Client-Side Data Block Encryption for Secure Cloud Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud storage solutions face challenges in ensuring data security and integrity, particularly when third parties have access to all keys and algorithms, as they can decrypt and manipulate data, and users are reluctant to use cloud services due to concerns about data sovereignty, storage space optimization, and unauthorized access.
Innovation Solution
A process that encrypts data blocks on the client using user-specific keys, generates unique data block IDs, and uploads only new blocks to the server, ensuring that the server cannot decrypt data and that user passwords remain unknown, while allowing for efficient data recovery and compression.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If data is stored on a central server with third-party access to keys and algorithms, then data storage and retrieval functionality is achieved, but data security and confidentiality are compromised as third parties can decrypt and manipulate data
Solution Approach 1:
The patent extracts the decryption capability from the server by removing the decryption key from server access. Only the encryption key is stored on the server, while the decryption key remains exclusively on the user's client device. This separation ensures that even though the server stores and can retrieve encrypted data, it cannot decrypt it without the user's private key, thus resolving the contradiction between storage functionality and data security.
Solution Approach 2:
The patent introduces encrypted data blocks as an intermediary form between storage and retrieval. Data is encrypted before upload to the server, and the server only handles this encrypted intermediate form. The decryption process requires the user's private key, which never leaves the client device. This intermediary encrypted state allows the server to perform storage operations without compromising security.
2Reliability
If all data blocks are uploaded to the server, then complete data backup is achieved, but server load and storage costs increase significantly
Solution Approach 1:
The patent segments data into individual data blocks with unique identifiers, allowing the server to track and store only unique blocks. When data is uploaded, the system divides it into blocks, checks if each block already exists on the server using the unique ID, and only uploads new blocks. This segmentation approach ensures complete backup coverage while minimizing redundant storage and server load.
Solution Approach 2:
The patent changes the parameter of data representation by using unique data block IDs instead of storing complete data blocks for comparison. The server stores a mapping of unique IDs to data block locations, allowing efficient identification of new versus existing blocks without duplicating full data content. This parameter change from storing complete blocks to storing ID mappings reduces server load and storage requirements.
3Reliability
If data is encrypted on the client before upload, then data security is improved, but the server cannot perform efficient data comparison and deduplication
Solution Approach 1:
The patent performs preliminary encryption of data blocks on the client device before upload to the server. Each data block is encrypted using the user's private key, ensuring confidentiality from the outset. The encrypted blocks are then uploaded with unique identifiers that the server can use for comparison and deduplication operations without needing to decrypt the data, thus maintaining both security and efficiency.
Solution Approach 2:
The patent creates a copy of the data block ID or hash value that can be stored and compared on the server without requiring the actual encrypted data blocks for comparison. The server stores and compares these ID copies to determine deduplication opportunities, while the actual encrypted data blocks remain confidential and are only retrieved when explicitly requested by the user with the proper decryption key.
Data Source
AI summary
This disclosure describes a process for storing data on a central server with a plurality of users, each of them having their own user password used for creating a user key, being respectively assigned to some of these users, and some of the data, being divided into data blocks to be uploaded, and each data block being compared to data blocks on the server based on a unique data block ID value in order to determine whether a corresponding data block is already stored on the server and to upload to the server those data blocks which are not already present, a data block list to be uploaded being created and uploaded to the central server, so that in a data recovery step data stored on the central server which are requested by the user can be restored in their original form based on said list.