Resilient Deterministic Encryption for Data Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current deterministic encryption solutions for data deduplication are vulnerable to attacks that allow duplicates of encrypted data to be identified and removed, compromising security and efficiency in storage systems.
Innovation Solution
A resilient deterministic encryption method is implemented by creating an initialization vector using a secret key and plaintext, combining it with the encrypted plaintext to form a deterministic ciphertext string, and adding it as metadata, ensuring both are calculated with a secret key to prevent security vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If current deterministic encryption approaches are used for data deduplication, then storage efficiency is improved by identifying and removing duplicates, but security is compromised as the system can be circumvented by known attack methods
Solution Approach 1:
The encryption process is segmented into distinct components: initialization vector generation, plaintext processing, and ciphertext generation. The initialization vector is separately generated using a key derivation function before being used in the encryption process, allowing for deterministic yet secure encryption that prevents known attack circumvention while enabling deduplication
Solution Approach 2:
A key derivation function acts as an intermediary between the secret key and the initialization vector. This intermediary layer transforms the secret key into a deterministic initialization vector that maintains security properties while enabling the deterministic encryption needed for deduplication, preventing direct attacks on the encryption system
2Volume of stationary object
If deterministic encryption is implemented to enable data deduplication, then storage capacity is increased, but the system becomes vulnerable to security attacks
Solution Approach 1:
The initialization vector is generated in advance using a key derivation function before the actual encryption process. This preliminary action creates a deterministic yet secure starting point for encryption that enables deduplication while preventing security vulnerabilities from arising during the main encryption operation
Solution Approach 2:
The system changes the parameter of the initialization vector from being random or predictable to being deterministically derived through a key derivation function. This parameter change maintains the deterministic property needed for deduplication while altering the security characteristics to prevent known attacks
Data Source
AI summary
A computer-implemented method according to one aspect includes creating an initialization vector, utilizing an instance of plaintext and a secret key; encrypting the instance of plaintext, utilizing the initialization vector, the secret key, and the instance of plaintext; combining the initialization vector and the encrypted instance of plaintext to create a ciphertext string; and outputting the ciphertext string.