Backup Storage Key Rotation Using O(1) Key Re-Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data platforms face inefficiencies and high computational costs during key rotation processes, particularly in large data volumes, leading to potential security risks due to unauthorized access and data exfiltration.
Innovation Solution
Implementing a method that performs O(1) re-encryptions instead of O(n) during key rotation, avoiding modifications to stored backups, and using multiple encryption keys to enhance security and reduce resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional key rotation methods are used that re-encrypt each DEK individually, then security is improved through key rotation, but computational cost and time increase significantly for large data volumes
Solution Approach 1:
The patent segments the encryption key management into two distinct layers: data encryption keys (DEKs) that remain unchanged and a new key wrapping mechanism that operates on a separate key store. This segmentation allows the DEKs to stay intact while security is updated through a separate key wrapping layer, eliminating the need to re-encrypt large volumes of data and achieving O(1) complexity instead of O(n).
Solution Approach 2:
The patent introduces an intermediary key wrapping mechanism that sits between the DEKs and the storage system. Instead of directly re-encrypting DEKs, the system uses a key wrapping operation that operates on a separate key store containing key metadata and wrapping keys. This intermediary layer enables security updates without touching the actual encrypted data, resolving the contradiction between security and efficiency.
2Reliability
If key rotation is performed frequently to mitigate security risks, then data protection is improved, but system load and computing resource consumption increase
Solution Approach 1:
By segmenting key management into immutable DEKs and a separate key wrapping layer, the patent enables frequent key rotation of the wrapping keys without the computational cost of re-encrypting data. The DEKs remain unchanged and stored once, while the key wrapping operation operates efficiently on a separate key store, allowing frequent rotation with minimal resource consumption.
Solution Approach 2:
The patent performs preliminary key wrapping operations on a separate key store before actual data access. The key wrapping keys and metadata are prepared and stored in advance in a dedicated key store, so that when key rotation is needed, the system can quickly swap wrapping keys without performing expensive re-encryption operations on the actual data, reducing computing resource consumption during rotation.
3Reliability
If DEKs are re-encrypted with new KEKs during key rotation, then security is enhanced, but system downtime increases
Solution Approach 1:
The patent segments key management operations so that DEKs and their associated encrypted data remain unchanged during key rotation. Instead of re-encrypting DEKs which would require system downtime, the system performs key wrapping operations on a separate key store containing key metadata. This segmentation allows the data path to remain operational while security is updated in the key management path, eliminating system downtime during rotation.
Solution Approach 2:
The intermediary key wrapping mechanism operates independently from the data encryption/decryption path. The key wrapping operation on the separate key store can be performed without interrupting data access operations, as the DEKs and encrypted data remain unchanged. This intermediary approach allows continuous system operation during key rotation, eliminating downtime.
4Reliability
If O(n) re-encryptions are performed during key rotation, then all DEKs are updated with new KEKs, but computational expense becomes prohibitive for large datasets
Solution Approach 1:
The patent segments the key management system into immutable DEKs and a separate key wrapping layer with its own key store. This segmentation reduces the scope of key rotation from O(n) DEK re-encryptions to O(1) key wrapping operations on the separate key store. The DEKs remain unchanged and are not included in the rotation operation, dramatically reducing computational complexity while maintaining complete key update security.
Solution Approach 2:
The patent extracts the key wrapping operation from the main data encryption path and places it in a separate key store. This extraction removes the expensive O(n) re-encryption operations from the key rotation process, retaining only the essential O(1) key wrapping operation on the separate key store. The result is complete key update capability with minimal computational complexity.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Techniques are described for efficient and secure key rotation for backup storage. An example method comprises generating, by a data platform implemented by a computing system, a first encrypted key and a second encrypted key, wherein the data platform stores one or more encrypted chunks encrypted using a first encryption key of the first encrypted key and a second encryption key from the second encrypted key, the first encrypted key and the second encrypted key encrypted with a first system key, replacing the first system key by determining a second system key, and encrypting, with the second system key, the first encryption key to generate a replacement first encrypted key and the second encryption key to generate a replacement second encrypted key.