Virtual Storage Encryption for Searchable Metadata
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Providing virtual storage services by a fog network closer to client computing devices poses challenges in ensuring security and privacy, particularly in searching encrypted files without incurring additional delays and complexity.
Innovation Solution
Files and their metadata are encrypted separately by client computing devices using different security keys, where files are encrypted with a secret key and metadata with a shared session key, allowing for secure storage and searchable metadata without transferring entire encrypted files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted with a secret key for secure storage, then security is improved, but the ability to search files without decryption is lost
Solution Approach 1:
The patent segments the file data into two distinct parts: encrypted file content (protected by secret key) and encrypted metadata (protected by public key). This segmentation allows different operations on different parts - the metadata can be searched while the file content remains securely encrypted, resolving the contradiction between security and search capability.
Solution Approach 2:
The patent introduces metadata as an intermediary element between the search function and the encrypted file content. The metadata contains searchable information about the file (such as tags, descriptions, or keywords) that can be encrypted and indexed without requiring decryption of the actual file content, enabling search capability while maintaining security.
2Ease of operation
If entire encrypted files are transferred to perform searches, then search capability is maintained, but additional delay and complexity are incurred
Solution Approach 1:
The patent extracts the searchable information from the file content and stores it separately as metadata. This extraction allows the system to search only the small metadata portion rather than transferring and decrypting entire large files, significantly reducing search delay and complexity while maintaining full search capability.
Solution Approach 2:
Instead of performing full file decryption and transfer for every search operation, the patent applies partial action by only processing and searching the metadata portion. This partial processing approach maintains search capability while avoiding the excessive time and computational resources that would be required to handle complete files.
3Reliability
If metadata is encrypted with the same secret key as files, then security is maximized, but operational efficiency on metadata is reduced
Solution Approach 1:
The patent applies local quality by using different encryption keys for different parts of the data structure. The file content uses a secret key for high-security encryption, while the metadata uses public key encryption that allows efficient operations. This localized differentiation of encryption approaches optimizes both security and operational efficiency for their respective purposes.
Solution Approach 2:
The patent changes the encryption parameter (key type) based on the data type and operational requirements. Secret key encryption is applied to file content where maximum security is needed, while public key encryption is applied to metadata where operational efficiency is also important. This parameter change allows the system to balance security and efficiency differently for different data elements.
Data Source
AI summary
Embodiments include apparatuses, methods, and systems including one or more servers and one or more storage devices, coupled with each other, to provide virtual storage service to store a file and meta data of the file for a client computing device. The file and the meta data of the file may be encrypted by the client computing device before providing to the virtual storage service. The file may be encrypted with a secret key of the client computing device, and the meta data of the file may be encrypted with a shared session key between the client computing device and the virtual storage service. The encrypted file may be stored in the one or more storage devices, and the encrypted meta data of the file may be stored in one or more secured areas of the one or more servers. Other embodiments may also be described and claimed.