive issue. Examples of hacking of companies and online services are multiplying. Even without malicious intent, a recent fire in a data center belonging to a major online service provider resulted in the loss of data for a significant number of its customers.

[0005] In this context, improving the security and reliability of online storage services is a constant concern.

[0006] The invention relates to a secure online storage service managed by a proxy server that connects the service user to a plurality of online storage services. The term "server" is used here in a functional sense and can refer to various physical implementations of the proxy server, including one or more physical servers. The term "user" refers to a computer terminal used by the human user to access the service. When we use the term "user" in the description of the proposed methods, we are referring to actions performed by the user's terminal under their control, and not to actions performed by the human user.

[0007] The user of the secure online storage service communicates only with the relay server and is unaware of the various online storage services used. Similarly, each online storage service communicates only with the relay server and is unaware of the other online services or the user.

[0008] The general operation of the secure online storage service is illustrated in Figure 1. User 101 transmits a file 106 to the relay server 102 for storage. The relay server 102 applies a scatter function to the file 106, generating fragments 107, 108, 109 from the initial file 106. These fragments are stored by the relay server 102 on the various online storage services 103, 104, 105. This is the upload operation.

[0009] When user 101 wants to retrieve the stored file, he submits a download request to the relay server 102. The relay server 102 then requests the different fragments 107, 108, 109 from the different online storage services 103, 104, 105. From these fragments 107, 108, 109, it reconstructs the original file 106 and transmits it to user 101.

[0010] The figure illustrates three online storage services. This figure is only an example, and the number of online services used by a particular embodiment of the invention can be any number, with a minimum of two services. Similarly, the figure illustrates the saving of a single fragment per online storage service. In practice, several fragments can be stored on the same online storage service.

[0011] Advantageously, these fragments have a certain degree of redundancy to allow the reconstruction of the original file from only a subset of all the fragments available for that file. This property provides the system with resilience against the potential loss or compromise of an online storage service.

[0012] Advantageously, communications between the user and the relay server, as well as between the relay server and the online storage services, use encrypted tunnels to guarantee the confidentiality of the exchanges. Each actor in the system is authenticated with the actors with which it communicates. The user, in particular, must be authenticated with the system that issues them an access token, which can be verified by the relay server and / or the online storage services.

[0013] The user also has a signing key that allows them to sign their messages. This signature can be verified, and therefore the messages authenticated as originating from the user, by the relay server and online storage services. This signing key can be symmetric or asymmetric.

[0014] Advantageously, the scatter function ensures that knowledge of a single fragment does not allow an online storage service to reconstruct the original file. In cases where the system uses redundancy and several fragments are stored on the same online storage service, the system ensures that the number of fragments stored on the same online storage service is insufficient to reconstruct the file.

[0015] In terms of security, it is advantageous to offer a so-called zero-trust storage service between the different actors. Thus, the compromise of one of the actors does not compromise the security of the solution. In this case, we are interested in the confidentiality of the exchanges and the means implemented to ensure that the relay server and the storage services cannot access the information saved by the user. This confidentiality must be ensured without requiring the user to manage keys over time. To achieve this, five constraints are imposed on the system.

[0016] According to a first constraint, the user must not have to manage persistent keys.

[0017] According to a second constraint, the user must not have knowledge of online storage services.

[0018] According to a third constraint, online storage services must not be able to acquire any knowledge, even partial, of the original content stored by the user.

[0019] According to a fourth constraint, the relay server must not be able to acquire any information about the original user content.

[0020] According to a fifth constraint, the user should only need one request to obtain a valid response from the service.

[0021] The invention aims to offer a secure online storage service based on a relay server and a plurality of online storage services respecting these constraints.

[0022] According to one aspect of the invention, a method for securely storing an original file is proposed, characterized in that it comprises the following steps for uploading an original file: - reception of the original file, transmitted by a user device, by a relay server connected to a plurality of online storage services; - application of a dispersion function by the relay server to generate a plurality of fragments from the original received file; - transmission for backup by the relay server of each fragment to an online storage service from among the plurality of online storage services; characterized in that: - the original file is transformed into a pseudo-message by the user device using an on / off transformation function; - the pseudo-message is encrypted, at least in part, by the user device using a secret key shared with the plurality of online storage services, the encryption being homomorphic, the original file received by the relay server being the encrypted pseudo-message; - the dispersion function is applied to the encrypted pseudo-message and generates encrypted fragments; - the encrypted fragments are decrypted by online storage services before storage.

[0023] An embodiment is characterized in that: - The secret key is shared between the user device and online storage services via a secure key exchange protocol.

[0024] An embodiment is characterized in that:

[0025] - the secure key exchange protocol is the Diffie-Hellman protocol.

[0026] An embodiment is characterized in that: - The secure key exchange protocol is the secure key exchange protocol. An embodiment is characterized in that: - The Diffie-Hellman protocol is based on a first asymmetric key generated by the user device and a second asymmetric key shared by online storage services.

[0027] An embodiment is characterized in that: - a new first asymmetric key is generated before each exchange by the user device.

[0028] An embodiment is characterized in that it further comprises the following steps for downloading: - encryption of fragments by online storage services using a secret key shared with the user device; - reception by the relay server of the encrypted fragments; - application of the inverse dispersion function by the relay server on the encrypted fragments to generate a pseudo-encrypted message; - transmission of the encrypted pseudo-message to the user device; - decryption of the pseudo-message encrypted by the user device; - application of the inverse all-or-nothing transformation function by the user device to recover the original file.

[0029] According to another aspect of the invention, a computer program is proposed comprising instructions adapted to the implementation of each of the steps of the process according to the invention when said program is executed on a computer.

[0030] According to another aspect of the invention, a means of storing information, removable or not, partially or totally readable by a computer or a microprocessor, comprising code instructions of a computer program for the execution of each of the steps of the process according to the invention, is proposed.

[0031] According to another aspect of the invention, a system is proposed comprising a user device, a relay server and a plurality of online storage services configured to implement a method according to the invention.

[0032] According to another aspect of the invention, a computer program is proposed comprising instructions adapted to the implementation of each of the steps of the process according to the invention when said program is executed on a computer.

[0033] According to another aspect of the invention, a means of storing information, removable or not, partially or totally readable by a computer or a microprocessor, comprising code instructions of a computer program for the execution of each of the steps of the process according to the invention, is proposed.

[0034] According to another aspect of the invention, a system is proposed comprising a user device, a relay server and a plurality of online storage services configured to implement a method according to the invention.

[0035] To the attached drawings, given by way of non-limiting examples:

[0036] Figure 1 illustrates the general architecture and operation of a secure online storage service according to one embodiment of the invention;

[0037] Figures 2a and 2b illustrate the general operation of uploading and downloading a file;

[0038] Figures 3a and 3b illustrate one embodiment of the invention;

[0039] [Fig.4] is a schematic block diagram of an information processing device for the implementation of one or more embodiments of the invention.

[0040] Figures 2a and 2b illustrate the general operation of uploading, [Fig.2a], and downloading, [Fig.2b], a file.

[0041] In these figures, only one online storage service 203 is represented. The same operation applies to the plurality of online storage services connected to the relay server 202.

[0042] The uploading of the file is illustrated by [Fig.2a] User 201 transmits the original file to be saved 204 to the relay server 202. The latter assigns an identifier 207 Id_o to the original file, transmits it to user 201 who stores it 210.

[0043] The relay server applies the scatter function to generate the fragments from the original file. The operation of the scatter function is not the subject of this document. The figure illustrates a fragment 205 of this plurality of fragments. Fragment 205 is transmitted to the online storage service 203, which assigns it a fragment identifier Id_f 206 and stores the link 208 between fragment 205 and its identifier Id_f 206. The online storage service transmits this fragment identifier 206 to the relay server, which stores the association 209 between the identifier of the The original file Id_o and the fragment identifier Id_f. The other fragments generated by the relay server receive the same processing, not shown in the figure.

[0044] The download illustrated in [Fig. 2b] operates symmetrically. User 201 sends a request to the relay server 202 containing the identifier Id_o 207 of the file they wish to download. The relay server retrieves the associated fragment identifier Id_f, which it uses to construct a request containing this identifier, and transmits it to the online storage service 203. Using the fragment identifier Id_f, the online storage service 203 retrieves the associated fragment 205 and transmits it to the relay server 202. Once the latter has retrieved all the fragments, or at least a sufficient number if redundancy is implemented, it reconstructs the original file 204 using the inverse function of the scatter function. The relay server can then transmit the resulting original file 204 to the user.

[0045] The solutions proposed in this document to address the security constraints outlined are based on the use of cryptographic tools. Among these tools, we will mention the following functions:

[0046] The KEYGEN function which allows the generation of a cryptographic key. The generated key can be a symmetric or asymmetric key.

[0047] A symmetric key is a key shared between two parties that allows the encryption of content to obtain encrypted content. The same key is required to decrypt the encrypted content and recover the original content. This key constitutes a secret shared between the sender of the encrypted content who performs the encryption and the receiver of the encrypted content who performs the decryption.

[0048] An asymmetric key consists of a key pair, a private key and a public key. To exchange encrypted content between two parties, each possesses their own asymmetric key. Each party keeps their private key secret and shares their public key. In this case, the sender who encrypts content encrypts it using the receiver's public key. The receiver decrypts the content using their own private key.

[0049] The function ENC(k, m) represents the encryption of a content 'm' using the key 'k'. This is a symmetric key, typically obtained from the KEYGEN function. An asymmetric key can also be used.

[0050] The function DEC(k, c) represents the decryption of an encrypted content 'c' using the key 'k'. It is the inverse function of the function ENC(k, m).

[0051] The function SIGN(k, m) produces a cryptographic signature of the content 'm' using the key 'k'. This function does not encrypt the content and leaves it readable. The sender of a content 'm' can sign this content using this function. They then transmit the content 'm' and the signature thus calculated. The receiver of the content 'm' can verify the signature, for example using the same function and key, or the verification functions according to the embodiment. If the resulting signature matches the received signature, this means that the content 'c' has not been altered and was indeed signed by the owner of the key 'k'. In the preferred embodiment, the signing key is different from the key used to encrypt / decrypt messages.

[0052] The HASH(m) function is a non-invertible mathematical function that produces a fixed-size value from a content 'm' of arbitrary length. The probability that two different contents ml and m2 produce the same hash value is sufficiently low that the HASH function can be considered as a means of verifying the integrity of the content 'm'.

[0053] The AONT (All-Or-Nothing Transform) function is an all-or-nothing transformation function, i.e., keyless, invertible, and random, with the property of being very difficult to invert if its entire result is not known. This function takes a message as input and generates a pseudo-message. The inverse operation, which allows the recovery of the original message from the pseudo-message, requires knowledge of the entire pseudo-message. A simple fragment of the pseudo-message does not allow the reconstruction, even partially, of the original message. Several examples of such functions are known to those skilled in the art, including the function described by Ronald L. Rivest in his 1997 article entitled "All-Or-Nothing Encryption and The Package Transform".The transformation proposed by Rivest involves preprocessing the plaintext by XORing each block of plaintext with the index of that block encrypted with a randomly chosen key, and then adding an additional block calculated by XORing this random key with the hashes of all the preprocessed blocks. The result of this preprocessing is called the pseudo-message and serves as input to the encryption algorithm. To undo the packet transformation, all blocks of the pseudo-message except the last must be hashed, all hashes are XORed with the last block to recover the random key, and then the random key is used to convert each preprocessed block back to its original plaintext block. In this way, it is impossible to recover the original plaintext without access to all the blocks of the pseudo-message. Other AONT functions have been proposed since.Within the context of this document, any AONT function can be used interchangeably.

[0054] The function HEenc(k, m) is a homomorphic encryption function of a message m by a key k having the following property with respect to a law defined by two operators ( ®, © ):

[0055] HEenc(k, ml) ® HEenc(k, m2) = HEenc(k, ml © m2);

[0056] The function HEenc(k, m) is said to be totally homomorphic if the homomorphism property holds with respect to two operations ( ®, © ) and ( O, 0 ) which allow any computable function to be expressed. Homomorphic encryption makes it possible to perform calculations on encrypted data without requiring decryption. A known use case for these encryption methods is the outsourcing of calculations to an untrusted entity. The data to be processed is encrypted by such a totally homomorphic function before being transmitted to the entity. The latter can then perform the requested processing on the encrypted data without being able to access this data. The result received from the entity can be decoded by the client. An example of a totally homomorphic encoding function is described in the scientific article: I. Chillotti, N. Gama, M. Georgieva, and M. Izabachène. TFHE: Fast Fully Homomorphic Encryption over the Torus. In Journal of Cryptology, volume 33.

[0057] The Diffie-Hellman DH-Key function allows a key exchange between two agents, conventionally named Alice and Bob, such that this exchange allows the two agents to share a secret without the exchange revealing that secret. If Alice has a secret key DH_S_A and a corresponding public key DH_P_A, while Bob has the secret key DH_S_B and the corresponding public key DH_P_B, and Alice and Bob exchange their public keys DH_P_A and DH_P_B, the Diffie-Hellman function allows the two agents Alice and Bob to calculate the same value K, which can serve as a key, in the following way:

[0058] K = DH-Key (DH_P_B, DH_S_A) = DH-Key (DH_P_A, DH_S_B);

[0059] A malicious agent intercepting the exchanges between Alice and Bob only acquires knowledge of Alice and Bob's public keys, which, in the absence of private keys, do not allow the calculation of K. The key K then allows Alice and Bob, for example, to encrypt their communications.

[0060] The invention is based on implementing encryption of the file to be saved by the user. It should be noted that one of the constraints is to avoid requiring the user to manage persistent keys. The fragments from the file to be saved are therefore stored in plain text by the storage services. This encryption aims to protect the confidentiality of the original file during communications, and in particular during file manipulation by the relay server to generate the fragments. Consequently, the file must not be decrypted by the relay server, which must work on the encrypted version of the file. To allow this manipulation of the encrypted file by the relay server without compromising the decryption of the fragments by the storage services, a fully homomorphic encryption is preferred.However, in certain embodiments, depending on the type of mathematical operations implemented by the dispersion function, a simply homomorphic encryption can be used.

[0061] It is also desired that the relay server not be able to decrypt the file and access its contents. Furthermore, the user has no prior knowledge of the storage services used; they communicate only with the relay server. These constraints must nevertheless allow the user to encrypt the file and the storage service to decrypt the fragments entrusted to it. To meet these constraints, it is proposed to use a secure protocol for exchanging a private key between the user and the storage services. Several protocols can be used, for example, the Diffie-Hellman key exchange protocol, or the Kyber algorithm described in the article "CRYSTALS-Kyber Algorithm Specifications And Supporting Documentation (version 3.02)", by Roberto Avanzi, Joppe Bos, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, John M.Schanck, Peter Schwabe, Gregor Seiler, Damien Stehlé, and submitted to the NIST competition. Advantageously, online storage services share the same asymmetric key, that is, a key composed of a public key and a secret key. The user can, however, generate a new asymmetric key for each exchange. This generation of a new key by the user is not mandatory but allows the shared key K used to encrypt the file to be changed with each exchange. Thus, during each exchange, the Diffie-Hellman protocol generates a key K dedicated to that exchange, shared between the user and all storage services and unknown to the relay server, even though the latter is aware of all exchanges between the user and the online storage services. This generation of a new key by the user is not mandatory but allows the shared key K used to encrypt the file to be changed with each exchange.The way in which online storage services obtain the asymmetric key they share is beyond the scope of this document. This key can be configured at system initialization or shared afterward. The only constraint is that it must be guaranteed that the relay server cannot acquire knowledge of it.

[0062] It is also desirable that the online storage services used to store the fragments not be able to acquire knowledge about the original file. However, the fragments are stored unencrypted by these online storage services. To comply with these constraints, it is proposed that the user encrypt the original file using an AONT function to generate a pseudo-message from the original file. It is this pseudo-message, and not the original file, that is then encrypted and transmitted to the relay server for storage by the online storage services. Due to the properties of the AONT function, the entire pseudo-message is necessary to decode it and recover the original file. Thus, each online storage service, by definition possessing only one or more fragments of the pseudo-message, is unable to access even a single fragment of the original file.

[0063] Furthermore, the use of the AONT function has an additional advantage. Indeed, since it is necessary to access the entire pseudo-message in order to decode it, it is not necessary to encrypt the entire pseudo-message to protect access to it. Encrypting only a small part of the pseudo-message offers the same degree of protection as encrypting the entire pseudo-message. This property can be used to limit the computational resources required by the proposed method by encrypting only a small part of the pseudo-message. This is all the more advantageous because fully homomorphic encryption functions are computationally expensive.

[0064] In summary, the proposed storage method comprises, for the upload operation, a first step in which the user applies an AONT function to the original file to obtain a pseudo-message corresponding to the original file. Next, the user encrypts at least part of the pseudo-message to obtain an encrypted pseudo-message. This encryption is totally homomorphic. It is performed using a secret key shared between the user and the online storage services. In one embodiment, this secret key is exchanged using the Diffie-Hellman protocol between the user and the storage services. The encrypted pseudo-message is then transmitted to the relay server. It should be noted here that the pseudo-message is referred to as an encrypted pseudo-message even in the case of partial encryption.Indeed, due to the use of the AONT function, even in the case of partial encryption, the unencrypted parts of the pseudo-message are inaccessible without decrypting the encrypted portion. The relay server then applies the scatter function to obtain a plurality of encrypted fragments. These fragments are referred to as encrypted here, although strictly speaking, since encryption may only affect a portion of the pseudo-message, some fragments may correspond to an unencrypted part of the pseudo-message, for the reason explained above regarding the encrypted pseudo-message. These encrypted fragments are distributed across the various online storage services. They are then decrypted and stored in plaintext by the online storage service.

[0065] The download operation is symmetric. It is also based on homomorphic encryption using a key shared between the user and the online storage services. This secret key can, in one embodiment, be exchanged via the Diffie-Hellman protocol following the possible generation of a new asymmetric key by the user. The online storage services then encrypt all or part of the fragments at their disposal. These fragments are then transmitted to the relay server upon request. The relay server, having received the encrypted fragments, applies the inverse scatter function to recover the encrypted pseudo-message. The manipulation of the encrypted data is made possible by the use of a fully homomorphic. This encrypted pseudo-message is then transmitted on request to the user who can decrypt it to obtain the unencrypted pseudo-message and decode the latter to recover the original file.

[0066] Figures 3a and 3b illustrate a first embodiment of the invention. [Fig. 3a] illustrates uploading according to this embodiment, while [Fig. 3b] illustrates downloading.

[0067] To perform the upload, user 201 begins by generating the pseudomessage by applying the AONT function to the original file. Next, they obtain the secret key K, which is shared with the online storage services, in this case storage service 203. In one example, the user generates an asymmetric key (DH_P_U, DH_S_U), typically using the KEYGEN function, and applies the Diffie-Hellman protocol to calculate the secret key K. This key is then used to at least partially encrypt the pseudomessage using a totally homomorphic cipher, resulting in an encrypted pseudomessage. The user then transmits the encrypted pseudomessage 204 to be stored to the relay server 202. The relay server applies the scatter function and generates the encrypted fragments from the encrypted pseudomessage. It also associates the encrypted pseudo-message with the original file identifier 207 Id_o, which it then transmits back to user 201.We describe the processing of one of these encrypted fragments, fragment 205, which is transmitted to the online storage service 203 for storage. This fragment, originating from an encrypted pseudo-message, is also encrypted. The online storage service 203 decrypts the encrypted fragment 205, stores it, and associates it with a fragment identifier (Id_f), which is then sent back to the relay server. Alternatively, the fragment identifier (Id_f) can be generated directly by the relay server, which can then calculate the hash directly to avoid a round trip to the storage service.

[0068] Regarding the download, in this embodiment, the user generates a new asymmetric key using the KEYGEN function to calculate a new secret key K' shared with the online storage services using the Diffie-Hellman protocol. To download the file, the user transmits, in step 307, the identifier of the original file Id_o, their public key DH_P_U, and possibly their signature. The signature allows the online storage service to verify that this public key has not been spoofed by the relay server. The relay server relays this information to the online storage service in step 306.

[0069] Using this key, the online storage service can also calculate the secret key K'. The storage service can then encrypt the fragment to reconstruct an encrypted fragment. Here again, since the encryption of the pseudo-message may be partial, it is possible that not all fragments are actually encrypted. These fragments will nevertheless be classified as encrypted fragments because they correspond to fragments from a pseudo-message that is at least partially encrypted.

[0070] This encrypted fragment is then transmitted to the relay server, during step 205, accompanied by the public key of the online storage service DH_P_S.

[0071] Then the relay server, once in possession of all the encrypted fragments, applies the inverse scatter function to obtain the encrypted pseudo-message HE(K', AONT(file)). This is transmitted, along with the public key of the online storage service, to the user.

[0072] Using the public key of the storage and applying the Diffie-Hellman protocol, the user can calculate the key K' and thus decipher the pseudo-message which then only needs to be decoded, i.e. to apply the inverse function AONT to recover the original file.

[0073] It can be observed that the five stated constraints are respected by the system during the download stage. The user is not required to manage persistent keys. The user acquires no information about the online storage services used. These services cannot acquire any information about the original stored file. Similarly, the relay server, although aware of all exchanges, cannot acquire any information about the original stored file. Finally, the entire process requires only one instance of exchange between the various actors in the system, from the request issued by the user to the response transmitting the encrypted pseudo-message from which the user can retrieve the original file.

[0074] The proposed system makes it possible to guarantee the security of user data, even in the event of compromise of the relay server or of one or more of the online storage services used.

[0075] Figure 4 is a schematic block diagram of an information processing device 400 for implementing one or more embodiments of the invention. The information processing device 400 may be a peripheral device such as a microcomputer, a workstation, or a mobile telecommunications terminal. The device 400 includes a communication bus connected to:

[0076] - a central processing unit 401, such as a microprocessor, denoted CPU;

[0077] - a 402 random access memory, denoted RAM, for storing the executable code of the method for carrying out the invention as well as registers adapted to record variables and parameters necessary for the implementation of the method according to embodiments of the invention; the memory capacity of the device can be supplemented by an optional RAM memory connected to an expansion port, for example;

[0078] - a read-only memory 403, denoted ROM, for storing computer programs for the implementation of the embodiments of the invention;

[0079] - a 404 network interface is normally connected to a communication network on which digital data to be processed is transmitted or received. The 404 network interface can be a single network interface, or composed of a set of different network interfaces (e.g., wired and wireless, interfaces, or different types of wired or wireless interfaces). Data packets are sent on the network interface for transmission or are read from the network interface for reception under the control of the software application running in the 401 processor;

[0080] - a 405 user interface for receiving input from a user or for display information to a user;

[0081] - a storage device 406 as described in the invention and denoted HD;

[0082] - an input / output module 407 for receiving / sending data to / from external devices such as hard drives, removable storage media or others.

[0083] The executable code can be stored in read-only memory 403, on the storage device 406, or on a removable digital medium such as, for example, a disk. According to one embodiment, the executable code of the programs can be received via a communication network, through the network interface 404, in order to be stored in one of the storage means of the communication device 400, such as the storage device 406, before being executed.

[0084] The central processing unit 401 is adapted to command and direct the execution of instructions or portions of software code of the program or programs according to one of the embodiments of the invention, instructions which are stored in one of the aforementioned storage means. After power-up, the CPU 401 is capable of executing instructions from the main RAM 402, relating to a software application. Such software, when executed by the processor 401, causes the execution of the processes described.

[0085] In this embodiment, the device is a programmable device that uses software to implement the invention. However, alternatively, the present invention can be implemented in hardware (for example, in the form of a specific integrated circuit or ASIC).

Claims

Demands

1. A method for securely storing an original file, characterized in that it comprises the following steps for uploading an original file: - receiving the original file, transmitted by a user device, by a relay server connected to a plurality of online storage services; - applying a scattering function by the relay server to generate a plurality of fragments from the received original file; - transmitting each fragment for backup by the relay server to one of the plurality of online storage services; characterized in that: - the original file is transformed into a pseudo-message by the user device using an all-or-nothing transformation function;- The pseudo-message is encrypted, at least in part, by the user device using a secret key shared with the plurality of online storage services, the encryption being homomorphic, the original file received by the relay server being the encrypted pseudo-message; - The scatter function is applied to the encrypted pseudo-message and generates encrypted fragments; - The encrypted fragments are decrypted by the online storage services before storage.

2. The method according to claim 1, characterized in that: - the secret key is shared between the user device and the online storage services by a secure key exchange protocol.

3. Method according to claim 2, characterized in that: - the secure key exchange protocol is the Diffie-Hellman protocol.

4. Method according to claim 3, characterized in that: - the Diffie-Hellman protocol is based on a first asymmetric key generated by the user device and a second asymmetric key shared by the online storage services.

5. The method according to claim 4, characterized in that: - a new first asymmetric key is generated before each exchange by the user device.

6. A method according to claim 1, characterized in that it further comprises the following steps for downloading: - encryption of the fragments by the online storage services using a secret key shared with the user device; - reception by the relay server of the encrypted fragments; - application of the inverse scatter function by the relay server on the encrypted fragments to generate an encrypted pseudo-message; - transmission of the encrypted pseudo-message to the user device; - decryption of the encrypted pseudo-message by the user device; - application of the inverse all-or-nothing transformation function by the user device to recover the original file.

7. A computer program comprising instructions which, when executed by one or more computers in a system comprising a user device, a relay server and a plurality of online storage services, cause the implementation of the steps of the method according to any one of claims 1 to 6.

8. Information storage means, removable or not, partially or totally readable by a computer or microprocessor, comprising code instructions of a computer program for the execution of each of the steps of the process according to any one of claims 1 to 6.

9. System comprising a user device, a relay server and a plurality of online storage services configured to implement a method according to any one of claims 1 to 6.

Images