Encrypted Content Deduplication Using Salted Chunk Fingerprints

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current deduplication solutions cannot operate on encrypted data, leading to a trade-off between storage space savings and user data security, as storage providers cannot identify duplicate encrypted data without decryption keys.

Innovation Solution

A method and system for secure deduplication of encrypted content using chunking, hashing, salting, and public key-private key encryption, along with a fingerprint index and secure coprocessor to manage salted keys, allowing deduplication without decrypting the data.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If data is stored unencrypted to enable deduplication by storage providers, then storage space savings are achieved, but user data security is compromised

Engineering Contradiction:

Improvestorage spaceVSAvoiddata security vulnerability

Core Design Contradiction:

Quantity of substanceVSObject-affected harmful factors

Solution Approach 1:

The file is divided into multiple chunks, each processed independently through hashing and encryption. This segmentation allows the system to work with smaller units of data, enabling deduplication at the chunk level while maintaining security through encrypted processing of each segment.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A secure coprocessor acts as an intermediary between the client and storage provider. The coprocessor performs hashing and salting operations on encrypted data without requiring decryption, serving as a trusted mediator that enables deduplication while preserving data confidentiality.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If data is stored encrypted to protect user data, then data security is maintained, but storage providers cannot identify duplicate data

Engineering Contradiction:

Improvedata securityVSAvoidduplicate identification capability

Core Design Contradiction:

Object-affected harmful factorsVSDifficulty of detecting and measuring

Solution Approach 1:

The system performs hashing and salting operations on encrypted data before storage, creating unique identifiers (fingerprints) for each encrypted chunk. This preliminary processing enables future duplicate detection without requiring decryption, as the same encrypted data will always produce the same hash fingerprint.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system transforms encrypted data into a different representation through hashing and salting, creating a fingerprint that preserves the uniqueness properties of the original encrypted data while enabling comparison and duplicate detection. The salted hash serves as a parameter transformation that maintains security while enabling identification.

Inventive Principle:

Principle #35Parameter changes

3Productivity

If traditional deduplication methods are used on unencrypted data, then storage efficiency is improved, but data privacy protection is lost

Engineering Contradiction:

Improvestorage efficiencyVSAvoiddata privacy protection

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system replaces the traditional mechanical approach of comparing plaintext data with a cryptographic approach using hashed fingerprints. Instead of directly comparing encrypted data (which would be computationally intensive and insecure), the system substitutes comparison of hash values, achieving both efficiency and security.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12505233B2Systems and methods of secure deduplication of encrypted content

Publication Date: 2025.12.23 ACRONIS INT

AI summary

Systems and methods for secure deduplication of encrypted content. A system generally includes a client, a key server, a fingerprint index, and a storage service. The client can perform chunking of a file, hashing of chunks to generate tags, and encryption of chunks using a salted key from the key server. The fingerprint index checks for duplicate ciphertexts using the tags. The storage service saves non-duplicate ciphertext.