Block-Level Encryption Key Segmentation for Storage Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data storage systems face security vulnerabilities due to the use of shared encryption keys across multiple file systems in disk-based storage, allowing unauthorized access to data, especially in network-accessible environments where data at rest is more valuable and exposed.
Innovation Solution
Implementing an encryption module that communicates with both the file server and physical storage to provide unique encryption keys at the block level, using block maps and signaling protocols to ensure each block range is encrypted with a distinct key, thereby preventing key sharing across different owners and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If the same encryption key is used for multiple file systems on disk-based storage, then the encryption implementation is simplified and performance is improved, but security is compromised because unauthorized users can access data across different file systems
Solution Approach 1:
The patent segments the encryption key space by assigning unique encryption keys to each file system on the disk-based storage system. This segmentation prevents key sharing across different file systems, thereby eliminating the security vulnerability where one user could access another user's data. Each file system maintains its own isolated encryption key, ensuring that even though multiple file systems exist on the same storage device, their data remains cryptographically separated and secure.
2Reliability
If unique encryption keys are assigned to each file system, then data security is improved by preventing unauthorized access, but device complexity increases due to key management overhead
Solution Approach 1:
The patent introduces a key management server as an intermediary component that centralizes the handling of encryption keys. This server mediates between the storage system and the applications, providing a dedicated service for key generation, distribution, and management. By isolating key management functions in a separate server component, the complexity of managing multiple unique keys is centralized and simplified, while still maintaining the security benefits of per-file-system encryption keys.
3Reliability
If a full proxy server is used to manage encryption keys for multiple file systems, then key separation is achieved, but performance deteriorates due to additional protocol stack traversals and processing overhead
Solution Approach 1:
The patent extracts the key management functionality from the data path by implementing keyspace separation at the storage level. Instead of having a proxy server intercept and process every data access request, the unique encryption keys are embedded with the file systems themselves on the disk-based storage. This extraction of key management from the data path eliminates the need for additional protocol stack traversals and processing overhead, while still achieving proper key separation and security.
Data Source
AI summary
A data storage architecture for networked access by clients includes a file server capable of communication with the clients via the network, physical storage organized as a plurality of logical volumes, and an encryption device in communication with both the file server and the physical storage. The encryption device is operable in response to signaling from the file server, including an indication of a range of blocks of data, to cause encryption of the range of blocks with an encryption key that is unique within the physical storage. The encryption device includes nested tables mapping block ranges to encryption keys. Consequently, undesirable key sharing across files, file systems, and other units can be avoided down to the block level.