AONT-Based Assured Delete for Irrecoverable Backup Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data sanitization techniques are vulnerable to unauthorized access and recovery of deleted data, particularly in storage systems and backup environments, due to incomplete deletion methods and key management weaknesses, leading to potential data breaches.
Innovation Solution
Implementing a combination of Scalable Assured Delete (SAD) with an All-Or-Nothing Transform (AONT) cryptosystem, where data is fragmented and encrypted, requiring both the key and complete ciphertext for decryption, and sending deleted fragments to separate heaps for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If standard deletion methods are used to remove data from storage systems, then storage space is freed up, but the deleted data remains recoverable using specialized recovery tools
Solution Approach 1:
The patent applies segmentation by dividing data into multiple fragments and distributing them across different storage locations. The All-Or-Nothing Transform (AONT) cryptosystem processes data through a series of transformations that create interdependent fragments, where any single fragment alone is useless for recovery. This resolves the contradiction by ensuring that even if storage space is reused, the segmented and transformed data fragments cannot be reconstructed without all components.
Solution Approach 2:
The patent introduces an intermediary transformation process (AONT) between the original data and its stored form. This intermediary step creates a mathematical transformation where the original data can only be recovered if all transformed fragments are present and combined correctly. This intermediary mechanism ensures that standard deletion methods cannot recover the original data, as the transformation process destroys the original data structure.
2Reliability
If cryptographic keys are deleted to secure encrypted data, then unauthorized access is prevented, but backup key recovery mechanisms may allow attackers to retrieve keys
Solution Approach 1:
The patent segments the cryptographic key into multiple key fragments and distributes them across different secure locations. The AONT transformation is applied to the key material, creating interdependent fragments where any single fragment is useless without the others. This resolves the contradiction by maintaining security through key deletion while using controlled backup mechanisms that require multiple fragments for reconstruction, preventing single-point failures and unauthorized recovery.
Solution Approach 2:
The patent implements beforehand cushioning by creating redundant key fragments with built-in verification mechanisms before key deletion. The system prepares for potential failures by distributing key fragments across multiple secure locations with integrity checks, ensuring that key recovery is only possible through authorized processes that verify the authenticity and completeness of all fragments. This cushions against unauthorized recovery while maintaining key availability for legitimate purposes.
3Speed
If data is encrypted with a single key for efficient access, then decryption speed is improved, but compromise of that key exposes all encrypted files
Solution Approach 1:
The patent segments the encryption key into multiple fragments distributed across different locations, with each fragment protecting a portion of the encrypted data. The AONT transformation creates mathematical dependencies between key fragments and data fragments, ensuring that compromising one key fragment does not expose the entire dataset. This resolves the contradiction by maintaining efficient decryption through distributed key fragments while reducing vulnerability, as an attacker would need to compromise multiple distributed fragments simultaneously.
Data Source
AI summary
One example method includes identifying a dataset, which may be a backup dataset, that has been subjected to a mix&slice process, identifying a cryptographic key that was used to encrypt the dataset, randomly selecting, from the backup dataset, a portion of the dataset, randomly applying writes to the portion of the dataset, and deleting the cryptographic key. The dataset cannot be recovered without both the cryptographic key, and the portion of the dataset to which the writes were randomly applied.