Chunk-Level Encryption for Secure Cloud Storage Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Distributed file systems face challenges in ensuring secure access to shared file system data across multiple files and clients, while preventing unauthorized access, especially in cloud-based storage environments.
Innovation Solution
A de-duplicating distributed file system segments files into chunks for de-duplication purposes but stores data in larger objects, using a file system client to encrypt each chunk with specific encryption keys, allowing access control on a chunk-by-chunk basis and storing these chunks in a cloud-based object store, where only necessary encryption keys are provided to authorized clients.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If chunks of data are shared across multiple files and clients to improve storage efficiency, then storage space is optimized, but security control becomes more complex and difficult to manage
Solution Approach 1:
The patent segments files into chunks and assigns unique encryption keys to each chunk. This segmentation allows the same physical chunk to be securely shared across multiple files and clients while maintaining granular access control. Each client receives only the encryption keys they are authorized to access, enabling secure sharing without compromising security management.
Solution Approach 2:
The patent implements local quality by providing different encryption keys to different clients for the same chunk of data. Each client has specific access rights to specific chunks, allowing the system to optimize storage through deduplication while maintaining differentiated security policies for each client-chunk pair.
2Ease of operation
If encryption keys are provided to multiple clients for shared data, then access is enabled, but security risks increase and unauthorized access becomes more likely
Solution Approach 1:
By segmenting the encryption key management at the chunk level, the patent enables each client to receive only the specific keys they need for authorized chunks. This segmentation isolates security risks, so that if one client's keys are compromised, it does not affect access to other chunks or other clients' data.
Solution Approach 2:
The patent changes the parameter of key distribution from file-level to chunk-level granularity. This allows the system to provide broad data accessibility across multiple clients while maintaining security by controlling access at a finer granularity, reducing the attack surface for potential security breaches.
3Quantity of substance
If files are segmented into small chunks for de-duplication, then storage efficiency improves, but performance and access speed deteriorate due to increased overhead
Solution Approach 1:
The patent merges multiple small chunks into larger objects for storage in the cloud-based object store. This merging approach maintains the de-duplication benefits of chunk-level segmentation while improving access performance by reducing the number of individual operations required to retrieve data, as clients can access larger consolidated objects rather than numerous small chunks.
Data Source
AI summary
A combined object associated with a data chunk included in a request file is determined. An encryption key associated with the combined object and a corresponding chunk hash value associated with the data chunk are used to determine a corresponding chunk key associated with the data chunk. At least a locator to be used to retrieve the combined object and the corresponding chunk key associated with the data chunk are provided to a requesting system.