WAN optimization for encrypted data traffic using fully homomorphic encryption

1. A method for WAN (wide area network) optimization for a WAN that connects a first site that sends a data stream to a second site, the method comprising:

at a gateway router deployed to a public cloud:

receiving, in the data stream, an optimized, encrypted file and a corresponding set of encrypted indices comprising unique identifiers that categorize the optimized, encrypted file;

using the set of encrypted indices and a particular encryption key to decompose the optimized, encrypted file and to identify (i) a set of full encrypted segments that comprise a first portion of the encrypted file and (ii) a set of encrypted values that comprise a second portion of the encrypted file, wherein each encrypted value in the set of encrypted values maps to a respective segment stored in a segment cache at the second site;

for each encrypted value in the set of encrypted values, retrieving the respective segment from the segment cache; and

using the identified set of full segments and set of retrieved segments to reconstruct the encrypted file;

wherein the gateway router comprises a first gateway router and the public cloud comprises a first public cloud, wherein receiving the optimized, encrypted file from the first site comprises receiving the optimized, encrypted file from a second gateway router that is deployed to a second gateway cloud to perform a set of WAN optimization operations on the data stream originating from a source device at the first site and to forward the optimized data stream to a destination device at the second site.

2. The method of claim 1 further comprising forwarding the reconstructed encrypted file to a destination device at the second site.

3. The method of claim 2 , wherein the destination device at the second site uses a secret decryption key generated by the source device at the first site to decrypt the reconstructed encrypted file.

4. The method of claim 1 , wherein the encrypted file comprises ciphertext content generated from plaintext content.

5. The method of claim 1 , wherein identifying the set of full segments further comprises storing each identified full segment in the segment cache.

6. The method of claim 5 , wherein before receiving the optimized, encrypted data stream, each segment in the identified set of full segments was not included in the segment cache.

7. The method of claim 1 , wherein retrieving the respective segment from the segment cache for each encrypted value in the set of encrypted values further comprises updating a state for the respective segment in the segment cache.

8. The method of claim 7 , wherein updating the state for the respective segment comprises updating a last-seen timestamp for the respective segment.

9. The method of claim 8 further comprising periodically deleting segments from the segment cache.

10. The method of claim 9 , wherein:

an expiration period is defined for each segment stored in the segment cache based on the last-seen time stamp for the segment, and

periodically deleting segments from the segment cache comprises (i) determining that a last-seen timestamp for a particular segment has not been updated within the defined expiration period, and (ii) deleting the particular segment from the segment cache.

11. The method of claim 1 , wherein the particular encryption key comprises a symmetric encryption key shared with a source of the data stream located at the first site.

12. The method of claim 1 , wherein the set of encrypted indices comprises unique identifiers to categorize the encrypted file.

13. The method of claim 1 , wherein each encrypted value is generated using a probabilistic encryption function.

14. A non-transitory machine-readable medium storing a program for execution by a set of processing units, the program for processing a WAN-(wide area network) optimized data stream at a gateway router deployed to a public cloud, the WAN-optimized data stream sent from a first site to a second site, the first and second sites connected by a WAN, the program comprising sets of instructions for:

receiving, in the data stream, an optimized, encrypted file and a corresponding set of encrypted indices comprising unique identifiers that categorize the optimized, encrypted file;

using the set of encrypted indices and a particular encryption key to decompose the optimized, encrypted file and to identify (i) a set of full encrypted segments that comprise a first portion of the encrypted file and (ii) a set of encrypted values that comprise a second portion of the encrypted file, wherein each encrypted value in the set of encrypted values maps to a respective segment stored in a segment cache at the second site;

for each encrypted value in the set of encrypted values, retrieving the respective segment from the segment cache; and

using the identified set of full segments and set of retrieved segments to reconstruct the encrypted file;

wherein the program further comprises a set of instructions for periodically deleting segments from the segment cache by (i) determining that a last-seen timestamp for a particular segment has not been updated within the defined expiration period, and (ii) deleting the particular segment from the segment cache; and

wherein an expiration period is defined for each segment stored in the segment cache based on the last-seen time stamp for the segment.

15. The non-transitory machine-readable medium of claim 14 , wherein after using the identified set of full segments and set of retrieved segments to reconstruct the encrypted file, the program further comprises a set of instructions for forwarding the reconstructed encrypted file to a destination device at the second site, wherein the destination device at the second site uses a secret decryption key generated by a source device at the first site to decrypt the encrypted file.

16. The non-transitory machine-readable medium of claim 14 , wherein the set of instructions for retrieving the respective segment from the segment cache for each encrypted value in the set of encrypted values further comprises a set of instructions for updating a state for the respective segment in the segment cache by updating a last-seen timestamp for the respective segment.

17. The non-transitory machine-readable medium of claim 14 , wherein the particular encryption key comprises a symmetric encryption key shared with a source device of the data stream located at the first site.

18. The non-transitory machine-readable medium of claim 14 , wherein each encrypted value is generated using a probabilistic encryption function.