Backup Storage Key Rotation Using Hierarchical Encrypted Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data encryption systems face inefficiencies and security risks during key rotation, particularly in large data volumes, leading to high computational costs and prolonged downtime due to O(n) re-encryptions, which are vulnerable to unauthorized access and data exfiltration.
Innovation Solution
Implementing a method that performs O(1) re-encryptions by generating and replacing encrypted keys using a second system key, avoiding modifications to stored backups, and utilizing multiple encryption keys to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If O(n) re-encryptions are performed during key rotation, then data security is maintained, but computational cost and time increase significantly
Solution Approach 1:
The patent segments the encryption key hierarchy into multiple levels (DEK for data encryption and KEK for key encryption), allowing selective re-encryption of only the KEK rather than all DEKs, thus reducing computational complexity from O(n) to O(1) while maintaining security
Solution Approach 2:
The patent introduces a key derivation function as an intermediary that generates DEKs from KEKs, enabling efficient key rotation where only the KEK needs to be re-encrypted, and the DEKs are automatically updated through the derivation function without requiring direct re-encryption of each DEK
2Reliability
If frequent key rotation is performed, then security against unauthorized access is improved, but system load and downtime increase
Solution Approach 1:
By segmenting keys into DEK and KEK levels, the patent enables frequent KEK rotation without requiring re-encryption of all data, reducing system downtime and allowing more frequent security updates
Solution Approach 2:
The patent creates a copy of the encryption system through the key derivation function, which can generate new DEKs from the rotated KEK without affecting the original data encryption process, thus enabling frequent rotation with minimal disruption
3Productivity
If O(n) re-encryptions are performed, then key rotation is completed, but computing resources are consumed excessively
Solution Approach 1:
The patent segments the re-encryption operation to apply only to the KEK level rather than all DEKs, reducing the number of encryption operations from O(n) to O(1) and significantly lowering computing resource consumption
Solution Approach 2:
The patent extracts the re-encryption operation from the data encryption process and applies it only to the KEK, separating the key management workload from the data processing workload, thus reducing overall computing resource consumption
Data Source
AI summary
Techniques are described for efficient and secure key rotation for backup storage. An example method comprises generating, by a data platform implemented by a computing system, a first encrypted key and a second encrypted key, wherein the data platform stores one or more encrypted chunks encrypted using a first encryption key of the first encrypted key and a second encryption key from the second encrypted key, the first encrypted key and the second encrypted key encrypted with a first system key, replacing the first system key by determining a second system key, and encrypting, with the second system key, the first encryption key to generate a replacement first encrypted key and the second encryption key to generate a replacement second encrypted key.