Method and apparatus for duplicated data management in cloud computing
An approach is provided for managing data duplication in cloud computing. A method comprising, sending from a first device to a data center, data encrypted with a data encryption key for storing the encrypted data at the data center; encrypting the data encryption key according to an attribute-based encryption (ABE) scheme by using identity as an attribute in a deduplication policy for the data; issuing to a second device, a personalized secret attribute key which is derived from a public key of the second device according to the attribute-based encryption (ABE) scheme, wherein the personalized secret attribute key is to be used for decrypting the encrypted data encryption key at the second device, in combination with the policy.
1. An apparatus comprising:
at least one processor; and
at least one memory including computer program code, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to at least:
send, to a data center, data encrypted with a data encryption key for storing the encrypted data at the data center;
encrypt the data encryption key according to an attribute-based encryption scheme by using identity as an attribute in a deduplication policy for the data;
receive, from the data center, a public key associated with a device, wherein the public key is received in response to the device sending, to the data center, a request to store a duplicate of the encrypted data; and
issue, to the device, a personalized secret attribute key which is derived from the public key of the device according to the attribute-based encryption scheme, wherein the personalized secret attribute key is to be used for decrypting the encrypted data encryption key at the device, in combination with the deduplication policy.
2. An apparatus of claim 1 , wherein the apparatus is further caused to at least:
receive a deduplication notification from the data center, indicating that a duplication of the same data from the device is requested to be stored or has been stored at the data center, wherein the personalized secret attribute key is derived and issued in response to the receipt of the deduplication notification.
3. An apparatus of claim 2 , wherein the apparatus is further caused to at least:
inform the data center to deduplicate the same data from the device.
4. An apparatus of claim 1 , wherein the apparatus is further caused to at least:
send the encrypted data encryption key to the data center and/or the device.
5. An apparatus of claim 1 , wherein the apparatus is further caused to at least:
issue to another device, a personalized secret attribute key which is derived from a public key of the other device according to the attribute-based encryption scheme,
wherein the personalized secret attribute key issued to the other device is to be used for decrypting the encrypted data encryption key at the other device, in combination with the deduplication policy.
6. An apparatus of claim 1 , wherein the apparatus is further caused to at least:
set an access policy for the access to the data and sending the access policy to the data center.
7. An apparatus of claim 1 , wherein the apparatus is further caused to at least:
send to the data center, a request for deleting the data from the data center; and
continue a control of an encryption of the data encryption key and the issue of personalized secret attribute keys for decrypting the encrypted data encryption key.
8. An apparatus of claim 1 , wherein the apparatus is further caused to at least:
send to the data center a request for storing the data; and
receive from the data center an indication that there is no same data stored at the data center, wherein the data encrypted with the data encryption key is sent to the data center in response to the receipt of the indication.
9. A method comprising:
sending, by a first device and to a data center, data encrypted with a data encryption key for storing the encrypted data at the data center;
encrypting, by the first device, the data encryption key according to an attribute-based encryption scheme by using identity as an attribute in a deduplication policy for the data;
receiving, at the first device and from the data center, a public key associated with a second device, wherein the public key is received in response to the second device sending, to the data center, a request to store a duplicate of the encrypted data; and
issuing, by the first device and to the second device, a personalized secret attribute key which is derived from the public key of the second device according to the attribute-based encryption scheme, wherein the personalized secret attribute key is to be used for decrypting the encrypted data encryption key at the device, in combination with the deduplication policy.