Client-Side Encryption Deduplication Integrity Check
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional client-side data encryption techniques hinder deduplication in storage systems as they produce different ciphertexts for the same plaintext data, requiring encryption keys to be shared with the storage system, and lack effective integrity checks for retrieved encrypted data.
Innovation Solution
Implementing client-side encryption with low-cost integrity checks that allow deduplication across multiple tenants without sharing encryption keys, using a client device to generate and encrypt data encryption keys, and performing integrity checks by decrypting and comparing hashed data items with their corresponding encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If client-side encryption is implemented to maintain key secrecy, then data security is improved, but deduplication capability deteriorates
Solution Approach 1:
The system segments the encryption key management by generating unique data encryption keys for each tenant while maintaining a shared secret key at the storage system level. This allows individual tenant data to be encrypted separately (enabling deduplication within tenant) while preserving overall security (preventing cross-tenant decryption).
Solution Approach 2:
The patent introduces an intermediary key derivation mechanism where the storage system generates data encryption keys using a combination of tenant-specific identifiers and a shared secret key. This intermediary process enables the storage system to participate in key management without having access to the full tenant secret keys, thus enabling deduplication while maintaining security.
2Reliability
If conventional integrity checks are implemented on retrieved encrypted data, then data integrity is improved, but storage cost and complexity increase
Solution Approach 1:
The system implements self-service integrity verification where the storage system automatically generates and stores hash values of encrypted data items. When data is retrieved, the system automatically verifies integrity by comparing the stored hash with a newly computed hash, eliminating the need for separate integrity check infrastructure or manual verification processes.
Solution Approach 2:
The patent changes the parameter representation by storing hash values (fixed-length digests) instead of storing complete copies of encrypted data for integrity verification. This parameter transformation reduces storage requirements from O(n) to O(1) where n is the data size, while maintaining comprehensive integrity coverage.
Data Source
AI summary
An apparatus in an illustrative embodiment comprises a client device configured for communication with a storage system, with the client device comprising a processor coupled to a memory. The client device is further configured to generate a data encryption key for a data item by computing a function of at least the data item, to encrypt the data item using the data encryption key for the data item, to encrypt the data encryption key using a secret key of the client device, and to send the encrypted data item and the encrypted data encryption key to the storage system for storage in the storage system. The client device is still further configured to retrieve the encrypted data item and the encrypted data encryption key from the storage system, and to perform an integrity check on the retrieved encrypted data item using a result of decrypting the retrieved encrypted data encryption key.