Selective Deniable File Storage via Hash Table Redirection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data storage encryption methods are vulnerable to password guessing and reuse, lack effective version control for data restoration, and do not securely hide data volumes, while SSDs face limited write cycles and data integrity challenges.
Innovation Solution
A method using a hash table and redirection table to store data blocks on multiple devices, where data is encrypted with a digest as a tweak, allowing selective deniability and version control, and extending SSD lifetime through efficient block management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional encryption methods are used with passwords, then data can be encrypted and stored, but the system becomes vulnerable to password guessing and reuse attacks
Solution Approach 1:
The patent extracts the password dependency from the encryption system by using cryptographic key pairs (public and private keys) instead of passwords. The public key is stored with the encrypted data while the private key remains secure with the user, eliminating the need for users to remember passwords and preventing password guessing attacks.
Solution Approach 2:
The patent introduces cryptographic keys as intermediaries between the user and the encrypted data. Instead of directly using passwords to encrypt/decrypt data, the system uses public-private key pairs where the public key mediates the encryption process and the private key mediates the decryption process, adding a layer of security against password attacks.
2Difficulty of detecting and measuring
If data is hidden in a volume, then the existence of data can be concealed, but it becomes impossible to selectively deny specific data while admitting others
Solution Approach 1:
The patent segments the data storage into individually addressable encrypted blocks, each with its own encryption key and metadata. This allows the system to selectively reveal or deny specific blocks independently, enabling selective deniability where the user can admit certain data while denying others, rather than treating all data as a single hidden volume.
Solution Approach 2:
The patent implements dynamic control over data visibility by allowing the user to selectively mark individual encrypted blocks as admissible or denied. This dynamic approach replaces the static all-or-nothing hidden volume model, enabling flexible selective deniability where the user can adapt their deniability strategy on a per-block basis.
3Speed
If SSDs are used for data storage, then data access speed is improved, but the limited write cycles reduce the device lifespan
Solution Approach 1:
The patent implements a wear-leveling mechanism that discards encrypted blocks from frequently written locations and recovers them by redistributing writes across less-used blocks. The system tracks write counts for each block and dynamically redirects new writes to blocks with lower write counts, thereby extending the overall SSD lifespan by evenly distributing wear across all blocks.
4Reliability
If data blocks are encrypted and stored, then data security is improved, but version control and data restoration become difficult
Solution Approach 1:
The patent performs preliminary actions by creating and storing metadata about each encrypted block before the actual encryption and storage process. This metadata includes version information, timestamps, and pointers to previous versions, enabling easy version control and restoration without requiring complex post-encryption operations. The system prepares the version control structure in advance, making restoration straightforward.
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The invention concerns a method for writing data to a memory device arrangement comprising a first and a second memory device in which the first memory device comprises data blocks numbered with block numbers and the second memory device comprises at least one reference calculated from a data block digest and its physical block number. The invention is characterized in that it comprises the following steps: calculating the digest from at least part of the data block content, receiving at least one physical block number, to which the data block contents in the first memory device is stored, encrypting the data block content, storing the data block content to the first memory device to the position pointed by the physical block number, and storing or issuing a command to save the digest, or a number derived from it, and at least one said physical block number to the second memory device. Also a system, a computer program and server computer in accordance to the invention are presented.