Content-based encryption keys
Techniques and mechanisms described herein facilitate the encryption of content using content-based encryption keys. According to various embodiments, data stream may include one or more data chunks. A client machine may apply a hash function to a data chunk to determine a fingerprint value. A cryptographic protocol shared with a remote server may be applied to the fingerprint value to determine a data chunk encryption key. The data chunk encryption key may be used to encrypt the data chunk, and the encrypted data chunk may be sent to the remote server for storage.
1. A method comprising:
parsing a data stream into a plurality of data chunks by applying a rolling hash function that produces a respective checksum value for each of the plurality of data chunks, the plurality of data chunks including a designated data chunk;
determining a fingerprint value for the designated data chunk by applying a hash function to the designated data chunk via a processor at a client machine;
constructing a data chunk encryption key for encrypting the designated data chunk by combining the fingerprint value with one or more secret strings, the one or more secret strings being pre-negotiated between the client machine and a remote server, the data chunk encryption key being specific to the designated data chunk;
encrypting the designated data chunk with the data chunk encryption key to produce an encrypted data chunk; and
transmitting the encrypted data chunk to the remote server for storage via a communications interface at the client machine.
2. The method recited in claim 1 , wherein a respective data chunk encryption key is constructed for each of the plurality of data chunks.
3. The method recited in claim 1 , wherein the cryptographic protocol comprises a secret shared between the client machine and the remote server.
4. The method recited in claim 1 , wherein constructing the data chunk encryption key further comprises determining a hash based message authentication code based on the fingerprint value.
5. The method recited in claim 1 , the method further comprising:
transmitting the fingerprint to the remote server via the communications interface.
6. The method recited in claim 5 , the method further comprising:
receiving a data chunk status message from the remote server indicating whether the designated data chunk is stored on the remote server.
7. The method recited in claim 6 , wherein the designated data chunk is transmitted to the remote server for storage when it is determined that the designated data chunk is not stored on the remote server.
8. A client machine comprising:
memory operable to store a fingerprint value for a designated data chunk, the fingerprint value determined by applying a hash function to the designated data chunk;
a processor operable to:
parsing a data stream into a plurality of data chunks by applying a rolling hash function that produces a respective checksum value for each of the plurality of data chunks, the plurality of data chunks including the designated data chunk,
construct a data chunk encryption key for encrypting the designated data chunk by combining the fingerprint value with one or more secret strings, the one or more secret strings being pre-negotiated between the client machine and a remote server, the data chunk encryption key being specific to the designated data chunk, and
encrypt the designated data chunk with the data chunk encryption key to produce an encrypted data chunk; and
a communications interface operable to transmit the encrypted data chunk to the remote server for storage.
9. The client machine recited in claim 8 , wherein a respective data chunk encryption key is constructed for each of the plurality of data chunks.
10. The client machine recited in claim 8 , wherein the cryptographic protocol comprises a secret shared between the client machine and the remote server.
11. The client machine recited in claim 8 , wherein constructing the data chunk encryption key further comprises determining a hash based message authentication code based on the fingerprint value.
12. The client machine recited in claim 8 , wherein the communications interface is operable to transmit the fingerprint to the remote server.
13. One or more non-transitory computer readable media having instructions stored thereon for performing a method, the method comprising:
parsing a data stream into a plurality of data chunks by applying a rolling hash function that produces a respective checksum value for each of the plurality of data chunks, the plurality of data chunks including a designated data chunk;
determining a fingerprint value for the designated data chunk by applying a hash function to the designated data chunk via a processor at a client machine;
constructing a data chunk encryption key for encrypting the designated data chunk by combining the fingerprint value with one or more secret strings, the one or more secret strings being pre-negotiated between the client machine and a remote server, the data chunk encryption key being specific to the designated data chunk;
encrypting the designated data chunk with the data chunk encryption key to produce an encrypted data chunk; and
transmitting the encrypted data chunk to the remote server for storage via a communications interface at the client machine.