Method for storing of data within a cloud storage and a cloud storage system

• US 10,313,311 B2
• Filed: 08/22/2014
• Issued: 06/04/2019
• Est. Priority Date: 08/22/2014
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Bohli, Jens-Matthias, Karame, Ghassan
• Primary Examiner(s): Plecha, Thaddeus J
• Application Number:
  US15/324,755
• Publication Number:
  US 20170208043A1
• Time in Patent Office: 1,747 Days
• CPC Class Codes: G06F 16/1824 implemented using Network-attached Storage [NAS] architecture distributed or networked storage systems G06F3/067; protocols for distributed storage of data in a network H04L67/1097
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2212/263 Network storage, e.g. SAN or NAS
• CPC Class Codes: G06F 3/0608 Saving storage space on storage systems
• CPC Class Codes: G06F 3/0623 in relation to content
• CPC Class Codes: G06F 3/0641 De-duplication techniques
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 2463/062 applying encryption of the keys
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

A method for storing data at a cloud storage, wherein data of a user is stored at the cloud storage upon a user request, includes encrypting the data of the user; directing the user request to a data manager; and before an uploading of the encrypted data to the cloud storage, performing, by the data manager, a deduplication on the encrypted data, so that uploading of the data is only performed, if the data is not yet stored within the cloud storage.

Claims

1. A method for storing data at a cloud storage, wherein data of a user is stored at the cloud storage upon a user request, the method comprising:

encrypting the data of the user;

directing the user request to a data manager;

before an uploading of the encrypted data to the cloud storage, performing, by the data manager, a deduplication on the encrypted data, so that uploading of the encrypted data is only performed if the encrypted data is not yet stored within the cloud storage, and

revoking access, of a user that has registered for the data, to the encrypted data stored within the cloud storage by changing a Uniform Resource Identifier (URI) of the encrypted data to another random URI when the registered user cancels their registration.

2. A method according to claim 1, wherein the data manager stores and/or provides at least one pointer to the encrypted data stored within the cloud storage.

3. A method according to claim 1, wherein the data manager maintains a list of data identifiers (IDs) in the cloud storage and of pointers to the location of the encrypted data stored within the cloud storage.

4. A method according to claim 1, wherein the data manager maintains a list of metadata that allows keeping information for each user that has registered for the data.

5. A method according to claim 1, wherein the data manager adapts metadata for the data if the data is already stored within the cloud storage.

6. A method according to claim 1, wherein the data is encrypted with a semantically secure encryption scheme.

7. A method according to claim 1, wherein a data encryption key is encrypted with a key derived from a content of the data.

8. A method according to claim 1, wherein the user generates a key f and encrypts the data before uploading the encrypted data to the cloud storage.

9. A method according to claim 8, wherein the user uploads an encrypted version of the key f using a key k derived from a content of the data to the data manager.

10. A method according to claim 1, wherein the user uploads a pointer of the uploaded encrypted data to the data manager.

11. A method according to claim 1, wherein the user computes a data identifier (ID) based on a knowledge of a content of the data.

12. A method according to claim 11,

wherein the user generates a key f and encrypts the data using the key f before uploading the encrypted data to the cloud storage,

wherein an encrypted version of the key f is generated using a key k derived from a content of the data,

wherein the data manager stores the data identifier (ID), the encrypted version of the key f, and a pointer to the encrypted data.

13. A method according to claim 1, wherein changing the Uniform Resource Identifier (URI) of the encrypted data is performed by the cloud storage upon request by the data manager.

14. A method according to claim 1, wherein the data manager computes or provides billing information for each user.

15. A method according to claim 1, wherein the data manager performs a proof of ownership protocol with the user.

16. A method according to claim 1, wherein the user queries the data manager about a data ID using an oblivious RAM or Private Information Retrieval (PIR).

17. A method according to claim 1, wherein the data manager is a server.

18. A method according to claim 1, wherein the data of the user is at least one file of data and/or block of data.

19. A method according to claim 1, wherein the data manager maintains a list of users per data stored within the cloud storage.

20. A cloud storage system, comprising:

a cloud storage, data of a user being stored as encrypted data within the cloud storage upon a request by the user;

an encryption entity for the data; and

a data manager,

wherein the data manager is configured to perform a deduplication on the encrypted data before an uploading of the encrypted data to the cloud storage, so that uploading of the encrypted data is only performed if the encrypted data is not yet stored within the cloud storage,

wherein the data manager is configured to revoke access, of a user that has registered for the data, to the encrypted data stored within the cloud storage by changing a Uniform Resource Identifier (URI) of the encrypted data to another random URI when the registered user cancels their registration.