User-Specific Hash Authentication for Backup Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Content Addressed Storage (CAS) systems are susceptible to unauthorized data access due to the use of hash values for data access, which allows malicious users to access sensitive data they are not authorized to access by obtaining hash values from other users.
Innovation Solution
Implementing user-specific encryption/decryption keys stored only on the backup server, where clients generate hash values for backup data and receive encrypted hash values from the server, preventing unauthorized access by ensuring only the correct decryption key can retrieve the data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If CAS systems use hash values for data access, then data retrieval efficiency is improved, but security against unauthorized access deteriorates
Solution Approach 1:
The patent introduces an intermediary authentication mechanism between the hash value and the data retrieval process. Instead of allowing direct access using only the hash value, the system requires additional authentication credentials (user identity, passwords, or cryptographic keys) that act as intermediaries to verify authorized access. This mediator layer prevents unauthorized users from exploiting hash values to access data they shouldn't retrieve, while still maintaining efficient data retrieval for authenticated users.
Solution Approach 2:
The patent segments the data access control mechanism into multiple independent components: hash values for data identification, user credentials for authentication, and authorization rules for access control. By dividing the access control process into these separate segments, the system can efficiently retrieve data using hash values while independently verifying user authorization through separate authentication checks, thus preventing unauthorized access without compromising retrieval efficiency.
2Reliability
If conventional access control lists are implemented in CAS systems, then data security is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal authentication framework that serves multiple functions simultaneously: it provides access control, maintains security policies, manages user credentials, and integrates with the existing CAS hash-based retrieval mechanism. This multi-functional authentication system replaces the need for separate, complex access control lists with a unified approach that handles various access control scenarios through a single coherent mechanism, thereby improving security without proportionally increasing system complexity.
Solution Approach 2:
The authentication system is designed to work seamlessly with the CAS architecture, where the authentication module automatically verifies user credentials and integrates with the hash-based data retrieval process without requiring manual intervention or complex configuration. The system self-manages the integration between authentication and data access, reducing the operational complexity that would otherwise accompany enhanced security measures.
Data Source
AI summary
Backup data in a single-instance storage device is accessed through a backup server using hashes representative of and pointing to the backup data. To prevent unauthorized access, the server provides each client with encrypted versions of hashes corresponding to data backed up by the client. The hashes can be encrypted using client-specific symmetric encryption keys known to the server. To request data, a client provides the backup server with a corresponding encrypted hash. The backup server decrypts the encrypted hash using the client's encryption key. The original hash is only obtained if the key used for decryption is identical to the key used for encryption. Consequently, if an encrypted hash is stolen or otherwise acquired by a client different from the client that backed up the corresponding data, it cannot be used by the different client to request the corresponding data from the backup server.