Encrypted Data Deduplication via Re-encryption Key
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage systems face challenges in efficiently managing encrypted data, particularly in deduplicating identical encrypted files across multiple users without compromising security or requiring user involvement, which can lead to storage inefficiencies and access issues.
Innovation Solution
The system employs a re-encryption scheme where a re-encryption key is generated and used to convert a ciphered encryption key from one user to be decryptable by another user, allowing for deduplication of encrypted data while maintaining security and user control, using a key server and cryptographic hashes to identify and manage duplicate data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted data is stored for each user independently, then data security is maintained, but storage efficiency deteriorates due to duplicate files occupying additional space
Solution Approach 1:
A re-encryption key is introduced as an intermediary element that enables secure key transformation between users. The re-encryption key allows the system to convert encryption keys without exposing the actual data or requiring users to share secrets, thus maintaining security while enabling deduplication identification
Solution Approach 2:
The system creates cryptographic copies (hashes and encrypted keys) of the original data to identify duplicates without storing multiple copies of the actual encrypted data. By comparing cryptographic representations rather than the data itself, the system can detect duplicates while maintaining security and reducing storage requirements
2Quantity of substance
If duplicate encrypted files are eliminated, then storage efficiency is improved, but system complexity increases due to key management requirements
Solution Approach 1:
The system enables self-service deduplication where the storage provider automatically identifies and eliminates duplicate encrypted files without requiring user intervention. Users simply store their encrypted data, and the system autonomously performs hash comparison and deduplication operations
Solution Approach 2:
The re-encryption key acts as a mediator that simplifies key management by enabling automatic key transformation. Instead of requiring complex user-managed key sharing agreements, the system uses the re-encryption key to automatically convert encryption keys when duplicates are detected, reducing the management burden on users
3Reliability
If users are involved in the deduplication process, then access control is maintained, but ease of operation deteriorates due to user intervention requirements
Solution Approach 1:
The system performs deduplication operations autonomously without requiring user participation. The storage provider automatically compares hashes of uploaded encrypted files, identifies duplicates, and manages key re-encryption in the background, making the process transparent and effortless for users while maintaining security
Solution Approach 2:
The system uses cryptographic hash values as feedback mechanisms to automatically identify duplicate files. By comparing hash values returned with uploaded data against stored hashes, the system can determine duplicates without user intervention and trigger the appropriate deduplication and re-encryption processes
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to an example aspect of the invention, there is provided an apparatus comprising at least one processing core and at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processing core, cause the apparatus at least to receive, from a first user, a ciphertext, a first hash value and a first ciphered encryption key, receive, from a second user, a second hash value, responsive to a determination the first hash value is the same as the second hash value, obtain a re-encryption key, and apply the re-encryption key to the first ciphered encryption key to obtain a re-encrypted encryption key, the re-encrypted encryption key being decryptable with a secret key of the second user.