# US 10,313,311 B2 · Method for storing of data within a cloud storage and a cloud storage system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,311 B2 - Document ID: US10313311B2 - Status: Granted - Kind: B2 - Application number: 15/324,755 - Filed: 2014-08-22 - Published: 2017-07-20 - Granted: 2019-06-04 - Earliest claimed: 2014-08-22 - Assignees: NEC Corporation - Applicants: NEC Europe Ltd. - Inventors: Jens-Matthias Bohli; Ghassan Karame - Web page: https://patentgrep.com/patent/US10313311B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - G06F 3/0608: {Saving storage space on storage systems} - G06F 3/0623: {in relation to content} - G06F 3/0641: {De-duplication techniques} - G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]} - G06F 16/1824: {implemented using Network-attached Storage [NAS] architecture (distributed or networked storage systems G06F3/067; protocols for distributed storage of data in a network H04L67/1097)} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - G06F 2212/263: Network storage, e.g. SAN or NAS - H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key - H04L 2463/062: applying encryption of the keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for storing data at a cloud storage, wherein data of a user is stored at the cloud storage upon a user request, includes encrypting the data of the user; directing the user request to a data manager; and before an uploading of the encrypted data to the cloud storage, performing, by the data manager, a deduplication on the encrypted data, so that uploading of the data is only performed, if the data is not yet stored within the cloud storage. ## Claims ### Claim 1 A method for storing data at a cloud storage, wherein data of a user is stored at the cloud storage upon a user request, the method comprising: encrypting the data of the user; directing the user request to a data manager; before an uploading of the encrypted data to the cloud storage, performing, by the data manager, a deduplication on the encrypted data, so that uploading of the encrypted data is only performed if the encrypted data is not yet stored within the cloud storage, and revoking access, of a user that has registered for the data, to the encrypted data stored within the cloud storage by changing a Uniform Resource Identifier (URI) of the encrypted data to another random URI when the registered user cancels their registration. ### Claim 2 (depends on 1) A method according to claim 1, wherein the data manager stores and/or provides at least one pointer to the encrypted data stored within the cloud storage. ### Claim 3 (depends on 1) A method according to claim 1, wherein the data manager maintains a list of data identifiers (IDs) in the cloud storage and of pointers to the location of the encrypted data stored within the cloud storage. ### Claim 4 (depends on 1) A method according to claim 1, wherein the data manager maintains a list of metadata that allows keeping information for each user that has registered for the data. ### Claim 5 (depends on 1) A method according to claim 1, wherein the data manager adapts metadata for the data if the data is already stored within the cloud storage. ### Claim 6 (depends on 1) A method according to claim 1, wherein the data is encrypted with a semantically secure encryption scheme. ### Claim 7 (depends on 1) A method according to claim 1, wherein a data encryption key is encrypted with a key derived from a content of the data. ### Claim 8 (depends on 1) A method according to claim 1, wherein the user generates a key f and encrypts the data before uploading the encrypted data to the cloud storage. ### Claim 9 (depends on 8) A method according to claim 8, wherein the user uploads an encrypted version of the key f using a key k derived from a content of the data to the data manager. ### Claim 10 (depends on 1) A method according to claim 1, wherein the user uploads a pointer of the uploaded encrypted data to the data manager. ### Claim 11 (depends on 1) A method according to claim 1, wherein the user computes a data identifier (ID) based on a knowledge of a content of the data. ### Claim 12 (depends on 11) A method according to claim 11, wherein the user generates a key f and encrypts the data using the key f before uploading the encrypted data to the cloud storage, wherein an encrypted version of the key f is generated using a key k derived from a content of the data, wherein the data manager stores the data identifier (ID), the encrypted version of the key f, and a pointer to the encrypted data. ### Claim 13 (depends on 1) A method according to claim 1, wherein changing the Uniform Resource Identifier (URI) of the encrypted data is performed by the cloud storage upon request by the data manager. ### Claim 14 (depends on 1) A method according to claim 1, wherein the data manager computes or provides billing information for each user. ### Claim 15 (depends on 1) A method according to claim 1, wherein the data manager performs a proof of ownership protocol with the user. ### Claim 16 (depends on 1) A method according to claim 1, wherein the user queries the data manager about a data ID using an oblivious RAM or Private Information Retrieval (PIR). ### Claim 17 (depends on 1) A method according to claim 1, wherein the data manager is a server. ### Claim 18 (depends on 1) A method according to claim 1, wherein the data of the user is at least one file of data and/or block of data. ### Claim 19 (depends on 1) A method according to claim 1, wherein the data manager maintains a list of users per data stored within the cloud storage. ### Claim 20 A cloud storage system, comprising: a cloud storage, data of a user being stored as encrypted data within the cloud storage upon a request by the user; an encryption entity for the data; and a data manager, wherein the data manager is configured to perform a deduplication on the encrypted data before an uploading of the encrypted data to the cloud storage, so that uploading of the encrypted data is only performed if the encrypted data is not yet stored within the cloud storage, wherein the data manager is configured to revoke access, of a user that has registered for the data, to the encrypted data stored within the cloud storage by changing a Uniform Resource Identifier (URI) of the encrypted data to another random URI when the registered user cancels their registration.