Client-side encryption with low-cost integrity check

A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by a client device comprising a processor coupled to a memory, the client device being configured to communicate with a storage system, causes said client device:

• to generate a data encryption key for a data item by computing a function of at least the data item;
• to encrypt the data item using the data encryption key for the data item;
• to encrypt the data encryption key using a secret key of the client device;
• to send the encrypted data item and the encrypted data encryption key to the storage system for storage therein;
• to retrieve the encrypted data item and the encrypted data encryption key from the storage system;
• and
• to perform an integrity check on the retrieved encrypted data item using a result of decrypting the retrieved encrypted data encryption key.

A method comprising:

• generating a data encryption key for a data item by computing a function of at least the data item;
• encrypting the data item using the data encryption key for the data item;
• encrypting the data encryption key using a secret key of the client device;
• sending the encrypted data item and the encrypted data encryption key to a storage system for storage therein;
• retrieving the encrypted data item and the encrypted data encryption key from the storage system;
• and
• performing an integrity check on the retrieved encrypted data item using a result of decrypting the retrieved encrypted data encryption key;
• wherein the method is performed by a client device comprising a processor coupled to a memory and configured to communicate with the storage system.