Cloud Storage Deduplication via Hash-Derived Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage environments face challenges in securely managing access to shared data blocks, as existing access control is granular only at the pool level, allowing unauthorized workloads to read all blocks, and burdensome key management is required for data encryption.
Innovation Solution
A data control server maintains a data storage reference table with hash values for each block, allowing workloads to securely store and access data blocks by deriving encryption keys from hash values, facilitating deduplication without giving unencrypted access to all blocks, and enabling secure shared access through cryptographic hash functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If cloud storage uses pool-level access control, then data storage efficiency is improved through shared access, but security deteriorates as unauthorized workloads can read all blocks
Solution Approach 1:
The patent segments the shared data pool into individually encrypted data blocks, where each block has its own encryption key. This allows the storage system to maintain shared access benefits while preventing unauthorized access to specific blocks, thus resolving the contradiction between storage efficiency and security.
Solution Approach 2:
The patent applies different encryption properties to different data blocks within the shared pool. Each block can have its own encryption key and access controls, allowing selective security measures tailored to specific data blocks while maintaining overall pool sharing, thereby achieving both efficiency and security.
2Reliability
If cloud storage implements data encryption, then data security is improved, but key management complexity increases
Solution Approach 1:
The patent enables workloads to autonomously manage their own encryption keys through cryptographic key derivation from stored data. This self-service approach eliminates the need for centralized key management infrastructure, reducing complexity while maintaining strong security through workload-controlled encryption.
3Productivity
If cloud storage allows workload access to shared blocks, then data access efficiency is improved, but unauthorized access risk increases
Solution Approach 1:
The patent introduces encryption keys as an intermediary layer between workloads and data blocks. Authorized workloads can efficiently access their permitted blocks through key-based authentication, while unauthorized workloads are blocked without access to actual data, thus enabling efficient access while preventing unauthorized reads.
Data Source
AI summary
Secure shared access to encrypted data in a data store is facilitated by using a data control server (DCS) to maintain a data storage reference table (DSRT) for shared data units present in a shared data pool hosted by least one data storage device, and accessible to a plurality of computing entities. The DSRT specifies for each shared data unit identifier information, location information for accessing the shared data unit in the shared data pool, and a hash value which has been computed for the shared data unit. The DCS selectively facilitates a decryption operation by providing hash values which serves as a basis for deriving a decryption key for decrypting shared data units which have been identified.