Secure proofs of storage for deduplication
AssigneeNetApp, Inc.
InventorSrinivasan Narayanamurthy
Life of this patent
Estimating the term…
Abstract
Storage providers can securely store data and avoid data duplication with secure derivative data and offload the responsibility of generating the secure derivative data to the data owners. Initially, a data source will provide an encrypted version of data and the secure derivative data to a remote storage provider. The secure derivative data can include a hash of the data, a hash of the encrypted version of the data, a hash tree generated from the data, and an encrypted version of the key used to encrypt the data. When the remote storage provider later receives a request to store the same data, the remote storage provider uses the secure derivative data for secure proofs of storage and for proof of data possession.
Claims20
A method for data deduplication comprising:
- determining that a hash value generated from data is currently stored after receiving a request to store the data from a requestor;
- communicating a challenge to the requestor after determining that the hash value generated from the data is stored, wherein the challenge is based, at least in part, on a portion of a hash tree generated from the data;
- after receiving a successful response to the challenge, communicating an encrypted security key to the requestor;
- after receiving a hash value from the requestor in response to communicating the encrypted security key, determining whether the hash value matches a hash value generated from an encryption of the data;
- and
- associating an indication of the requestor with the encryption of the data if the hash value from the requestor matches the hash value generated from the encryption of the data.
A non-transitory machine-readable medium having program instructions stored thereon, the program instructions to:
- determine whether a hash value generated from data is currently stored after receipt of a request to store the data from a requestor;
- communicate a challenge to the requestor after a determination that the hash value generated from the data is stored, wherein the challenge is based, at least in part, on a portion of a multiple element hash structure generated from the data;
- communicate an encrypted security key to the requestor after receipt of a successful response to the challenge;
- determine whether the hash value matches a hash value generated from an encryption of the data, after receipt of a hash value from the requestor in response to communication of the encrypted security key;
- and
- associate an indication of the requestor with the encryption of the data if the hash value from the requestor matches the hash value generated from the encryption of the data.
An apparatus comprising:
- a processor;
- a network interface;
- and
- a machine-readable medium having program instructions stored thereon, the program instructions executable by the processor to cause the apparatus to,
- determine whether a hash value generated from data is currently stored after receipt of a request to store the data from a requestor;
- communicate a challenge to the requestor after a determination that the hash value generated from the data is stored, wherein the challenge is based, at least in part, on a portion of a multiple element hash structure generated from the data;
- communicate an encrypted security key to the requestor after receipt of a successful response to the challenge;
- determine whether the hash value matches a hash value generated from an encryption of the data, after receipt of a hash value from the requestor in response to communication of the encrypted security key;
- and
- associate an indication of the requestor with the encryption of the data if the hash value from the requestor matches the hash value generated from the encryption of the data.
Dependencies are inferred from the claim text.