Secure cloud storage and synchronization systems and methods

Abstract

A secure cloud storage and synchronization system and method is described that provides, among other things: (1) local password recovery, including a mechanism by which the user of the system can recover their password without having stored it on a remote server; (2) secure, private versioning of files, including a mechanism to privately store a version history of files on one or more remote servers in such a way that it is technically infeasible for anyone other than the legitimate owner to access any component of the file history; (3) secure, private de-duplication of files stored on one or more remote servers that reduces storage requirements by allowing for the storage of a single file when there are duplicates, even across users; and (4) secure, private sharing of files between users of the system that allows one user to share a file on the “cloud” with another user without deciphering or transporting the file.

1 . A de-duplication system comprising:
 a first computing device and a second computing device, both devices being adapted and programmed to communicate data to and from each other over the Internet, the first computing device being further adapted and programmed such that, upon a first request:   the first computing device encrypts a first data blob using a first key, thereby creating a first encrypted data blob;   the first computing device cryptographically hashes the first data blob, thereby creating a first cryptographic hash of the first data blob;   the first computing device encrypts the first key, using a first root key, thereby creating a first encrypted key;   the first computing device communicates to the second computing device: the first encrypted data blob; the first cryptographic hash of the first data blob; and the first encrypted key;   the second computing device being further adapted and programmed such that, after receipt of the first encrypted data blob, the first cryptographic hash of the first data blob, and the first encrypted key from the first device, the second computing device will:   recognize when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob;   deny the second request; and   provide to the second requester access to first encrypted data blob.   
     
     
         2 . The de-duplication system of  claim 1 , wherein the second computing device is further adapted and programmed such that, when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob, the second computing device will:
 recognize when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob by comparing the first cryptographic hash of the first data blob to a second cryptographic hash of the second data blob.   
     
     
         3 . The de-duplication system of  claim 1 , wherein the second computing device is further adapted and programmed such that, when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob, the second computing device will:
 deny the second request when the second computing device determines that the second requester can compute the first key with which the first encrypted data blob is encrypted.   
     
     
         4 . The de-duplication system of  claim 1 , wherein the second computing device is further adapted and programmed such that, when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob, the second computing device will:
 provide to the second requester access to the first encrypted data blob by communicating to second requester: the first encrypted data blob; and the first encrypted key from the first device.   
     
     
         5 . The de-duplication system of  claim 1 , wherein the second computing device cannot compute the first key with which the first encrypted data blob is encrypted. 
     
     
         6 . The de-duplication system of  claim 1 , wherein the first computing device and the second computing device are further adapted and programmed such that the system operates as claimed when the first request and the second request come from different computing devices. 
     
     
         7 . The de-duplication system of  claim 1 , wherein the first computing device and the second computing device are further adapted and programmed such that the system operates as claimed when the first request and the second request come from the same computing device. 
     
     
         8 . The de-duplication system of  claim 1 , wherein the first computing device and the second computing device are further adapted and programmed such that the system operates as claimed when the first request and the second request come from computing devices that both store the first root key. 
     
     
         9 . The de-duplication system of  claim 1 , wherein the first computing device and the second computing device are further adapted and programmed such that the system operates as claimed when the first request and the second request come from computing devices that do not both store the first root key. 
     
     
         10 . The de-duplication system of  claim 1 , wherein the second computing device comprises a plurality of computers in the Cloud. 
     
     
         11 . A method of de-duplication operable on a first computing device and a second computing device when both devices are adapted and programmed to communicate data to and from each other over the Internet and to perform the following respective steps, comprising the following steps:
 the first computing device encrypts a first data blob using a first key, thereby creating a first encrypted data blob;   the first computing device cryptographically hashes the first data blob, thereby creating a first cryptographic hash of the first data blob;   the first computing device encrypts the first key, using a first root key, thereby creating a first encrypted key;   the first computing device communicates to the second computing device: the first encrypted data blob; the first cryptographic hash of the first data blob; and the first encrypted key;   the second computing device, after receipt of the first encrypted data blob, the first cryptographic hash of the first data blob, and the first encrypted key from the first device:   recognizing when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob;   denying the second request; and   providing to the second requester access to first encrypted data blob.   
     
     
         12 . The de-duplication method of  claim 11 , wherein the second computing device, when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob:
 recognizes when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob by comparing the first cryptographic hash of the first data blob to a second cryptographic hash of the second data blob.   
     
     
         13 . The de-duplication method of  claim 11 , wherein the second computing device, when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob, will:
 deny the second request when the second computing device determines that the second requester can compute the first key with which the first encrypted data blob is encrypted.   
     
     
         14 . The de-duplication method of  claim 11 , wherein the second computing device, when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob, will:
 provide to the second requester access to the first encrypted data blob by communicating to second requester: the first encrypted data blob; and the first encrypted key from the first device.   
     
     
         15 . The de-duplication method of  claim 11 , wherein the second computing device does not compute the first key with which the first encrypted data blob is encrypted. 
     
     
         16 . The de-duplication method of  claim 11 , wherein the first computing device and the second computing device are further adapted and programmed such that the method operates as claimed when the first request and the second request come from different computing devices. 
     
     
         17 . The de-duplication method of  claim 11 , wherein the first computing device and the second computing device are further adapted and programmed such that the method operates as claimed when the first request and the second request come from the same computing device. 
     
     
         18 . The de-duplication method of  claim 11 , wherein the first computing device and the second computing device are further adapted and programmed such that the method operates as claimed when the first request and the second request come from computing devices that both store the first root key. 
     
     
         19 . The de-duplication method of  claim 11 , wherein the first computing device and the second computing device are further adapted and programmed such that the method operates as claimed when the first request and the second request come from computing devices that do not both store the first root key. 
     
     
         20 . A de-duplication system comprising:
 first computing means and second computing means, both computing means being adapted and programmed to communicate data to and from each other over the Internet, the first computing device being further adapted and programmed such that, upon a first request:   the first computing means encrypts a first data blob using a first key, thereby creating a first encrypted data blob;   the first computing means cryptographically hashes the first data blob, thereby creating a first cryptographic hash of the first data blob;   the first computing means encrypts the first key, using a first root key, thereby creating a first encrypted key;   the first computing means communicates to the second computing means: the first encrypted data blob; the first cryptographic hash of the first data blob; and the first encrypted key;   the second computing means being further adapted and programmed such that, after receipt of the first encrypted data blob, the first cryptographic hash of the first data blob, and the first encrypted key from the first device, the second computing means will:   recognize when it receives a second request to receive a second encrypted data blob that coincides byte-for-byte with the first encrypted data blob;   deny the second request; and   provide to the second requester access to first encrypted data blob.