Method for storing a data file

Patent metadata

Field	Value
Publication number	US-11595188-B2
Application number	US-202017019492-A
Country	US
Kind code	B2
Filing date	Sep 14, 2020
Priority date	Oct 7, 2015
Publication date	Feb 28, 2023
Grant date	Feb 28, 2023

Abstract

A method for storing a data file (DF) on a storage entity (SE) includes receiving, by a proxy (PE) and from a computing entity (CE), a plurality of hash values corresponding to a plurality of blocks of the DF. The PE may check whether the plurality of blocks of the DF are stored in the SE based on the plurality of hash values. Based on determining that at least a subset of the plurality of blocks of the DF are not being stored in the SE, the PE may compute a secret associated with an encryption key. The PE may transmit, to the CE, the secret. The PE may receive, from the CE, information including storage locations of the subset of the plurality of blocks within the SE and one or more hash values, of the plurality of hash values, associated with the subset of the plurality of blocks.

First claim

What is claimed is:

1. A method for storing a data file (DF) on a storage entity (SE), the method comprising:
receiving, by a proxy (PE) and from a computing entity (CE), a plurality of hash values corresponding to a plurality of blocks of the DF;
checking, by the PE, whether the plurality of blocks of the DF are stored in the SE based on the plurality of hash values;
based on determining that at least a subset of the plurality of blocks of the DF are not being stored in the SE, computing, by the PE, a secret associated with an encryption key;
transmitting, by the PE and to the CE, the secret;
receiving, by the PE and from the CE, information comprising:
storage locations of the subset of the plurality of blocks within the SE; and
one or more hash values, of the plurality of hash values, associated with the subset of the plurality of blocks; and

based on a usage counter reaching zero, deleting, by the PE and for all blocks used by the DF, encryption keys and/or chunking keys associated with the DF.

2. The method according to claim 1 , wherein computing the secret comprises computing the secret based on proxy information.

3. The method according to claim 1 , wherein computing the secret comprises computing the secret based on CE information.

4. The method according to claim 1 , wherein the encryption key is used by the CE to encrypt the subset of the plurality of blocks.

5. The method according to claim 1 , the method further comprising:
checking, by the PE and at a regular time interval, at least a portion of the DF that is stored on the SE to verify its correctness.

6. The method of claim 1 , the method further comprising:
receiving, by the PE and from the CE, a query request requesting information about the DF; and
providing, by the PE and to the CE, the information about the DF.

7. The method according to claim 1 , the method further comprising:
prior to receiving the plurality of hash corresponding to the plurality of blocks of the DF, receiving, by the PE and from the CE, an initial hash value for the DF; and
checking, by the PE and based on the initial hash value, whether the DF has been stored in its entirety in the SE.

8. The method according to claim 1 , wherein the PE is provided in form of one or more client computing entities.

9. The method according to claim 1 , wherein the PE is a keyserver.

10. The method according to claim 1 , the method further comprising:
receiving, by the PE and from the CE, a request to delete the DF; and
deleting the DF in the SE based on the request
wherein deleting the encryption keys and/or the chunking keys associated with the DF is based on the request to delete the DF.

11. The method according to claim 10 , further comprising:
decrementing, by the PE, the usage counter for all blocks used by the DF, and wherein deleting the DF in the SE comprises:
informing, by the PE, the SE to delete the DF.

12. The method according to claim 1 , wherein deleting the encryption keys and/or the chunking keys associated with the DF comprises:
transmitting, by the PE and to the CE, a command to delete the encryption keys and/or the chunking keys associated with the DF on the CE.

13. The method according to claim 1 , further comprising:
distributing, by the PE and to the CE, metadata comprising a distributed hash table.

14. A proxy device (PE) that is used for storing a data file (DF) on a storage entity (SE), the PE comprising one or more hardware processors which, alone or in combination, are configured to provide for execution of the following:
receiving, from a computing entity (CE), a plurality of hash values corresponding to a plurality of blocks of the DF;
checking whether the plurality of blocks of the DF are stored in the SE based on the plurality of hash values;
based on determining that at least a subset of the plurality of blocks of the DF are not being stored in the SE, computing a secret associated with an encryption key;
transmitting, to the CE, the secret;
receiving, from the CE, information comprising:
storage locations of the subset of the plurality of blocks within the SE; and
one or more hash values, of the plurality of hash values, associated with the subset of the plurality of blocks; and
based on a usage counter reaching zero, deleting, for all blocks used by the DF, encryption keys and/or chunking keys associated with the DF.

15. The PE according to claim 14 , wherein computing the secret comprises computing the secret based on proxy information.

16. The PE according to claim 14 , wherein computing the secret comprises computing the secret based on CE information.

17. The PE according to claim 14 , wherein the one or more hardware processors are further configured to provide for execution of the following steps:
checking, at a regular time interval, at least a portion of the DF that is stored on the SE to verify its correctness.

18. The PE according to claim 14 , wherein the one or more hardware processors are further configured to provide for execution of the following steps:
receiving, from the CE, a request to delete the DF; and
deleting the DF in the SE based on the request,
wherein deleting the encryption keys and/or the chunking keys associated with the DF is based on the request to delete the DF.

19. The PE according to claim 18 , wherein the one or more hardware processors are further configured to provide for execution of the following steps:
decrementing the usage counter for all blocks used by the DF, and
wherein deleting the DF in the SE comprises:
informing the SE to delete the DF.

20. A tangible, non-transitory computer-readable medium having instructions thereon which, upon being executed by one or more processors, alone or in combination, provide for execution of the following:
receiving, from a computing entity (CE), a plurality of hash values corresponding to a plurality of blocks of a data file (DF);
checking whether the plurality of blocks of the DF are stored in a storage entity (SE) based on the plurality of hash values;
based on determining that at least a subset of the plurality of blocks of the DF are not being stored in the SE, computing a secret associated with an encryption key;
transmitting, to the CE, the secret;
receiving, from the CE, information comprising:
storage locations of the subset of the plurality of blocks within the SE; and
one or more hash values, of the plurality of hash values, associated with the subset of the plurality of blocks; and
based on a usage counter reaching zero, deleting, for all blocks used by the DF, encryption keys and/or chunking keys associated with the DF.

Assignees

• Nec Corp

Inventors

• Karame Ghassan
• Soriente Claudio
• Ritzdorf Hubert
• Capkun Srdjan

Classifications

• G06F3/0608 Primary

  Saving storage space on storage systems · CPC title

• H04L9/0816 Primary

  Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use · CPC title

• G06F16/13

  File access structures, e.g. distributed indices (arrangements of input from, or output to, record carriers G06F3/06) · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title