Single File Multiple Metadata for Encrypted Cloud Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud storage solutions face challenges in efficiently managing file operations while ensuring security, as they often require multiple requests and significant data transfer, and they typically keep file names in plain text, making them vulnerable to cryptanalysis.
Innovation Solution
The Single File Multiple Metadata (SFMM) technique is proposed, where all file operations are performed by manipulating a single small metadata file that carries the metadata of all files in the filesystem. This approach reduces data traffic and enhances security by hashing the file names.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file operations are performed by downloading and uploading entire encrypted files, then file security is maintained, but network resource consumption and time are significantly increased
Solution Approach 1:
The patent segments the file system into two distinct components: encrypted file contents stored in the cloud and separate metadata files stored locally. File operations are performed by manipulating only the small metadata files locally rather than downloading and uploading entire encrypted files. This segmentation allows the system to maintain security while dramatically reducing network resource consumption during file operations.
Solution Approach 2:
The patent introduces metadata files as an intermediary layer between the user and the encrypted file contents. These metadata files contain file descriptors, names, and other attributes, allowing users to perform file operations (rename, move, delete, etc.) by manipulating the metadata locally without needing to access the actual encrypted file contents over the network. This intermediary mechanism resolves the contradiction by enabling secure operations with minimal network usage.
2Ease of operation
If file names are kept in plain text in cloud storage, then file accessibility and operations are simplified, but vulnerability to cryptanalysis attacks increases
Solution Approach 1:
The patent segments the file identification system by separating file names from file contents. File names are stored in local metadata files that are encrypted and stored on the user's device, while the actual file contents are encrypted and stored in the cloud. This segmentation allows the system to protect file names from cloud-based cryptanalysis attacks while maintaining ease of operation through local metadata management.
Solution Approach 2:
The patent creates encrypted copies of file names within the local metadata files. Instead of storing plain text file names in the cloud, the system encrypts file names and stores them in the local metadata that the user controls. This copying mechanism allows the user to maintain accessibility to file names locally while eliminating the vulnerability of storing plain text names in the cloud.
3Reliability
If multiple metadata files are created for each uploaded file, then file security and metadata management are improved, but device storage usage and system complexity increase
Solution Approach 1:
The patent merges all file metadata into a single consolidated metadata structure stored locally on the user's device. Instead of creating separate metadata files for each uploaded file in the cloud, the system combines all file descriptors, names, and attributes into one local metadata file. This merging approach reduces device storage usage and simplifies the system architecture while maintaining security through local control of the consolidated metadata.
Data Source
AI summary
A method of managing filesystem elements between a user device and a network connected to the user device comprising: receiving a request related to a filesystem element operation over the network; performing the filesystem element operation; updating a local metadata file based on the operation; downloading an encrypted network metadata file including data of the filesystem on the network from the network to the user device. The method comprises decrypting the encrypted network metadata file on the user device with a network encryption key; and provided the network metadata stored in the network is newer than the updated local metadata file, merging the network metadata file stored in the network with the updated local metadata file to update the local metadata file. The method comprises encrypting the updated local metadata file on the user device with the network encryption key; and uploading the encrypted updated metadata file to the network.