Backup Service Single-Instance Storage Encrypted Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Backup storage systems face inefficiencies due to the inability to distinguish duplicate encrypted data, leading to redundant storage, which clashes with user data protection interests.
Innovation Solution
Implementing convergent encryption and signature-based methods to identify and store only unique encrypted data portions, using client computers to generate signatures and encrypt data, and maintaining an index of these signatures on the backup server to prevent redundant storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users encrypt data prior to backup storage, then data security is improved, but the ability to identify and eliminate duplicate data is worsened
Solution Approach 1:
The system performs preliminary hashing of encrypted data blocks before storage, creating a fingerprint that enables future duplicate detection. This preliminary action allows the system to maintain both encryption for security and hash-based identification for efficiency, resolving the contradiction by preparing identification markers in advance without compromising the encrypted state
Solution Approach 2:
A hash function serves as an intermediary between the encrypted data and the storage system. The hash operates on the encrypted data without requiring decryption, acting as a mediator that enables duplicate detection while preserving the encryption's security properties. This intermediary allows both security and efficiency to coexist
2Reliability
If all encrypted data portions are stored without deduplication, then data retrieval reliability is improved, but storage resource utilization is worsened
Solution Approach 1:
The system replaces the mechanical approach of comparing encrypted data blocks directly with a computational hash-based identification system. Instead of attempting to compare ciphertexts (which appears random), the system uses hash functions to create compact identifiers that enable efficient duplicate detection while maintaining the integrity and reliability of the encrypted stored data
3Reliability
If duplicate encrypted data is stored, then data availability is improved, but network bandwidth consumption is worsened
Solution Approach 1:
The system implements a feedback mechanism where hash values of stored encrypted data blocks are maintained in an index. Before storing new data, the system queries this index to check for existing duplicates, receiving feedback that prevents redundant network transfers. This feedback loop maintains data availability while eliminating unnecessary bandwidth consumption
Data Source
AI summary
One implementation of a method for providing backup storage services for encrypted data includes receiving signatures of convergently encrypted portions of data from client computers, determining whether the encrypted portions are already present on a backup storage, and obtaining only the needed portions. Users unassociated with a particular user account are denied access to information backed up in that account. The backup storage also stores password protected key files holding signatures of the unencrypted portions of data. One implementation of a system includes a memory, a single-instance storage circuit, a user account management circuit, and a signature index. The memory holds a user-account database and backup copies of convergently encrypted portions of data. The single-instance storage circuit uses the signature index to prevent duplicative backup copies. The user account management circuit responds to download requests after authenticating the user information associated with the requested data.