Data Object Version Authentication for Secure Cloud Recovery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems face challenges in verifying the authenticity and integrity of data object versions, particularly in cloud storage environments, where malicious actors can upload corrupted or malicious versions that may be inadvertently restored, compromising system security.
Innovation Solution
A data management system generates a unique signature using an AES key, HMAC, and timestamp for each data object version, storing it in metadata to ensure authenticity, allowing the system to identify and download the earliest written version with the latest encrypted timestamp, thereby preventing the download of malicious data objects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data objects are stored in cloud storage with versioning, then data recovery capability is improved, but security against malicious data objects deteriorates
Solution Approach 1:
The system performs preliminary actions by generating cryptographic signatures (HMAC) for each data object version at the time of upload, storing these signatures in metadata alongside the data. This preliminary authentication mechanism is in place before any recovery operation, enabling the system to verify the authenticity of data objects during recovery without exposing vulnerabilities to malicious actors.
Solution Approach 2:
The patent introduces cryptographic signatures and metadata as intermediary elements between the data object and the verification process. These intermediaries serve as mediators that authenticate the origin and integrity of each data version, allowing the system to distinguish legitimate data from malicious injections without compromising recovery capabilities.
2Reliability
If multiple data object versions are stored, then data integrity verification is improved, but system complexity deteriorates
Solution Approach 1:
The system creates simplified copies of authentication information (HMAC signatures) in metadata for each data version. Instead of implementing complex verification mechanisms, the patent uses cryptographic copying of the data's digital fingerprint, allowing straightforward comparison and verification of data integrity across multiple versions without significant system complexity.
3Object-affected harmful factors
If cryptographic verification is performed on each data version, then security is improved, but processing time deteriorates
Solution Approach 1:
The cryptographic verification mechanism is prepared in advance by generating HMAC signatures during the data upload process. This preliminary action ensures that when recovery or verification is needed, the system can quickly compare stored signatures against current data without performing time-consuming cryptographic computations, thus minimizing processing time loss while maintaining strong security.
Data Source
AI summary
Methods, systems, and devices for data management are described. A data management system (DMS) may identify, in accordance with a data recovery operation, a set of data object versions stored in a cloud storage system and associated with a data object identifier. The DMS may verify, using a cryptographic key, whether each data object version of the set of data object versions is associated with a respective valid signature stored in the cloud storage system. A valid signature for a data object version of the set of data object versions may be generated using a timestamp associated with upload of the data object version and the data object identifier. The DMS may obtain the data object version that is associated with the respective valid signature that is generated using a most recent timestamp among one or more timestamps associated with the set of data object versions.