Proxy Entity Deterministic Encryption for Secure Cloud Storage Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cloud storage techniques face challenges in data deduplication over encrypted files, as they compromise data confidentiality and lack fine-grained control for users, while existing solutions are not transparent and inefficient in preventing malicious user abuse.
Innovation Solution
A method and system where a proxy entity generates a master encryption key based on a hash value of the data file, encrypts the file, computes a hash-tree, and uses the top-hash as a file identification (FID) to determine if it's already stored, allowing for secure deduplication and proof-of-ownership procedures to ensure only legitimate files are stored and accessed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of substance
If data deduplication is performed on encrypted files, then storage space is reduced, but data confidentiality is compromised
Solution Approach 1:
A proxy entity is introduced as an intermediary between the client and cloud storage provider. The proxy generates deterministic encryption keys from file hashes, enabling the cloud provider to perform deduplication on encrypted files without being able to decrypt or read the actual data content, thus maintaining confidentiality while enabling storage optimization
Solution Approach 2:
The encryption key is generated in advance based on the file hash before the actual encryption and storage process. This preliminary key generation enables the cloud provider to identify and deduplicate files based on their cryptographic fingerprints without needing to access or understand the encrypted content, resolving the contradiction between deduplication and confidentiality
2Productivity
If existing deduplication techniques are used, then storage efficiency is improved, but user control and transparency are reduced
Solution Approach 1:
The system implements proof-of-ownership procedures where clients must verify their ownership of files before deduplication can occur. The proxy entity provides feedback mechanisms including ownership verification, file identification return, and transparent operation status, giving users fine-grained control over their files while maintaining storage efficiency
Solution Approach 2:
Clients perform self-verification of file ownership through cryptographic proof mechanisms. The system enables users to autonomously control which files are deduplicated and accessed, with the proxy entity facilitating but not forcing deduplication operations, thus maintaining user control while achieving storage efficiency
3Reliability
If encryption is applied to protect data confidentiality, then data security is improved, but deduplication capability is lost
Solution Approach 1:
The system changes the parameter of encryption from random to deterministic, where encryption keys are derived deterministically from file hashes rather than being randomly generated. This parameter change allows identical files to produce identical encrypted versions, enabling deduplication while maintaining strong cryptographic security through the deterministic key derivation function
4Reliability
If proof-of-ownership procedures are implemented, then malicious user abuse is prevented, but system complexity increases
Solution Approach 1:
Complex manual verification and administrative procedures are replaced with automated cryptographic proof-of-ownership mechanisms. The system uses hash-based deterministic encryption and cryptographic verification to automatically prevent malicious abuse, reducing the need for complex human-mediated security procedures while maintaining high security standards
Data Source
AI summary
A method for storing a data file of a client on a storage entity includes generating, by a proxy entity, a master encryption key; encrypting, by the client, the data file using the master encryption key to produce an encrypted file; computing a hash-tree for the encrypted file and using a top-hash of the hash-tree as a file identification (FID); and determining, by the proxy entity, whether the FID is already known to the storage entity. If the FID is not already known to the storage entity the method further includes computing, by the proxy entity, a top-hash of the encrypted file (PFID), and when the ownership of the data file has been proven, storing the FID being equal with the PFID at the client together with the hash value.