Homomorphic Tag Deduplication for Cloud Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud storage solutions fail to provide effective proofs of retrievability that account for multi-tenancy and data deduplication, leading to storage overhead issues and security concerns, as they assume a single trusted tenant and require sharing of secret material among tenants.
Innovation Solution
A method that computes user-specific private and public identifiers using an oblivious key generation protocol, allowing clients to update file tags homomorphically and provide proof of possession, enabling secure and efficient storage and retrievability without requiring tenants to trust each other, and leveraging BLS signatures for scalable and secure proof-of-retrievability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional POR methods are used with single trusted tenant assumption, then data retrievability verification is achieved, but storage overhead increases dramatically when multiple tenants are involved
Solution Approach 1:
The patent merges multiple tenants' POR tags into a single aggregated tag structure. Instead of storing separate tags for each tenant (which would multiply storage overhead), the system combines all tenant identifiers and their respective POR information into one unified tag that serves all tenants simultaneously, thereby reducing total storage requirements while maintaining verification capability for each tenant.
Solution Approach 2:
The aggregated POR tag structure serves multiple functions: it verifies data retrievability for multiple tenants simultaneously, stores multiple tenant identifiers within a single data structure, and enables cross-tenant verification without requiring separate verification mechanisms for each tenant. This multi-functionality eliminates the need for proportional storage increases with tenant count.
2Reliability
If each tenant stores their own separate tags in the cloud, then data security and tenant independence is maintained, but storage efficiency is lost due to inability to deduplicate across tenants
Solution Approach 1:
The patent segments the POR tag into distinct components: a shared aggregated portion that contains deduplicated information accessible by all tenants, and tenant-specific portions that maintain individual security requirements. This segmentation allows the system to store only one copy of common data structures while preserving tenant isolation for sensitive information.
Solution Approach 2:
The aggregated tag structure acts as an intermediary between the cloud storage provider and multiple tenants. It enables the cloud provider to efficiently store and manage data for multiple tenants without requiring each tenant to maintain separate complete tag structures, while still allowing each tenant to verify their own data integrity through the unified structure.
3Reliability
If secret material is shared among tenants for constructing POR tags, then verification consistency is improved, but security is compromised as tenants must trust each other
Solution Approach 1:
The patent implements local quality by allowing each tenant to have their own private key and locally-generated portion of the POR tag that only they can verify. Meanwhile, the shared aggregated portion uses public-key cryptography where tenants verify data using each other's public keys without needing to share secret material. This ensures verification consistency through the shared structure while maintaining security through localized private key ownership.
Solution Approach 2:
The patent replaces the mechanical system of secret material sharing with a cryptographic system based on public-key infrastructure. Instead of tenants physically or digitally sharing secret keys to construct POR tags, the system uses public keys for verification and cryptographic proofs that do not require secret sharing, thereby eliminating the security vulnerability while maintaining verification consistency.
Data Source
AI summary
A method for storing data on a storage entity (SE) includes: computing a file identifier for a file to be stored on the SE; checking if the file has already been stored using the file identifier; generating a user-specific private and public identifier, wherein generating the user-specific private identifier is based on using an oblivious key generation protocol between the client and a trusted entity, and wherein the user-specific private identifier is a deterministic private identifier; updating or computing tags of the file by the client such that the updating or computing is homomorphic in the user-specific private identifier and in parts of the file; and providing the user-specific public identifier, the updated tags and a proof of possession of the secret identifier to the SE to enable the SE to store information associated with the file.