Client-Side Data Block Key Generation for Secure Cloud Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cloud storage methods face challenges in ensuring data security and sovereignty, particularly in scenarios where third parties have access to all keys and algorithms, and users cannot encrypt their data without compromising the security of others' data, leading to resource optimization issues for storage providers.
Innovation Solution
A method where each unencrypted data block is encrypted with a data block key generated solely from the block itself, and a unique data block ID is created, allowing the client to determine if the block exists on the server without revealing user passwords, with encryption and decryption occurring on the client side to maintain security and reduce server load.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If data is encrypted on the server side with provider-managed keys, then storage resource optimization is improved, but data security and user sovereignty deteriorate
Solution Approach 1:
The data is segmented into data blocks, each with its own unique ID. The system segments the encryption responsibility between client (generates data block keys) and server (stores encrypted blocks), allowing resource optimization while maintaining security through distributed key management
Solution Approach 2:
A data block key list acts as an intermediary between user passwords and encrypted data blocks. The list contains data block IDs and their corresponding keys, enabling secure key management without requiring the server to store user passwords or master keys
2Reliability
If each user encrypts their data individually on the client side, then data security is improved, but server resource optimization deteriorates
Solution Approach 1:
User data is divided into standardized data blocks with unique IDs. This segmentation allows the server to store and manage encrypted blocks uniformly without needing to process or understand user-specific encryption, achieving both security and resource optimization
Solution Approach 2:
The server implements a universal storage mechanism that handles all encrypted data blocks identically, regardless of user or content. The server's function is limited to storing and retrieving blocks by ID, making it universally applicable while minimizing resource usage
3Device complexity
If user passwords are transmitted to the server for key generation, then key management is simplified, but data sovereignty and security deteriorate
Solution Approach 1:
The sensitive element (user password) is extracted from the transmission process entirely. Instead of sending passwords to the server, the system generates data block keys locally on the client using only the user's password and the data block content, keeping sensitive information local
Solution Approach 2:
The client performs self-service key generation by deriving data block keys locally from the user password and data block content. This eliminates the need for server involvement in key creation, maintaining data sovereignty while managing complexity through automated local key derivation
4Productivity
If data blocks are uploaded without checking for duplicates, then upload speed is improved, but storage efficiency deteriorates
Solution Approach 1:
The system performs preliminary duplicate detection by comparing data block IDs against existing blocks on the server before uploading. This preliminary check prevents redundant uploads, achieving storage efficiency without significantly impacting upload speed for new content
Data Source
AI summary
The invention relates to a method for storing data on a central server. Each of a plurality of users has a user password that is used at least for generating a user key. At least some of said users are assigned to at least one respective client that stores data, and at least some of said data is partitioned into at least one data block to be uploaded as needed. A check is carried out for each data block using a data block ID value that is unique for said data block to determine whether a matching data block is already present on the server, and the data blocks that are not present on said server are uploaded to the central server. A data data block list to be uploaded is generated and uploaded to the central server. When the user requests the data that is stored on the central server, said data can be regenerated in the original form using the data data block list in a data recovery step. A data block key is generated exclusively by means of the unencrypted data block using a key-generation protocol in order to ascertain the data blocks that are to be uploaded to the central server and the data data block list that is to be uploaded for each unencrypted data block on the client so that the user password or other user-relevant data is not used for this purpose.