Deduplicated Data Ownership Validation via Cryptographic Challenges
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Third-party storage systems face security issues due to the facilitation of illegitimate data acquisition through fingerprint-based deduplication, where users can acquire and store files without owning the original data, exploiting the system as an efficient piracy platform.
Innovation Solution
Implementing a system that issues randomized challenges to remote clients to validate ownership of deduplicated data by generating an authentication token based on a random value combined with a portion of the data object, ensuring only clients in possession of the files can store or retrieve them without transmitting full copies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If traditional deduplication systems accept fingerprints instead of full file transfers, then storage efficiency and time savings are improved, but security deteriorates enabling illegitimate data acquisition
Solution Approach 1:
The system performs preliminary authentication by requiring clients to prove possession of the original file through cryptographic challenges before allowing fingerprint-based deduplication operations. This preliminary verification step ensures that only legitimate owners can benefit from the efficiency of fingerprint-based storage, while preventing unauthorized users from exploiting the system.
Solution Approach 2:
The patent introduces cryptographic proof mechanisms as an intermediary between the client and the storage system. Instead of directly trusting fingerprint submissions, the system uses cryptographic challenges and responses as a mediator to verify ownership. This intermediary layer maintains both the efficiency of deduplication and the security of data protection.
2Reliability
If full file transfers are required for verification, then security is improved by ensuring ownership, but time consumption and computing resources worsen
Solution Approach 1:
The system extracts only the essential verification element from the complete file - specifically, cryptographic proofs of possession such as hashes or encrypted portions. Instead of requiring full file transfers for verification, the system takes out and verifies only the minimal necessary data elements, achieving both security and efficiency.
Solution Approach 2:
The patent implements partial verification by requiring clients to demonstrate possession through cryptographic challenges that involve only portions of the file (e.g., specific blocks, hashes, or encrypted segments). This partial action is sufficient to prove ownership without the excessive time and resource consumption of full file transfers.
3Quantity of substance
If fingerprint-based deduplication is implemented, then storage space is optimized, but data access control deteriorates allowing unauthorized retrieval
Solution Approach 1:
The system establishes preliminary access control by requiring cryptographic authentication before granting access to deduplicated data. Clients must prove ownership through challenges that verify possession of the original file, ensuring that storage space optimization through deduplication does not compromise access control.
Solution Approach 2:
The patent implements feedback mechanisms where the storage system continuously verifies client ownership through cryptographic challenges before and during data access operations. This feedback loop ensures that clients can only access data they legitimately own, maintaining proper access control while benefiting from storage optimization.
Data Source
AI summary
A computer-implemented method for validating ownership of deduplicated data may include (1) identifying a request from a remote client to store a data object in a data store that already includes an instance of the data object, (2) in response to the request, verifying that the remote client possesses the data object by (i) issuing a randomized challenge to the remote client, the randomized challenge including a random value which, when combined with at least a portion of the data object, produces an authentication token demonstrating possession of the data object and, in response to the randomized challenge, (ii) receiving the authentication token from the remote client; and, in response to receiving the authentication token from the remote client, (3) storing the data object in the data store on behalf of the remote client. Various other methods and systems are also disclosed.