Asymmetric Key Management for Secure Third-Party Data Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Third-party storage vendors face challenges in deduplicating encrypted files across different encryption schemes, and encrypting files before storage interferes with data sharing and deduplication processes, posing security and compliance issues for customers.
Innovation Solution
The system maintains asymmetric key pairs for encrypting and decrypting data on a third-party storage server, with decryption keys encrypted by clients, using client-initiated long poll connections to facilitate secure access and deduplication without storing client-side decryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If customers encrypt data before submitting to third-party storage, then data security and compliance are improved, but the third-party vendor's ability to deduplicate and share data is worsened
Solution Approach 1:
The system segments the encryption process into two distinct parts: (1) symmetric encryption of the actual data files using file-specific keys, and (2) asymmetric encryption of only the file keys using customer-provided public keys. This segmentation allows the storage system to store and manage encrypted file keys centrally, enabling deduplication based on matching encrypted keys while maintaining strong security through customer-controlled decryption keys.
Solution Approach 2:
The system introduces customer-provided asymmetric key pairs as an intermediary mechanism between the customer's security requirements and the storage system's deduplication needs. The public key acts as a mediator that allows the storage system to encrypt and store file keys without having access to the customer's private decryption key, thus enabling secure key management while maintaining deduplication capabilities.
2Reliability
If customers encrypt data before storage, then privacy protection is improved, but file sharing capability with other users is worsened
Solution Approach 1:
The encryption architecture segments data protection into file-level symmetric encryption and key-level asymmetric encryption. This allows the storage system to manage and share encrypted file keys efficiently while maintaining customer-controlled security. When sharing is required, the system can retrieve and re-encrypt file keys with appropriate customer keys without exposing the actual data, enabling controlled sharing while preserving privacy.
Solution Approach 2:
Asymmetric key pairs serve as an intermediary that decouples security control from data access. The public key enables the storage system to perform encryption and sharing operations, while the private key remains exclusively with the customer for decryption. This intermediary mechanism allows the storage system to facilitate sharing by managing encrypted keys without compromising the customer's privacy control.
3Reliability
If different encryption schemes are used for identical files, then individual security control is improved, but deduplication into a single file is worsened
Solution Approach 1:
The system segments the encryption into data encryption and key encryption layers. Identical files encrypted with the same symmetric key will produce identical encrypted data and identical encrypted file keys, enabling deduplication. Each customer's unique asymmetric key pair provides individual security control by encrypting the file keys differently at the key layer, while the data layer remains deduplicable.
Solution Approach 2:
The system changes the encryption parameter structure by separating the encryption keys into two types: file-specific symmetric keys for data encryption (enabling deduplication of identical files) and customer-specific asymmetric keys for key encryption (providing individual security control). This parameter separation allows identical files from different customers to be deduplicated while maintaining each customer's security requirements.
Data Source
AI summary
A computer-implemented method for secure third-party data storage may include (1) identifying, at a server-side computing system, a data access request from a client system to access an encrypted file stored under a user account, (2) receiving a long poll request from the client system, (3) identifying an asymmetric key pair designated for the user account, the asymmetric key pair including an encryption key and a decryption key that has been encrypted with a client-side key, (4) responding to the long poll request with a message notifying the client system to transmit the client-side key, (5) receiving, from the client system, the client-side key, (6) decrypting the decryption key with the client-side key, and (7) using the decryption key to access an unencrypted version of the encrypted file. Various other methods, systems, and computer-readable media are also disclosed.