Third-Party Storage Deduplication via Client-Side Key Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Third-party storage vendors face challenges in deduplicating and efficiently managing encrypted data due to different encryption schemes used by customers, which hinders data sharing and processing operations.
Innovation Solution
The system maintains asymmetric key pairs for encrypting and decrypting data on a third-party storage server, where decryption keys are encrypted with client-side keys, allowing secure access while preventing unauthorized access and enabling deduplication and data processing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If customers encrypt data before submitting to third-party storage, then data security is improved, but data deduplication capability deteriorates
Solution Approach 1:
The system segments the encryption process by separating the encryption key management from the data storage. Each customer's data is encrypted with their own key, but the system maintains a separate deduplication index that stores hash values of encrypted data without requiring key access. This segmentation allows independent operation of encryption and deduplication functions.
Solution Approach 2:
The patent introduces an intermediary deduplication index that mediates between encrypted data storage and security requirements. The index contains hash values and metadata about encrypted files without exposing decryption keys, enabling the third-party vendor to perform deduplication operations on encrypted data by comparing hash values rather than decrypting and comparing actual file contents.
2Reliability
If customers encrypt data before submitting to third-party storage, then data security is improved, but file sharing efficiency deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-computing and storing hash values and metadata of encrypted files in the deduplication index before any sharing operations occur. When a sharing request is made, the system can quickly identify existing copies through hash comparison without requiring decryption, enabling efficient sharing decisions to be made in advance.
Solution Approach 2:
The deduplication index acts as an intermediary that enables file sharing operations on encrypted data. It provides a mechanism for the third-party vendor to identify, locate, and manage shared files through hash-based matching without exposing encrypted content, thus maintaining security while enabling efficient sharing operations.
3Reliability
If different encryption schemes are used by customers, then individual data protection is improved, but system-wide deduplication capability deteriorates
Solution Approach 1:
The deduplication index is designed with universal functionality to handle multiple encryption schemes simultaneously. It stores hash values and metadata that are independent of the specific encryption algorithm used, allowing the system to perform deduplication across encrypted files regardless of which encryption scheme (AES, RSA, or custom algorithms) was applied to each file.
Solution Approach 2:
The system changes the parameter basis for deduplication from cryptographic content comparison to hash value comparison. By using cryptographic hash functions to generate unique identifiers for encrypted files, the system can compare and match files across different encryption schemes without needing to understand or reverse any specific encryption algorithm, thus enabling system-wide deduplication while preserving individual encryption choices.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method for secure third-party data storage may include 1) identifying, at a server-side computing device, a request from a client system to access an encrypted file stored under a user account, 2) identifying, in response to the request, an asymmetric key pair designated for the user account that includes an encryption key and a decryption key that has been encrypted with a client-side key, 3) receiving, from the client system, the client-side key, 4) decrypting the decryption key with the client-side key, and 5) using the decryption key to access an unencrypted version of the encrypted file. Various other methods, systems, and computer-readable media are also disclosed.