Authenticated Writes via Hash Table Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for authenticated writes to storage platforms, such as those used in public and private cloud data storage, are complex, inefficient, and costly due to the requirement of bidirectional encrypted sessions between verified endpoints.
Innovation Solution
The implementation of an aggregate storage array that partitions data into blocks, generates a hash table for per-block authentication, and uses a signature server to digitally sign the hash table, allowing for efficient and cost-effective authentication without bidirectional encryption, enabling modular connectivity and enhanced storage density.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If bidirectional encrypted sessions are used between verified endpoints for authenticated writes, then data authentication and security are achieved, but system complexity increases and operational efficiency decreases
Solution Approach 1:
The patent segments the authentication process by introducing a signature server that separately generates digital signatures for data blocks. Instead of requiring bidirectional encrypted sessions between all endpoints, the authentication function is divided into: (1) data block generation by the storage platform, (2) signature generation by the signature server, and (3) verification by clients. This segmentation reduces system complexity while maintaining authentication reliability.
Solution Approach 2:
The patent introduces a signature server as an intermediary component that mediates the authentication process. The signature server receives data blocks from the storage platform, generates digital signatures using private keys, and provides these signatures to clients for verification. This intermediary approach eliminates the need for complex bidirectional encrypted sessions between all endpoints, reducing overall system complexity while ensuring data authentication.
2Reliability
If bidirectional encrypted sessions are implemented for authenticated writes, then security is improved, but operational efficiency and cost-effectiveness deteriorate
Solution Approach 1:
The patent implements preliminary action by pre-generating digital signatures for data blocks before actual write operations. The signature server creates signatures in advance using private keys, and these pre-generated signatures are stored and reused during write operations. This eliminates the need for real-time bidirectional encrypted sessions during each write operation, significantly improving operational efficiency while maintaining security through the pre-established digital signatures.
Solution Approach 2:
The patent uses copying by distributing data blocks and their corresponding digital signatures across multiple storage devices. Instead of requiring complex encrypted sessions for each access, the system copies authenticated data blocks with their signatures to multiple locations, allowing efficient read and write operations. The digital signatures serve as reusable authentication copies that eliminate the need for repeated encrypted communication protocols.
3Ease of manufacture
If data is stored without partitioning into blocks with hash tables, then storage simplicity is maintained, but authentication efficiency and storage density decrease
Solution Approach 1:
The patent segments data into discrete blocks and creates hash tables that map data block identifiers to their locations and authentication information. Each data block is independently authenticated through its own digital signature, allowing parallel processing and efficient verification. This segmentation approach improves authentication efficiency by enabling block-level parallel authentication while maintaining storage simplicity through standardized block structures and hash table indexing.
Data Source
Figure 1
Figure 2
Figure 3A~3D
AI summary
Systems, apparatuses and methods may provide for technology that digitally signs a hash table and a data payload, wherein the data payload is partitioned into a plurality of storage blocks and the hash table specifies how to index into and individually authenticate the plurality of storage blocks. Additionally, a write of the digitally signed hash table and data payload may be initiated to an aggregate storage array. In one example, the aggregate storage array authenticates the digital signature of the hash table and the data payload and conducts a write of the data payload to a plurality of drives in the aggregate storage array in accordance with the hash table.