All-or-Nothing Encryption Chunking for Partial Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
All-or-Nothing Encryption schemes face challenges in performing file updates efficiently, as they require decrypting and re-encrypting entire files, compromising security by relaxing the notion of each block depending only on the encryption of m/N other blocks, and are vulnerable to internal adversaries.
Innovation Solution
The method involves dividing data into equal-sized chunks, embedding additional randomness into each chunk's All-or-Nothing Encryption scheme, storing encrypted chunks across servers, determining and updating specific chunks, and re-encrypting them using the scheme, ensuring that an adversary must access all blocks to decrypt, thereby enhancing security and supporting partial file updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If All-or-Nothing Encryption is applied to encrypt entire files, then security is improved, but update efficiency deteriorates because the entire file must be decrypted and re-encrypted
Solution Approach 1:
The patent divides the file into multiple blocks and further segments the encryption process by introducing chunk-level encryption units. Each chunk is encrypted independently using AONE, allowing partial updates without processing the entire file. This segmentation enables efficient partial updates while maintaining the security properties of AONE at the chunk level.
Solution Approach 2:
Instead of requiring complete file decryption and re-encryption, the patent enables partial action by allowing updates to specific chunks only. The system encrypts and stores only the modified chunks while retaining unchanged chunks, significantly reducing the computational overhead and time required for updates compared to full file re-encryption.
2Ease of operation
If conventional AONE is used with relaxed block dependency, then update operations become simpler, but security deteriorates because each block no longer depends on encryption of other blocks
Solution Approach 1:
The patent segments the file into chunks where each chunk maintains independent AONE encryption. This segmentation allows simple update operations on individual chunks while preserving the security property that each chunk's ciphertext blocks depend on the encryption of other blocks within the same chunk, preventing security degradation.
Solution Approach 2:
The patent applies local quality by making each chunk have independent encryption properties. Each chunk is encrypted separately with its own AONE scheme, allowing local updates without affecting other chunks. This local independence simplifies operations while maintaining security through localized block dependencies within each chunk.
3Device complexity
If AONE is applied without additional randomness, then encryption process is simpler, but security against internal adversaries deteriorates
Solution Approach 1:
The patent incorporates additional randomness into the AONE encryption process as a preliminary action before encryption. This randomness is embedded in the encryption parameters, ensuring that even if an internal adversary has access to the encryption process, they cannot predict or control the encryption outcomes. This preliminary randomness injection strengthens security without significantly increasing operational complexity.
Solution Approach 2:
The patent changes the encryption parameters by introducing additional randomness into the AONE scheme. This parameter modification enhances the encryption's resistance to internal adversaries by ensuring that the same plaintext produces different ciphertexts under the influence of random parameters, while the overall encryption process remains practically the same complexity.
Data Source
AI summary
A method for encrypting data for storage on one or more servers includes dividing the data, which includes a first number m of plaintext blocks, into a second number N of equal sized chunks, wherein the second number is based on a number of the servers on which the encrypted data is to be stored, and wherein each chunk includes m/N plaintext blocks. Each of the chunks is encrypted using an all-or-nothing encryption (AONE) scheme so as to output a plurality of ciphertext blocks for each chunk, wherein an additional randomness is embedded into the AONE scheme by an initialization vector derived from the randomness being used as an initial seed for an AONE initialization vector of the AONE scheme. The randomness is encrypted using an XOR-combination of XOR operations performed on the ciphertext blocks for each chunk. The encrypted randomness is stored on each of the servers.