Salt Parameter-Based File Erasure in Encrypted Backup Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional remote backup systems face inefficiencies in deleting electronic files, as complete deletion can take days and deleting encryption keys can compromise access to other encrypted files, and encryption key deletion is ineffective when keys are only maintained on client computers.
Innovation Solution
The use of a salt parameter to create file encryption keys based on user input and automatically generated random numbers, allowing for quick erasure of encrypted files by deleting the salt parameter, and enabling storage of encryption keys on client devices or external systems while salt parameters reside on external storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the remote backup system deletes actual electronic files in response to a delete command, then complete deletion is achieved, but the deletion process takes a substantial amount of time (on the order of days)
Solution Approach 1:
The patent extracts the essential deletion function by removing only the salt parameter from the backup system, rather than deleting actual files. The salt parameter is a small cryptographic element that enables decryption of encrypted files. By deleting just this small element, the system achieves complete file erasure without needing to physically delete large file datasets, thus reducing deletion time from days to moments while maintaining reliability.
Solution Approach 2:
The patent uses encrypted copies of files stored at the backup system with the understanding that the only way to access the original data is through the salt parameter. The encrypted files remain as inert data structures, and the salt parameter acts as a key that can be deleted to permanently prevent access. This copying approach allows deletion of the key (salt parameter) without deleting the bulk data, achieving fast and complete erasure.
2Reliability
If the remote backup system deletes encryption keys in response to a delete command, then access to the deleted file is prevented, but the ability to decrypt other encrypted files is also lost
Solution Approach 1:
The patent segments the encryption key into two distinct components: a salt parameter stored at the backup system and a file encryption key stored at the client computer. This segmentation allows the salt parameter to be deleted for file erasure while preserving the file encryption key at the client computer, thus maintaining the ability to decrypt other files. Each component has a specific function, and deleting one does not affect the other, resolving the contradiction between file access control and decryption capability.
Solution Approach 2:
The patent applies local quality by storing different cryptographic elements at different locations with different functions. The salt parameter is stored at the backup system and is deleted for file erasure, while the file encryption key is stored at the client computer and remains for decryption. This spatial separation of cryptographic functions allows independent manipulation of each element, enabling selective file deletion without affecting overall system functionality.
3Ease of operation
If the remote backup system stores encryption keys, then file decryption is enabled, but the system cannot effectively erase encrypted files when keys are maintained only at client computers
Solution Approach 1:
The patent introduces the salt parameter as an intermediary element that bridges the gap between the backup system and the client computer's encryption keys. The salt parameter is stored at the backup system and is required to reconstruct the file encryption key at the client computer. This intermediary allows the backup system to control file access by deleting the salt parameter, effectively enabling erasure even when encryption keys are maintained at client computers, thus resolving the contradiction between ease of decryption and reliability of erasure.
Data Source
AI summary
A technique controls access to a file. The technique involves creating a file encryption key based on (i) a user input parameter (e.g., a user password) from a user of the client device and (ii) an automatically generated salt parameter (e.g., a random number). The technique further involves encrypting the file using the file encryption key to form an encrypted copy of the file, and providing the salt parameter to an external storage system to externally store the salt parameter. Access to data within the encrypted copy of the file requires the salt parameter provided to the external storage system.