Trusted storage systems and methods
View Patent ↗Systems and methods are disclosed for providing a trusted database system that leverages a small amount of trusted storage to secure a larger amount of untrusted storage. Data are encrypted and validated to prevent unauthorized modification or access. Encryption and hashing are integrated with a low-level data model in which data and meta-data are secured uniformly. Synergies between data validation and log-structured storage are exploited.
1. A non-transitory computer readable medium containing executable instructions for protecting a database system from external analysis and attack, the executable instructions including instructions for:
disguising the size of data blocks targeted for storage on a storage medium;
disguising the frequency with which data blocks are written to the storage medium; and
disguising the location at which data blocks are stored on the storage medium including relocating data blocks that were previously stored on the storage medium to new quasi-randomly selected locations on the storage medium when said data blocks are rewritten or updated.
2. The non-transitory computer readable medium as in claim 1 , in which disguising the size of data blocks includes padding the data blocks with additional data.
3. The non-transitory computer readable medium as in claim 1 , in which the data blocks are padded such that each block falls within predefined size limitations.
4. The non-transitory computer readable medium as in claim 1 , in which the data blocks are padded such that each block is of substantially the same size as the other data blocks.
5. The non-transitory computer readable medium as in claim 1 , in which disguising the frequency with which data blocks are written to the storage medium includes writing data blocks to the storage medium at a substantially constant frequency.
6. The non-transitory computer readable medium as in claim 1 , in which disguising the frequency with which data blocks are written to the storage medium includes writing data blocks to the storage medium at a frequency that varies according to a predefined pattern.
7. The non-transitory computer readable medium of claim 1 , wherein the one or more blocks of data are stored on the storage medium in a log-structured file.
8. A secure database system comprising:
a cryptographic module operable to disguise the size of data blocks targeted for storage on a non-transitory computer readable medium and to disguise the frequency with which data blocks are written to the non-transitory computer readable medium; and
a log-structured file system for disguising the location at which data blocks are stored on the non-transitory computer readable medium including relocating data blocks that were previously stored on the non-transitory computer readable medium to new quasi-randomly selected locations on the non-transitory computer readable medium when said data blocks are rewritten or updated.
9. A system as in claim 8 , in which disguising the size of data blocks includes padding the data blocks with additional data.
10. A system as in claim 8 , in which the data blocks are padded such that each block falls within predefined size limitations.
11. A system as in claim 8 , in which the data blocks are padded such that each block is of substantially the same size as the other data blocks.
12. A system as in claim 8 , in which disguising the frequency with which data blocks are written to the non-transitory computer readable medium includes writing data blocks to the non-transitory computer readable medium at a substantially constant frequency.
13. A system as in claim 8 , in which disguising the frequency with which data blocks are written to the non-transitory computer readable medium includes writing data blocks to the non-transitory computer readable medium at a frequency that varies according to a predefined pattern.
14. A system as in claim 8 , wherein the one or more blocks of data are stored on the non-transitory computer readable medium in a log-structured file.