Secured encrypted shared cloud storage
Secure shared access to encrypted data in a data store is facilitated by using a data control server (DCS) to maintain a data storage reference table (DSRT) for shared data units present in a shared data pool hosted by least one data storage device, and accessible to a plurality of computing entities. The DSRT specifies for each shared data unit identifier information, location information for accessing the shared data unit in the shared data pool, and a hash value which has been computed for the shared data unit. The DCS selectively facilitates a decryption operation by providing hash values which serves as a basis for deriving a decryption key for decrypting shared data units which have been identified.
1. A method for secure shared access to encrypted data in a data store, comprising:
maintaining a data storage reference table (DSRT) at a data control server (DCS) for a plurality of blocks of data of a shared data pool, the shared data pool being one or more data storage devices logically grouped together and accessible to a plurality of computing entities, and the blocks of data being stored in encrypted form to prevent unauthorized access to any one of the blocks of data by the plurality of computing entities;
specifying, for at least one block of data of the shared data pool, location information and a hash value, the location information being configured to enable access to the at least one block of data stored in one of the data storage devices of the shared data pool, and the hash value being computed for the at least one block of data and configured to decrypt that block of data when stored in encrypted form; and
performing by the DCS post-write request operations that comprise:
receiving (i) a hash value for unencrypted content from a first computing entity of the plurality of computing entities, and (ii) file location data specifying a location in the shared data pool where a given block of data associated with the unencrypted content was written;
determining whether the first computing entity was permitted to perform a write transaction for the given block of data;
comparing the received hash value with a list of hash values in the DSRT to determine that the unencrypted content is duplicative of content previously written to the shared data pool based on the received hash value being present in the list of hash values, responsive to a determination that the first computing entity was permitted to perform the write transaction for the given block of data; and
changing a pointer value for the given block of data to be the same as that of another block of the shared data pool based on the comparing, so that the given location indicated by the location information remains usable for storage of other data.
2. The method according to claim 1 , further comprising updating the DSRT to include the received hash value for the unencrypted content when a determination is made that the received hash value is not present in the list of hash values.
3. The method according to claim 1 , further comprising:
receiving at the DCS, from the first computing entity, authentication information; and
analyzing the authentication information to determine whether the first computing entity is permitted to perform a write operation associated with the unencrypted content.
4. The method according to claim 3 , wherein the comparing is performed when a determination is made that the first computing entity is permitted to perform the write operation.
5. The method according to claim 1 , wherein the blocks of data data are encrypted prior to being stored by using an encryption key that has been derived from the hash value.
6. The method according to claim 1 , further comprising:
receiving a request from a second computing entity of the plurality of computing entities, said request specifying identifier information for at least one block of the blocks of data; and
responsive to said request, selectively facilitating a decryption operation of the block which has been specified, by communicating to the second computing entity one of the plurality of hash values which is specified in the DSRT and which corresponds to the identifier information;
wherein a decryption key for the block which has been specified is derivable from the hash value which is communicated to the second computing entity.
7. The method according to claim 6 , further comprising decrypting the content of the shared data pool which has been requested by the second computing entity using the decryption key.
8. A system for facilitating secure shared access to encrypted data in a data store, comprising:
a data control server (DCS) comprising at least one electronic processor and a server data store accessible to the at least one electronic processor;
the DCS configured to maintain a data storage reference table (DSRT) for a plurality of blocks of data of a shared data pool, the shared data pool being one or more data storage devices logically grouped together and accessible to a plurality of computing entities, and the blocks of data being stored in encrypted form to prevent unauthorized access to any one of the blocks of data by the plurality of computing entities;
the DSRT specifying for at least one block of data of the shared data pool, location information and a hash value, the location information being configured to enable access to the at least one block of data stored in one of the data storage devices of the shared data pool, and the hash value being computed for the at least one block of data and configured to decrypt that block of data when stored in encrypted form;
wherein the DCS performs post-write request operations that comprise:
receiving (i) a hash value for unencrypted content from a first computing entity of the plurality of computing entities, and (ii) file location data specifying a location in the shared data pool where a given block of data associated with the unencrypted content was written;
determining whether the first computing entity was permitted to perform a write transaction for the given block of data;
comparing the received hash value with a list of hash values in the DSRT to determine that the unencrypted content is duplicative of content previously written to the shared data pool based on the received has value being present in the list of has values, responsive to a determination that the first computing entity was permitted to perform the write transaction for the given block of data; and
changing a pointer value for the given block of data to be the same as that of another block of the shared data pool based on the comparing, so that the given location indicated by the location information remains usable for storage of other data.
9. The system according to claim 8 , wherein the DCS is configured to update the DSRT to include the received hash value for the unencrypted content when a determination is made that the received hash value is not present in the list of hash values.
10. The system according to claim 8 , wherein the DCS is configured to:
receive, from the first computing entity, authentication information; and
analyze the authentication information to determine whether the first computing entity is permitted to perform a write operation associated with the unencrypted content.
11. The system according to claim 10 , wherein the comparing is performed where a determination is made that the first computing entity is permitted to perform the write operation.
12. The system according to claim 8 , wherein the blocks of data unit are encrypted prior to being stored by using an encryption key that has been derived from the hash value.
13. The system according to claim 8 , wherein the DCS is responsive to a requests from a second computing entity of the plurality of computing entities, said request specifying identifier information for at least one block of the blocks of data, the DCS configured to selectively facilitate a decryption operation of the block which has been specified by communicating to the second computing entity which initiated the request one of the plurality of hash values which is specified in the DSRT and which corresponds to the identifier information;
wherein a decryption key for the block which has been specified is derivable from the hash value which is communicated to the second computing entity.
14. The system according to claim 13 , wherein the second computing entity is configured to decrypt the content of the shared data pool which has been requested by using the decryption key.
15. A method for secure shared access to encrypted data in a data store, comprising:
maintaining a data storage reference table (DSRT) at a data control server (DCS) for a plurality of shared data units, the plurality of shared data units being stored in encrypted form in a shared data pool that is hosted by at least one data storage device, and the shared data units being accessible to a plurality of computing entities;
specifying for each said shared data unit of the plurality of shared data units identifier information, location information and a hash value, the location information being configured to enable access to the shared data unit stored in the shared data pool, and the hash value comprising a unique value that is computed from a respective shared data unit of the plurality of shared data units; and
performing by the DCS post-write operations that comprise:
receiving (i) a hash value for unencrypted content from a first computing entity of the plurality of computing entities, and (ii) file location data specifying a location in the shared data pool where a given shared data unit associated with the unencrypted content was written;
determining whether the first computing entity was permitted to perform a write transaction for the given shared data unit;
comparing the received hash value with a list of hash values in the DSRT to determine whether the received hash value is present in the list of hash values, responsive to a determination that the first computing entity was permitted to perform the write transaction for the given shared data unit; and
selectively changing a pointer value for the given shared data unit to be equal to a pointer value associated with a hash value in the list of hash values that matches the received hash value.
16. The method according to claim 15 , wherein:
the DCS post-write request operations further comprise determining whether the first computing entity was permitted to perform a write transaction for the given shared data unit; and
the received hash value is compared with a list of hash values in the DSRT, responsive to a determination that the first computing entity was permitted to perform the write transaction for the given shared data unit.