# US 2019/0171847 A1 · Method for storing data blocks from client devices to a cloud storage system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0171847 A1
- Document ID: US20190171847A1
- Status: Published application
- Kind: A1
- Application number: 16/266,151
- Filed: 2019-02-04
- Published: 2019-06-06
- Earliest claimed: 2016-08-03
- Assignees: ABB Scheiz AG
- Applicants: ABB Schweiz AG
- Inventors: Johannes Schneider; Matus Harvan; Sebastian Obermeier; Thomas Locher; Yvonne-Anne Pignolet
- Web page: https://patentgrep.com/patent/US20190171847A1

## CPC

- G06F 21/6272: {by registering files or documents with a third party}
- G06F 3/0623: {in relation to content}
- G06F 3/0647: {Migration mechanisms}
- G06F 3/067: {Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]}
- G06F 11/1453: {using de-duplication of the data}
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/0478: {applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

The invention relates to a method for storing data blocks from client devices to a cloud storage system, the method includes the steps of: d) storing an encrypted first data block and a challenge of the first data block of a first client device on the cloud storage system, e) determining if a hash of a second data block of a second client device stored on the cloud storage system equals the hash of the first data block, f) if yes, transmitting the challenge of the first data block from the cloud storage system to the second client device, g) extracting, at the second client device, the bits at the positions or at the range contained in the challenge, hashing the extracted bits, encrypting the hashed bits with a public key of the first client device or of the second client device and uploading the encrypted bits from the second client device to the cloud storage system, and h) storing the encrypted bits from the second client device on the cloud storage system.

## Claims

### Claim 1

A method for storing data blocks from client devices to a cloud storage system, the method comprising the steps of:
d) storing an encrypted first data block, a challenge and a hash of the first data block of a first client device on the cloud storage system,
e) determining if a hash of a second data block of a second client device stored on the cloud storage system equals the hash of the first data block,
f) if yes, transmitting the challenge of the first data block from the cloud storage system to the second client device,
g) extracting, at the second client device, the bits positions or at a range contained in the challenge, hashing the extracted bits, encrypting the hashed bits with a public key of the first client device or of the second client device and uploading the encrypted bits from the second client device to the cloud storage system,
h) storing the encrypted bits from the second client device on the cloud storage system,
i) sending the challenge and the encrypted bits from the cloud storage system to the first client device,
j) extracting, at the first client device, the bits at the positions or at the range contained in the challenge, hashing the extracted bits, encrypting the hashed bits with a public key of the first client device or a public key of the second client device depending on the key chosen in step g) and comparing the encrypted bits with the challenge created in step c) or with the challenge received in step i),
k) if the comparison results in equality, encrypting the symmetric key used in step c) with the public key of the second client device and sending the encrypted symmetric key together with a new challenge of hashed bits at randomly chosen bit positions of the first data block or of a bit range of the first data block from the first client device to the cloud storage system, and
l) storing the new challenge and the encrypted symmetric key on the cloud storage system.

### Claim 2 (depends on 1)

The method according to claim 1, comprising the additional steps of:
a) determining if a hash of the first data block of the first client device is stored on the cloud storage system,
b) if not, providing an upload request for the first data block from the cloud storage system to the first client device,
c) in response thereto, encrypting, at the first client device, the first data block with a randomly generated symmetric key, creating the challenge of hashed bits at randomly chosen bit positions of the first data block or of the bit range of the first data block and encrypting the challenge with the private key of the first client device and uploading the encrypted first data block and the challenge from the first client device to the cloud storage system.

### Claim 3 (depends on 1)

The method according to claim 1, comprising the additional steps of:
m) sending the encrypted symmetric key from the cloud storage system to the second client device,
n) decrypting the symmetric key with a private key of the second client device and storing the symmetric key of the second client device.

### Claim 4 (depends on 1)

The method according to claim 1, comprising the additional steps of:
o) sending a download request for the first data block from the first client or second client device to the cloud storage system,
p) in response thereto, sending the encrypted first data block from cloud storage system to the first client or second client device,
q) decrypting the received first data block with the symmetric key at the first client or second client device.

### Claim 5 (depends on 1)

The method according to claim 1, comprising the additional steps of:
if the first client device cannot be accessed for executing step i) or step j), providing an upload request for the second data block from the cloud storage system to the second client device,
in response thereto, encrypting, at the second client device, the second data block with a further randomly generated symmetric key, creating a further challenge of hashed bits at randomly chosen bit positions of the second data block or of a bit range of the second data block and encrypting the further challenge with the private key of the second client device and uploading the encrypted second data block and the further challenge from the second device to the cloud storage system,
temporarily storing the encrypted second data block and the further challenge at the cloud storage system,
once the first client device can be accessed again, perform step i) or steps i) and j), and, if the comparison is successful, delete the temporarily stored encrypted second data block and the further challenge from the cloud storage system.

### Claim 6 (depends on 1)

The method according to claim 1, comprising the additional step of:
performing, at the cloud storage system, homomorphic encryption in regard to uploaded challenge and the uploaded encrypted bits from the second client device.

### Claim 7 (depends on 1)

The method according to claim 1, comprising the additional step of:
sending an acknowledgment, by the first client device, second client device and/or the cloud storage system, in response to an upload request.

### Claim 8 (depends on 1)

The method according to claim 1, comprising a public key infrastructure for provisioning the public key of the first client device and/or the public key of the second client device.

### Claim 9 (depends on 1)

The method according to claim 1, whereby the first data block and/or the second data block comprises a size of 0.5, 1, 2 or 5 MB.

### Claim 10 (depends on 1)

The method according to claim 1, whereby an individual symmetric key is provided to each first data block and/or each second data block.

### Claim 11 (depends on 2)

The method according to claim 2, comprising the additional steps of:
m) sending the encrypted symmetric key from the cloud storage system to the second client device,
n) decrypting the symmetric key with a private key of the second client device and storing the symmetric key of the second client device.

### Claim 12 (depends on 2)

The method according to claim 2, comprising the additional steps of:
o) sending a download request for the first data block from the first client or second client device to the cloud storage system,
p) in response thereto, sending the encrypted first data block from cloud storage system to the first client or second client device,
q) decrypting the received first data block with the symmetric key at the first client or second client device.

### Claim 13 (depends on 3)

The method according to claim 3, comprising the additional steps of:
o) sending a download request for the first data block from the first client or second client device to the cloud storage system,
p) in response thereto, sending the encrypted first data block from cloud storage system to the first client or second client device,
q) decrypting the received first data block with the symmetric key at the first client or second client device.

### Claim 14 (depends on 2)

The method according to claim 2, comprising the additional steps of:
if the first client device cannot be accessed for executing step i) or step j), providing an upload request for the second data block from the cloud storage system to the second client device,
in response thereto, encrypting, at the second client device, the second data block with a further randomly generated symmetric key, creating a further challenge of hashed bits at randomly chosen bit positions of the second data block or of a bit range of the second data block and encrypting the further challenge with the private key of the second client device and uploading the encrypted second data block and the further challenge from the second device to the cloud storage system,
temporarily storing the encrypted second data block and the further challenge at the cloud storage system,
once the first client device can be accessed again, perform step i) or steps i) and j), and, if the comparison is successful, delete the temporarily stored encrypted second data block and the further challenge from the cloud storage system.

### Claim 15 (depends on 3)

The method according to claim 3, comprising the additional steps of:
if the first client device cannot be accessed for executing step i) or step j), providing an upload request for the second data block from the cloud storage system to the second client device,
in response thereto, encrypting, at the second client device, the second data block with a further randomly generated symmetric key, creating a further challenge of hashed bits at randomly chosen bit positions of the second data block or of a bit range of the second data block and encrypting the further challenge with the private key of the second client device and uploading the encrypted second data block and the further challenge from the second device to the cloud storage system,
temporarily storing the encrypted second data block and the further challenge at the cloud storage system,
once the first client device can be accessed again, perform step i) or steps i) and j), and, if the comparison is successful, delete the temporarily stored encrypted second data block and the further challenge from the cloud storage system.

### Claim 16 (depends on 4)

The method according to claim 4, comprising the additional steps of:
if the first client device cannot be accessed for executing step i) or step j), providing an upload request for the second data block from the cloud storage system to the second client device,
in response thereto, encrypting, at the second client device, the second data block with a further randomly generated symmetric key, creating a further challenge of hashed bits at randomly chosen bit positions of the second data block or of a bit range of the second data block and encrypting the further challenge with the private key of the second client device and uploading the encrypted second data block and the further challenge from the second device to the cloud storage system,
temporarily storing the encrypted second data block and the further challenge at the cloud storage system,
once the first client device can be accessed again, perform step i) or steps i) and j), and, if the comparison is successful, delete the temporarily stored encrypted second data block and the further challenge from the cloud storage system.

### Claim 17 (depends on 2)

The method according to claim 2, comprising the additional step of:
performing, at the cloud storage system, homomorphic encryption in regard to uploaded challenge and the uploaded encrypted bits from the second client device.

### Claim 18 (depends on 3)

The method according to claim 3, comprising the additional step of:
performing, at the cloud storage system, homomorphic encryption in regard to uploaded challenge and the uploaded encrypted bits from the second client device.

### Claim 19 (depends on 4)

The method according to claim 4, comprising the additional step of:
performing, at the cloud storage system, homomorphic encryption in regard to uploaded challenge and the uploaded encrypted bits from the second client device.

### Claim 20 (depends on 5)

The method according to claim 5, comprising the additional step of:
performing, at the cloud storage system, homomorphic encryption in regard to uploaded challenge and the uploaded encrypted bits from the second client device.