Virtual storage services for client computing devices

Patent metadata

Field	Value
Publication number	US-11615194-B2
Application number	US-201816975661-A
Country	US
Kind code	B2
Filing date	Jun 29, 2018
Priority date	Jun 29, 2018
Publication date	Mar 28, 2023
Grant date	Mar 28, 2023

Abstract

Embodiments include apparatuses, methods, and systems including one or more servers and one or more storage devices, coupled with each other, to provide virtual storage service to store a file and meta data of the file for a client computing device. The file and the meta data of the file may be encrypted by the client computing device before providing to the virtual storage service. The file may be encrypted with a secret key of the client computing device, and the meta data of the file may be encrypted with a shared session key between the client computing device and the virtual storage service. The encrypted file may be stored in the one or more storage devices, and the encrypted meta data of the file may be stored in one or more secured areas of the one or more servers. Other embodiments may also be described and claimed.

First claim

What is claimed is:

1. A system to provide a virtual storage service for a client computing device for storing a file and associated metadata, wherein the system comprises:
one or more storage devices to store an encrypted file, wherein the encrypted file is produced by encryption of the file by the client computing device using a secret; and
one or more servers connected to the one or more storage devices, wherein the one or more servers are to:
receive, from the client computing device, the encrypted file and encrypted metadata, wherein the encrypted metadata is produced by encryption of the metadata by the client computing device using a shared session key, and the shared session key is shared between the client computing device and the virtual storage service; and
store the encrypted metadata in one or more secured areas of the one or more servers, wherein the stored encrypted metadata is for retrieval of the stored encrypted file;

wherein the virtual storage service is to receive an encrypted query about the file based on the shared session key, and the one or more servers is to decrypt the encrypted query based on the shared session key to obtain a query, and to search the encrypted metadata of the file stored on the one or more servers based on the query.

2. The system of claim 1 , wherein the metadata includes a file name, a file size, a date for the file, an owner of the file, a tag of the file, a portion of the file, or an abstract of the file.

3. The system of claim 1 , wherein the file includes an audio file, a multimedia file, a document, or an object file.

4. The system of claim 1 , wherein the one or more servers and the one or more storage devices are part of a fog network of computing devices.

5. The system of claim 1 , wherein the one or more servers are part of a fog network, and the one or more storage devices are disposed in a cloud coupled to the fog network.

6. The system of claim 1 , wherein the encrypted file and the encrypted metadata of the file are provided to the virtual storage service through a secure channel between the client computing device and the virtual storage service.

7. The system of claim 1 , wherein the one or more servers is to determine the encrypted file stored in the one or more storage devices based on the search performed on the stored encrypted metadata of the file, and to transmit the determined encrypted file to the client computing device.

8. The system of claim 1 , wherein the client computing device, the file, the encrypted file, the encrypted metadata of the file, the secret key, or the shared session key is a first client computing device, a first file, a first encrypted file, a first encrypted metadata of the first file, a first secret key, or a first shared session key, and the one or more servers and one or more storage devices are to provide virtual storage service to store a second file and second metadata of the second file for a second client computing device.

9. A computing device, comprising:
one or more processors to:
encrypt a file based on a secret key of the computing device to generate an encrypted file; and
encrypt metadata of the file based on a key shared between the computing device and a virtual storage service to generate an encrypted metadata; and
a communication interface coupled with the one or more processors to transmit the encrypted file and the encrypted metadata of the file to the virtual storage service, wherein the virtual storage service is to store the encrypted file in one or more storage device, and wherein the virtual storage service is to store the encrypted metadata in one or more secured areas of one or more servers, wherein the stored encrypted metadata is for retrieval of the stored encrypted file;
wherein the one or more processors are to generate an encrypted query about the file based on the shared key, and the communication interface is to transmit the encrypted query to the virtual storage service, wherein the virtual storage service is to decrypt the encrypted query based on the shared key, and to search and locate the stored encrypted metadata of the file to generate a response to the encrypted query.

10. The computing device of claim 9 , wherein the communication interface is to transmit the encrypted file and the encrypted metadata of the file to the virtual storage service through a secure channel between the computing device and the virtual storage service.

11. The computing device of claim 9 , wherein the communication interface is to receive the encrypted file from the virtual storage service as the response to the encrypted query.

12. One or more non-transitory computer-readable media (NTCRM) comprising instructions that cause a virtual storage service for a client computing device for storing a file and associated metadata, in response to execution of the instructions by the virtual storage service, to:
identify, from the client computing device, a received encrypted file that was produced by encryption of a file by the client computing device using a secret key;
store the encrypted file in one or more storage devices;
identify, from the client computing device, a received encrypted metadata, where the encrypted metadata is generated by the client computing device using a shared key to encrypt metadata of the file, wherein the shared key is shared between the client computing device and the virtual storage service;
store the encrypted metadata in one or more secured areas of one or more servers, wherein the stored encrypted metadata is for retrieval of the stored encrypted file;

identify, from the client computing device, a received encrypted query about the file based on the shared key;
decrypt the encrypted query based on the shared key to obtain a query; and
search the encrypted metadata of the file stored on the one or more servers based on the query.

13. The one or more NTCRM of claim 12 , wherein the instructions are further to cause the virtual storage service to:
identify the encrypted file stored in the one or more storage devices based on the search performed on the stored encrypted metadata of the file; and
transmit the identified encrypted file to the client computing device.

14. The one or more NTCRM of claim 12 , wherein the one or more servers are part of a fog network, and the one or more storage devices are disposed in a cloud coupled to the fog network.

15. The one or more NTCRM of claim 12 , wherein the encrypted file and the encrypted metadata of the file are provided to the virtual storage service through a secure channel between the client computing device and the virtual storage service.

16. A method for a virtual storage service for a client computing device to store a file and associated metadata, the method comprising:
generating an encrypted file, wherein the encrypted file is generated by encrypting the file using a secret key of the computing device;
generating encrypted metadata, wherein the encrypted metadata is generated by encrypting the metadata using a shared session key between the computing device and the virtual storage service;
transmitting the encrypted file and the encrypted metadata of the file to the virtual storage service, wherein the encrypted file is received by the virtual storage service and stored in one or more storage devices of the virtual storage service, and the encrypted metadata of the file are stored in one or more secured areas of one or more servers of the virtual storage service, wherein the stored encrypted metadata is for retrieval of the stored encrypted file;

generating a query about the file;
encrypt

Assignees

• Intel Corp

Inventors

• Wei Changzheng
• Yang Ziye
• Wang Junyuan
• Liang Cunming
• Hou Junhua
• Li Weigang
• Yu Ping
• Yang Yi
• Li Baoqian
• Zeng Xin

Classifications

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• G06F21/602 Primary

  Providing cryptographic facilities or services · CPC title

• G06F16/148

  File search processing · CPC title

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title