Dynamic Salt Convergent Encryption for Secure Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Convergent encryption techniques face limitations in deduplicating data with small changes and are vulnerable to 'confirmation of file' and 'remaining information' attacks, while also having issues with redundancy and reference counting in distributed systems.
Innovation Solution
Implementing block-based convergent encryption with manifests and dynamic salts to securely deduplicate and store data, using message authentication codes or hash values for identification, and controlling redundancy through salt variations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If convergent encryption is used to enable deduplication, then storage efficiency is improved, but security against confirmation attacks deteriorates
Solution Approach 1:
The data is divided into blocks, and each block is encrypted independently using convergent encryption. This segmentation allows deduplication at the block level while maintaining security, as each block's ciphertext can be deduplicated without exposing the entire file's plaintext structure.
Solution Approach 2:
A manifest file serves as an intermediary that stores metadata about encrypted blocks including their ciphertexts, hashes, and offsets. The manifest enables the storage system to track and deduplicate blocks without having to decrypt or directly access the plaintext data, thus maintaining security while enabling efficient deduplication.
2Object-affected harmful factors
If dynamic salts are used to control redundancy, then security against remaining information attacks is improved, but deduplication efficiency deteriorates
Solution Approach 1:
The system dynamically selects salt values based on the number of existing copies of a block. When a block is first stored, no salt is applied. When a second copy is detected, a salt is applied to create a differentiated ciphertext. This dynamic approach maintains security by preventing remaining information attacks while preserving deduplication efficiency through conditional salt application.
Solution Approach 2:
The encryption parameters (specifically the salt value) are changed based on the redundancy level of the data. By modifying the salt parameter dynamically, the system can control the number of redundant copies stored while maintaining security, allowing flexible adjustment between security and storage efficiency.
3Measurement precision
If block-based convergent encryption is implemented, then deduplication precision is improved, but device complexity increases
Solution Approach 1:
The data is divided into fixed-size blocks (e.g., 4KB or 64KB) that are independently encrypted and tracked. This segmentation enables precise deduplication at the block level, allowing the system to identify and eliminate duplicates with high precision while keeping each block's processing complexity manageable and uniform.
Solution Approach 2:
The system creates and stores cryptographic hashes of block data as identifiers in the manifest. These hash copies enable efficient comparison and deduplication without requiring direct comparison of the actual block data, reducing the computational complexity of the deduplication process while maintaining high precision.
Data Source
AI summary
Systems and methods are described for providing storage of encrypted data sets, deduplication of such data sets, and control of the redundancy of those data sets. A form of modified convergent encryption can be employed, whereby an encryption key for a data set is selected based on a combination of the plaintext of the data set and a salt value, with the salt value being selected from a number of permutations corresponding to a desired redundancy of the data set in a storage system. Accordingly, a given data set can result in a number of ciphertexts equal to the desired redundancy, and deduplication can occur by removing duplicative instances of individual ciphertexts. Salt values can be selected according to a variety of criteria, including user-based, time-based, and location-based criteria.