Secure Third-Party Storage Data Sharing via Asymmetric Key Segmentation

The encryption process is segmented into two independent stages: (1) customers encrypt files using their own keys before upload, ensuring security; (2) the storage system performs deduplication and sharing operations on the already-encrypted data without needing to decrypt it. This segmentation allows both security and efficiency to coexist by operating at different layers of the system.

Encrypted file hashes serve as an intermediary mechanism that enables the storage system to identify duplicate files and manage sharing without ever exposing the actual encrypted data or decryption keys. The system compares hashes of encrypted files to detect duplicates, and uses cryptographic tokens as intermediaries for sharing, never requiring the storage provider to handle plaintext or master decryption keys.

Instead of comparing actual encrypted file contents (which would require identical encryption schemes), the system creates and compares cryptographic hashes of the encrypted files. These hashes serve as compact representations that enable duplicate detection while preserving the security benefits of different encryption schemes. The hash comparison operates on metadata rather than the encrypted data itself.

The system changes the parameter being compared from the encrypted file contents to cryptographic hashes of those contents. This parameter transformation allows the system to detect duplicates based on the underlying plaintext content while being insensitive to different encryption schemes applied to that content. The hash function transforms the encrypted data into a form that reveals duplication without revealing decryption information.

The decryption keys are extracted from the third-party storage system and kept exclusively in customer-controlled environments. Only encrypted file data is stored on the third-party servers, while the decryption keys remain in customer-managed key vaults or secure storage. This extraction eliminates the security risk of key exposure while maintaining operational simplicity through automated key management services that facilitate secure key retrieval when needed.

The system separates the storage dimension from the key management dimension, storing encrypted files in one dimension (cloud storage) and decryption keys in another dimension (customer-controlled secure storage). This dimensional separation allows the third-party provider to handle only encrypted data without access to decryption capabilities, while customers retain full control over key security. File access is simplified through automated key retrieval processes that bridge these two dimensions when needed.