Encrypted Data File Re-Keying via Oblivious Key Exchange
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for deduplicated cloud storage are vulnerable to brute-force attacks due to convergent encryption and lack efficient re-keying capabilities, which is essential for minimizing information leakage and revoking access to malicious employees.
Innovation Solution
A method for re-keying encrypted data files involves updating the global secret partially and locally re-encrypting the data using an assist server, which communicates with clients through an oblivious key generation protocol and non-interactive Diffie-Hellman key exchange to generate new private keys without revealing the hash value, ensuring security and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of energy
If convergent encryption is used for deduplication, then storage cost is reduced, but security is weakened due to vulnerability to brute-force attacks
Solution Approach 1:
The patent introduces a key server as an intermediary component that manages encryption keys separately from the storage system. The key server generates keys based on file hashes and maintains a mapping between keys and file identifiers, allowing deduplication to work while preventing brute-force attacks on stored ciphertexts.
Solution Approach 2:
The system segments the encryption key management function from the storage function. Instead of using the file hash directly as the encryption key (convergent encryption), the system separates key generation (performed by the key server) from data storage, creating distinct components that can operate independently and securely.
2Reliability
If re-keying is implemented for security reasons, then information leakage is minimized, but re-encryption time becomes prohibitively long for large data volumes
Solution Approach 1:
The patent extracts only the necessary portion of data for re-keying operations. Instead of re-encrypting entire large data volumes, the system identifies and processes only the specific data blocks that need re-keying, significantly reducing the time required while maintaining security.
Solution Approach 2:
The system performs preliminary key generation and preparation before actual re-encryption is needed. The key server pre-generates new keys and prepares re-keying information, so that when re-keying is triggered, the actual encryption operation can proceed quickly with minimal data processing time.
3Reliability
If a dedicated key server is used for message locked encryption, then semantic security is achieved, but system complexity increases
Solution Approach 1:
The key server is designed to perform multiple functions: key generation, key storage, key distribution, and re-keying management. By consolidating these functions into a single component, the system achieves semantic security without proportionally increasing complexity, as one server handles multiple security-related tasks.
Solution Approach 2:
The key server autonomously generates keys based on file hashes and manages the key lifecycle without requiring manual intervention. The system self-manages key distribution and revocation, reducing operational complexity while maintaining strong semantic security through automated cryptographic operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to a method for re-keying an encrypted data file, said data file being stored chunkwise on a storage entity, 'SE', said data file chunks being encrypted with a global secret, wherein said method performed in a memory available to a computing device, a wherein a global secret for encryption data is partially updated for a data chunk to be re-keyed such that the output of a non- interactive oblivious key exchange is used to identify the private key of said chunk to be replaced with a new private key and wherein said data chunk to be re-keyed is reencrypted with said updated global secret.