Third-Party Storage Asymmetric Key Segmentation for Secure Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Third-party storage vendors face challenges in deduplicating and efficiently sharing encrypted data due to different encryption schemes used by customers, which interferes with their ability to provide services like deduplication, sharing, and security scans.
Innovation Solution
Maintaining asymmetric key pairs on a third-party storage server and encrypting decryption keys with client-side keys, allowing clients to submit decryption keys for access while preventing unauthorized access to encrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If customers encrypt data before submitting to third-party storage, then data security is improved, but the third-party vendor's ability to deduplicate and share data is worsened
Solution Approach 1:
The encryption process is segmented into two independent stages: customer-side encryption of data content, and server-side encryption of decryption keys. This segmentation allows the customer to control data encryption while the server independently manages key encryption, enabling both security and deduplication functionality without interference between the two processes.
Solution Approach 2:
The server acts as an intermediary that receives both encrypted data and encrypted decryption keys from customers, then performs deduplication by comparing encrypted keys across different customers. This intermediary role allows the server to facilitate deduplication and sharing services without requiring access to the actual decryption capability, thus maintaining both security and functionality.
2Reliability
If customers use different encryption schemes, then data security is improved, but the third-party vendor's ability to perform services on files is worsened
Solution Approach 1:
The server implements a universal key management system that can handle multiple customer-specific encryption schemes through a common interface. By encrypting decryption keys with customer-provided keys and storing them centrally, the server provides universal access control and service capabilities (deduplication, sharing, security scans) that work across different encryption schemes without requiring scheme-specific implementation details.
3Ease of operation
If the third-party storage server stores decryption keys, then data access is improved, but data security is worsened
Solution Approach 1:
The system extracts the decryption key from the encrypted data structure and treats it as a separate entity that can be independently encrypted and managed. By separating the decryption key storage from the encrypted data and applying independent encryption to the key itself, the system enables efficient data access while maintaining security through the extracted and separately protected key.
4Reliability
If the third-party storage server does not store decryption keys, then data security is improved, but data access is worsened
Solution Approach 1:
The customer performs preliminary action by providing the decryption key to the server at the time of data upload. The server then uses this key to encrypt the decryption information and store it alongside the encrypted data. This preliminary provision of the key enables future efficient data access without requiring the customer to repeatedly provide decryption credentials, thus improving ease of operation while maintaining security through the preliminary established trust relationship.
Data Source
AI summary
A computer-implemented method for secure third-party data storage may include 1) identifying, at a server-side computing device, a request from a client system to access an encrypted file stored under a user account, 2) identifying, in response to the request, an asymmetric key pair designated for the user account that includes an encryption key and a decryption key that has been encrypted with a client-side key, 3) receiving, from the client system, the client-side key, 4) decrypting the decryption key with the client-side key, and 5) using the decryption key to access an unencrypted version of the encrypted file. Various other methods, systems, and computer-readable media are also disclosed.