Segment-Based File Encryption for De-Duplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing single instance storage systems face challenges in managing identical files encrypted by different clients, as different encryption keys result in non-identical encrypted data, complicating de-duplication processes.
Innovation Solution
The system splits files into segments, encrypts each segment with a content-based key derived from the segment's content, and stores only a single instance of each encrypted segment on the server, while encrypting metadata with user-specific keys to maintain security and de-duplication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted with user-specific keys before storage, then security is improved, but de-duplication efficiency deteriorates because identical files produce different encrypted data
Solution Approach 1:
The patent divides the file into multiple segments before encryption. Each segment is encrypted separately with a segment key, and only the first segment is encrypted with the user-specific key. This segmentation allows identical files to produce identical encrypted segments, enabling de-duplication while maintaining security through user-specific key encryption of at least the first segment.
Solution Approach 2:
The patent applies different encryption methods to different parts of the file. The first segment uses user-specific key encryption for security, while subsequent segments use content-based encryption for de-duplication. This local differentiation allows the system to optimize both security and storage efficiency simultaneously.
2Quantity of substance
If content-based encryption is used for de-duplication, then storage efficiency is improved, but security deteriorates because identical encrypted data from different users cannot be distinguished
Solution Approach 1:
The patent segments the file and applies content-based encryption only to segments after the first one. This allows identical files to produce identical encrypted segments for de-duplication, while the first segment maintains user-specific encryption for security differentiation.
Solution Approach 2:
The patent applies different encryption strategies to different segments: the first segment uses user-specific key encryption for security, while subsequent segments use content-based encryption for storage efficiency. This local quality differentiation resolves the contradiction between security and storage efficiency.
3Reliability
If full file encryption with user-specific keys is applied, then access control is improved, but system complexity increases due to key management requirements
Solution Approach 1:
The patent segments the encryption process so that only the first segment requires user-specific key encryption for access control. Subsequent segments use content-based encryption, significantly reducing the key management burden while maintaining adequate access control for the most critical data portions.
Solution Approach 2:
Instead of encrypting the entire file with user-specific keys (excessive action), the patent applies user-specific encryption only to the first segment (partial action). This partial approach provides sufficient access control for the most important data while reducing key management complexity.
Data Source
AI summary
Various embodiments of a system and method for backing up a plurality of copies of a file are described. A first copy of the file may be owned by a first user, and a second copy of the file may be owned by a second user. The file is split into a plurality of segments, and each segment is encrypted with a respective segment key. Each encrypted segment is transmitted to and stored on a server computer system. De-duplication techniques are used to ensure that only a single instance of each encrypted segment is stored. The segment keys used to encrypt the file segments are also stored on the server computer system in an encrypted form. De-duplication techniques may be utilized so that only a single instance of the encrypted segment keys is stored.