Secure KV-SSD Deduplication via User-Specific Object Maps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storage systems that support both security and data deduplication face challenges in ensuring data integrity and access control, as data deduplication can lead to unintended changes or access issues between users, compromising security and data ownership.
Innovation Solution
A secure Key-Value Solid State Drive (KV-SSD) implementation that uses encrypted user-specific object maps, deduplication maps, and key share tables to manage access and deduplication, ensuring only authorized users can access and modify their data, while allowing secure sharing and deduplication across users who explicitly share data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of substance
If data deduplication is implemented in KV-SSD, then storage efficiency is improved, but security is compromised because users can inadvertently change each other's data
Solution Approach 1:
The patent segments the key space by associating each key with a specific user identifier. The KV-SSD maintains separate key namespaces for different users, so that keys are unique relative to their user context. This allows deduplication within each user's data while preventing cross-user data interference, as each user operates in their own segmented key space.
Solution Approach 2:
The patent introduces an intermediary authentication mechanism that verifies user identity before allowing access to stored values. The system checks whether a key belongs to the requesting user and whether the user has proper authorization, acting as a mediator between the user and the deduplicated data storage, thereby preventing unauthorized access while maintaining deduplication benefits.
2Adaptability or versatility
If multiple users store data on the same KV-SSD, then data sharing capability is improved, but unauthorized access and data integrity issues worsen
Solution Approach 1:
The patent applies different security properties to different data access scenarios. Authorized users can access and share their data freely, while unauthorized users are blocked. The system dynamically adjusts access permissions based on the specific user-key pairing, allowing data sharing among authorized users while preventing unauthorized access, thus creating local quality variations in security enforcement.
Solution Approach 2:
The patent performs preliminary authentication and authorization checks before allowing any data access operations. The system verifies user identity and key ownership beforehand, preventing unauthorized access attempts before they can affect data integrity. This preliminary action ensures that only authenticated users can access or modify their own data or shared data.
Data Source
AI summary
A Key-Value Solid State Drive (KV-SSD) is disclosed. The KV-SSD may include storage for data. The data may include a data value encrypted using an object encryption key. The data value may be associated with an object key: the data value and the object key forming an object. A user secure object map may map the object key to a hash value. A secure key share table may map the hash value to the object encryption key. A dedup map may map the hash value to an address where the data value is stored on the KV-SSD.