Age-Based Garbage Collection for Live Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption systems in distributed storage environments face challenges such as increased latency during encryption and decryption, complex key management, and difficulties in selecting which data to encrypt and when, especially in dynamic environments where encryption can be turned on and off.
Innovation Solution
A system and method that utilize age-based garbage collection to opportunistically encrypt unencrypted data by piggybacking encryption on the defragmentation process, allowing for dynamic encryption management and reducing computational resources and network bandwidth usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is encrypted using traditional methods, then data security is improved, but latency increases
Solution Approach 1:
The system performs encryption in advance during the defragmentation process before data is accessed, so that when data is subsequently read, it is already encrypted. This preliminary encryption action eliminates the need for real-time encryption during data access, thereby reducing latency while maintaining security.
Solution Approach 2:
The patent combines the encryption operation with the existing defragmentation process. Instead of treating encryption as a separate operation that adds latency, it merges encryption with the routine defragmentation task that already occurs periodically, thereby achieving encryption without additional time penalty.
2Reliability
If encryption is enabled for all data, then data security is improved, but computational resources increase
Solution Approach 1:
The system applies encryption selectively rather than uniformly to all data. During defragmentation, only the specific data units being moved and rewritten are encrypted, rather than pre-encrypting all possible data. This partial action approach reduces the total computational burden while still securing the data that needs protection.
Solution Approach 2:
The defragmentation process itself performs the encryption as part of its normal operation. The system uses the existing computational resources allocated for defragmentation to simultaneously perform encryption, rather than allocating separate resources for encryption. This self-service approach reduces overall computational overhead.
3Reliability
If encryption is applied to existing live unencrypted data, then data security is improved, but system complexity increases
Solution Approach 1:
The patent merges encryption functionality into the existing defragmentation system. The same components that manage defragmentation (identifying data units, allocating new storage locations, transferring data) are also used to manage encryption. This consolidation avoids creating a separate, complex encryption management infrastructure.
Solution Approach 2:
The defragmentation system is designed to perform multiple functions: it identifies data units for defragmentation, allocates new storage locations, transfers data, and now also encrypts data during the transfer process. This multi-functionality reduces overall system complexity by using a single versatile system rather than multiple specialized systems.
Data Source
AI summary
A system stores data in data units in a cluster in a cloud computing system, the data stored in the data units being encrypted or unencrypted depending on whether encryption is enabled or disabled when storing data in the data units. The system identifies one or more data units to defragment and defragments the identified data units by writing the data from the identified data units to one or more new data units and by releasing the identified data units for storing new data. The system encrypts unencrypted data from the identified data units when writing the data from the identified data units to the one or more new data units.