Secure Deduplication in Encrypted Storage via Keyed Digests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In encrypted data storage systems, implementing data deduplication across different storage units with distinct encryption keys poses a challenge as direct comparison of encrypted data units is not feasible, risking information leakage if security precautions are not observed.
Innovation Solution
A method employing keyed data digests and asymmetric key pairs within a secure equivalence detection process, using techniques like Diffie-Hellman or Elliptic-Curve Diffie-Hellman key sharing, allows for duplicate detection without decrypting data or exposing sensitive information, maintaining security by calculating and comparing hashes between storage units.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data deduplication is implemented across encrypted storage units with distinct encryption keys, then storage efficiency is improved, but security is compromised due to information leakage risks
Solution Approach 1:
The patent introduces keyed data digests as an intermediary mechanism that enables deduplication comparison without exposing the actual encrypted data. The keyed data digest serves as a mediator between the encryption layer and deduplication layer, allowing duplicate detection while maintaining security by preventing direct exposure of encrypted data contents across different storage units.
Solution Approach 2:
The patent transforms the data representation from encrypted data units to keyed data digests, changing the parameter space in which comparison occurs. By operating on keyed data digests rather than encrypted data, the system achieves deduplication efficiency while the encryption keys prevent information leakage, thus resolving the contradiction between storage efficiency and security.
2Ease of operation
If direct comparison of encrypted data units is performed across different storage units, then duplicate detection is simplified, but security is compromised due to information leakage
Solution Approach 1:
The keyed data digest acts as an intermediary that simplifies duplicate detection while preventing information leakage. Instead of directly comparing encrypted data units which would expose information, the system compares keyed data digests that are derived from encrypted data but protected by encryption keys, thus maintaining both simplicity and security.
Solution Approach 2:
The patent creates a copy of the data representation in the form of keyed data digests, which are derived from encrypted data units but are not the encrypted data themselves. This copy enables comparison and duplicate detection without exposing the original encrypted data, preventing information leakage while maintaining operational simplicity.
3Measurement precision
If keyed data digests are exchanged between storage units for deduplication, then deduplication accuracy is improved, but data exposure risk increases
Solution Approach 1:
The patent changes the parameter being exchanged from encrypted data units to keyed data digests. This parameter change enables accurate deduplication measurement while the encryption key protection ensures that even though keyed data digests are exchanged, the actual data contents remain protected, thus reducing data exposure risk.
Solution Approach 2:
The keyed data digest serves as a secure intermediary that enables accurate deduplication comparison without exposing sensitive data. By using the encryption key to protect the keyed data digest, the system achieves deduplication accuracy while minimizing data exposure risk during the exchange process between storage units.
Data Source
AI summary
In an encrypted storage system employing data deduplication, encrypted data units are stored with the respective keyed data digests. A secure equivalence process is performed to determine whether an encrypted data unit on one storage unit is a duplicate of an encrypted data unit on another storage unit. The process includes an exchange phase and a testing phase in which no sensitive information is exposed outside the storage units. If duplication is detected then the duplicate data unit is deleted from one of the storage units and replaced with a mapping to the encrypted data unit as stored on the other storage unit. The mapping is used at the one storage unit when the corresponding logical data unit is accessed there.