Cryptographic System for Secure Ciphertext Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems for deduplication lack user-specific encryption keys, leading to potential plaintext leakage and lack of indistinguishability, making them insecure for deduplicating ciphertexts.
Innovation Solution
A cryptographic system that generates user-specific encryption keys and converts ciphertexts into deduplicable forms only with user permission, using a third key generated from a first and second key, ensuring indistinguishability and secure deduplication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional encryption with hash functions is used to enable deduplication, then ciphertext deduplication is achieved, but indistinguishability and user-specific key security are lost
Solution Approach 1:
The encryption key is segmented into two parts: a public key component and a private key component. The public key is used for encryption and can be shared, while the private key remains secret and is specific to each user. This segmentation allows deduplication through public key comparison while maintaining security through private key protection.
Solution Approach 2:
A third key is introduced as an intermediary element that combines the first key and second key through a key derivation function. This third key enables the conversion of encrypted data between different encryption schemes, allowing deduplication capability while preserving the security properties of the original encryption.
2Reliability
If per-user encryption keys are implemented to ensure security, then indistinguishability is maintained, but ciphertext deduplication becomes difficult
Solution Approach 1:
The encryption system is designed with multi-functionality: the same encryption mechanism can both secure data with per-user keys and enable deduplication through the third key conversion. The system universally handles both security and deduplication requirements without requiring separate systems.
Solution Approach 2:
The encryption parameters are changed dynamically based on the operation required. For security operations, per-user keys are used; for deduplication operations, the third key enables conversion to a standardized format. This parameter flexibility allows the system to switch between security and deduplication modes as needed.
3Productivity
If deterministic encryption is used to ensure same plaintext produces same ciphertext, then deduplication is enabled, but security against plaintext leakage is compromised
Solution Approach 1:
The encryption system transitions from static deterministic encryption to dynamic encryption where the same plaintext can produce different ciphertexts when encrypted with different keys. This dynamic behavior prevents plaintext leakage while maintaining deduplication capability through the third key conversion mechanism.
Data Source
AI summary
A deduplication system (100) includes encryption apparatuses (400), a conversion key generation apparatus (500), a tag conversion apparatus (600), and a match determination apparatus (700). The encryption apparatuses (400) each generate encryption tag (ETag) using an encryption key (ek) and plaintext (M). The conversion key generation apparatus (500) generates a conversion key (ck) using the encryption key (ek) and a conversion key generation key (tk). The tag conversion apparatus (600) converts an encryption tag (ETag) for which the same plaintext (M) has been used into an encryption tag (T) that takes the same value regardless of a value of the encryption key (ek) used for the encryption tag (ETag) by applying the conversion key (ck) to the encryption tag (ETag). The match determination apparatus (700) determines whether the values of two encryption tags (T) match.