Protecting data in insecure cloud storage

摘要

The disclosed embodiments provide a system that processes data. The system includes a first client that encrypts a first set of data, uploads the encrypted first set of data to a volume on a cloud storage system, and creates a commit record of the upload. The system also includes a synchronization server that verifies access to the volume by the first client and includes the commit record in a change set containing a set of commit records associated with the volume. The synchronization server also signs the change set and provides the change set for use in synchronizing the upload with a second client.

主权项

1. A system for processing data, comprising:
a first client configured to: encrypt a first set of data; upload the encrypted first set of data to a volume on a cloud storage system; and create a commit record of the upload, wherein the commit record comprises: a hash-based message authentication code (HMAC) of a path associated with the data; a previous state of the data; a current state of the data; metadata for the data; a digital signature from the first client; and a timestamp; and a synchronization server configured to: verify access to the volume by the first client; include the commit record in a change set comprising a set of commit records associated with the volume; sign the change set; and provide the change set for use in synchronizing the upload with a second client.