Cloud Storage Encryption Key Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud storage service providers face challenges in preventing the storage of duplicate files while ensuring that unencrypted data remains inaccessible, even to themselves, due to the need for decryption key possession for file access.
Innovation Solution
The method involves encrypting data with a storage key, generating a personal key and a data key using two different encryption methods, allowing only the data owner to access the storage key, and ensuring the service provider cannot access unencrypted data by using the data itself to decrypt and re-encrypt the storage key.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the service provider saves the decryption key for long-term use to enable duplicate file detection and user authorization, then file access functionality is improved, but data security deteriorates because the provider can access unencrypted user data
Solution Approach 1:
The decryption key is extracted from the service provider's control and given exclusively to the user. The provider only stores encrypted files and cannot decrypt them, eliminating the security risk while maintaining file access functionality through client-side decryption capability.
Solution Approach 2:
A cryptographic intermediary mechanism is introduced where the user's public key serves as a mediator between the file encryption and the decryption key. The provider stores encryption performed with the user's public key, and only the user's private key can decrypt, allowing duplicate detection without compromising security.
2Object-affected harmful factors
If asymmetric encryption is used to prevent provider access to unencrypted data, then data security is improved, but the provider cannot recognize files for duplicate detection
Solution Approach 1:
Instead of storing or processing the actual unencrypted file content, the system uses cryptographic hashes (copies/digests) of the files for duplicate detection. These hashes can be computed from encrypted data without requiring decryption, enabling productivity while maintaining security.
Solution Approach 2:
The system transforms the file representation from unencrypted content to cryptographic hash values and encrypted ciphertext. This parameter change allows duplicate detection through hash comparison while the actual file remains securely encrypted, resolving the contradiction between security and detection capability.
3Device complexity
If symmetric encryption is used with provider-held keys, then duplicate file detection is simplified, but the provider can view file contents which compromises user privacy
Solution Approach 1:
The traditional model is inverted: instead of the provider holding decryption keys to manage files, the user holds the decryption keys exclusively. The provider only performs encryption operations using the user's public key and stores the ciphertext, simplifying provider operations while maximizing user privacy protection.
Data Source
AI summary
The present invention discloses a storage method, system and apparatus. The method comprises: storing data after encrypting the data with a storage key; encrypting the storage key with two different encryption methods to generate a personal key and a data key respectively; wherein, the personal key can be decrypted by a private key of a user who owns the data to obtain the storage key and the data key can be decrypted by the data unencrypted to obtain the storage key; saving the encrypted data, personal key and data key. The technical scheme of the present invention can prevent saving duplicate files while ensuring that the unencrypted data cannot be accessed by any other users and storage service providers.