Client-Side Encrypted File Storage with Distributed Indexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data storage systems face challenges in securely storing and retrieving files while ensuring unauthorized access is restricted, especially when using untrusted third-party cloud storage providers where data is shared with other users and organizations.
Innovation Solution
A file management application and index service collaborate to encrypt files on client devices, store encrypted versions in untrusted data storage systems, and manage access through encryption keys, allowing only authorized devices to decrypt and access the files, while the index service monitors and restricts access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If files are stored in untrusted third-party cloud storage systems, then storage capacity and accessibility are improved, but security and confidentiality of the stored files deteriorate
Solution Approach 1:
The system segments the file into multiple portions and stores them in different locations within the cloud storage system. This segmentation ensures that no single location contains the complete file, enhancing security while maintaining accessibility through distributed storage architecture.
Solution Approach 2:
The system extracts the encryption key from the file storage process and stores it separately in secure key storage on the client device. This separation ensures that even if the cloud storage is compromised, the encrypted file portions without the key remain inaccessible, resolving the security concern while allowing cloud storage usage.
2Reliability
If encryption is implemented on client devices before storage, then file security is improved, but system complexity and key management overhead increase
Solution Approach 1:
The system implements self-service encryption where the client device automatically performs encryption of file portions and manages its own encryption keys without requiring external key management infrastructure. This reduces system complexity while maintaining strong security through client-side autonomous key management.
Solution Approach 2:
The system introduces an intermediary index service that manages metadata and file portion locations without handling encryption keys. This intermediary separates the complexity of key management from the storage operation, simplifying the overall system while maintaining security through centralized index management.
3Reliability
If file portions are distributed across multiple storage locations, then security against unauthorized access is improved, but retrieval time and system overhead increase
Solution Approach 1:
The system performs preliminary actions by pre-computing and storing metadata about file portions including their locations and encryption information in an index. This preliminary indexing allows for efficient retrieval operations where the client can quickly locate and assemble file portions without scanning the entire storage system, reducing retrieval time while maintaining distributed security.
Solution Approach 2:
The system implements feedback mechanisms where the index service tracks and manages the locations of file portions, providing real-time information about file assembly requirements. This feedback enables optimized retrieval paths and reduces overhead by avoiding redundant operations, balancing security through distribution with efficient retrieval.
Data Source
AI summary
Various systems facilitate encrypted file storage. A client device may generate an encrypted version of a file. The client device may obtain at least one reference to at least one storage location for the encrypted version of the file. The client device may cause the encrypted version of the file to be store at the at least one storage location using the at least one reference to the at least one storage location.