Secure Audit Scheme in Distributed Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed data storage systems, such as cloud computing environments, there is a delay in replicating data objects across geographically distributed locations, especially during heavy network traffic, and the audit process to ensure data integrity is inefficient due to security concerns like local encryption.
Innovation Solution
A method where data objects are encrypted using user encryption keys, generating ciphertext, and then hashed with an audit key to form an audit value, which is encrypted and stored on non-volatile memory across storage nodes. An audit process verifies the replicas by decrypting and re-hashing, comparing hash values to ensure consistency without needing access to local encryption keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data objects are encrypted using local encryption keys at each storage node, then data security is improved, but audit efficiency deteriorates because the audit process cannot efficiently verify data integrity without access to decryption keys
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing audit values (hashes of encrypted data) at each storage node before the actual audit process. When an audit is needed, the audit server can immediately retrieve and compare these pre-computed audit values without requiring decryption operations, thus maintaining security while achieving efficient verification
Solution Approach 2:
The patent introduces an intermediary mechanism by using audit values (cryptographic hashes) as a mediator between the encrypted data and the audit verification process. These audit values allow the audit server to verify data integrity without directly accessing or decrypting the encrypted data, thus resolving the contradiction between security and audit efficiency
2Reliability
If data objects are replicated across geographically distributed storage locations, then data availability is improved, but replication delay worsens during heavy network traffic
Solution Approach 1:
The patent applies the copying principle by creating and distributing audit values (compact hash representations) to multiple storage nodes simultaneously during the data replication process. This allows the audit infrastructure to be established in parallel with data replication, reducing the overall time penalty of geographic distribution while maintaining data availability across multiple locations
3Measurement precision
If the audit process decrypts data to verify integrity, then measurement precision is improved, but energy consumption and processing time worsen
Solution Approach 1:
The patent extracts the essential verification information (audit values) from the encrypted data and stores it separately at each storage node. This extraction allows the audit process to verify data integrity by comparing audit values without needing to decrypt or process the actual encrypted data, thus achieving precise integrity verification with minimal energy consumption and processing time
Data Source
AI summary
Apparatus and method for managing data objects in a distributed data storage system, such as a cloud computing environment. In some embodiments, a data object is encrypted using a user encryption key to generate ciphertext. A first hash function is applied to the ciphertext and an audit encryption key to generate a first hash value. An audit value is formed by combining the ciphertext and the first hash value, and the audit value is locally encrypted and stored to non-volatile memory (NVM) of each of a plurality of storage nodes. An audit process is performed to confirm each of the encrypted replicas store identical copies of the ciphertext. This is carried out by decrypting the ciphertext and applying a second hash function to the ciphertext and the audit encryption key by each storage node to form a plurality of second hash values which are then compared by an audit processor.