Method and system for preventing de-duplication side-channel attacks in cloud storage systems
AssigneeEMC Corporation
InventorAri Juels
Life of this patent
Estimating the term…
Abstract
An index-based proof-of-responsibility method and system for preventing side-channel attacks in data deduplication systems is described. A storage server computer creates a secret index referencing a specific random block in a file stored in a central data store. The server stores the hash value of the file along with the block referenced by the index. When a client computer submits a deduplication request regarding the file, server challenges the client to produce the block referenced by the index. If the proper file block is returned, the client has proven ownership of the file, and the request is granted. The server refreshes the index and associated challenge block after processing each request by a client computer.
Claims20
A computer-implemented method for proving responsibility over files stored in a data storage system, the method comprising:
- generating, in index process executed by a storage server computer in a network, an index referencing a block within a file stored in a central data store accessible by the storage server;
- storing, by the index process, the block referenced by the index in the central data store;
- receiving a request to process the file from a client computer coupled to the storage server over the network;
- transmitting the index to the client computer as a challenge for the client computer to return the block referenced by the index;
- comparing a block returned by the client to the stored block to validate the response by the client computer;
- and
- granting the request to access the file if the block returned by the client matches the stored block.
A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors to implement a method for configuring a multi-path index, the method comprising:
- generating, in index process executed by a storage server computer in a network, an index referencing a block within a file stored in a central data store accessible by the storage server;
- storing, by the index process, the block referenced by the index in the central data store;
- receiving a request to process the file from a client computer coupled to the storage server over the network;
- transmitting the index to the client computer as a challenge for the client computer to return the block referenced by the index;
- comparing a block returned by the client to the stored block to validate the response by the client computer;
- and
- granting the request to access the file if the block returned by the client matches the stored block.
A system for providing proof-of-responsibility in a data deduplication system, the system comprising:
- a processor-based data storage system executed on a server computer that is configured to store a plurality of files for a plurality of different client users;
- an index processing module configured to generate an index referencing a block within a file stored in a central data store accessible by the server computer, and further configured to store the block referenced by the index in the central data store;
- a transceiver component configured to receive a request to process the file from a client computer coupled to the server computer over a network, and to transmit the index to the client computer as a challenge for the client computer to return the block referenced by the index;
- and
- a validation module configured to compare a block returned by the client to the stored block to validate the response by the client computer to cause the server computer to grant the request to access the file if the block returned by the client matches the stored block.
A method of processing proof-of-responsibility challenges in a data deduplication system, the method comprising:
- storing in a data store of a server computer, a random block of a file referenced by a secret index;
- transmitting the index to a client computer upon a deduplication request by the client computer regarding the file, as a request for the client computer to return the block referenced by the index;
- validating a user of the client computer to be a proven owner of the file upon an exact match between the stored file block and the block returned by the client computer through a comparison process of the server computer;
- and
- refreshing the index to reference a new block upon comparing the returned block with the stored block.
Dependencies are inferred from the claim text.