Identifying and coalescing identical objects encrypted with different keys
Cryptographic protocols and methods of employing the same are described. The described protocols advantageously enable two or more identical encryptable objects that are coded for encryption with different keys to be identified as identical without access to either the unencrypted objects or the keys that are used in the encryption process. Additionally, the protocols enable two or more identical encryptable objects to be processed with different encryption keys, yet be stored in a manner so that the total required storage space is proportional to the space that is required to store a single encryptable object, plus a constant amount for each distinct encryption key. In various embodiments, the encryptable objects comprise files and the cryptographic protocols enable encrypted files to be used in connection with single instance store (SIS) systems.
1. An encryption method comprising:
computing a representation for each of two or more encryptable objects;
encrypting each of the encryptable objects using its own representation as an encryption key, said encrypting defining a plurality of cipher objects each of which corresponds to an encryptable object;
encrypting multiple representations with individual unique keys;
ascertaining from the cipher objects whether the corresponding encryptable objects are identical; and
constructing a convergent cipher object that includes a cipher object corresponding to identical encryptable objects, each encrypted representation, and a key identifier for each key used to encrypt a representation.
2. The encryption method of claim 1 , wherein said computing of the representation comprises computing hashes of each of the two or more encryptable objects.
3. The encryption method of claim 1 , wherein said computing of the representations comprises computing secure hashes of each of the two or more encryptable objects.
4. The encryption method of claim 1 , wherein the two or more encryptable objects are identical.
5. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, implement the method of claim 1 .
6. A computer system programmed to implement the method of claim 1 .
7. One or more computer-readable media having computer-readable instructions thereon which, when executed by a computer, cause the computer to:
compute hashes of each of a plurality of identical objects;
encrypt each of the identical objects with its hash;
encrypt each hash with a different key; and
form at least one ordered tuple each of which comprising:
a single encrypted object that represents all of the identical objects; and
a list that contains information about each of the different keys.
8. The computer-readable media of claim 7 , wherein the list contains at least one identifier that uniquely identifies a key.
9. The computer-readable media of claim 7 , wherein the list contains at least one encrypted hash.
10. The computer-readable media of claim 7 , wherein the list contains a plurality of order pairs, each ordered pair containing:
an identifier that identifies a key; and
an encrypted hash that was encrypted with the key that is identified by the identifier.
11. The computer-readable media of claim 7 , wherein the instructions cause the computer to:
encrypt the hash with a one-way encryption function to provide an undecryptable encrypted hash; and
form at least one ordered tuple to contain the undecryptable encrypted hash.
12. The computer-readable media of claim 11 , wherein the instructions cause the computer to:
form multiple ordered tuples; and
determine whether objects that correspond to the multiple ordered tuples appear to be identical by comparing the single encrypted objects and the undecryptable encrypted hashes for each ordered tuple.
13. The computer-readable media of claim 7 , wherein the identical objects comprise files.
14. A file system encryption method comprising:
computing representations of two or more files;
encrypting each of the files with its own representation, said encrypting defining a plurality of cipher objects each of which corresponds to a file;
encrypting multiple representations with individual unique keys;
ascertaining from the cipher objects whether the corresponding files are identical; and
constructing a convergent cipher object that includes a cipher object that corresponds to identical files, each encrypted representation, and a key identifier for each key used to encrypt a multiple representation.
15. The file system encryption method of claim 14 , wherein said computing of the representations comprises computing hashes of the two or more files.
16. The file system encryption method of claim 14 , wherein said computing of the representations comprises computing secure hashes of the two or more files.
17. The file system encryption method of claim 14 , wherein the two or more files are identical.