Granted Patent B1

US 8,401,185 · App. 12/697,705 · Granted Mar 19, 2013

Abstract

Claims (54)

1. A computer-implemented method for securely deduplicating data owned by multiple entities, at least a portion of the method being performed by a client device comprising at least one processor, the method comprising:

identifying, at the client device, a plurality of data segments to store on a third-party storage system;

for each data segment, performing the following steps at the client device:

identifying a hash of the data segment;

transmitting the hash of the data segment to a central server;

receiving an encrypted string that is based on the hash of the data segment from the central server, wherein the encrypted string comprises an encryption of the hash of the data segment using a key that is derived from the hash of the data segment using a transformation function;

encrypting the data segment with the encrypted string;

transferring the encrypted data segment to the third-party storage system.

2. The computer-implemented method of claim 1 , wherein encrypting the data segment with the encrypted string comprises encrypting the data segment using the encrypted string as a symmetric key.

3. The computer-implemented method of claim 1 , further comprising:

identifying a hash of the encrypted data segment;

saving a hash-string pair that comprises the hash of the encrypted data segment and the encrypted string.

4. The computer-implemented method of claim 3 , further comprising accessing the data segment from the third-party storage system.

5. The computer-implemented method of claim 4 , wherein accessing the data segment from the third-party storage system comprises performing the following steps at the client device:

retrieving the encrypted data segment from the third-party storage system;

identifying the hash of the encrypted data segment;

locating the hash-string pair using the hash of the encrypted data segment;

identifying the encrypted string in the pair;

decrypting the encrypted data segment with the encrypted string.

6. The computer-implemented method of claim 1 , wherein the transformation function comprises at least one of a hash function and a mapping function.

7. The computer-implemented method of claim 1 , further comprising identifying a policy restricting cross-client convergent encryption for the data segment.

8. The computer-implemented method of claim 7 , wherein the key that is based on the hash of the data segment comprises a client-specific key.

9. The computer-implemented method of claim 7 , wherein the policy comprises a limitation of the percentage of data segments in the plurality of data segments that may undergo cross-client convergent encryption.

10. The computer-implemented method of claim 7 , wherein the policy comprises an indicator that the data segment is too sensitive to undergo cross-client convergent encryption.

11. A system for securely deduplicating data owned by multiple entities, the system comprising:

an identification module programmed to identify, at a client device, a plurality of data segments to store on a third-party storage system;

a hash-to-key module programmed to perform the following steps at the client device for each data segment:

identify a hash of the data segment;

transmit the hash of the data segment to a central server;

receive an encrypted string that is based on the hash of the data segment from the central server, wherein the encrypted string comprises an encryption of the hash of the data segment using a key that is derived from the hash of the data segment using a transformation function;

an encryption module programmed to encrypt the data segment with the encrypted string;

a storage module programmed to transfer the encrypted data segment to the third-party storage system;

at least one processor configured to execute the identification module, the hash-to-key module, the encryption module, and the storage module.

12. The system of claim 11 , wherein the encryption module is programmed to encrypt the data segment with the encrypted string by encrypting the data segment using the encrypted string as a symmetric key.

13. The system of claim 11 , further comprising a pairing module programmed to:

identify a hash of the encrypted data segment;

save a hash-string pair that comprises the hash of the encrypted data segment and the encrypted string.

14. The system of claim 13 , further comprising a retrieval module programmed to access the data segment from the third-party storage system.

15. The system of claim 14 , wherein the retrieval module is programmed to access the data segment from the third-party storage system by performing the following steps at the client device:

retrieving the encrypted data segment from the third-party storage system;

identifying the hash of the encrypted data segment;

locating the hash-string pair using the hash of the encrypted data segment;

identifying the encrypted string in the pair;

decrypting the encrypted data segment with the encrypted string.

16. The system of claim 11 , wherein the third-party storage system comprises a single-instance storage system.

17. The system of claim 11 , wherein the hash-to-key module is further programmed to identify a policy restricting cross-client convergent encryption for the data segment.

18. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing client device, cause the computing client device to:

identify, at the client device, a plurality of data segments to store on a third-party storage system;

for each data segment, perform the following steps at the client device:

identify a hash of the data segment;

transmit the hash of the data segment to a central server;

receive an encrypted string that is based on the hash of the data segment from the central server, wherein the encrypted string comprises an encryption of the hash of the data segment using a key that is derived from the hash of the data segment using a transformation function;

encrypt the data segment with the encrypted string;

transfer the encrypted data segment to the third-party storage system.

Assignments (6)