FR3146220A1 - METHOD AND DEVICE FOR DISTRIBUTED ONLINE STORAGE OF FILES IN A ZERO TRUST CONTEXT - Google Patents

Abstract

The present invention relates to a method and system for secure zero-knowledge storage managed by a relay server connected to a plurality of online storage services, the file to be stored being divided into a plurality of fragments saved on the plurality of online storage services. The file to be saved is subjected to an all-or-nothing transformation function and to at least partial fully homomorphic encryption before its transmission for backup to the relay server.

Description

METHOD AND DEVICE FOR DISTRIBUTED ONLINE STORAGE OF FILES IN A ZERO TRUST CONTEXT

The present invention relates to the field of storing computer files online with a plurality of storage services in a context where the security of the service does not imply a relationship of trust between the different actors.

Online computer file storage services have grown in recent years. The big names in IT almost all offer their own service. Alongside these major players, many companies have also developed their own service for both individuals and businesses. Many of the latter are now adopting these services to save their data.

Using an online storage service allows you to avoid setting up and managing storage, its backups and its security on a daily basis. It also allows you to share the costs of the service between different customers.

IT security is also an increasingly sensitive topic. Examples of hacking of companies and online services are increasing. Even without malicious intent, a recent example of a fire in a data center of a major online services player could have caused the loss of data for a significant number of its customers.

In this context, improving the security and reliability of online storage services is a constant concern.

The invention is placed in the context where a secure online storage service is managed by a proxy server which provides the link between the user of the service and a plurality of online storage services. The term server is used here in a functional manner and can refer to various physical implementations of the relay server comprising one or more physical servers. The term user designates a computer terminal used by the human user to access the service. When we use this term user in the description of the proposed methods, it refers to actions performed by the user's terminal under his control and not to actions performed by the human user.

The user of the secure online storage service communicates only with the relay server and has no knowledge of the different online storage services used. Similarly, each online storage service communicates only with the relay server and has no knowledge of the other online services or the user.

The general operation of the secure online storage service is illustrated by the . The user 101 transmits to the relay server 102 a file 106 to be stored. The relay server 102 applies to the file 106 a dispersion function generating fragments 107, 108, 109 from the initial file 106. These fragments are stored by the relay server 102 on the various online storage services 103, 104, 105. This is the upload operation.

When the user 101 wants to find the stored file, he submits a download request to the relay server 102. The relay server 102 then requests the different fragments 107, 108, 109 from the different online storage services 103, 104, 105. From these fragments 107, 108, 109, it reconstitutes the initial file 106 and transmits it to the user 101.

The figure illustrates three online storage services. This figure is only an example and the number of online services used by a particular embodiment of the invention can be any with a minimum of two services. Similarly, the figure illustrates the backup of a single fragment per online storage service. In practice, multiple fragments can be stored on a single online storage service.

Advantageously, these fragments include a certain degree of redundancy to allow the reconstruction of the initial file from only a subset of the entirety of the fragments available for this file. This property provides the resilience of the system in the face of the potential loss or compromise of an online storage service.

Advantageously, communications between the user and the relay server as well as between the relay server and the online storage services use encrypted tunnels to ensure the confidentiality of the exchanges. Each actor in the system is authenticated with the actors with whom it communicates. The user, in particular, must be authenticated with the system which issues him an access token that can be verified by the relay server and/or the online storage services.

The user also has a signature key that allows him to sign his messages. This signature can be verified, and therefore the messages authenticated as coming from the user by the relay server and online storage services. This signature key can be symmetric or asymmetric.

Advantageously, the dispersion function ensures that knowledge of a single fragment does not allow an online storage service to reconstruct the initial file. In the case where the system uses redundancy and where several fragments are stored on the same online storage service, the system ensures that the number of fragments stored on the same online storage service does not allow the file to be reconstructed.

In terms of security, it is advantageous to offer a so-called zero-trust storage service between the different actors. Thus, the compromise of one of the actors does not compromise the security of the solution. In this case, we are interested in the confidentiality of the exchanges and the means implemented to ensure that the relay server and the storage services cannot access the information saved by the user. This confidentiality must be ensured without requiring the management of keys over time by the user. To do this, five constraints are imposed on the system.

According to a first constraint, the user must not have to manage persistent keys.

According to a second constraint, the user must not have knowledge of online storage services.

According to a third constraint, online storage services must not be able to acquire knowledge, even partial, of the original content stored by the user.

A fourth constraint is that the relay server must not be able to acquire any information about the user's original content.

A fifth constraint is that the user should only need one request to get a valid response from the service.

The invention aims to offer a secure online storage service based on a relay server and a plurality of online storage services respecting these constraints.

According to one aspect of the invention, a method for securely storing an original file is provided, characterized in that it comprises the following steps for uploading an original file:
- reception of the original file, transmitted by a user device, by a relay server connected to a plurality of online storage services;
- application of a dispersion function by the relay server to generate a plurality of fragments from the original file received;
- transmission for backup by the relay server of each fragment to an online storage service among the plurality of online storage services;
characterized in that:
- the original file is transformed into a pseudo-message by the user device using an all-or-nothing transformation function;
- the pseudo-message is encrypted, at least in part, by the user device using a secret key shared with the plurality of online storage services, the encryption being homomorphic, the original file received by the relay server being the encrypted pseudo-message;
- the dispersion function is applied to the encrypted pseudo-message and generates encrypted fragments;
- encrypted fragments are decrypted by online storage services before storage.

One embodiment is characterized in that:
- the secret key is shared between the user device and the online storage services by a secure key exchange protocol.

One embodiment is characterized in that:

- the secure key exchange protocol is the Diffie-Hellman protocol.

One embodiment is characterized in that:
- Secure Key Exchange Protocol is the Secure Key Exchange Protocol.
One embodiment is characterized in that:
- the Diffie-Hellman protocol is based on a first asymmetric key generated by the user device and a second asymmetric key shared by the online storage services.

One embodiment is characterized in that:
- a new first asymmetric key is generated before each exchange by the user device.

One embodiment is characterized in that it further comprises the following steps for downloading:
- encryption of fragments by online storage services using a secret key shared with the user device;
- reception by the relay server of encrypted fragments;
- application of the inverse dispersion function by the relay server on the encrypted fragments to generate a pseudo-encrypted message;
- transmission of the encrypted pseudo-message to the user device;
- decryption of the encrypted pseudo-message by the user device;
- application of the inverse all-or-nothing transformation function by the user device to find the original file.

According to another aspect of the invention, a computer program is provided comprising instructions adapted to the implementation of each of the steps of the method according to the invention when said program is executed on a computer.

According to another aspect of the invention, there is provided a means of storing information, removable or not, partially or totally readable by a computer or a microprocessor comprising code instructions of a computer program for the execution of each of the steps of the method according to the invention.

According to another aspect of the invention, there is provided a system comprising a user device, a relay server and a plurality of online storage services configured to implement a method according to the invention.

According to another aspect of the invention, a computer program is provided comprising instructions adapted to the implementation of each of the steps of the method according to the invention when said program is executed on a computer.

According to another aspect of the invention, there is provided a means of storing information, removable or not, partially or totally readable by a computer or a microprocessor comprising code instructions of a computer program for the execution of each of the steps of the method according to the invention.

According to another aspect of the invention there is provided a system comprising a user device, a relay server and a plurality of online storage services configured to implement a method according to the invention.

In the attached drawings, given as non-limiting examples:

there illustrates the general architecture and operation of a secure online storage service according to one embodiment of the invention;

Figures 2a and 2b illustrate the general operation of uploading and downloading a file;

Figures 3a and 3b illustrate one embodiment of the invention;

there is a schematic block diagram of an information processing device for implementing one or more embodiments of the invention.

Figures 2a and 2b illustrate the general operation of the upload, , and downloading, figure 2b, a file.

In these figures only one online storage service 203 is shown. The same operation applies to the plurality of online storage services connected to the relay server 202.

The file upload is illustrated by the . The user 201 transmits the original file to be saved 204 to the relay server 202. The latter assigns an identifier 207 Id_o to the original file, transmits it to the user 201 who stores it 210.

The relay server applies the dispersion function to generate the fragments from the original file. The operation of the dispersion function is not the subject of this document. The figure illustrates a fragment 205 of this plurality of fragments. The fragment 205 is transmitted to the online storage service 203 which assigns it a fragment identifier Id_f 206 and stores the link 208 between the fragment 205 and its identifier Id_f 206. The online storage service transmits this fragment identifier 206 to the relay server which stores the association 209 between the identifier of the original file Id_o and the fragment identifier Id_f. The other fragments generated by the relay server receive the same processing not shown in the figure.

The download illustrated in Figure 2b has a symmetrical operation. The user 201 transmits to the relay server 202 a request comprising the identifier Id_o 207 of the file that he wishes to download. The relay server finds the associated fragment identifier Id_f that it uses to construct a request comprising this identifier that it transmits to the online storage service 203. Using the fragment identifier Id_f, the online storage service 203 finds the associated fragment 205 and transmits it to the relay server 202. The latter, when it has recovered all of the fragments, or at least a sufficient number if redundancy is implemented, reconstructs the original file 204 using the inverse function of the dispersion function. The relay server can then transmit the original file 204 thus obtained to the user.

The solutions proposed in this document to meet the security constraints outlined are based on the use of cryptographic tools. Among these tools we will cite the following functions:

The KEYGEN function which allows to generate a cryptographic key. The generated key can be a symmetric or asymmetric key.

A symmetric key is a key shared between two parties that allows the encryption of content to obtain encrypted content. The same key is needed to decrypt the encrypted content and retrieve the original content. This key constitutes a secret shared between the sender of the encrypted content who performs the encryption and the receiver of the encrypted content who performs the decryption.

An asymmetric key is composed of a pair of keys, a so-called private key and a so-called public key. To exchange encrypted content between two actors, each has their own asymmetric key. Each actor keeps their private key secret and broadcasts their public key. In this case, the sender who encrypts content encrypts it using the receiver's public key. The latter decrypts the content using their own private key.

The ENC(k, m) function represents the encryption of a content ‘m’ using the key ‘k’. This is a symmetric key, typically from the KEYGEN function. An asymmetric key can also be used.

The function DEC(k, c) represents the decryption of an encrypted content ‘c’ using the key ‘k’. It is the inverse function of the function ENC(k, m).

The function SIGN(k, m) produces a cryptographic signature of the content ‘m’ using the key ‘k’. This function does not encrypt the content and leaves it readable. The sender of a content ‘m’ can sign this content using this function. He then transmits the content ‘m’ and the signature thus calculated. The receiver of the content ‘m’ can verify the signature, for example using the same function and the same key or the verification functions according to the embodiment. If the signature thus obtained corresponds to the signature received, this means that the content ‘c’ has not been altered and that it has indeed been signed by the owner of the key ‘k’. In the preferred embodiment, the signature key is different from the key used to encrypt/decrypt the messages.

The HASH(m) function is a non-invertible mathematical function that produces a fixed-size value from a content ‘m’ of any length. The probability that two different contents m1 and m2 produce the same hash value is low enough that the HASH function is considered to be a way to verify the integrity of the content ‘m’.

The AONT function (for All Or Nothing Transform in English) is an all-or-nothing transformation function, i.e. without a key, invertible, random, having the property of being very difficult to invert if the entirety of its result is not known. This function takes a message as input and generates a pseudo-message. The inverse operation allowing the original message to be found from the pseudo-message requires knowing the entirety of the pseudo-message. A simple fragment of the pseudo-message does not allow the original message to be reconstructed, even partially. Various examples of such functions are known to those skilled in the art, including the function described by Ronald L. Rivest in his 1997 article entitled "All-Or-Nothing Encryption and The Package Transform". The transformation proposed by Rivest consists of preprocessing the plaintext by performing an XOR of each plaintext block with the index of this block encrypted by a randomly chosen key, then adding an additional block calculated by performing an XOR of this random key and the hashes of all the preprocessed blocks. The result of this preprocessing is called the pseudo-message and serves as input to the encryption algorithm. To undo the transformation of the packet, one must hash all the blocks of the pseudo-message except the last one, perform an XOR of all the hashes with the last block to recover the random key, then use the random key to convert each preprocessed block back to its original plaintext block. In this way, it is impossible to recover the original plaintext without having access to all the blocks of the pseudo-message. Other AONT functions have been proposed since. For the purposes of this document, any AONT function can be used interchangeably.

The HEenc(k, m) function is a homomorphic encryption function of a message m by a key k having the following property with respect to a law defined by two operators ( , ) :

HEenc(k, m1) HEenc(k, m2) = HEenc(k, m1 m2);

The function HEenc(k, m) is said to be totally homomorphic if the homomorphism property is valid with respect to two laws And which allow to express any computable function. Homomorphic encryption allows to perform calculations on encrypted data without requiring their decryption. The known use case of these encryption methods is the outsourcing of calculations to an insecure entity. The data to be processed are encrypted by such a fully homomorphic function before their transmission to the entity. The latter can then perform the requested processing on the encrypted data without being able to access these data. The result received from the entity can be decoded by the ordering party. An example of a fully homomorphic encoding function is described in the scientific article: I. Chillotti, N. Gama, M. Georgieva, and M. Izabachène. TFHE: Fast Fully Homomorphic Encryptionover the Torus. In Journal of Cryptology, volume 33.

The Diffie Hellman DH-Key function allows a key exchange between two agents, conventionally named Alice and Bob, such that this exchange allows the two agents to share a secret without the exchanges revealing this secret. If Alice has a secret key DH_S_A and a corresponding public key DH_P_A, while Bob has the secret key DH_S_B and the corresponding public key DH_P_B, and Alice and Bob exchange their public keys DH_P_A and DH_P_B, the Diffie Hellman function allows the two agents Alice and Bob to calculate the same value K, which can be used as a key, as follows:

K = DH-Key(DH_P_B, DH_S_A) = DH-Key(DH_P_A, DH_S_B);

A malicious agent intercepting the exchanges between Alice and Bob only acquires knowledge of Alice and Bob's public keys which, in the absence of the private keys, do not allow the calculation of K. The key K then allows Alice and Bob, for example, to encrypt their communications.

The invention is based on the implementation of encryption of the file to be saved by the user. We recall that one of the constraints is not to have to impose persistent key management on the user. The fragments from the file to be saved are therefore stored in clear text by the storage services. This encryption aims to protect the confidentiality of the original file during communications and in particular during manipulation of the file by the relay server to generate the fragments. As a result, the file must not be decrypted by the relay server which must work on the encrypted version of the file. To allow this manipulation of the encrypted file by the relay server without compromising the decryption of the fragments by the storage services, a fully homomorphic encryption is preferred. However, in certain embodiments, depending on the type of mathematical operations implemented by the dispersion function, a simply homomorphic encryption can be used.

It is also desired that the relay server cannot decrypt the file and access its content. In addition, the user has no a priori knowledge of the storage services used; he communicates only with the relay server. These constraints must still allow the user to encrypt the file and the storage service to decrypt the fragments entrusted to it. To allow these constraints to be respected, it is proposed to use a secure private key exchange protocol between the user and the storage services. Several protocols can be used, for example the Diffie-Hellman key exchange protocol, or the Kyber algorithm described in the article "CRYSTALS-Kyber Algorithm Specifications And Supporting Documentation (version 3.02)", by Roberto Avanzi, Joppe Bos, Léo Ducas, Eike Kiltz, Tancrède Lepoint, Vadim Lyubashevsky, John M. Schanck, Peter Schwabe, Gregor Seiler, Damien Stehlé, and submitted to the NIST competition. Advantageously, online storage services share the same asymmetric key, i.e. composed of a public key and a secret key. The user can, for his part, generate a new asymmetric key for each exchange. This generation of a new key by the user is not mandatory but allows to change the shared key K used to encrypt the file at each exchange. Thus, during each exchange, the Diffie-Hellman protocol generates a key K dedicated to the exchange, shared between the user and all storage services and unknown to the relay server, although the latter has knowledge of all exchanges between the user and the online storage services. This generation of a new key by the user is not mandatory but allows changing the shared key K used to encrypt the file at each exchange. How online storage services obtain the asymmetric key they share is outside the scope of this document. This key can be configured at system initialization or shared afterwards. The only constraint is that it must be guaranteed that the relay server cannot acquire knowledge of it.

It is further desired that the online storage services used to store the fragments cannot acquire knowledge about the original file. However, the fragments are stored unencrypted by these online storage services. To comply with these constraints, it is proposed that the user encodes the original file using an AONT function to generate a pseudo-message from the original file. It is this pseudo-message and not the original file that is then encrypted and transmitted to the relay server for storage by the online storage services. Due to the properties of the AONT function, the entire pseudo-message is necessary to decode it and find the original file. Thus, each online storage service that by definition only has one or more fragments of the pseudo-message is unable to access even one fragment of the original file.

Moreover, using the AONT function has an additional advantage. Indeed, since it is necessary to access the entire pseudo-message to decode it, it is not necessary to encrypt the entire pseudo-message to protect access to it. Encrypting only a small part of the pseudo-message offers the same degree of protection as encrypting the entire pseudo-message. This property can be implemented to limit the computational resources required by the proposed method by encrypting only a small part of the pseudo-message. This is all the more interesting since fully homomorphic encryption functions are computationally expensive.

To summarize, the proposed storage method comprises, for the upload operation, a first step of application of an AONT function by the user on the original file to obtain a pseudo-message corresponding to the original file. Then, the user encrypts at least part of the pseudo-message to obtain an encrypted pseudo-message. This encryption is of the fully homomorphic type. It is performed using a secret key shared between the user and the online storage services. In one embodiment, this secret key is exchanged using the Diffie-Hellman protocol between the user and the storage services. The encrypted pseudo-message is transmitted to the relay server. It should be noted here that the pseudo-message is referred to as an encrypted pseudo-message even in the case of partial encryption of the pseudo-message. Indeed, due to the use of the AONT function, even in the case of partial encryption, the unencrypted parts of the pseudo-message are not accessible without decrypting the encrypted part. The relay server then applies the dispersion function to obtain a plurality of encrypted fragments. The fragments are called encrypted here, although strictly speaking, since encryption may only affect part of the pseudo-message, some fragments may correspond to an unencrypted part of the pseudo-message, for the reason explained above regarding the encrypted pseudo-message. These encrypted fragments are distributed across the various online storage services. They are then decrypted and stored in clear text by the online storage service.

The download operation is symmetrical. It is also based on homomorphic encryption using a key shared between the user and the online storage services. This secret key can, in an exemplary embodiment, be exchanged by the Diffie-Hellman protocol following a possible generation of a new asymmetric key by the user. The online storage services then encrypt all or part of the fragments at their disposal. These fragments are then transmitted to the relay server upon request. The relay server having received the encrypted fragments applies the inverse dispersion function to find the encrypted pseudo-message. The manipulation of the encrypted data is made possible by the use of fully homomorphic encryption. This encrypted pseudo-message is then transmitted upon request to the user who can decrypt it to obtain the unencrypted pseudo-message and decode the latter to find the original file.

Figures 3a and 3b illustrate a first embodiment of the invention. The illustrates the upload according to this embodiment, while the illustrates the download.

To perform the upload, the user 201 begins by generating the pseudo-message by applying the AONT function to the original file. Then, he obtains the secret key K shared with the online storage services, here the storage service 203. In an exemplary embodiment, the user generates an asymmetric key (DH_P_U, DH_S_U), typically using the KEYGEN function and applies the Diffie-Hellman protocol to calculate the secret key K. This key is then used to at least partially encrypt the pseudo-message using a fully homomorphic encryption and obtain an encrypted pseudo-message. The user then transmits the encrypted pseudo-message 204 to be stored to the relay server 202. The latter applies the dispersion function and generates the encrypted fragments resulting from the encrypted pseudo-message. It also associates the encrypted pseudo-message with the original file identifier 207 Id_o that it transmits back to the user 201. We describe the processing of one of these encrypted fragments, the fragment 205 which is transmitted to the online storage service 203 for storage. This fragment from an encrypted pseudo-message is also encrypted. The online storage service 203 decrypts the encrypted fragment 205, stores it and associates it with a fragment identifier Id_f which is sent back to the relay server. Alternatively, the fragment identifier Id_f can be generated directly by the relay server which can then calculate the hash directly in order to avoid a round trip with the storage service.

Regarding the download, in this embodiment, the user generates a new asymmetric key using the KEYGEN function to calculate a new secret key K’ shared with the online storage services using the Diffie-Hellman protocol. To download the file, the user transmits, step 307, the identifier of the original file Id_o, its public key DH_P_U and possibly its signature. The signature allows the online storage service to verify that this public key has not been usurped by the relay server. The relay server relays this information to the online storage service, step 306.

Using this key, the online storage service can also calculate the secret key K’. The storage service can then encrypt the fragment to reconstruct an encrypted fragment. Here again, since the encryption of the pseudo-message may be partial, it is possible that not all the fragments are actually encrypted. These fragments will still be called encrypted fragments because they correspond to fragments from a pseudo-message that is at least partially encrypted.

This encrypted fragment is then transmitted to the relay server, during step 205, accompanied by the public key of the DH_P_S online storage service.

Then the relay server, once in possession of all the encrypted fragments, applies the inverse dispersion function to obtain the encrypted pseudo-message HE(K’, AONT(file)). The latter is transmitted accompanied by the public key of the online storage service to the user.

Using the public key of the storage and applying the Diffie-Hellman protocol, the user can calculate the key K' and thus decrypt the pseudo-message which then only needs to be decoded, i.e. apply the inverse function AONT to find the original file.

It can be seen that the five stated constraints are respected by the system during the download stage. The user is not forced to manage persistent keys. The user does not acquire any information on the online storage services used. The latter cannot acquire any information on the original file stored. Similarly, the relay server, although aware of all the exchanges, cannot acquire information on the original file stored. Finally, the entire process only requires one occurrence of exchanges between the different actors of the system from the request issued by the user to the response transmitting the encrypted pseudo-message from which the original file can be found.

The proposed system ensures the security of user data, even in the event of compromise of the relay server or one or more online storage services used.

There is a schematic block diagram of an information processing device 400 for implementing one or more embodiments of the invention. The information processing device 400 may be a peripheral such as a microcomputer, a workstation or a mobile telecommunications terminal. The device 400 comprises a communication bus connected to:

- a central processing unit 401, such as a microprocessor, denoted CPU;

- a random access memory 402, denoted RAM, for storing the executable code of the method for implementing the invention as well as the registers adapted to record variables and parameters necessary for implementing the method according to embodiments of the invention; the memory capacity of the device can be supplemented by an optional RAM memory connected to an extension port, for example;

- a read-only memory 403, denoted ROM, for storing computer programs for implementing the embodiments of the invention;

- a network interface 404 is normally connected to a communication network over which digital data to be processed are transmitted or received. The network interface 404 may be a single network interface, or composed of a set of different network interfaces (e.g. wired and wireless interfaces or different types of wired or wireless interfaces). Data packets are sent over the network interface for transmission or are read from the network interface for reception under the control of the software application running in the processor 401;

- a user interface 405 for receiving input from a user or for displaying information to a user;

- a storage device 406 as described in the invention and denoted HD;

- an input/output module 407 for receiving/sending data from/to external devices such as hard disk, removable storage media or others.

The executable code may be stored in a read-only memory 403, on the storage device 406 or on a removable digital medium such as for example a disk. According to a variant, the executable code of the programs may be received by means of a communication network, via the network interface 404, in order to be stored in one of the storage means of the communication device 400, such as the storage device 406, before being executed.

The central processing unit 401 is adapted to control and direct the execution of the instructions or portions of software code of the program or programs according to one of the embodiments of the invention, instructions which are stored in one of the aforementioned storage means. After power-up, the CPU 401 is capable of executing instructions from the main RAM 402, relating to a software application. Such software, when executed by the processor 401, causes the execution of the methods described.

In this embodiment, the apparatus is a programmable apparatus that uses software to implement the invention. However, alternatively, the present invention may be implemented in hardware (e.g., as a specific integrated circuit or ASIC).

Claims (9)

A method of securely storing an original file, characterized in that it comprises the following steps for uploading an original file:
- reception of the original file, transmitted by a user device, by a relay server connected to a plurality of online storage services;
- application of a dispersion function by the relay server to generate a plurality of fragments from the original file received;
- transmission for backup by the relay server of each fragment to an online storage service among the plurality of online storage services;
characterized in that:
- the original file is transformed into a pseudo-message by the user device using an all-or-nothing transformation function;
- the pseudo-message is encrypted, at least in part, by the user device using a secret key shared with the plurality of online storage services, the encryption being homomorphic, the original file received by the relay server being the encrypted pseudo-message;
- the dispersion function is applied to the encrypted pseudo-message and generates encrypted fragments;
- encrypted fragments are decrypted by online storage services before storage. Method according to claim 1, characterized in that:
- the secret key is shared between the user device and the online storage services by a secure key exchange protocol. Method according to claim 2, characterized in that:
- the secure key exchange protocol is the Diffie-Hellman protocol. Method according to claim 3, characterized in that:
- the Diffie-Hellman protocol is based on a first asymmetric key generated by the user device and a second asymmetric key shared by the online storage services. Method according to claim 4, characterized in that:
- a new first asymmetric key is generated before each exchange by the user device. Method according to claim 1, characterized in that it further comprises the following steps for downloading:
- encryption of fragments by online storage services using a secret key shared with the user device;
- reception by the relay server of encrypted fragments;
- application of the inverse dispersion function by the relay server on the encrypted fragments to generate a pseudo-encrypted message;
- transmission of the encrypted pseudo-message to the user device;
- decryption of the encrypted pseudo-message by the user device;
- application of the inverse all-or-nothing transformation function by the user device to find the original file. Computer program comprising instructions adapted to the implementation of each of the steps of the method according to any one of claims 1 to 6 when said program is executed on a computer. Information storage means, removable or not, partially or totally readable by a computer or a microprocessor comprising code instructions of a computer program for the execution of each of the steps of the method according to any one of claims 1 to 6. System comprising a user device, a relay server and a plurality of online storage services configured to implement a method according to one of claims 1 to 6.